Skip to main content

Service Onboarding KMS Module

The service-onboarding-kms module provisions KMS Keyrings and CryptoKeys in the central environment KMS project and grants IAM access to Git repositories (Workload Identity Federation) for managing keys.

Features​

  • Creates regional or multi-regional KMS keyrings in the central KMS project.
  • Creates and configures individual CryptoKeys (rotation period, purpose, labels, destruction duration).
  • Binds IAM permissions on keyrings to Workload Identity Federation (GitHub Actions) principals.
  • Exposes fully qualified keyring and key IDs for consumption by service modules.