Console
    Contact Us Start free

    Destroy a regional secret version

    This page describes how you can destroy a secret version. In the destroyed state , the secret version's contents are discarded. Destroying a secret version is a permanent action. After a version is destroyed, you can't access the secret data or restore the version to another state.

    Before destroying a secret version, try disabling it first and observe your application's behavior. You can re-enable the secret version if you encounter unexpected issues.

    When you disable or destroy a secret or secret version, the change takes time to propagate through the system. If necessary, you can revoke access to the secret. Changes to IAM permissions are consistent within seconds.

    Required roles

    To get the permissions that you need to destroy a secret version, ask your administrator to grant you the Secret Manager Secret Version Manager ( roles/secretmanager.secretVersionManager ) IAM role on a secret. For more information about granting roles, see Manage access to projects, folders, and organizations .

    You might also be able to get the required permissions through custom roles or other predefined roles .

    Destroy a secret version

    To destroy a secret version, use one of the following methods:

    Console

    1. In the Google Cloud console, go to the Secret Manager page.

      Go to Secret Manager

    2. On the Secret Manager page, click the Regional secrets tab, and then click a secret to access its versions.

    3. On the secret details page, in the Versions tab, select the secret version that you want to destroy.

    4. Click Actions , and then click Destroy .

    5. In the confirmation dialog that appears, enter the secret ID to confirm, and then click Destroy selected versions .

    gcloud

    Before using any of the command data below, make the following replacements:

    • VERSION_ID : the resource name of the secret version
    • SECRET_ID : the ID of the secret
    • LOCATION : the Google Cloud location of the secret

    Execute the following command:

    Linux, macOS, or Cloud Shell

    gcloud  
secrets  
versions  
destroy  
 VERSION_ID 
  
--secret = 
 SECRET_ID 
  
--location = 
 LOCATION

    Windows (PowerShell)

    gcloud  
secrets  
versions  
destroy  
 VERSION_ID 
  
--secret = 
 SECRET_ID 
  
--location = 
 LOCATION

    Windows (cmd.exe)

    gcloud  
secrets  
versions  
destroy  
 VERSION_ID 
  
--secret = 
 SECRET_ID 
  
--location = 
 LOCATION

    REST

    Before using any of the request data, make the following replacements:

    • LOCATION : the Google Cloud location of the secret
    • PROJECT_ID : the Google Cloud project ID
    • SECRET_ID : the ID of the secret
    • VERSION_ID : the ID of the secret version

    HTTP method and URL:

    POST https://secretmanager. LOCATION 
.rep.googleapis.com/v1/projects/ PROJECT_ID 
/locations/ LOCATION 
/secrets/ SECRET_ID 
/versions/ VERSION_ID 
:destroy

    Request JSON body:

    {}

    To send your request, choose one of these options:

    curl

    Save the request body in a file named request.json , and execute the following command:

    curl -X POST \
    -H "Authorization: Bearer $(gcloud auth print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    -d @request.json \
    "https://secretmanager. LOCATION 
.rep.googleapis.com/v1/projects/ PROJECT_ID 
/locations/ LOCATION 
/secrets/ SECRET_ID 
/versions/ VERSION_ID 
:destroy"

    PowerShell

    Save the request body in a file named request.json , and execute the following command:

    $cred = gcloud auth print-access-token
    $headers = @{ "Authorization" = "Bearer $cred" }

    Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://secretmanager. LOCATION 
.rep.googleapis.com/v1/projects/ PROJECT_ID 
/locations/ LOCATION 
/secrets/ SECRET_ID 
/versions/ VERSION_ID 
:destroy" | Select-Object -Expand Content

    You should receive a JSON response similar to the following:

    {
  "name": "projects/ PROJECT_ID 
/locations/ LOCATION 
/secrets/ SECRET_ID 
/versions/ VERSION_ID 
",
  "createTime": "2024-09-02T07:16:34.566706Z",
  "destroyTime": "2024-09-04T06:29:01.893743728Z",
  "state": "DESTROYED",
  "etag": "\"1621454a37ce7f\""
}

    Go

    To run this code, first set up a Go development environment and install the Secret Manager Go SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

      import 
  
 ( 
  
 "context" 
  
 "fmt" 
  
 secretmanager 
  
 "cloud.google.com/go/secretmanager/apiv1" 
  
 "cloud.google.com/go/secretmanager/apiv1/secretmanagerpb" 
  
 "google.golang.org/api/option" 
 ) 
 // destroySecretVersion destroys the given secret version, making the payload 
 // irrecoverable. Other secrets versions are unaffected. 
 func 
  
 DestroyRegionalSecretVersion 
 ( 
 projectId 
 , 
  
 locationId 
 , 
  
 secretId 
 , 
  
 versionId 
  
 string 
 ) 
  
 error 
  
 { 
  
 // name := "projects/my-project/locations/my-location/secrets/my-secret/versions/5" 
  
