- release_tracks: [ALPHA]

  help_text:
    brief: Set the IAM policy for a key.
    description: |
      Sets the IAM policy for the given key as defined in a JSON or YAML file.

      See https://cloud.google.com/iam/docs/managing-policies for details of
      the policy file format and contents.
    examples: |
      The following command will read am IAM policy defined in a JSON file
      'policy.json' and set it for the key `frodo` with the keyring
      `fellowship` and location `global`:

      $ {command} frodo policy.json --keyring fellowship --location global

      See https://cloud.google.com/iam/docs/managing-policies for details of the
      policy file format and contents.
  request:
    collection: cloudkms.projects.locations.keyRings.cryptoKeys
    modify_request_hooks:
    - googlecloudsdk.command_lib.iam.hooks:UseMaxRequestedPolicyVersion:api_field=setIamPolicyRequest.policy.version
    - googlecloudsdk.command_lib.iam.hooks:AddVersionToUpdateMaskIfNotPresent:update_mask_path=setIamPolicyRequest.updateMask

  arguments:
    resource:
      help_text: The key whose IAM policy to update.
      spec: !REF googlecloudsdk.command_lib.kms.resources:key

  iam:
    policy_version: 3