public final class ServiceAccountKey extends GeneratedMessageV3 implements ServiceAccountKeyOrBuilder
Represents a service account key.
A service account has two sets of key-pairs: user-managed, and
system-managed.
User-managed key-pairs can be created and deleted by users. Users are
responsible for rotating these keys periodically to ensure security of
their service accounts. Users retain the private key of these key-pairs,
and Google retains ONLY the public key.
System-managed keys are automatically rotated by Google, and are used for
signing for a maximum of two weeks. The rotation process is probabilistic,
and usage of the new key will gradually ramp up and down over the key's
lifetime.
If you cache the public key set for a service account, we recommend that you
update the cache every 15 minutes. User-managed keys can be added and removed
at any time, so it is important to update the cache frequently. For
Google-managed keys, Google will publish a key at least 6 hours before it is
first used for signing and will keep publishing it for at least 6 hours after
it was last used for signing.
Public keys for all service accounts are also published at the OAuth2
Service Account API.
Protobuf type google.iam.admin.v1.ServiceAccountKey
Static Fields
KEY_ALGORITHM_FIELD_NUMBER
public static final int KEY_ALGORITHM_FIELD_NUMBER
Field Value
KEY_ORIGIN_FIELD_NUMBER
public static final int KEY_ORIGIN_FIELD_NUMBER
Field Value
KEY_TYPE_FIELD_NUMBER
public static final int KEY_TYPE_FIELD_NUMBER
Field Value
NAME_FIELD_NUMBER
public static final int NAME_FIELD_NUMBER
Field Value
PRIVATE_KEY_DATA_FIELD_NUMBER
public static final int PRIVATE_KEY_DATA_FIELD_NUMBER
Field Value
PRIVATE_KEY_TYPE_FIELD_NUMBER
public static final int PRIVATE_KEY_TYPE_FIELD_NUMBER
Field Value
PUBLIC_KEY_DATA_FIELD_NUMBER
public static final int PUBLIC_KEY_DATA_FIELD_NUMBER
Field Value
VALID_AFTER_TIME_FIELD_NUMBER
public static final int VALID_AFTER_TIME_FIELD_NUMBER
Field Value
VALID_BEFORE_TIME_FIELD_NUMBER
public static final int VALID_BEFORE_TIME_FIELD_NUMBER
Field Value
Static Methods
getDefaultInstance()
public static ServiceAccountKey getDefaultInstance()
Returns
getDescriptor()
public static final Descriptors.Descriptor getDescriptor()
Returns
newBuilder()
public static ServiceAccountKey.Builder newBuilder()
Returns
newBuilder(ServiceAccountKey prototype)
public static ServiceAccountKey.Builder newBuilder(ServiceAccountKey prototype)
Parameter
Returns
public static ServiceAccountKey parseDelimitedFrom(InputStream input)
Parameter
Returns
Exceptions
public static ServiceAccountKey parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)
Parameters
Returns
Exceptions
parseFrom(byte[] data)
public static ServiceAccountKey parseFrom(byte[] data)
Parameter
| Name | Description |
| data | byte[]
|
Returns
Exceptions
parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)
public static ServiceAccountKey parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)
Parameters
Returns
Exceptions
parseFrom(ByteString data)
public static ServiceAccountKey parseFrom(ByteString data)
Parameter
Returns
Exceptions
parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)
public static ServiceAccountKey parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)
Parameters
Returns
Exceptions
public static ServiceAccountKey parseFrom(CodedInputStream input)
Parameter
Returns
Exceptions
public static ServiceAccountKey parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)
Parameters
Returns
Exceptions
public static ServiceAccountKey parseFrom(InputStream input)
Parameter
Returns
Exceptions
public static ServiceAccountKey parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)
Parameters
Returns
Exceptions
parseFrom(ByteBuffer data)
public static ServiceAccountKey parseFrom(ByteBuffer data)
Parameter
Returns
Exceptions
parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)
public static ServiceAccountKey parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)
Parameters
Returns
Exceptions
parser()
public static Parser<ServiceAccountKey> parser()
Returns
Methods
equals(Object obj)
public boolean equals(Object obj)
Parameter
Returns
Overrides
getDefaultInstanceForType()
public ServiceAccountKey getDefaultInstanceForType()
Returns
getKeyAlgorithm()
public ServiceAccountKeyAlgorithm getKeyAlgorithm()
Specifies the algorithm (and possibly key size) for the key.
.google.iam.admin.v1.ServiceAccountKeyAlgorithm key_algorithm = 8;
getKeyAlgorithmValue()
public int getKeyAlgorithmValue()
Specifies the algorithm (and possibly key size) for the key.
.google.iam.admin.v1.ServiceAccountKeyAlgorithm key_algorithm = 8;
| Type | Description |
| int | The enum numeric value on the wire for keyAlgorithm.
|
getKeyOrigin()
public ServiceAccountKeyOrigin getKeyOrigin()
The key origin.
.google.iam.admin.v1.ServiceAccountKeyOrigin key_origin = 9;
getKeyOriginValue()
public int getKeyOriginValue()
The key origin.
