Clean up access

Google Cloud Console

1. Go to the Cryptographic Keyspage in the Google Cloud console.

   Go to the Cryptographic Keys page

2. Click the name of the key ring that contains the key used in Prepare the Cloud KMS key .

3. Select the checkbox for the key whose access you are revoking from the service account.

4. Click Show Info Panel.

   The information panel is displayed.

5. To revoke the Cloud KMS CryptoKey Decrypterrole from the service account, do the following:

   1. In the Permissionstab, expand Cloud KMS CryptoKey Decrypter.

   2. Locate the service account. It looks like the following example:

      service- PROJECT_ID @gcp-sa-transferappliance.iam.gserviceaccount.com

      In this example, PEOJECT_ID is the Google Cloud project ID that your key is under.

   3. Click delete Delete.

   4. In the delete window, select the service account and click Remove.

6. To revoke the Cloud KMS CryptoKey Public Key Viewerrole from the service account, do the following:

   1. In the Permissionstab, expand the Cloud KMS CryptoKey Public Key Viewerrole.

   2. Locate the session service account. It looks like the following example:

      service- PROJECT_ID @gcp-sa-transferappliance.iam.gserviceaccount.com

      In this example, PEOJECT_ID is the Google Cloud project ID that your key is under.

   3. Click delete Delete.

   4. In the delete window, select the checkbox next to the service account and click Remove.

Command line

1. Run the following command to revoke the roles/cloudkms.cryptoKeyDecrypterrole from the session service account:

   gcloud kms keys remove-iam-policy-binding KEY 
   \
     --keyring KEY_RING 
   \
     --location LOCATION 
   \
     --member=serviceAccount:service- PROJECT_ID 
   @gcp-sa-transferappliance.iam.gserviceaccount.com \
     --role roles/cloudkms.cryptoKeyDecrypter

   In this example:

   • KEY : The name of the Cloud Key Management Service key. For example, ta-key .
   • KEY_RING : The key ring's name.
   • LOCATION : The Cloud Key Management Service location for the key ring. For example, global .
   • PROJECT_ID : The Google Cloud project ID that your key is under.

2. Run the following command to revoke the roles/cloudkms.publicKeyViewerrole from the session service account:

   gcloud kms keys remove-iam-policy-binding KEY 
   \
     --keyring KEY_RING 
   \
     --location LOCATION 
   \
     --member=serviceAccount:service- PROJECT_ID 
   @gcp-sa-transferappliance.iam.gserviceaccount.com \
     --role roles/cloudkms.publicKeyViewer

   In this example:

   • KEY : The name of the Cloud Key Management Service key. For example, ta-key .
   • KEY_RING : The key ring's name.
   • LOCATION : The Cloud Key Management Service location for the key ring. For example, global .
   • PROJECT_ID : The Google Cloud project ID that your key is under.

Google Cloud Console

1. In the Google Cloud console, go to the Cloud Storage Buckets page.
   

   Go to Buckets

2. Locate the Cloud Storage bucket that your data was copied to and select the checkbox next to the bucket name.

3. Click Show Info Panel.

   The information panel is displayed.

4. In the Permissionstab, expand Storage Admin Role.

5. Locate the associated service accounts. There will be from 2 to 4 accounts depending on your configuration. Service accounts are described in Service account quick reference .

   For each service account:

   1. Click delete Delete.

   2. To confirm deletion, select the checkbox next to the service account and click Remove.

Command line

Use the gcloud storage buckets remove-iam-policy-binding command:

gcloud storage buckets remove-iam-policy-binding gs:// BUCKET_NAME 
\
--member=serviceAccount:ta- SESSION_ID 
@transfer-appliance-zimbru.iam.gserviceaccount.com \
--role=roles/storage.admin

gcloud storage buckets remove-iam-policy-binding gs:// BUCKET_NAME 
\
--member=serviceAccount:project- IDENTIFIER 
@storage-transfer-service.iam.gserviceaccount.com \
--role=roles/storage.admin

You may have additional service accounts, depending on your configuration. Refer to the Service account quick reference for details.

In this example:

• SESSION_ID : The session ID for this particular transfer.
• IDENTIFIER : A generated number specific to this particular project.
• BUCKET_NAME : The name of your Cloud Storage bucket.

Google Cloud Console

1. Go to the Cryptographic Keyspage in the Google Cloud console.

   Go to the Cryptographic Keys page

2. Click the name of the key ring used to Prepare the Cloud KMS key .

3. Locate the row that contains the key you are destroying.

4. Select more_vert More > Destroy.

   A confirmation dialog is displayed.

5. In the confirmation dialog, click Schedule destruction.

Command line

Use the gcloud kms keys version destroy command:

gcloud kms keys versions destroy VERSION_NUMBER 
--keyring= KEY_RING 
\
--key= KEY 
--location= LOCATION 
\
--project= PROJECT_ID 

In this example:

• VERSION_NUMBER : The key's version number.
• KEY_RING : The name of your key ring.
• KEY : The name of your asymmetric key.
• LOCATION : The Google Cloud location of the key ring.
• PROJECT_ID : The Google Cloud project ID that your key is under.