Meta tags:
Headings (most frequently used words):
gcloud, rest, cmek, console, disk, with, key, snapshot, and, or, create, from, encrypted, the, resources, on, for, required, permissions, cloud, kms, encrypt, new, vm, remove, revocation, protect, keys, stay, organized, collections, save, categorize, content, based, your, preferences, before, you, begin, encryption, specifications, limitations, manual, automated, creation, persistent, hyperdisk, balanced, in, confidential, mode, an, imported, image, attaching, boot, to, rotate, change, disable, destroy, what, next, roles, manually, ring, impact, of, configure, shutdown, products, pricing, support, engage, this, task,
Text of the page (most frequently used words):
the (691), disk (239), #create (228), key (226), and (164), for (149), cloud (143), compute (140), you (134), snapshot (131), with (122), vms (108), that (97), disks (97), kms (89), use (85), google (75), region (72), projects (70), name (68), zone (64), about (63), new (62), troubleshoot (62), snapshots (61), instance (59), from (57), using (57), encrypted (54), gcloud (51), can (51), image (50), encryption (49), manage (47), project (46), encrypt (45), type (43), cmek (43), your (43), engine (43), following (41), hyperdisk (40), server (39), view (38), images (37), keys (37), configure (36), key_ring (36), zones (35), project_id (35), source (35), storage (35), set (34), resources (33), windows (33), mig (33), post (32), overview (32), change (31), performance (31), locations (30), kms_project_id (30), global (29), managed (29), instances (29), disk_name (29), machine (29), location (28), reservation (27), snapshot_name (26), where (26), this (25), com (25), creation (25), persistent (24), request (24), keyrings (24), cryptokeys (24), https (23), googleapis (23), default (23), when (23), located (23), scoped (23), specify (22), replace (22), regional (22), network (21), method (21), console (21), service (21), sql (21), example (20), management (20), access (20), monitor (20), standard (19), attached (19), used (19), update (19), boot (18), want (18), rest (18), kmskeyname (18), linux (18), custom (18), confidential (18), gpu (18), are (17), command (17), shutdown (17), creating (17), enable (17), policies (16), mode (16), configuration (16), data (16), apply (16), remove (16), reservations (16), see (15), more (15), revocation (15), select (15), rotate (15), virtual (15), groups (15), ssh (15), recommendations (15), down (14), information (14), insert (14), sole (14), agent (14), regions (14), updatekmskey (14), optional (14), ring (14), contains (14), workload (14), host (14), load (14), connect (14), stop (13), include (13), protect (13), regionally (13), delete (13), balanced (13), bulk (13), microsoft (13), cluster (13), permissions (12), resource (12), workloads (12), volumes (12), add (12), choose (12), availability (12), best (12), must (11), customer (11), cli (11), property (11), uses (11), running (11), version (11), flag (11), click (11), existing (11), import (11), settings (11), types (11), roles (11), based (11), practices (11), stateful (11), debian (10), required (10), security (10), zonal (10), diskencryptionkey (10), customized (10), manually (10), time (10), instant (10), multiple (10), install (10), metadata (10), migs (10), machines (10), migrate (10), logs (10), all (9), page (9), template (9), created (9), templates (9), networking (9), disable (9), same (9), new_key_name (9), only (9), multi (9), tpu (9), h4d (9), application (9), licenses (9), tenant (9), openshift (9), start (9), hpc (9), samples (8), license (8), properties (8), construct (8), policy (8), includes (8), note (8), during (8), owned (8), different (8), one (8), operation (8), key_project_id (8), disk_type (8), snapshot_type (8), source_disk_name (8), backup (8), source_image (8), role (8), authentication (8), run (8), cpu (8), login (8), optimize (8), internal (8), disaster (8), recovery (8), high (8), guest (8), flexibility (8), dns (8), optimized (8), thumb (7), other (7), send (7), sourceimage (7), section (7), tenancy (7), automatically (7), then (7), such (7), encrypting (7), instead (7), migration (7), get (7), operations (7), globally (7), predefined (7), source_zone (7), services (7), demand (7), across (7), local (7), usage (7), commitments (7), startup (7), balancing (7), benchmark (7), idle (7), addresses (7), scale (7), deploy (7), back (7), mysql (7), maintenance (7), events (6), code (6), understand (6), need (6), under (6), details (6), after (6), configured (6), true (6), revoked (6), not (6), have (6), between (6), iam (6), copy (6), process (6), api (6), preview (6), operating (6), don (6), number (6), ssd (6), parameter (6), snapshot_scope_region (6), storage_location (6), snapshot_key (6), key_region (6), owns (6), hsm (6), accounts (6), errors (6), identity (6), apis (6), options (6), updates (6), files (6), nested (6), gpus (6), applications (6), group (6), pools (6), failover (6), extension (6), transfer (6), spot (6), action (5), system (5), shut (5), attach (5), external (5), will (5), machine_type (5), prevent (5), also (5), perform (5), archive (5), runs (5), list (5), sourcesnapshot (5), source_region (5), image_name (5), file (5), override (5), make (5), environment (5), how (5), monitoring (5), databases (5), future (5), drivers (5), virtualization (5), nvidia (5), placement (5), node (5), highly (5), available (5), build (5), modify (5), capacity (5), schedules (5), audit (5), symphony (5), email (5), scripts (5), manager (5), systems (5), enhanced (5), capabilities (5), restore (5), control (5), workstation (5), faq (5), flex (5), português (4), español (4), sign (4), support (4), machinetype (4), initializeparams (4), keyrevocationactiontype (4), menu (4), vm_name (4), within (4), destroy (4), automatic (4), which (4), these (4), rotation (4), beta (4), full (4), either (4), yyyyyyyyyyyyy (4), yyyyyyyy (4), schedule (4), device (4), disktypes (4), supports (4), storagelocations (4), source_project_id (4), destination_project_id (4), bullseye (4), v20231115 (4), size (4), autokey (4), manual (4), online (4), generation (4), infrastructure (4), cmeks (4), has (4), documentation (4), grant (4), account (4), permission (4), development (4), authenticate (4), provider (4), plan (4), through (4), tools (4), distributed (4), issues (4), ubuntu (4), bandwidth (4), tcp (4), pmu (4), share (4), upgrade (4), live (4), autoscaling (4), cross (4), requests (4), calendar (4), single (4), metrics (4), health (4), active (4), clusters (4), containers (4), container (4), database (4), postgresql (4), extensions (4), work (4), suspend (4), resize (4), graceful (4), plans (4), replication (4), review (4), bound (4), terms (3), status (3), content (3), its (3), apache (3), networks (3), define (3), expand (3), begin (3), alternatively (3), machinetypes (3), restart (3), helps (3), revoke (3), setting (3), enabled (3), shuts (3), disabling (3), effects (3), any (3), was (3), follow (3), steps (3), help (3), provide (3), protecting (3), dek (3), doesn (3), versions (3), value (3), format (3), directory (3), reference (3), continue (3), specified (3), snapshot_project_id (3), enter (3), imported (3), because (3), store (3), sourcedisk (3), snapshottype (3), snapshotencryptionkey (3), alternative (3), event (3), unless (3), enableconfidentialcompute (3), provisioned (3), throughput (3), provisioning (3), cloning (3), clones (3), first (3), decrease (3), latency (3), failure (3), user (3), project_number (3), credentials (3), guides (3), observability (3), analytics (3), troubleshooting (3), pro (3), serial (3), configurations (3), patterns (3), higher (3), discounts (3), cuds (3), scalable (3), resilient (3), autoscale (3), balancer (3), testing (3), ibm (3), spectrum (3), deploying (3), prepare (3), deployment (3), rhel (3), certificates (3), query (3), state (3), increase (3), lifecycle (3), design (3), non (3), pool (3), move (3), workstations (3), series (3), tpus (3), product (3), 한국어 (2), 日本語 (2), עברית (2), brasil (2), italiano (2), indonesia (2), français (2), américa (2), latina (2), deutsch (2), english (2), third (2), site (2), youtube (2), center (2), started (2), pricing (2), products (2), last (2), updated (2), 2026 (2), utc (2), otherwise (2), licensed (2), feedback (2), learn (2), next (2), instancetemplates (2), networkinterfaces (2), family (2), body (2), fields (2), open (2), protected (2), public (2), hours (2), deleting (2), reverse (2), preceding (2), impact (2), still (2), until (2), decrypt (2), contents (2), encrypts (2), requirements (2), without (2), response (2), represents (2), progress (2), operation_name (2), reduce (2), methods (2), resizing (2), form (2), disk_alias (2), shown (2), supplied (2), imageencryptionkey (2), compressed (2), source_disk (2), drop (2), before (2), recommends (2), features (2), createsnapshot (2), stored (2), allowed (2), defined (2), choice (2), volume (2), indicate (2), fails (2), able (2), accidental (2), deletion (2), task (2), similarly (2), computing (2), iops (2), assign (2), replica (2), rings (2), provision (2), they (2), deleted (2), bare (2), metal (2), offline (2), were (2), spread (2), west1 (2), own (2), limitations (2), additional (2), specifications (2), related (2), administrator (2), might (2), ensure (2), cloudkms (2), cryptokeyencrypterdecrypter (2), gserviceaccount (2), already (2), idp (2), federated (2), supported (2), owner (2), serviceusage (2), sdk (2), languages (2), frameworks (2), costs (2), industry (2), solutions (2), hybrid (2), multicloud (2), pipelines (2), hosting (2), quota (2), commitment (2), consumption (2), registration (2), sles (2), export (2), port (2), collecting (2), nodes (2), report (2), arm (2), core (2), rdp (2), general (2), app (2), analyze (2), visible (2), cores (2), committed (2), underutilized (2), insights (2), utilization (2), web (2), autohealing (2), iis (2), shared (2), reserve (2), autoscaler (2), autoscalers (2), activity (2), kubernetes (2), place (2), redis (2), writer (2), always (2), alwayson (2), synchronization (2), switch (2), byol (2), payg (2), byos (2), changes (2), families (2), guide (2), securing (2), simulate (2), topology (2), together (2), repairs (2), repair (2), check (2), failures (2), suspended (2), stopped (2), target (2), distribution (2), physical (2), cancel (2), once (2), limit (2), interfaces (2), ipv6 (2), static (2), basic (2), consistent (2), appliances (2), asynchronous (2), names (2), mount (2), memory (2), extreme (2), organization (2), advanced (2), rdma (2), specific (2), preemptible (2), models (2), rtx (2), vws (2), constraints (2), accelerator (2), technology (2), areas (2), close (2), subscribe, newsletter, our, decade, climate, join, cookies, privacy, tech, twitter, blog, engage, training, certification, architecture, getting, github, release, notes, community, forums, contact, sales, marketplace, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, sample, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, except, noted, java, registered, trademark, oracle, affiliates, developers, creative, commons, attribution, what, accessconfigs, one_to_one_nat, read_write, explicitly, minimal, looks, like, instance_template_name, image_project, machine_type_zone, creates, again, does, helping, enabling, cannot, protects, affected, follows, accessible, trigger, there, delay, hour, usable, decrypting, may, order, destroying, quickly, longer, removing, referred, revoking, currently, primary, containing, new_kms_key, changing, meet, compliance, downtime, rotating, previous, succeeded, 100, poll, determine, call, successful, making, item, patch, potential, consequences, being, compromised, recommend, regular, unique, alias, mounting, chooses, assigned, field, applicable, dev, devicename, yes, attaching, partial, url, reside, rawdisk, http, tar, sourcetype, raw, uri, upload, compress, try, won, original, capture, clean, failsafe, unsuccessful, caution, incremental, well, convert, completely, n2d, isn, standalone, replicas, two, specifying, supplying, described, simplifies, managing, automating, assignment, ahead, generated, part, automated, a4x, c4a, c4d, fourth, second, unsupported, recommended, approach, prevents, cases, depend, domains, geographical, terminated, ensures, isolation, increases, reliability, working, them, hardware, backed, enclaves, aes, 256, itself, give, exact, necessary, ask, granting, folders, organizations, correct, principal, result, important, cryptokey, encrypter, decrypter, even, binding, member, serviceaccount, haven, verifies, selecting, installed, previously, sure, latest, components, init, installation, initialize, tab, case, reviewing, relevant, likely, admin, serviceusageadmin, decide, whether, going, ids, numbers, identifying, document, provides, known, save, categorize, preferences, stay, organized, collections, home, concurrent, renewal, nvme, common, pay, viewing, output, diagnostic, sudoers, screenshots, generate, bug, blackwell, soft, lockups, bus, locks, rescue, inaccessible, dumps, kernel, panic, fstab, unresponsive, suspension, reboots, shutdowns, connectivity, tips, nics, dpdk, improve, resiliency, communication, compact, idpf, interface, irdma, driver, nic, customize, threads, per, sustained, merge, split, extend, renew, purchase, cost, savings, dynamic, overcommit, cpus, floating, reliable, udp, backends, routing, scaling, consuming, consume, combine, cud, allow, sharing, decisions, signals, serving, predictions, organize, labels, states, observe, reports, tensorflow, inference, tensorrt5, learning, monte, carlo, spark, forwarding, others, integrate, clustering, exchange, 2016, sharepoint, strategies, passive, inactive, setups, built, integrations, validation, deployed, transition, test, hammerdb, bucket, aws, ec2, pacemaker, s2d, block, netapp, hot, standby, drbd, architectures, client, private, address, mailjet, mailgun, sendgrid, sending, blue, green, deployments, lamp, joomla, asp, net, interactive, mongodb, flask, terraform, servers, over, mtls, random, generator, virtio, rng, accurate, protocol, ntp, append, els, restrictions, packages, deprecate, trusted, red, hat, knowledgebase, functionality, risks, vpc, controls, kek, secure, expiration, shielded, attributes, handle, notices, faulty, unmanaged, affect, preserved, turn, off, alternate, repairing, maintain, upgrades, selectively, applying, accelerate, out, outage, rebalance, reenable, proactive, redistribution, shape, distribute, info, edit, rename, reset, resume, referrers, uuid, recover, corrupted, duplicate, alerts, backups, vss, protection, considerations, synchronous, consistency, failback, replicate, limits, evaluate, symbolic, links, practice, ram, exapools, verify, ptr, record, rates, tags, restrict, automate, password, require, powershell, sac, securely, apps, root, vpn, bastion, iap, connection, browser, connections, iso, prerequisites, importing, exporting, bring, path, detach, reattach, constraint, accounting, examples, slurm, reserved, team, slice, slices, adds, scenarios, deterministic, base, ready, aci, preempted, historical, similar, displays, ops, logging, subnet, gpudirect, ultra, minimum, platform, hostname, quickstarts, office, licensing, premium, strategy, gemini, accelerators, platforms, scores, purpose, discover, free, skip, main,
