diff --git a/google/cloud/kms/v1/resources.proto b/google/cloud/kms/v1/resources.proto
index 95e9b1250f..b2b7ab919f 100644
--- a/google/cloud/kms/v1/resources.proto
+++ b/google/cloud/kms/v1/resources.proto
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC.
+// Copyright 2020 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,11 +16,11 @@ syntax = "proto3";
 
 package google.cloud.kms.v1;
 
-import "google/api/annotations.proto";
 import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/timestamp.proto";
+import "google/api/annotations.proto";
 
 option cc_enable_arenas = true;
 option csharp_namespace = "Google.Cloud.Kms.V1";
@@ -284,6 +284,9 @@ message CryptoKeyVersion {
 
     // ECDSA on the NIST P-384 curve with a SHA384 digest.
     EC_SIGN_P384_SHA384 = 13;
+
+    // Algorithm representing symmetric encryption by an external key manager.
+    EXTERNAL_SYMMETRIC_ENCRYPTION = 18;
   }
 
   // The state of a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], indicating if it can be used.
@@ -390,11 +393,21 @@ message CryptoKeyVersion {
   // [state][google.cloud.kms.v1.CryptoKeyVersion.state] is
   // [IMPORT_FAILED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.IMPORT_FAILED].
   string import_failure_reason = 16 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // ExternalProtectionLevelOptions stores a group of additional fields for
+  // configuring a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that are specific to the
+  // [EXTERNAL][google.cloud.kms.v1.ProtectionLevel.EXTERNAL] protection level.
+  ExternalProtectionLevelOptions external_protection_level_options = 17;
 }
 
 // The public key for a given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Obtained via
 // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
 message PublicKey {
+  option (google.api.resource) = {
+    type: "cloudkms.googleapis.com/PublicKey"
+    pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}/publicKey"
+  };
+
   // The public key, encoded in PEM format. For more information, see the
   // [RFC 7468](https://tools.ietf.org/html/rfc7468) sections for
   // [General Considerations](https://tools.ietf.org/html/rfc7468#section-2) and
@@ -560,3 +573,11 @@ enum ProtectionLevel {
   // Crypto operations are performed by an external key manager.
   EXTERNAL = 3;
 }
+
+// ExternalProtectionLevelOptions stores a group of additional fields for
+// configuring a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that are specific to the
+// [EXTERNAL][google.cloud.kms.v1.ProtectionLevel.EXTERNAL] protection level.
+message ExternalProtectionLevelOptions {
+  // The URI for an external resource that this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents.
+  string external_key_uri = 1;
+}
diff --git a/google/cloud/kms/v1/service.proto b/google/cloud/kms/v1/service.proto
index 4dd5fd14ee..d0c8949cba 100644
--- a/google/cloud/kms/v1/service.proto
+++ b/google/cloud/kms/v1/service.proto
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC.
+// Copyright 2020 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -870,4 +870,9 @@ message LocationMetadata {
   // [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]
   // [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] can be created in this location.
   bool hsm_available = 1;
+
+  // Indicates whether [CryptoKeys][google.cloud.kms.v1.CryptoKey] with
+  // [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]
+  // [EXTERNAL][google.cloud.kms.v1.ProtectionLevel.EXTERNAL] can be created in this location.
+  bool ekm_available = 2;
 }