 // Create the client. 
  
 ctx 
  
 := 
  
 context 
 . 
 Background 
 () 
  
 //Endpoint to send the request to regional server 
  
 endpoint 
  
 := 
  
 fmt 
 . 
 Sprintf 
 ( 
 "secretmanager.%s.rep.googleapis.com:443" 
 , 
  
 locationId 
 ) 
  
 client 
 , 
  
 err 
  
 := 
  
 secretmanager 
 . 
  NewClient 
 
 ( 
 ctx 
 , 
  
 option 
 . 
 WithEndpoint 
 ( 
 endpoint 
 )) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "failed to create regional secretmanager client: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 defer 
  
 client 
 . 
  Close 
 
 () 
  
 name 
  
 := 
  
 fmt 
 . 
 Sprintf 
 ( 
 "projects/%s/locations/%s/secrets/%s/versions/%s" 
 , 
  
 projectId 
 , 
  
 locationId 
 , 
  
 secretId 
 , 
  
 versionId 
 ) 
  
 // Build the request. 
  
 req 
  
 := 
  
& secretmanagerpb 
 . 
 DestroySecretVersionRequest 
 { 
  
 Name 
 : 
  
 name 
 , 
  
 } 
  
 // Call the API. 
  
 if 
  
 _ 
 , 
  
 err 
  
 := 
  
 client 
 . 
 DestroySecretVersion 
 ( 
 ctx 
 , 
  
 req 
 ); 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "failed to destroy regional secret version: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 return 
  
 nil 
 }

    Java

    To run this code, first set up a Java development environment and install the Secret Manager Java SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

      import 
  
 com.google.cloud.secretmanager.v1. SecretManagerServiceClient 
 
 ; 
 import 
  
 com.google.cloud.secretmanager.v1. SecretManagerServiceSettings 
 
 ; 
 import 
  
 com.google.cloud.secretmanager.v1. SecretVersion 
 
 ; 
 import 
  
 com.google.cloud.secretmanager.v1. SecretVersionName 
 
 ; 
 import 
  
 java.io.IOException 
 ; 
 public 
  
 class 
 DestroyRegionalSecretVersion 
  
 { 
  
 public 
  
 static 
  
 void 
  
 main 
 ( 
 String 
 [] 
  
 args 
 ) 
  
 throws 
  
 IOException 
  
 { 
  
 // TODO(developer): Replace these variables before running the sample. 
  
 // Your GCP project ID. 
  
 String 
  
 projectId 
  
 = 
  
 "your-project-id" 
 ; 
  
 // Location of the secret. 
  
 String 
  
 locationId 
  
 = 
  
 "your-location-id" 
 ; 
  
 // Resource ID of the secret. 
  
 String 
  
 secretId 
  
 = 
  
 "your-secret-id" 
 ; 
  
 // Version of the Secret ID you want to destroy. 
  
 String 
  
 versionId 
  
 = 
  
 "your-version-id" 
 ; 
  
 destroyRegionalSecretVersion 
 ( 
 projectId 
 , 
  
 locationId 
 , 
  
 secretId 
 , 
  
 versionId 
 ); 
  
 } 
  
 // Destroy an existing secret version. 
  
 public 
  
 static 
  
  SecretVersion 
 
  
 destroyRegionalSecretVersion 
 ( 
  
 String 
  
 projectId 
 , 
  
 String 
  
 locationId 
 , 
  
 String 
  
 secretId 
 , 
  
 String 
  
 versionId 
 ) 
  
 throws 
  
 IOException 
  
 { 
  
 // Endpoint to call the regional secret manager sever 
  
 String 
  
 apiEndpoint 
  
 = 
  
 String 
 . 
 format 
 ( 
 "secretmanager.%s.rep.googleapis.com:443" 
 , 
  
 locationId 
 ); 
  
  SecretManagerServiceSettings 
 
  
 secretManagerServiceSettings 
  
 = 
  
  SecretManagerServiceSettings 
 
 . 
 newBuilder 
 (). 
 setEndpoint 
 ( 
 apiEndpoint 
 ). 
 build 
 (); 
  
 // Initialize the client that will be used to send requests. This client only needs to be 
  
 // created once, and can be reused for multiple requests. 
  
 try 
  
 ( 
  SecretManagerServiceClient 
 
  
 client 
  
 = 
  
  
  SecretManagerServiceClient 
 
 . 
 create 
 ( 
 secretManagerServiceSettings 
 )) 
  
 { 
  
 // Build the name from the version. 
  
