Hey @navid - I was able to set up the Google KMS (service account and asymmetric key). I used the
flow keys decode pem --from-file new-key2.pub
to convert the public key into a proper format and then used that key to create an account on Testnet via faucet.
Finally, I integrated it into our Golang backend like this:
func TestKMS() {
ctx := context.Background()
node := "access.devnet.nodes.onflow.org:9000" // NODE
flowClient, err := client.New(node, grpc.WithInsecure())
examples.Handle(err)
senderAddr := flow.HexToAddress("XXXXXXXXXX") // ADMIN ADDRESS
account, err := flowClient.GetAccount(ctx, senderAddr)
examples.Handle(err)
senderAccountKey := account.Keys[0]
accountKMSKey := cloudkms.Key{
ProjectID: "GOOGLE_KMS_PROJECT_ID",
LocationID: "GOOGLE_KMS_LOCATION_ID",
KeyRingID: "GOOGLE_KMS_KEY_RING_ID",
KeyID: "GOOGLE_KMS_KEY_ID",
KeyVersion: "GOOGLE_KMS_KEY_VERSION",
}
fmt.Print("accountKMSKey: ", accountKMSKey)
kmsClient, err := cloudkms.NewClient(ctx, option.WithCredentialsFile("Credentials.json"))
if err != nil {
panic(err)
}
accountKMSSigner, err := kmsClient.SignerForKey(
ctx,
senderAddr,
accountKMSKey,
)
if err != nil {
panic(err)
}
latestBlock, err := flowClient.GetLatestBlockHeader(ctx, true)
if err != nil {
panic(err)
}
var testTransactionString string = `
transaction() {
prepare(signer: AuthAccount) {
// Get a key from an auth account.
let keyA = signer.keys.get(0)
}
}
`
tx := flow.NewTransaction().
SetScript([]byte(testTransactionString)).
SetGasLimit(1000).
SetPayer(senderAddr).
SetReferenceBlockID(latestBlock.ID).
SetProposalKey(senderAddr, senderAccountKey.Index, senderAccountKey.SequenceNumber)
err = tx.SignEnvelope(senderAddr, senderAccountKey.Index, accountKMSSigner)
examples.Handle(err)
err = flowClient.SendTransaction(ctx, *tx)
examples.Handle(err)
result := examples.WaitForSeal(ctx, flowClient, tx.ID())
examples.Handle(result.Error)
fmt.Println("Transaction was Successful")
}
------> Unfortunately, whatever we do, we get the:
[Error Code: 1006] invalid proposal key: public key 0 on account XXXXXXXXXXXX does not have a valid signature: [Error Code: 1009] invalid envelope key: public key 0 on account XXXXXXXXXXXX does not have a valid signature: signature is not valid
Google KMS is not returning any errors so I assume the key signing process is done properly.
Before implementing Google KMS, we were using the Private key directly from Env Vars and it was working perfectly fine.
Any help would be appreciated…
