IssueTracker

Issue you have encountered:

• When trying to destroy all key version material from the Console for a given key with thousands of versions, the operation is unsuccessful, since despite the key displays as not available, there are still some key versions that are in an enabled state, and others versions scheduled for destruction.

What you would like to accomplish:

• To be able to destroy all key version material from the Console for a given key regardless of the key versions.

How this might work:

• Given that when Destroying all key version material from the Console, the method [1] is being used recursively (it seems that this deletion occurs by fetching the key information, and recursively ruining [1] with that information, and that via gcloud or API usage this functionality of Destroy all key version material is not implemented as such) make it so there is no possible limit.

If applicable, reasons why alternative solutions are not sufficient:

• Using Custom scripts such as the described at [2] recursively (using the respective API method [1]) add an additional layer of complexity/time consumption when a methodology is already implemented via console.

Other information (workarounds you have tried, documentation consulted, etc):

• Available script examples to be used as a possible workaround here [2], nevertheless it will require a custom implementation to iterate over the key versions.

[1]https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys.cryptoKeyVersions/destroy
[2] https://cloud.google.com/kms/docs/destroy-restore#destroy