Google Cloud offers two organization policy constraints to set key version destruction policy across an organization:
constraints/cloudkms.minimumDestroyScheduledDurationis used to set a minimum length for the scheduled for destruction duration for new keys within the organization.constraints/cloudkms.disableBeforeDestroyis used to require that a key version has been disabled before it can be scheduled for destruction.
Before you begin
The instructions on this page assume that you're familiar with using constraints and that you have the required resources and roles.