title: Google cloud KMS permission issue with encrypt
body: <p>I tried to encrypt the contents of a file and to write the encrypted data to a cipher file with Google cloud KMS. But the php script shows a permission error. Here's the php script I tried</p>
  
  <pre><code>$cryptoKeyName = $kms-&gt;cryptoKeyName($projectId, $locationId, $keyRingId, $cryptoKeyId);
  $plaintext = file_get_contents($plaintextFileName);
  
  $response = $kms-&gt;encrypt($cryptoKeyName, $plaintext);
  file_put_contents($ciphertextFileName, $response-&gt;getCiphertext());
  </code></pre>
  
  <p>I got this error</p>
  
  <blockquote>
    <p>Fatal error: Uncaught Google\ApiCore\ApiException: { "message": "Permission 'cloudkms.cryptoKeyVersions.useToEncrypt' denied for resource 'projects/testproject/locations/global/keyRings/test/cryptoKeys/testkey'.", "code": 7, "status": "PERMISSION_DENIED", "details": [] } thrown in /home/xxxxx/xxx.com/vendor/google/gax/src/ApiException.php on line 139</p>
  </blockquote>
  
  <p>When I print the user permission, it shows</p>
  
  <pre><code>Role: roles/cloudkms.admin Members: user:renjith@pi-digi.com Role: roles/cloudkms.cryptoKeyEncrypterDecrypter Members: user:renjith@pi-digi.com`
  </code></pre>