  SecretVersionName 
 
  
 secretVersionName 
  
 = 
  
  
  SecretVersionName 
 
 . 
  ofProjectLocationSecretSecretVersionName 
 
 ( 
  
 projectId 
 , 
  
 locationId 
 , 
  
 secretId 
 , 
  
 versionId 
 ); 
  
 // Destroy the secret version. 
  
  SecretVersion 
 
  
 version 
  
 = 
  
 client 
 . 
 destroySecretVersion 
 ( 
 secretVersionName 
 ); 
  
 System 
 . 
 out 
 . 
 printf 
 ( 
 "Destroyed regional secret version %s\n" 
 , 
  
 version 
 . 
  getName 
 
 ()); 
  
 return 
  
 version 
 ; 
  
 } 
  
 } 
 }

    Node.js

    To run this code, first set up a Node.js development environment and install the Secret Manager Node.js SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

      /** 
 * TODO(developer): Uncomment these variables before running the sample. 
 */ 
 // const name = 'projects/my-project/secrets/my-secret/versions/5'; 
 // 
 // const projectId = 'my-project'; 
 // const locationId = 'my-location'; 
 // const secretId = 'my-secret'; 
 // const version = 'my-version'; 
 const 
  
 name 
  
 = 
  
 `projects/ 
 ${ 
 projectId 
 } 
 /locations/ 
 ${ 
 locationId 
 } 
 /secrets/ 
 ${ 
 secretId 
 } 
 /versions/ 
 ${ 
 version 
 } 
 ` 
 ; 
 // Imports the Secret Manager library 
 const 
  
 { 
 SecretManagerServiceClient 
 } 
  
 = 
  
 require 
 ( 
 ' @google-cloud/secret-manager 
' 
 ); 
 // Adding the endpoint to call the regional secret manager sever 
 const 
  
 options 
  
 = 
  
 {}; 
 options 
 . 
 apiEndpoint 
  
 = 
  
 `secretmanager. 
 ${ 
 locationId 
 } 
 .rep.googleapis.com` 
 ; 
 // Instantiates a client 
 const 
  
 client 
  
 = 
  
 new 
  
  SecretManagerServiceClient 
 
 ( 
 options 
 ); 
 async 
  
 function 
  
 destroySecretVersion 
 () 
  
 { 
  
 const 
  
 [ 
 version 
 ] 
  
 = 
  
 await 
  
 client 
 . 
 destroySecretVersion 
 ({ 
  
 name 
 : 
  
 name 
 , 
  
 }); 
  
 console 
 . 
 info 
 ( 
 `Destroyed 
 ${ 
 version 
 . 
 name 
 } 
 ` 
 ); 
 } 
 destroySecretVersion 
 ();

    Python

    To run this code, first set up a Python development environment and install the Secret Manager Python SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

      # Import the Secret Manager client library. 
 from 
  
 google.cloud 
  
 import 
  secretmanager_v1 
 
 def 
  
 destroy_regional_secret_version 
 ( 
 project_id 
 : 
 str 
 , 
 location_id 
 : 
 str 
 , 
 secret_id 
 : 
 str 
 , 
 version_id 
 : 
 str 
 , 
 ) 
 - 
> secretmanager_v1 
 . 
 DestroySecretVersionRequest 
 : 
  
 """ 
 Destroys the given secret version, making the payload irrecoverable. Other 
 secrets versions are unaffected. 
 """ 
 # Endpoint to call the regional secret manager sever. 
 api_endpoint 
 = 
 f 
 "secretmanager. 
 { 
 location_id 
 } 
 .rep.googleapis.com" 
 # Create the Secret Manager client. 
 client 
 = 
  secretmanager_v1 
 
 . 
  SecretManagerServiceClient 
 
 ( 
 client_options 
 = 
 { 
 "api_endpoint" 
 : 
 api_endpoint 
 }, 
 ) 
 # Build the resource name of the secret version. 
 name 
 = 
 f 
 "projects/ 
 { 
 project_id 
 } 
 /locations/ 
 { 
 location_id 
 } 
 /secrets/ 
 { 
 secret_id 
 } 
 /versions/ 
 { 
 version_id 
 } 
 " 
 # Destroy the secret version. 
 response 
 = 
 client 
 . 
  destroy_secret_version 
 
 ( 
 request 
 = 
 { 
 "name" 
 : 
 name 
 }) 
 print 
 ( 
 f 
 "Destroyed secret version: 
 { 
 response 
 . 
 name 
 } 
 " 
 ) 
 return 
 response

    Delayed destruction of secret versions

    Users with the Secret Manager Admin role can set up delayed destruction of secret versions by configuring the Delay secret version destroy feature on the secret. If this feature is enabled, the secret version isn't immediately destroyed upon request. Instead, the secret version is disabled and scheduled for destruction at a later date. During this time, the Secret Manager Admin can restore the secret version.

    What's next
    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: