keyops

type Key struct {
	// Scope name of the containing cloud resource where a key lives, this is either a google project id or a google service account email
	Scope string
	// Identifier for the the service account or application the key is for, this is either service account email or application id
	Identifier string
	// ID alphanumeric ID for the key
	ID string
}

type KeyOps interface {
	// Create a new service account key for the given service account
	// returns a Key instance that includes the new key's ID as well as the key's JSON private key data
	Create(project string, serviceAccountEmail string) (Key, []byte, error)
	// IsDisabled return true if the given key is enabled, false otherwise
	IsDisabled(key Key) (bool, error)
	// EnsureDisabled check if the key is enabled and if so, disable it
	EnsureDisabled(key Key) error
	// DeleteIfDisabled if the service account key is disabled, delete it, else return an error
	DeleteIfDisabled(key Key) error
}