Reference documentation and code samples for the Cloud Firestore V1 Client class CmekConfig.
The CMEK (Customer Managed Encryption Key) configuration for a Firestore
database. If not present, the database is secured by the default Google
encryption key.
Generated from protobuf message google.firestore.admin.v1.Database.CmekConfig
Required. Only keys in the same location as this database are allowed to be used for encryption. For Firestore's nam5 multi-region, this corresponds to Cloud KMS multi-region us. For Firestore's eur3 multi-region, this corresponds to Cloud KMS multi-region europe. See https://cloud.google.com/kms/docs/locations. The expected format is projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}.
↳ active_key_version
array
Output only. Currently in-use KMS key versions. During key rotation, there can be multiple in-use key versions. The expected format is projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{key_version}.
getKmsKeyName
Required. Only keys in the same location as this database are allowed to
be used for encryption.
For Firestore's nam5 multi-region, this corresponds to Cloud KMS
multi-region us. For Firestore's eur3 multi-region, this corresponds to
Cloud KMS multi-region europe. See
https://cloud.google.com/kms/docs/locations.
The expected format is
projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}.
Returns
Type
Description
string
setKmsKeyName
Required. Only keys in the same location as this database are allowed to
be used for encryption.
For Firestore's nam5 multi-region, this corresponds to Cloud KMS
multi-region us. For Firestore's eur3 multi-region, this corresponds to
Cloud KMS multi-region europe. See
https://cloud.google.com/kms/docs/locations.
The expected format is
projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}.
During key rotation,
there can be multiple in-use key versions.
The expected format is
projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{key_version}.
During key rotation,
there can be multiple in-use key versions.
The expected format is
projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{key_version}.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[],[],null,["# Cloud Firestore V1 Client - Class CmekConfig (1.53.0)\n\nVersion latestkeyboard_arrow_down\n\n- [1.53.0 (latest)](/php/docs/reference/cloud-firestore/latest/Admin.V1.Database.CmekConfig)\n- [1.52.0](/php/docs/reference/cloud-firestore/1.52.0/Admin.V1.Database.CmekConfig)\n- [1.51.0](/php/docs/reference/cloud-firestore/1.51.0/Admin.V1.Database.CmekConfig)\n- [1.50.0](/php/docs/reference/cloud-firestore/1.50.0/Admin.V1.Database.CmekConfig)\n- [1.48.1](/php/docs/reference/cloud-firestore/1.48.1/Admin.V1.Database.CmekConfig)\n- [1.47.3](/php/docs/reference/cloud-firestore/1.47.3/Admin.V1.Database.CmekConfig)\n- [1.46.0](/php/docs/reference/cloud-firestore/1.46.0/Admin.V1.Database.CmekConfig)\n- [1.45.2](/php/docs/reference/cloud-firestore/1.45.2/Admin.V1.Database.CmekConfig)\n- [1.44.1](/php/docs/reference/cloud-firestore/1.44.1/Admin.V1.Database.CmekConfig)\n- [1.43.3](/php/docs/reference/cloud-firestore/1.43.3/Admin.V1.Database.CmekConfig)\n- [1.40.0](/php/docs/reference/cloud-firestore/1.40.0/Admin.V1.Database.CmekConfig)\n- [1.39.0](/php/docs/reference/cloud-firestore/1.39.0/Admin.V1.Database.CmekConfig)\n- [1.38.0](/php/docs/reference/cloud-firestore/1.38.0/Admin.V1.Database.CmekConfig)\n- [1.37.7](/php/docs/reference/cloud-firestore/1.37.7/Admin.V1.Database.CmekConfig)\n- [1.36.1](/php/docs/reference/cloud-firestore/1.36.1/Admin.V1.Database.CmekConfig)\n- [1.35.0](/php/docs/reference/cloud-firestore/1.35.0/Admin.V1.Database.CmekConfig)\n- [1.34.0](/php/docs/reference/cloud-firestore/1.34.0/Admin.V1.Database.CmekConfig)\n- [1.33.0](/php/docs/reference/cloud-firestore/1.33.0/Admin.V1.Database.CmekConfig)\n- [1.32.0](/php/docs/reference/cloud-firestore/1.32.0/Admin.V1.Database.CmekConfig)\n- [1.31.0](/php/docs/reference/cloud-firestore/1.31.0/Admin.V1.Database.CmekConfig)\n- [1.30.0](/php/docs/reference/cloud-firestore/1.30.0/Admin.V1.Database.CmekConfig)\n- [1.28.0](/php/docs/reference/cloud-firestore/1.28.0/Admin.V1.Database.CmekConfig)\n- [1.27.3](/php/docs/reference/cloud-firestore/1.27.3/Admin.V1.Database.CmekConfig) \nReference documentation and code samples for the Cloud Firestore V1 Client class CmekConfig.\n\nThe CMEK (Customer Managed Encryption Key) configuration for a Firestore\ndatabase. If not present, the database is secured by the default Google\nencryption key.\n\nGenerated from protobuf message `google.firestore.admin.v1.Database.CmekConfig`\n\nNamespace\n---------\n\nGoogle \\\\ Cloud \\\\ Firestore \\\\ Admin \\\\ V1 \\\\ Database\n\nMethods\n-------\n\n### __construct\n\nConstructor.\n\n### getKmsKeyName\n\nRequired. Only keys in the same location as this database are allowed to\nbe used for encryption.\n\nFor Firestore's nam5 multi-region, this corresponds to Cloud KMS\nmulti-region us. For Firestore's eur3 multi-region, this corresponds to\nCloud KMS multi-region europe. See\n\u003chttps://cloud.google.com/kms/docs/locations\u003e.\nThe expected format is\n`projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}`.\n\n### setKmsKeyName\n\nRequired. Only keys in the same location as this database are allowed to\nbe used for encryption.\n\nFor Firestore's nam5 multi-region, this corresponds to Cloud KMS\nmulti-region us. For Firestore's eur3 multi-region, this corresponds to\nCloud KMS multi-region europe. See\n\u003chttps://cloud.google.com/kms/docs/locations\u003e.\nThe expected format is\n`projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}`.\n\n### getActiveKeyVersion\n\nOutput only. Currently in-use [KMS key\nversions](https://cloud.google.com/kms/docs/resource-hierarchy#key_versions).\n\nDuring [key rotation](https://cloud.google.com/kms/docs/key-rotation),\nthere can be multiple in-use key versions.\nThe expected format is\n`projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{key_version}`.\n\n### setActiveKeyVersion\n\nOutput only. Currently in-use [KMS key\nversions](https://cloud.google.com/kms/docs/resource-hierarchy#key_versions).\n\nDuring [key rotation](https://cloud.google.com/kms/docs/key-rotation),\nthere can be multiple in-use key versions.\nThe expected format is\n`projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{key_version}`."]]