Text of the page (random words):
ate a disk from a snapshot encrypted with cmek to create a new disk from an encrypted snapshot do the following console in the google cloud console go to the disks page go to disks click create disk and enter the properties for the new disk for source type select the snapshot or image you want to use optional if you want to specify a new encryption key for encryption specify the type of encryption key to use and then provide the encryption key information if you want to remove the customer managed or customer supplied encryption key for encryption use the default value google managed encryption key continue with the disk creation process gcloud to create a new disk from a globally scoped encrypted snapshot use the gcloud compute disks create command gcloud compute disks create disk_name zone zone source snapshot snapshot_name kms key projects kms_project_id locations region keyrings key_ring cryptokeys key preview to create a new disk from a regionally scoped encrypted snapshot use the gcloud compute disks create command and specify the source snapshot region gcloud compute disks create disk_name zone zone source snapshot snapshot_name source snapshot region source_region kms key projects kms_project_id locations region keyrings key_ring cryptokeys key replace the following disk_name the name of the new disk snapshot_name the name of the encrypted snapshot to use an image instead of a snapshot replace source snapshot snapshot_name with image image_name kms_project_id optional the project that contains the cloud kms key region optional the region the cloud kms key is located in source_region the region that the source snapshot is scoped to zone the zone where the new disk will reside key_ring optional the key ring that contains the cloud kms key key optional the name of the cloud kms key to use to encrypt the new disk to encrypt the new disk you can do one of the following to specify a new customer managed encryption key use the kms key flag to use the default google owned and google managed encryption key don t include the kms key flag rest to create a new disk from a globally scoped encrypted snapshot construct a post request to the compute disks insert method use the sourcesnapshot property to specify the snapshot post https compute googleapis com compute v1 projects project_id zones zone disks name disk_name sourcesnapshot projects snapshot_project_id global snapshots snapshot_name diskencryptionkey kmskeyname projects kms_project_id locations region keyrings key_ring cryptokeys key preview to create a new disk from a regionally scoped encrypted snapshot construct a post request to the compute disks insert method use the sourcesnapshot property to specify the snapshot post https compute googleapis com compute v1 projects project_id zones zone disks name disk_name sourcesnapshot projects snapshot_project_id regions source_region snapshots snapshot_name type projects project_id zones zone disktypes disk_type zone projects project_id zones zone diskencryptionkey kmskeyname projects kms_project_id locations region keyrings key_ring cryptokeys key replace the following project_id the project to create the new disk in zone the zone to create the new disk in source_region the region that the source snapshot is scoped to disk_name the name of the new disk disk_type the full or partial url for the type of the disk for example project_id zones zone disktypes pd ssd snapshot_project_id the project that contains the snapshot snapshot_name the name of the encrypted snapshot to use an image instead of a snapshot replace sourcesnapshot with sourceimage kms_project_id optional the project that contains the cloud kms key region optional the region the cloud kms key is located in key_ring optional the key ring that contains the cloud kms key key optional the name of the cloud kms key to use to encrypt the new disk if you include diskencryptionkey then the disk is encrypted with the specified cloud kms key if you don t include diskencryptionkey then the disk is encrypted using a google owned and google managed encryption key attaching a boot disk encrypted with cmek to a new vm console in the google cloud console go to the create an instance page go to create an instance specify the vm details and in the boot disk section click change then do the following click existing disks in the disk list select an existing disk to attach to the vm click select continue with the vm creation process gcloud to attach an encrypted disk when you create a new vm use the gcloud compute instances create command use the disk flag to specify the encrypted boot disk as shown in the following example gcloud compute instances create vm_name disk name disk_name boot yes replace the following vm_name the name of the vm you are creating disk_name the name of the encrypted disk rest construct a post request to