This page describes how to disable a secret version. A secret version can be in one of the following three states:
-
Enabled
-
Disabled
-
Destroyed
Required roles
To get the permissions that you need to disable a secret version,
ask your administrator to grant you the
Secret Manager Secret Version Manager (roles/secretmanager.secretVersionManager
) IAM role on a secret.
For more information about granting roles, see Manage access to projects, folders, and organizations.
You might also be able to get the required permissions through custom roles or other predefined roles.
Disable a secret version
To disable a secret version, use one of the following methods:
Console
-
Go to the Secret Manager page in the Google Cloud console.
-
On the Secret Manager page, click the Regional secrets tab, and then click a secret to access its versions.
-
On the secret details page, in the Versions tab, select the secret version that you want to access.
-
Click
Actions for the secret version that you want to disable, and then click Disable. -
In the confirmation dialog that appears, click Disable selected versions.
gcloud
Before using any of the command data below, make the following replacements:
- VERSION_ID: the ID of the secret version
- SECRET_ID: the ID of the secret or fully qualified identifier for the secret
- LOCATION: the Google Cloud location of the secret
Execute the following command:
Linux, macOS, or Cloud Shell
gcloud secrets versions disable VERSION_ID --secret=SECRET_ID --location=LOCATION
Windows (PowerShell)
gcloud secrets versions disable VERSION_ID --secret=SECRET_ID --location=LOCATION
Windows (cmd.exe)
gcloud secrets versions disable VERSION_ID --secret=SECRET_ID --location=LOCATION
REST
Before using any of the request data, make the following replacements:
- LOCATION: the Google Cloud location of the secret
- PROJECT_ID: the Google Cloud project ID
- SECRET_ID: the ID of the secret or fully qualified identifier for the secret
- VERSION_ID: the ID of the secret version
HTTP method and URL:
POST https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID/versions/VERSION_ID:disable
Request JSON body:
{}
To send your request, choose one of these options:
curl
Save the request body in a file named request.json
,
and execute the following command:
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID/versions/VERSION_ID:disable"
PowerShell
Save the request body in a file named request.json
,
and execute the following command:
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `
-Method POST `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID/versions/VERSION_ID:disable" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
{ "name": "projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID/versions/VERSION_ID", "createTime": "2024-09-02T07:16:34.566706Z", "state": "DISABLED", "etag": "\"16214546481514\"" }
Go
To run this code, first set up a Go development environment and install the Secret Manager Go SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Java
To run this code, first set up a Java development environment and install the Secret Manager Java SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Node.js
To run this code, first set up a Node.js development environment and install the Secret Manager Node.js SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Python
To run this code, first set up a Python development environment and install the Secret Manager Python SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.