def test_update_table_cmek(client, to_delete):
"""Patch a table's metadata."""
dataset_id = 'update_table_cmek_{}'.format(_millis())
table_id = 'update_table_cmek_{}'.format(_millis())
dataset = bigquery.Dataset(client.dataset(dataset_id))
client.create_dataset(dataset)
to_delete.append(dataset)
table = bigquery.Table(dataset.table(table_id))
original_kms_key_name = (
'projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}'.format(
'cloud-samples-tests', 'us-central1', 'test', 'test'))
table.encryption_configuration = bigquery.EncryptionConfiguration(
kms_key_name=original_kms_key_name)
table = client.create_table(table)
to_delete.insert(0, table)
# [START bigquery_update_table_cmek]
assert table.encryption_configuration.kms_key_name == original_kms_key_name
# Set a new encryption key to use for the destination.
# TODO: Replace this key with a key you have created in KMS.
updated_kms_key_name = (
'projects/cloud-samples-tests/locations/us-central1/'
'keyRings/test/cryptoKeys/otherkey')
table.encryption_configuration = bigquery.EncryptionConfiguration(
kms_key_name=updated_kms_key_name)
table = client.update_table(table,
['encryption_configuration']) # API request
assert table.encryption_configuration.kms_key_name == updated_kms_key_name
assert original_kms_key_name != updated_kms_key_name
def test_update_table_cmek(client, to_delete):
"""Patch a table's metadata."""
dataset_id = "update_table_cmek_{}".format(_millis())
table_id = "update_table_cmek_{}".format(_millis())
dataset = bigquery.Dataset(client.dataset(dataset_id))
client.create_dataset(dataset)
to_delete.append(dataset)
table = bigquery.Table(dataset.table(table_id))
original_kms_key_name = "projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}".format(
"cloud-samples-tests", "us", "test", "test")
table.encryption_configuration = bigquery.EncryptionConfiguration(
kms_key_name=original_kms_key_name)
table = client.create_table(table)
# [START bigquery_update_table_cmek]
# from google.cloud import bigquery
# client = bigquery.Client()
assert table.encryption_configuration.kms_key_name == original_kms_key_name
# Set a new encryption key to use for the destination.
# TODO: Replace this key with a key you have created in KMS.
updated_kms_key_name = (
"projects/cloud-samples-tests/locations/us/keyRings/test/cryptoKeys/otherkey"
)
table.encryption_configuration = bigquery.EncryptionConfiguration(
kms_key_name=updated_kms_key_name)
table = client.update_table(table,
["encryption_configuration"]) # API request
assert table.encryption_configuration.kms_key_name == updated_kms_key_name
assert original_kms_key_name != updated_kms_key_name
def test_copy_table_cmek(client, to_delete):
dataset_id = 'copy_table_cmek_{}'.format(_millis())
dest_dataset = bigquery.Dataset(client.dataset(dataset_id))
dest_dataset = client.create_dataset(dest_dataset)
to_delete.append(dest_dataset)
# [START bigquery_copy_table_cmek]
source_dataset = bigquery.DatasetReference('bigquery-public-data',
'samples')
source_table_ref = source_dataset.table('shakespeare')
# dataset_id = 'my_dataset'
dest_dataset_ref = client.dataset(dataset_id)
dest_table_ref = dest_dataset_ref.table('destination_table')
# Set the encryption key to use for the destination.
# TODO: Replace this key with a key you have created in KMS.
kms_key_name = 'projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}'.format(
'cloud-samples-tests', 'us-central1', 'test', 'test')
encryption_config = bigquery.EncryptionConfiguration(
kms_key_name=kms_key_name)
job_config = bigquery.CopyJobConfig()
job_config.destination_encryption_configuration = encryption_config
job = client.copy_table(source_table_ref,
dest_table_ref,
job_config=job_config) # API request
job.result() # Waits for job to complete.
