def METHOD_NAME(additional_authenticated_data: Optional[str] = None,
                   ciphertext: Optional[str] = None,
                   crypto_key: Optional[str] = None,
                   opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetKMSSecretResult:
    """
    This data source allows you to use data encrypted with Google Cloud KMS
    within your resource definitions.
    For more information see
    [the official documentation](https://cloud.google.com/kms/docs/encrypt-decrypt).
    > **NOTE:** Using this data provider will allow you to conceal secret data within your
    resource definitions, but it does not take care of protecting that data in the
    logging output, plan output, or state output.  Please take care to secure your secret
    data outside of resource definitions.
    :param str additional_authenticated_data: The [additional authenticated data](https://cloud.google.com/kms/docs/additional-authenticated-data) used for integrity checks during encryption and decryption.
    :param str ciphertext: The ciphertext to be decrypted, encoded in base64
    :param str crypto_key: The id of the CryptoKey that will be used to
           decrypt the provided ciphertext. This is represented by the format
           `{projectId}/{location}/{keyRingName}/{cryptoKeyName}`.
    """
    __args__ = dict()
    __args__['additionalAuthenticatedData'] = additional_authenticated_data
    __args__['ciphertext'] = ciphertext
    __args__['cryptoKey'] = crypto_key
    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
    __ret__ = pulumi.runtime.invoke('gcp:kms/getKMSSecret:getKMSSecret', __args__, opts=opts, typ=GetKMSSecretResult).value
    return AwaitableGetKMSSecretResult(
        additional_authenticated_data=pulumi.get(__ret__, 'additional_authenticated_data'),
        ciphertext=pulumi.get(__ret__, 'ciphertext'),
        crypto_key=pulumi.get(__ret__, 'crypto_key'),
        id=pulumi.get(__ret__, 'id'),
        plaintext=pulumi.get(__ret__, 'plaintext'))