:mod:`airflow.contrib.hooks.gcp_kms_hook`
=========================================

.. py:module:: airflow.contrib.hooks.gcp_kms_hook







Module Contents
---------------






.. function:: _b64encode(s)

   
   Base 64 encodes a bytes object to a string 

   









.. function:: _b64decode(s)

   
   Base 64 decodes a string to bytes. 

   









.. py:class:: GoogleCloudKMSHook(gcp_conn_id='google_cloud_default', delegate_to=None)

   Bases::class:`airflow.contrib.hooks.gcp_api_base_hook.GoogleCloudBaseHook`

   

   Interact with Google Cloud KMS. This hook uses the Google Cloud Platform
   connection.


   

   

   

   .. method:: get_conn(self)

      
      Returns a KMS service object.

      :rtype: googleapiclient.discovery.Resource

      



   

   .. method:: encrypt(self, key_name, plaintext, authenticated_data=None)

      
      Encrypts a plaintext message using Google Cloud KMS.

      :param key_name: The Resource Name for the key (or key version)
                       to be used for encyption. Of the form
                       ``projects/*/locations/*/keyRings/*/cryptoKeys/**``
      :type key_name: str
      :param plaintext: The message to be encrypted.
      :type plaintext: bytes
      :param authenticated_data: Optional additional authenticated data that
                                 must also be provided to decrypt the message.
      :type authenticated_data: bytes
      :return: The base 64 encoded ciphertext of the original message.
      :rtype: str

      



   

   .. method:: decrypt(self, key_name, ciphertext, authenticated_data=None)

      
      Decrypts a ciphertext message using Google Cloud KMS.

      :param key_name: The Resource Name for the key to be used for decyption.
                       Of the form ``projects/*/locations/*/keyRings/*/cryptoKeys/**``
      :type key_name: str
      :param ciphertext: The message to be decrypted.
      :type ciphertext: str
      :param authenticated_data: Any additional authenticated data that was
                                 provided when encrypting the message.
      :type authenticated_data: bytes
      :return: The original message.
      :rtype: bytes