assert job.state == 'DONE'
dest_table = client.get_table(dest_table_ref)
assert dest_table.encryption_configuration.kms_key_name == kms_key_name
# [END bigquery_copy_table_cmek]
to_delete.insert(0, dest_table)
def test_load_table_from_uri_cmek(client, to_delete):
dataset_id = 'load_table_from_uri_cmek_{}'.format(_millis())
dataset = bigquery.Dataset(client.dataset(dataset_id))
client.create_dataset(dataset)
to_delete.append(dataset)
# [START bigquery_load_table_gcs_json_cmek]
# dataset_id = 'my_dataset'
dataset_ref = client.dataset(dataset_id)
job_config = bigquery.LoadJobConfig()
job_config.autodetect = True
job_config.source_format = bigquery.SourceFormat.NEWLINE_DELIMITED_JSON
# Set the encryption key to use for the destination.
# TODO: Replace this key with a key you have created in KMS.
kms_key_name = 'projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}'.format(
'cloud-samples-tests', 'us-central1', 'test', 'test')
encryption_config = bigquery.EncryptionConfiguration(
kms_key_name=kms_key_name)
job_config.destination_encryption_configuration = encryption_config
load_job = client.load_table_from_uri(
'gs://cloud-samples-data/bigquery/us-states/us-states.json',
dataset_ref.table('us_states'),
job_config=job_config) # API request
assert load_job.job_type == 'load'
load_job.result() # Waits for table load to complete.
assert load_job.state == 'DONE'
table = client.get_table(dataset_ref.table('us_states'))
assert table.encryption_configuration.kms_key_name == kms_key_name
def test_client_query_destination_table_cmek(client, to_delete):
"""Run a query"""
dataset_id = 'query_destination_table_{}'.format(_millis())
dataset_ref = client.dataset(dataset_id)
to_delete.append(dataset_ref)
client.create_dataset(bigquery.Dataset(dataset_ref))
to_delete.insert(0, dataset_ref.table('your_table_id'))
# [START bigquery_query_destination_table_cmek]
job_config = bigquery.QueryJobConfig()
# Set the destination table. Here, dataset_id is a string, such as:
# dataset_id = 'your_dataset_id'
table_ref = client.dataset(dataset_id).table('your_table_id')
job_config.destination = table_ref
# Set the encryption key to use for the destination.
# TODO: Replace this key with a key you have created in KMS.
kms_key_name = 'projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}'.format(
'cloud-samples-tests', 'us-central1', 'test', 'test')
encryption_config = bigquery.EncryptionConfiguration(
kms_key_name=kms_key_name)
job_config.destination_encryption_configuration = encryption_config
# Start the query, passing in the extra configuration.
query_job = client.query('SELECT 17 AS my_col;', job_config=job_config)
query_job.result()
# The destination table is written using the encryption configuration.
table = client.get_table(table_ref)
assert table.encryption_configuration.kms_key_name == kms_key_name
def client_query_destination_table_cmek(client, table_id, kms_key_name):
# [START bigquery_query_destination_table_cmek]
from google.cloud import bigquery
# TODO(developer): Construct a BigQuery client object.
# client = bigquery.Client()
# TODO(developer): Set table_id to the ID of the destination table.
# table_id = "your-project.your_dataset.your_table_name"
# Set the encryption key to use for the destination.
# TODO(developer): Replace this key with a key you have created in KMS.
# kms_key_name = "projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}".format(
# your-project, location, your-ring, your-key
# )
job_config = bigquery.QueryJobConfig(
destination=table_id,
destination_encryption_configuration=bigquery.EncryptionConfiguration(
kms_key_name=kms_key_name),
)
# Start the query, passing in the extra configuration.
query_job = client.query("SELECT 17 AS my_col;",
job_config=job_config) # Make an API request.
query_job.result() # Wait for the job to complete.
table = client.get_table(table_id) # Make an API request.
