Get External Key

ExternalKey is an account-level, customer-managed KMS key registration for CMEK envelope encryption. It is a collection — an account may hold several keys at once — with exactly one marked primary. The primary wraps newly minted DEKs; older keys stay active so data wrapped under them still decrypts (the rotation/migration story is inherently multi-key). The whole resource is Fireworks-operator (superuser) managed.

Fireworks reaches the customer KMS as a single shared Google OIDC identity (a global per-env subject), scoped per account by minting tokens with aud = account_id, pinned in the customer's own KMS trust. So these configs carry identity references only — never long-lived secrets — and Fireworks provisions nothing per account.