Google Cloud · Cloud service
Google Cloud KMS with OrchestrAI
Catalog exported 2026-09-02
Manage Cloud KMS from chat: key rings, crypto keys, and IAM bindings, every write confirmed first.
OrchestrAI exposes 6 Cloud KMS operations: 3 are low-risk (read-only or low-impact), and 3 create or modify resources and run only after you confirm the plan. 3 of them also carry a step-level approval gate.
What teams use it for
Security teams use OrchestrAI to set up a key ring and a crypto key for a new workload, then grant a service account the encrypter/decrypter role in the same conversation. Reading back the IAM policy on a key is a fast way to answer who can use it during an audit. There is no rotate, disable, or destroy operation for key versions, and no way to remove an IAM binding, so rotation schedules and access revocation are handled in the console.
Every Cloud KMS operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Get Cloud KMS IAM Policy |
Get IAM policy for a GCP Cloud KMS crypto key | Low risk | No |
List Cloud KMS Crypto Keys |
List crypto keys in a GCP Cloud KMS key ring | Low risk | No |
List Cloud KMS Key Rings |
List GCP Cloud KMS key rings in a location | Low risk | No |
Add Cloud KMS IAM Binding |
Add an IAM policy binding to a GCP Cloud KMS crypto key | Modifies existing | Yes |
Create Cloud KMS Crypto Key |
Create a GCP Cloud KMS crypto key | Modifies existing | Yes |
Create Cloud KMS Key Ring |
Create a GCP Cloud KMS key ring | Modifies existing | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
Prompts that work
- List the key rings in us-east1 and the crypto keys inside each one
- Create a key ring called payments in us-central1 and a symmetric key named card-data in it
- Give the service account etl@myproject.iam.gserviceaccount.com the cryptoKeyEncrypterDecrypter role on the card-data key
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Why does OrchestrAI treat creating a Cloud KMS key as high risk?
- Key rings and crypto keys cannot be deleted in Cloud KMS, and IAM bindings change who can decrypt data, so all three write operations are rated high and wait for your confirmation.
- Can OrchestrAI show me who has access to a Cloud KMS key?
- Yes, getting the IAM policy for a crypto key is a read-only operation, as are listing key rings in a location and listing the keys within a ring.
- Which Cloud KMS operations need an extra approval step?
- 3 operations carry a step-level approval gate on top of plan confirmation: Add Cloud KMS IAM Binding, Create Cloud KMS Crypto Key, Create Cloud KMS Key Ring. None of them is classed destructive.
Other Google Cloud services
Related integrations
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.