刪除密鑰

本頁說明如何刪除密鑰及其所有版本。

如要只刪除密鑰版本，請參閱「刪除密鑰版本」。

必要的角色

如要取得刪除密碼所需的權限，請要求管理員授予您密碼、專案、資料夾或機構的 Secret Manager 管理員 (roles/secretmanager.admin) IAM 角色。如要進一步瞭解如何授予角色，請參閱「管理專案、資料夾和機構的存取權」。

您或許還可透過自訂角色或其他預先定義的角色取得必要權限。

刪除密鑰

如要刪除密鑰，請使用下列其中一種方法：

控制台

  1. 前往 Google Cloud 控制台的「Secret Manager」頁面。

    前往 Secret Manager

  2. 選取要刪除的密鑰。

  3. 按一下「動作」，然後按一下「刪除」。

  4. 在隨即顯示的確認對話方塊中，輸入密鑰名稱，然後按一下「刪除密鑰」。

gcloud

使用下列任何指令資料之前，請先替換以下項目：

  • SECRET_ID：密鑰的 ID

執行下列指令：

Linux、macOS 或 Cloud Shell

gcloud secrets delete SECRET_ID

Windows (PowerShell)

gcloud secrets delete SECRET_ID

Windows (cmd.exe)

gcloud secrets delete SECRET_ID

回應會傳回密碼。

REST

使用任何要求資料之前，請先替換以下項目：

  • PROJECT_ID：專案 ID Google Cloud
  • SECRET_ID：密鑰的 ID

HTTP 方法和網址：

DELETE https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID

JSON 要求主體：

{}

如要傳送要求，請選擇以下其中一個選項：

curl

將要求主體儲存在名為 request.json 的檔案中，然後執行下列指令：

curl -X DELETE \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID"

PowerShell

將要求主體儲存在名為 request.json 的檔案中，然後執行下列指令：

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method DELETE `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID" | Select-Object -Expand Content

您應該會收到如下的 JSON 回應：

{}

C#

如要執行這段程式碼，請先設定 C# 開發環境，並安裝 Secret Manager C# SDK。在 Compute Engine 或 GKE 上，您必須使用 cloud-platform 範圍進行驗證。


using Google.Cloud.SecretManager.V1;

public class DeleteSecretSample
{
    public void DeleteSecret(
      string projectId = "my-project", string secretId = "my-secret")
    {
        // Create the client.
        SecretManagerServiceClient client = SecretManagerServiceClient.Create();

        // Build the resource name.
        SecretName secretName = new SecretName(projectId, secretId);

        // Delete the secret.
        client.DeleteSecret(secretName);
    }
}

Go

如要執行這段程式碼，請先設定 Go 開發環境，並安裝 Secret Manager Go SDK。在 Compute Engine 或 GKE 上，您必須使用 cloud-platform 範圍進行驗證。

import (
	"context"
	"fmt"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"
	"cloud.google.com/go/secretmanager/apiv1/secretmanagerpb"
)

// deleteSecret deletes the secret with the given name and all of its versions.
func deleteSecret(name string) error {
	// name := "projects/my-project/secrets/my-secret"

	// Create the client.
	ctx := context.Background()
	client, err := secretmanager.NewClient(ctx)
	if err != nil {
		return fmt.Errorf("failed to create secretmanager client: %w", err)
	}
	defer client.Close()

	// Build the request.
	req := &secretmanagerpb.DeleteSecretRequest{
		Name: name,
	}

	// Call the API.
	if err := client.DeleteSecret(ctx, req); err != nil {
		return fmt.Errorf("failed to delete secret: %w", err)
	}
	return nil
}

