# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities

__all__ = [
    'GetKMSSecretResult',
    'AwaitableGetKMSSecretResult',
    'get_kms_secret',
    'get_kms_secret_output',
]

@pulumi.output_type
class GetKMSSecretResult:
    """
    A collection of values returned by getKMSSecret.
    """
    def __init__(__self__, additional_authenticated_data=None, ciphertext=None, crypto_key=None, id=None, plaintext=None):
        if additional_authenticated_data and not isinstance(additional_authenticated_data, str):
            raise TypeError("Expected argument 'additional_authenticated_data' to be a str")
        pulumi.set(__self__, "additional_authenticated_data", additional_authenticated_data)
        if ciphertext and not isinstance(ciphertext, str):
            raise TypeError("Expected argument 'ciphertext' to be a str")
        pulumi.set(__self__, "ciphertext", ciphertext)
        if crypto_key and not isinstance(crypto_key, str):
            raise TypeError("Expected argument 'crypto_key' to be a str")
        pulumi.set(__self__, "crypto_key", crypto_key)
        if id and not isinstance(id, str):
            raise TypeError("Expected argument 'id' to be a str")
        pulumi.set(__self__, "id", id)
        if plaintext and not isinstance(plaintext, str):
            raise TypeError("Expected argument 'plaintext' to be a str")
        pulumi.set(__self__, "plaintext", plaintext)

    @property
    @pulumi.getter(name="additionalAuthenticatedData")
    def additional_authenticated_data(self) -> Optional[str]:
        return pulumi.get(self, "additional_authenticated_data")

    @property
    @pulumi.getter
    def ciphertext(self) -> str:
        return pulumi.get(self, "ciphertext")

    @property
    @pulumi.getter(name="cryptoKey")
    def crypto_key(self) -> str:
        return pulumi.get(self, "crypto_key")

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        The provider-assigned unique ID for this managed resource.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def plaintext(self) -> str:
        """
        Contains the result of decrypting the provided ciphertext.
        """
        return pulumi.get(self, "plaintext")


class AwaitableGetKMSSecretResult(GetKMSSecretResult):
    # pylint: disable=using-constant-test
    def __await__(self):
        if False:
            yield self
        return GetKMSSecretResult(
            additional_authenticated_data=self.additional_authenticated_data,
            ciphertext=self.ciphertext,
            crypto_key=self.crypto_key,
            id=self.id,
            plaintext=self.plaintext)


def get_kms_secret(additional_authenticated_data: Optional[str] = None,
                   ciphertext: Optional[str] = None,
                   crypto_key: Optional[str] = None,
                   opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetKMSSecretResult:
    """
    This data source allows you to use data encrypted with Google Cloud KMS
    within your resource definitions.

    For more information see
    [the official documentation](https://cloud.google.com/kms/docs/encrypt-decrypt).

    > **NOTE:** Using this data provider will allow you to conceal secret data within your
    resource definitions, but it does not take care of protecting that data in the
    logging output, plan output, or state output.  Please take care to secure your secret
    data outside of resource definitions.


    :param str additional_authenticated_data: The [additional authenticated data](https://cloud.google.com/kms/docs/additional-authenticated-data) used for integrity checks during encryption and decryption.
    :param str ciphertext: The ciphertext to be decrypted, encoded in base64
    :param str crypto_key: The id of the CryptoKey that will be used to
           decrypt the provided ciphertext. This is represented by the format
           `{projectId}/{location}/{keyRingName}/{cryptoKeyName}`.
    """
    __args__ = dict()
    __args__['additionalAuthenticatedData'] = additional_authenticated_data
    __args__['ciphertext'] = ciphertext
    __args__['cryptoKey'] = crypto_key
    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
    __ret__ = pulumi.runtime.invoke('gcp:kms/getKMSSecret:getKMSSecret', __args__, opts=opts, typ=GetKMSSecretResult).value

    return AwaitableGetKMSSecretResult(
        additional_authenticated_data=__ret__.additional_authenticated_data,
        ciphertext=__ret__.ciphertext,
        crypto_key=__ret__.crypto_key,
        id=__ret__.id,
        plaintext=__ret__.plaintext)


@_utilities.lift_output_func(get_kms_secret)
def get_kms_secret_output(additional_authenticated_data: Optional[pulumi.Input[Optional[str]]] = None,
                          ciphertext: Optional[pulumi.Input[str]] = None,
                          crypto_key: Optional[pulumi.Input[str]] = None,
                          opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[GetKMSSecretResult]:
    """
    This data source allows you to use data encrypted with Google Cloud KMS
    within your resource definitions.

    For more information see
    [the official documentation](https://cloud.google.com/kms/docs/encrypt-decrypt).

    > **NOTE:** Using this data provider will allow you to conceal secret data within your
    resource definitions, but it does not take care of protecting that data in the
    logging output, plan output, or state output.  Please take care to secure your secret
    data outside of resource definitions.


    :param str additional_authenticated_data: The [additional authenticated data](https://cloud.google.com/kms/docs/additional-authenticated-data) used for integrity checks during encryption and decryption.
    :param str ciphertext: The ciphertext to be decrypted, encoded in base64
    :param str crypto_key: The id of the CryptoKey that will be used to
           decrypt the provided ciphertext. This is represented by the format
           `{projectId}/{location}/{keyRingName}/{cryptoKeyName}`.
    """
    ...