the compute instances insert method use the disks property to specify the encrypted boot disk as shown in the following example post https compute googleapis com compute v1 projects project_id zones zone instances disks devicename disk_alias source projects project_id zones zone disks disk_name replace the following project_id the project to create the new vm in zone the zone to create the new vm in disk_alias a unique device name to use as the disk alias in the dev disk by id google directory of vm that runs a linux operating system this name can be used to reference the disk for operations such as mounting or resizing from within the instance if you don t specify a device name the vm chooses a default device name to apply to this disk in the form persistent disk x where x is a number assigned by compute engine this field is only applicable for persistent disk volumes disk_name the name of the encrypted disk rotate the cmek for a disk or snapshot to reduce the potential consequences of your key being compromised we recommend that you rotate cloud kms encryption keys on a regular schedule using one of the following methods gcloud to rotate the cloud kms key that s used to encrypt a disk an archive snapshot or a standard snapshot to a new key version use the gcloud compute disks update kms key command or gcloud compute snapshots update kms key command to rotate the key version encrypting a disk gcloud compute disks update kms key disk_name zone zone to rotate the key version encrypting a standard snapshot gcloud compute snapshots update kms key snapshot_name replace the following disk_name the name of the encrypted disk zone the zone where the encrypted disk is located snapshot_name the name of the encrypted snapshot rest to rotate the cloud kms key that s used to encrypt a disk archive snapshot or standard snapshot to a new key version construct a patch request to the compute disks updatekmskey method or compute snapshots updatekmskey method to rotate the key version encrypting a zonal disk post https compute googleapis com compute v1 projects project_id zones zone disks disk_name updatekmskey to rotate the key version encrypting a regional disk post https compute googleapis com compute v1 projects project_id regions region disks disk_name updatekmskey to rotate the key version encrypting a globally scoped standard snapshot post https compute googleapis com compute v1 projects project_id global snapshots snapshot_name updatekmskey preview to rotate the key version encrypting a regionally scoped standard snapshot post https compute googleapis com compute v1 projects project_id regions region snapshots snapshot_name updatekmskey replace the following project_id the project where the encrypted disk or snapshot is located zone the zone where the encrypted disk is located region the region where the regional disk or regionally scoped snapshot is located disk_name the name of the encrypted disk snapshot_name the name of the encrypted snapshot region the region where the regional disk or regionally scoped snapshot is located the response will include a name item with an operation value that represents the key rotation name operation yyyyyyyyyyyyy yyyyyyyyyyyyy yyyyyyyy yyyyyyyy you can then poll the status for the operation to determine if your api call was successful by making a get request get https compute googleapis com compute v1 projects project_id zones zone operations operation_name replace the following project_id the project where the encrypted disk or snapshot is located zone the zone where the encrypted disk is located operation_name the name of the cmek rotation operation in the format operation yyyyyyyyyyyyy yyyyyyyyyyyyy yyyyyyyy yyyyyyyy the response will include a progress value that represents the status of the key rotation when progress is 100 the operation succeeded rotating keys doesn t disable or delete previous key versions for more information see after you rotate keys change the cmek for a disk or snapshot you can change the encryption of a disk an archive snapshot or a standard snapshot to a different cmek for example during a project migration or to meet new compliance requirements without downtime changing the cmek re encrypts the resource s data encryption key dek with the new key this process doesn t change the dek and doesn t impact performance on running workloads to change the cloud kms key you can use either the gcloud cli or rest gcloud to change the cloud kms key for a disk or standard snapshot use the kms key flag with the gcloud compute disks update kms key command or gcloud compute snapshots update kms key command to change the key for a zonal disk gcloud compute disks update kms key disk_name kms key projects key_project_id locations global keyrings key_ring cryptokeys new_key_name zone zone to change the key for a regional disk gcloud compute disks update kms key disk_name kms key projects key_project_id locations global keyrings key_ring cryptokeys new_key_name region region to change the key for a global snapshot gcloud compute snapshots update