This topic describes how you can destroy a secret version. In the destroyed state, the secret version's contents are discarded. Destroying a secret version is permanent. You won't be able to access the secret any more. The secret version can't be changed to another state.
Before destroying a secret version, try disabling it and observe your application's behavior. You can re-enable the secret version if you encounter unexpected issues.
When you disable or destroy a secret or secret version, the change takes time to propagate through the system. If necessary, you can revoke IAM access to the secret. Changes to IAM permissions are consistent within seconds.
Required roles
To get the permissions that you need to destroy a secret version,
ask your administrator to grant you the
Secret Manager Secret Version Manager (roles/secretmanager.secretVersionManager
) IAM role on a secret.
For more information about granting roles, see Manage access to projects, folders, and organizations.
You might also be able to get the required permissions through custom roles or other predefined roles.
Destroy a secret version
Console
-
Go to the Secret Manager page in the Google Cloud console.
-
On the Secret Manager page, click on the Name of a secret.
-
On the Secret details page, in the Versions table, locate a secret version to access.
-
In the Actions column, click View more
. -
Click Destroy from the menu.
-
In the Destroy secret version dialog, enter the name of the secret.
-
Click the Destroy selected versions button.
gcloud
To use Secret Manager on the command line, first Install or upgrade to version 378.0.0 or higher of the Google Cloud CLI. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
$ gcloud secrets versions destroy version-id --secret="secret-id"
C#
To run this code, first set up a C# development environment and install the Secret Manager C# SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Go
To run this code, first set up a Go development environment and install the Secret Manager Go SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Java
To run this code, first set up a Java development environment and install the Secret Manager Java SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Node.js
To run this code, first set up a Node.js development environment and install the Secret Manager Node.js SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
PHP
To run this code, first learn about using PHP on Google Cloud and install the Secret Manager PHP SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Python
To run this code, first set up a Python development environment and install the Secret Manager Python SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Ruby
To run this code, first set up a Ruby development environment and install the Secret Manager Ruby SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
API
These examples use curl to demonstrate using the API. You can generate access tokens with gcloud auth print-access-token. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
$ curl "https://secretmanager.googleapis.com/v1/projects/project-id/secrets/secret-id/versions/version-id:destroy" \
--request "POST" \
--header "authorization: Bearer $(gcloud auth print-access-token)" \
--header "content-type: application/json"
Delayed destruction of secret versions
The Secret Manager Admin can set up delayed destruction of secret versions by turning on the feature Delay secret version dstroy on the secret. If this feature is turned on, the secret version isn't immediately destroyed upon request. Instead, the secret version is disabled and scheduled for destruction at a later date. During this time, the Secret Manager Admin can restore the secret version. To learn more, see Delay destruction of secret versions
What's next
- Learn how to ensure data integrity.
- Learn about best practices.