Delete Cloud KMS resources

This document shows how to permanently delete Cloud Key Management Service keys and key versions. This operation is irreversible.

In Cloud KMS, destruction and deletion are different operations:

  • Destruction: Disables a key version permanently, including irreversibly destroying the underlying key material after the specified destruction period. A key version in the DESTROYED state can't be used for cryptographic operations and is no longer billed. You can destroy a key version that was used to encrypt data to crypto-shred data that you want to be permanently unrecoverable. Destroyed key versions are still included in lists of Cloud KMS resources.

  • Deletion: Removes a key or key version from lists of Cloud KMS resources in the Google Cloud console, Google Cloud CLI, Cloud Key Management Service API, and client libraries. For projects with many keys or key versions that are no longer active, deletion streamlines search and list operations. Deleted CryptoKey names can't be reused. You can view a list of deleted CryptoKey names that can't be reused using the retiredResources.list method.

Before you begin

To get the permissions that you need to delete and view Cloud KMS resources, ask your administrator to grant you the Cloud KMS administrator (roles/cloudkms.admin) IAM role on the key. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the permissions required to delete and view Cloud KMS resources. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to delete and view Cloud KMS resources:

  • To delete a key version: cloudkms.cryptoKeyVersions.delete
  • To delete a key: cloudkms.cryptoKeys.delete
  • To view deleted resources:
    • cloudkms.retiredResources.get
    • cloudkms.retiredResources.list

You might also be able to get these permissions with custom roles or other predefined roles.

Delete a key version

You can delete a key version if it's in the DESTROYED, IMPORT_FAILED, or GENERATION_FAILED state. If the key version was imported, it can only be deleted if the import failed.

To permanently delete a key version, follow these steps:

Console

  1. In the Google Cloud console, go to the Key Management page.

    Go to Key Management

  2. Click the name of the key ring that contains the key and key version that you want to delete.

  3. Click the key that contains the key version that you want to delete.

  4. In the Versions table, locate the key version that you want to delete, and then click More actions.

  5. In the More actions menu, click Delete.

  6. In the confirmation prompt, enter the key name and then click Delete.

gcloud

To delete a key version, run the following command:

gcloud kms keys versions delete KEY_VERSION \
    --location=LOCATION \
    --keyring=KEY_RING \
    --key=KEY_NAME

Replace the following:

  • KEY_VERSION: the number of the key version that you want to permanently delete. The indicated key version must be in the DESTROYED, IMPORT_FAILED, or GENERATION_FAILED state.
  • LOCATION: the Cloud KMS location of the key ring.
  • KEY_RING: the name of the key ring that contains the key.
  • KEY_NAME: the name of the key that contains the key version that you want to permanently delete.