Destroy a secret version

This page describes how you can destroy a secret version. In the destroyed state, the secret version's contents are discarded. Destroying a secret version is a permanent action. After a version is destroyed, you can't access the secret data or restore the version to another state.

Before destroying a secret version, try disabling it first and observe your application's behavior. You can re-enable the secret version if you encounter unexpected issues.

When you disable or destroy a secret or secret version, the change takes time to propagate through the system. If necessary, you can revoke access to the secret. Changes to IAM permissions are consistent within seconds.

Required roles

To get the permissions that you need to destroy a secret version, ask your administrator to grant you the Secret Manager Secret Version Manager (roles/secretmanager.secretVersionManager) IAM role on a secret. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Destroy a secret version

To destroy a secret version, use one of the following methods:

Console

  1. In the Google Cloud console, go to the Secret Manager page.

    Go to Secret Manager

  2. On the Secret Manager page, click a secret to access its versions.

  3. On the secret details page, in the Versions tab, select the secret version that you want to destroy.

  4. Click Actions, and then click Destroy.

  5. In the confirmation dialog that appears, enter the secret ID to confirm, and then click Destroy selected versions.

gcloud

Before using any of the command data below, make the following replacements:

  • VERSION_ID: the resource name of the secret version
  • SECRET_ID: the ID of the secret

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud secrets versions destroy VERSION_ID --secret=SECRET_ID

Windows (PowerShell)

gcloud secrets versions destroy VERSION_ID --secret=SECRET_ID

Windows (cmd.exe)

gcloud secrets versions destroy VERSION_ID --secret=SECRET_ID

REST

Before using any of the request data, make the following replacements:

  • PROJECT_ID: the Google Cloud project ID
  • SECRET_ID: the ID of the secret
  • VERSION_ID: the ID of the secret version

HTTP method and URL: 

POST https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID/versions/VERSION_ID:destroy

Request JSON body: 

{}

To send your request, choose one of these options:

curl

Save the request body in a file named request.json, and execute the following command: 

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID/versions/VERSION_ID:destroy"

PowerShell

Save the request body in a file named request.json, and execute the following command: 

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID/versions/VERSION_ID:destroy" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "name": "projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID/versions/VERSION_ID",
  "createTime": "2024-09-02T07:16:34.566706Z",
  "destroyTime": "2024-09-04T06:29:01.893743728Z",
  "state": "DESTROYED",
  "etag": "\"1621454a37ce7f\""
}

C#

To run this code, first set up a C# development environment and install the Secret Manager C# SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope. 


using Google.Cloud.SecretManager.V1;

public class DestroySecretVersionSample
{
    public SecretVersion DestroySecretVersion(
      string projectId = "my-project", string secretId = "my-secret", string secretVersionId = "123")
    {
        // Create the client.
        SecretManagerServiceClient client = SecretManagerServiceClient.Create();

        // Build the resource name.
        SecretVersionName secretVersionName = new SecretVersionName(projectId, secretId, secretVersionId);

        // Call the API.
        SecretVersion version = client.DestroySecretVersion(secretVersionName);
        return version;
    }
}

Go

To run this code, first set up a Go development environment and install the Secret Manager Go SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope. 

import (
	"context"
	"fmt"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"
	"cloud.google.com/go/secretmanager/apiv1/secretmanagerpb"
)

// destroySecretVersion destroys the given secret version, making the payload
// irrecoverable. Other secrets versions are unaffected.
func destroySecretVersion(name string) error {
	// name := "projects/my-project/secrets/my-secret/versions/5"

	// Create the client.
	ctx :=