How to iterate thru all google cloud kms keys in an organization without running into read quotas? - quota

Question

I am trying to find out if there are keys which have versions that are older than one year and setting their rotation period to 24 hours from now. Unfortunately, each list keyring call is counting as a key.read which there is a quota which is very small (~300/min) is there a way to work around these quotas besides increasing them? I am trying to run this code periodically in a cloud function so there is a runtime limit such that I cannot just wait for the quota to reset.
def list_keys(project):
client = kms_v1.KeyManagementServiceClient()
#this location list is based on a running of `gcloud kms locations list` and represents a where a key could be created
location_list = ['asia','asia-east1','asia-east2','asia-northeast1','asia-northeast2',
'asia-south1','asia-southeast1','australia-southeast1','eur4','europe',
'europe-north1','europe-west1','europe-west2','europe-west3','europe-west4',
'europe-west6','global','nam4','northamerica-northeast1','southamerica-east1',
'us','us-central1','us-east1','us-east4','us-west1','us-west2']
for location in location_list:
key_ring_parent = client.location_path(project,location)
key_ring_list = client.list_key_rings(key_ring_parent)
for key_ring in key_ring_list:
parent = client.key_ring_path(project,location,format_keyring_name(key_ring.name))
for key in client.list_crypto_keys(parent):
start_time = key.primary.create_time # need to use primary to get latest version of the key
now = time.time()
now_seconds = int(now)
elapsed = now_seconds - start_time.seconds
next_rotate_age =(key.next_rotation_time.seconds - now_seconds) + elapsed
days_elapsed = elapsed/3600/24
print(key.name," is this many days old: ", days_elapsed)
print(key.name," will be this many days old when it is scheduled to rotate: ", next_rotate_age/3600/24)
#if the key is a year old set it to rotate tomorrow
if days_elapsed > 364:
#client.
update_mask = kms_v1.types.UpdateCryptoKeyRequest.update_mask
#print(update_mask)
new_rotation_time = now_seconds + (3600*24) # 1 day from now because can't set less than 24 hrs notice on certain keys
key.next_rotation_time.seconds = new_rotation_time
update_mask = {'paths':{'next_rotation_time': new_rotation_time}}
print(client.update_crypto_key(key, update_mask))

Answer 1

Is cloud asset inventory an option? You could run something like
$ gcloud asset export --organization YOUR_ORG_ID \
--asset_types cloudkms.googleapis.com/CryptoKey \
--content-type RESOURCE \
--output-path "gs://YOUR_BUCKET/NEW_FILE"
The output file will contain the full CryptoKey resource for every single key in the organization so you don't need to send a ton of List/Get requests to the KMS API.

Answer 2

Having looking into your request, it would seem that it would not be possible to work around the quotas besides increasing them.
I would suggest looking at these following documentations on the following:
Resource quotas
Working with Quotas
Quotas and Limits
These documents should provide you with the information you need on quotas.