if table.encryption_configuration.kms_key_name == kms_key_name:
print(
"The destination table is written using the encryption configuration"
)
def test_create_table_cmek(client, to_delete):
dataset_id = "create_table_cmek_{}".format(_millis())
project = client.project
dataset_ref = bigquery.DatasetReference(project, dataset_id)
dataset = bigquery.Dataset(dataset_ref)
client.create_dataset(dataset)
to_delete.append(dataset)
# [START bigquery_create_table_cmek]
# from google.cloud import bigquery
# client = bigquery.Client()
# dataset_id = 'my_dataset'
table_ref = dataset.table("my_table")
table = bigquery.Table(table_ref)
# Set the encryption key to use for the table.
# TODO: Replace this key with a key you have created in Cloud KMS.
kms_key_name = "projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}".format(
"cloud-samples-tests", "us", "test", "test"
)
table.encryption_configuration = bigquery.EncryptionConfiguration(
kms_key_name=kms_key_name
)
table = client.create_table(table) # API request
assert table.encryption_configuration.kms_key_name == kms_key_name
def copy_table_cmek(dest_table_id, orig_table_id, kms_key_name):
# [START bigquery_copy_table_cmek]
from google.cloud import bigquery
# Construct a BigQuery client object.
client = bigquery.Client()
# TODO(developer): Set dest_table_id to the ID of the destination table.
# dest_table_id = "your-project.your_dataset.your_table_name"
# TODO(developer): Set orig_table_id to the ID of the original table.
# orig_table_id = "your-project.your_dataset.your_table_name"
# Set the encryption key to use for the destination.
# TODO(developer): Replace this key with a key you have created in KMS.
# kms_key_name = "projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}".format(
# your-project, location, your-ring, your-key
# )
job_config = bigquery.CopyJobConfig(
destination_encryption_configuration=bigquery.EncryptionConfiguration(
kms_key_name=kms_key_name))
job = client.copy_table(orig_table_id,
dest_table_id,
job_config=job_config)
job.result() # Wait for the job to complete.
dest_table = client.get_table(dest_table_id) # Make an API request.
if dest_table.encryption_configuration.kms_key_name == kms_key_name:
print("A copy of the table created")
def load_table_uri_cmek(table_id, kms_key_name):
# [START bigquery_load_table_gcs_json_cmek]
from google.cloud import bigquery
# Construct a BigQuery client object.
client = bigquery.Client()
# TODO(developer): Set table_id to the ID of the table to create.
# table_id = "your-project.your_dataset.your_table_name
# Set the encryption key to use for the destination.
# TODO: Replace this key with a key you have created in KMS.
# kms_key_name = "projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}".format(
# "cloud-samples-tests", "us", "test", "test"
# )
job_config = bigquery.LoadJobConfig(
autodetect=True,
source_format=bigquery.SourceFormat.NEWLINE_DELIMITED_JSON,
destination_encryption_configuration=bigquery.EncryptionConfiguration(
kms_key_name=kms_key_name),
)
uri = "gs://cloud-samples-data/bigquery/us-states/us-states.json"
load_job = client.load_table_from_uri(
uri,
table_id,
location="US", # Must match the destination dataset location.
job_config=job_config,
) # Make an API request.
assert load_job.job_type == "load"
load_job.result() # Waits for the job to complete.
assert load_job.state == "DONE"
table = client.get_table(table_id)
if table.encryption_configuration.kms_key_name == kms_key_name:
print("A table loaded with encryption configuration key")
def test_create_table_cmek(client, to_delete):
DATASET_ID = 'create_table_cmek_{}'.format(_millis())
dataset = bigquery.Dataset(client.dataset(DATASET_ID))
client.create_dataset(dataset)
to_delete.append(dataset)
# [START bigquery_create_table_cmek]
table_ref = dataset.table('my_table')
table = bigquery.Table(table_ref)
# Set the encryption key to use for the table.
# TODO: Replace this key with a key you have created in Cloud KMS.
kms_key_name = 'projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}'.format(
'cloud-samples-tests', 'us-central1', 'test', 'test')
table.encryption_configuration = bigquery.EncryptionConfiguration(
kms_key_name=kms_key_name)
table = client.create_table(table) # API request
assert table.encryption_configuration.kms_key_name == kms_key_name
