This page shows you how to schedule a Cloud Key Management Service key version for permanent destruction. In Cloud KMS, the cryptographic key material that you use to encrypt, decrypt, sign, and verify data is stored in a key version. A key has zero or more key versions. When you rotate a key, you create a new key version.
Destroying a key version means that the key material is permanently deleted. When you destroy a key version, other details such as the key name and key version number aren't deleted. After a key is destroyed, data that was encrypted with the key version can't be decrypted.
The only exception is key re-import, which lets you restore a previously imported key by providing the same original key material.
Because key destruction is generally irreversible, Cloud KMS doesn't let you destroy key versions immediately. Instead, you schedule a key version for destruction. The key version remains in the scheduled for destruction state for a configurable time. During the scheduled for destruction duration, you can restore a key version to cancel its destruction.
The default scheduled for destruction duration is 30 days. You can set a custom scheduled for destruction duration for a key during key creation. Your organization can enforce a minimum scheduled for destruction duration by setting the Minimum destroy scheduled duration per key constraint in your organization policies.
You can also manage access to the key using Identity and Access Management (IAM). IAM operations are consistent within seconds. For more information, see Using IAM.
You can also temporarily disable a key version. We recommend disabling key versions prior to scheduling them for destruction as part of your procedures for ensuring that the key can be safely destroyed. Depending on your organization policies, you might be required to disable a key version before you can schedule it for destruction. For more information about controlling key version destruction using organization policies, see Control key version destruction.
In the rest of this document, scheduling a key for destruction is referred to as destroying the key, even though destruction is not immediate.
Before you begin
Understand the risks
Destroying a key version is a permanent operation. Destroying a key version that is still needed has risks including the following:
Service outage: If you destroy a key that is required to start a container or instance, your services or applications can become unavailable.