Java

如要執行這段程式碼，請先設定 Java 開發環境，並安裝 Secret Manager Java SDK。在 Compute Engine 或 GKE 上，您必須使用 cloud-platform 範圍進行驗證。

import com.google.cloud.secretmanager.v1.SecretManagerServiceClient;
import com.google.cloud.secretmanager.v1.SecretName;
import java.io.IOException;

public class DeleteSecret {

  public static void deleteSecret() throws IOException {
    // TODO(developer): Replace these variables before running the sample.
    String projectId = "your-project-id";
    String secretId = "your-secret-id";
    deleteSecret(projectId, secretId);
  }

  // Delete an existing secret with the given name.
  public static void deleteSecret(String projectId, String secretId) throws IOException {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests. After completing all of your requests, call
    // the "close" method on the client to safely clean up any remaining background resources.
    try (SecretManagerServiceClient client = SecretManagerServiceClient.create()) {
      // Build the secret name.
      SecretName secretName = SecretName.of(projectId, secretId);

      // Delete the secret.
      client.deleteSecret(secretName);
      System.out.printf("Deleted secret %s\n", secretId);
    }
  }
}

Node.js

如要執行這段程式碼，請先設定 Node.js 開發環境，並安裝 Secret Manager Node.js SDK。在 Compute Engine 或 GKE 上，您必須使用 cloud-platform 範圍進行驗證。

/**
 * TODO(developer): Uncomment these variables before running the sample.
 */
// const name = 'projects/my-project/secrets/my-secret';

// Imports the Secret Manager library
const {SecretManagerServiceClient} = require('@google-cloud/secret-manager');

// Instantiates a client
const client = new SecretManagerServiceClient();

async function deleteSecret() {
  await client.deleteSecret({
    name: name,
  });

  console.log(`Deleted secret ${name}`);
}

deleteSecret();

PHP

如要執行這段程式碼，請先瞭解如何在 Google Cloud 上使用 PHP，並安裝 Secret Manager PHP SDK。在 Compute Engine 或 GKE 上，您必須使用 cloud-platform 範圍進行驗證。

// Import the Secret Manager client library.
use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
use Google\Cloud\SecretManager\V1\DeleteSecretRequest;

/**
 * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
 * @param string $secretId  Your secret ID (e.g. 'my-secret')
 */
function delete_secret(string $projectId, string $secretId): void
{
    // Create the Secret Manager client.
    $client = new SecretManagerServiceClient();

    // Build the resource name of the secret.
    $name = $client->secretName($projectId, $secretId);

    // Build the request.
    $request = DeleteSecretRequest::build($name);

    // Delete the secret.
    $client->deleteSecret($request);
    printf('Deleted secret %s', $secretId);
}

Python

如要執行這段程式碼，請先設定 Python 開發環境，然後安裝 Secret Manager Python SDK。在 Compute Engine 或 GKE 上，您必須使用 cloud-platform 範圍進行驗證。

def delete_secret(project_id: str, secret_id: str) -> None:
    """
    Delete the secret with the given name and all of its versions.
    """

    # Import the Secret Manager client library.
    from google.cloud import secretmanager

    # Create the Secret Manager client.
    client = secretmanager.SecretManagerServiceClient()

    # Build the resource name of the secret.
    name = client.secret_path(project_id, secret_id)

    # Delete the secret.
    client.delete_secret(request={"name": name})

Ruby

如要執行這段程式碼，請先設定 Ruby 開發環境，然後安裝 Secret Manager Ruby SDK。在 Compute Engine 或 GKE 上，您必須使用 cloud-platform 範圍進行驗證。

# project_id = "YOUR-GOOGLE-CLOUD-PROJECT"  # (e.g. "my-project")
# secret_id  = "YOUR-SECRET-ID"             # (e.g. "my-secret")

# Require the Secret Manager client library.
require "google/cloud/secret_manager"

# Create a Secret Manager client.
client = Google::Cloud::SecretManager.secret_manager_service

# Build the resource name of the secret.
name = client.secret_path project: project_id, secret: secret_id

# Delete the secret.
client.delete_secret name: name

# Print a success message.
puts "Deleted secret #{name}"

後續步驟