kms key snapshot_name kms key projects key_project_id locations global keyrings key_ring cryptokeys new_key_name to change the key for a regionally scoped snapshot gcloud beta compute snapshots update kms key snapshot_name kms key projects key_project_id locations global keyrings key_ring cryptokeys new_key_name regions region replace the following disk_name the name of the encrypted disk new_kms_key the full resource id of the new cmek zone the zone where the disk is located region the region where the disk or snapshot is located snapshot_name the name of the encrypted snapshot rest to change the key send a post request to the compute disks updatekmskey method or compute snapshots updatekmskey method and include the kmskeyname in the request body to change the key for a zonal disk post https compute googleapis com compute v1 projects project_id zones zone disks disk_name updatekmskey kmskeyname projects key_project_id locations global keyrings key_ring cryptokeys new_key_name to change the key for a regional disk post https compute googleapis com compute v1 projects project_id regions region disks disk_name updatekmskey kmskeyname projects key_project_id locations global keyrings key_ring cryptokeys new_key_name to change the key for a global snapshot post https compute googleapis com compute v1 projects project_id global snapshots snapshot_name updatekmskey kmskeyname projects key_project_id locations global keyrings key_ring cryptokeys new_key_name to change the key for a regionally scoped snapshot post https compute googleapis com compute beta projects project_id regions region snapshots snapshot_name updatekmskey kmskeyname projects key_project_id locations global keyrings key_ring cryptokeys new_key_name replace the following project_id the project containing the disk or snapshot zone the zone where the disk is located region the region where the disk or snapshot is located disk_name the name of the disk new_key_name the name of the new cmek snapshot_name the name of the encrypted snapshot note if you provide the same cmek that s currently protecting the resource the operation will perform a version rotation to the key s primary version remove the cmek from a disk you can t remove a cmek from a disk or change the encryption key s type you can do one of the following change the disk to use a different cmek decrypt the contents of a cmek encrypted disk and create a new disk that uses google cloud default encryption instead by default google cloud encrypts all data at rest to create a disk that uses google owned and managed key from a cmek encrypted disk follow these steps create a snapshot of the encrypted disk use the new encrypted snapshot to create a new disk after you create the new disk it uses google cloud default encryption to help protect the disk contents any snapshots that you create from that disk must also use default encryption remove the cmek from a snapshot you can t remove a cmek from a snapshot or change the encryption key s type you can change the snapshot to use a different cmek or create a copy of the snapshot and encrypt the copy with a google owned and managed key to create a snapshot that uses google owned and managed key from a cmek encrypted snapshot follow these steps create a new disk from the snapshot when you create the new disk select the encryption type that you want create a snapshot of the new disk if the new disk is encrypted with a cmek see create a disk from a snapshot encrypted with cmek if the new disk is encrypted with a google owned and managed key see create disk snapshots disable or destroy a cmek if you no longer need a cmek or want to prevent its use disable or destroy the key deleting disabling or removing iam permissions on a key is also referred to as revoking the key note there is a delay of up to an hour between when you disable or destroy the key during which it is still usable for encrypting and decrypting data you may disable the compute engine service agent used to encrypt and decrypt keys in order to apply the effects of disabling or destroying a key more quickly note if a disk was attached to a vm when you revoked the disk s encryption key the disk is still accessible from the vm until the vm shuts down to trigger the automatic shutdown of vms that are attached to such disks enable vm shutdown on key revocation impact of key revocation on encrypted resources when you revoke an encryption key resources that the key protects are affected as follows you can t boot a vm if any of its attached disks have revoked keys if a disk that uses the key is attached to a running vm and you enabled vm shutdown on key revocation for the vm then compute engine shuts down the vm within 7 hours you can t attach a disk with a revoked key to a vm or create a snapshot from the disk you can t use images or snapshots that are encrypted with revoked keys to create disks if you disable the key you can reverse the preceding effects by enabling the key if you destroy the key you cannot reverse the preceding effects configure vm shutdown on clo...
|