.google.iam.admin.v1.ServiceAccountKeyOrigin key_origin = 9;
| Type | Description |
| int | The enum numeric value on the wire for keyOrigin.
|
getKeyType()
public ListServiceAccountKeysRequest.KeyType getKeyType()
The key type.
.google.iam.admin.v1.ListServiceAccountKeysRequest.KeyType key_type = 10;
getKeyTypeValue()
public int getKeyTypeValue()
The key type.
.google.iam.admin.v1.ListServiceAccountKeysRequest.KeyType key_type = 10;
| Type | Description |
| int | The enum numeric value on the wire for keyType.
|
getName()
The resource name of the service account key in the following format
projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}.
string name = 1;
| Type | Description |
| String | The name.
|
getNameBytes()
public ByteString getNameBytes()
The resource name of the service account key in the following format
projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}.
string name = 1;
getParserForType()
public Parser<ServiceAccountKey> getParserForType()
Returns
Overrides
getPrivateKeyData()
public ByteString getPrivateKeyData()
The private key data. Only provided in CreateServiceAccountKey
responses. Make sure to keep the private key data secure because it
allows for the assertion of the service account identity.
When base64 decoded, the private key data can be used to authenticate with
Google API client libraries and with
<a href="/sdk/gcloud/reference/auth/activate-service-account">gcloud
auth activate-service-account</a>.
bytes private_key_data = 3;
getPrivateKeyType()
public ServiceAccountPrivateKeyType getPrivateKeyType()
The output format for the private key.
Only provided in CreateServiceAccountKey responses, not
in GetServiceAccountKey or ListServiceAccountKey responses.
Google never exposes system-managed private keys, and never retains
user-managed private keys.
.google.iam.admin.v1.ServiceAccountPrivateKeyType private_key_type = 2;
getPrivateKeyTypeValue()
public int getPrivateKeyTypeValue()
The output format for the private key.
Only provided in CreateServiceAccountKey responses, not
in GetServiceAccountKey or ListServiceAccountKey responses.
Google never exposes system-managed private keys, and never retains
user-managed private keys.
.google.iam.admin.v1.ServiceAccountPrivateKeyType private_key_type = 2;
| Type | Description |
| int | The enum numeric value on the wire for privateKeyType.
|
getPublicKeyData()
public ByteString getPublicKeyData()
The public key data. Only provided in GetServiceAccountKey responses.
bytes public_key_data = 7;
getSerializedSize()
public int getSerializedSize()
Returns
Overrides
getUnknownFields()
public final UnknownFieldSet getUnknownFields()
Returns
Overrides
getValidAfterTime()
public Timestamp getValidAfterTime()
The key can be used after this timestamp.
.google.protobuf.Timestamp valid_after_time = 4;
getValidAfterTimeOrBuilder()
public TimestampOrBuilder getValidAfterTimeOrBuilder()
The key can be used after this timestamp.
.google.protobuf.Timestamp valid_after_time = 4;
getValidBeforeTime()
public Timestamp getValidBeforeTime()
The key can be used before this timestamp.
For system-managed key pairs, this timestamp is the end time for the
private key signing operation. The public key could still be used
for verification for a few hours after this time.
.google.protobuf.Timestamp valid_before_time = 5;
getValidBeforeTimeOrBuilder()
public TimestampOrBuilder getValidBeforeTimeOrBuilder()
The key can be used before this timestamp.
For system-managed key pairs, this timestamp is the end time for the
private key signing operation. The public key could still be used
for verification for a few hours after this time.
.google.protobuf.Timestamp valid_before_time = 5;
hasValidAfterTime()
public boolean hasValidAfterTime()
The key can be used after this timestamp.
.google.protobuf.Timestamp valid_after_time = 4;
| Type | Description |
| boolean | Whether the validAfterTime field is set.
|
hasValidBeforeTime()
public boolean hasValidBeforeTime()
The key can be used before this timestamp.
For system-managed key pairs, this timestamp is the end time for the
private key signing operation. The public key could still be used
for verification for a few hours after this time.
.google.protobuf.Timestamp valid_before_time = 5;
| Type | Description |
| boolean | Whether the validBeforeTime field is set.
|
hashCode()
Returns
Overrides
internalGetFieldAccessorTable()
protected GeneratedMessageV3.FieldAccessorTable internalGetFieldAccessorTable()
Returns
Overrides
isInitialized()
public final boolean isInitialized()
Returns
Overrides
newBuilderForType()
public ServiceAccountKey.Builder newBuilderForType()
Returns
newBuilderForType(GeneratedMessageV3.BuilderParent parent)
protected ServiceAccountKey.Builder newBuilderForType(GeneratedMessageV3.BuilderParent parent)
Parameter
Returns
Overrides
newInstance(GeneratedMessageV3.UnusedPrivateParameter unused)
protected Object newInstance(GeneratedMessageV3.UnusedPrivateParameter unused)
Parameter
Returns
Overrides
toBuilder()
public ServiceAccountKey.Builder toBuilder()
Returns
writeTo(CodedOutputStream output)
public void writeTo(CodedOutputStream output)
Parameter
Overrides
Exceptions
