A key version has a state:
Pending generation (
PENDING_GENERATION): (Applies to asymmetric keys only.) This key version is still being generated. It may not be used, enabled, disabled, or destroyed yet. Cloud Key Management Service will automatically change the state to enabled as soon as the version is ready.Pending import (
PENDING_IMPORT): (Applies to imported keys only.) This key version is still being imported. It may not be used, enabled, disabled, or destroyed yet. Cloud Key Management Service will automatically change the state to enabled as soon as the version is ready.Enabled (
ENABLED): The key version is ready for use.Disabled (
DISABLED): This key version may not be used, but the key material is still available, and the version can be re-enabled.Scheduled for destruction (
DESTROY_SCHEDULED): This key version is scheduled for destruction and will be destroyed soon. While a key version is in this state, it can't be used for cryptographic operations, and requests to use the key fail. The key version can be restored into the disabled state within the scheduled destruction period. This state corresponds with Stage 2 - Soft Deletion in the data deletion pipeline.Destroyed (
DESTROYED): This key version is destroyed, and the key material is no longer stored in Cloud KMS. If the key version was used for asymmetric or symmetric encryption, any ciphertext encrypted with this version is not recoverable. If the key version was used for digital signing, new signatures cannot be created. Additionally, for all asymmetric key versions, the public key is no longer available for download. A key version may not leave the destroyed state once entered, except when re-imported. This state corresponds with Stage 3 - Logical Deletion from Active Systems in the data deletion pipeline, meaning key material is deleted from all active Cloud KMS systems. It takes 45 days from destruction time for key material to be deleted from all Google active and backup systems. See Cloud KMS's deletion timeline for more information.Import failed (
IMPORT_FAILED): This key version could not be imported. See Troubleshooting failed imports for additional information about the conditions that cause import failures.
Changing states of a key version
The following describes how a key version can change states: