Google Cloud Key Management Service

import os
from google.cloud import kms
import base64

project_id = os.environ.get('GCP_PROJECT_ID', 'your-project-id')
location_id = os.environ.get('KMS_KEY_LOCATION', 'global') # e.g., 'global', 'us-central1'
key_ring_id = os.environ.get('KMS_KEY_RING_ID', 'my-key-ring')
key_id = os.environ.get('KMS_KEY_ID', 'my-symmetric-key')

# Construct the key resource name
key_name = (
    f"projects/{project_id}/locations/{location_id}/keyRings/"
    f"{key_ring_id}/cryptoKeys/{key_id}"
)

# Initialize the KMS client
try:
    client = kms.KeyManagementServiceClient()
    print("KMS client initialized.")
except Exception as e:
    print(f"Error initializing KMS client: {e}")
    print("Ensure GOOGLE_APPLICATION_CREDENTIALS is set or running in a GCP environment.")
    exit(1)

# Data to encrypt
plaintext = b"This is a super secret message."

try:
    # Encrypt the plaintext
    encrypt_response = client.encrypt(request={'name': key_name, 'plaintext': plaintext})
    ciphertext = encrypt_response.ciphertext
    print(f"Plaintext encrypted. Ciphertext (base64): {base64.b64encode(ciphertext).decode('utf-8')}")

    # Decrypt the ciphertext
    decrypt_response = client.decrypt(request={'name': key_name, 'ciphertext': ciphertext})
    decrypted_text = decrypt_response.plaintext
    print(f"Ciphertext decrypted. Decrypted text: {decrypted_text.decode('utf-8')}")

    assert plaintext == decrypted_text
    print("Encryption and decryption successful!")

except Exception as e:
    print(f"An error occurred during KMS operation: {e}")
    print("Make sure the key exists, has appropriate IAM permissions, and billing is enabled.")