Release Notes

This page documents production updates to Cloud KMS. You can periodically check this page for announcements about new or updated features, bug fixes, known issues, and deprecated functionality.

Current version: v1

Subscribe to the Cloud KMS release notes. Subscribe

July 14, 2018

Cloud KMS resources can now be created in the us-west2 region. Learn more about Cloud Locations.

June 14, 2018

Cloud KMS resources can now be created in the europe-north1 region. Learn more about Cloud Locations.

April 12, 2018

Cloud KMS resources can now be created in the following regions:

  • asia-south1
  • australia-southeast1
  • europe-west2
  • europe-west3
  • northamerica-northeast1
  • southamerica-east1
  • us-east4

Learn more about Cloud Locations.

April 11, 2018

The URL of the Cloud KMS page in the Google Cloud Platform Console has been changed from https://console.cloud.google.com/iam-admin/kms to https://console.cloud.google.com/security/kms.

April 3, 2018

The name of the Cloud KMS page in the Google Cloud Platform Console has been changed from Encryption keys to Cryptographic keys.

March 29, 2018

Cloud KMS resources can now be created in the asia-northeast1 region. Learn more about Cloud Locations.

February 8, 2018

Cloud KMS resources can now be created in the asia, europe, and us multi-regional locations. Learn more about Cloud KMS locations.

January 31, 2018

Announced general availability of IAM custom roles for Cloud KMS.

January 22, 2018

The gcloud kms locations list command now supports the europe-west4 region.

January 17, 2018

The Google Cloud Platform console now supports the europe-west4 region. You can create new key rings in this region using the console, the API and the gcloud command-line tool. The gcloud kms locations list command will support this region approximately January 22, 2018. Learn more about Cloud Locations.

January 10, 2018

Cloud KMS resources can now be created in the europe-west4 region. You can use this region to create new key rings using the API and the gcloud command-line tool. This region will not be viewable in the Google Cloud Platform console or returned by gcloud kms locations list until approximately January 17, 2018. Learn more about Cloud Locations.

October 11, 2017

Promoted keys updatefrom gcloud beta kms to gcloud kms as part of gcloud 175.0.0.

October 4, 2017

The Envelope Encryption topic provides more information about key wrapping and envelope encryption.

September 19, 2017

Batch operations are no longer supported.

September 6, 2017

Labels can now be applied to CryptoKeys:

gcloud changes:

  • The gcloud kms keys create command has a new parameter, --labels. Use this parameter to specify labels when you create a key.
  • The output from the gcloud kms keys list command now contains a LABELS column.
  • The gcloud beta kms keys update command is new. This command supports updating an existing key.

These changes are effective in gcloud version 170.0.0.

August 23, 2017

Cloud KMS resources can now be created in the asia-southeast1 region. Learn more about Cloud Locations.

August 18, 2017

Cloud KMS is now available in a larger group of countries.

June 14, 2017

Promoted encrypt and decrypt commands from gcloud beta kms to gcloud kms as part of gcloud 159.0.0.

June 7, 2017

API version v1beta1 has been turned off. Please use v1 API endpoint.

As part of gcloud 158.0.0, when using gcloud to update IAM policies, data access logs can be enabled for key rings and keys, in addition to projects which were already supported.

May 31, 2017

Added encrypt and decrypt commands to gcloud beta kms as part of gcloud 157.0.0.

  • Added examples for using gcloud beta kms encrypt and gcloud beta kms decrypt.

May 2, 2017

Data Access audit logs can now be self-enabled for Cloud KMS. For more information, see Cloud Audit Logging documentation.

April 17, 2017

Cloud KMS resources can now be created in the us-west1 region. Learn more about Cloud Locations.

March 22, 2017

Promoted gcloud beta kms commands to gcloud kms as part of gcloud 148.0.0.

March 15, 2017

Renamed cryptokey to key as part of gcloud 147.0.0.

  • Renamed gcloud kms cryptokeys as gcloud kms keys.
  • Renamed the --cryptokey flag as --key.
  • Deprecated the cryptokey variants.

March 8, 2017

Launch of Cloud KMS to General Availability.

API version from v1beta1 to v1.

  • The v1beta1 API is deprecated and will be turned down no sooner than June 7, 2017.
  • To start using the v1 API, follow the process to install the client library for your preferred language. Other than the API version, your code shouldn't need any other changes.

January 11, 2017

Launch of Cloud KMS to Beta. Use Cloud KMS to create, use, rotate, automatically rotate, and destroy symmetric AES256 encryption keys. Cloud KMS is accessible via

  • REST API
  • Google APIs Client Libraries in go, python, and java
  • Cloud Console user interface
Was this page helpful? Let us know how we did:

Send feedback about...

Cloud KMS Documentation