Question

A security engineer at a fintech company accidentally scheduled the destruction of a Cloud KMS symmetric key version that still encrypts several active BigQuery datasets and Cloud Storage objects. The destruction was initiated 6 hours ago. The engineer needs to prevent permanent data loss while following the least-disruptive supported recovery path. What should the engineer do?

Accepted Answer

Immediately restore the key version using the Cloud KMS restore operation, since scheduled destruction has a default 24-hour waiting period before the version is permanently destroyed.

Answer

Create a new key version, re-encrypt all affected datasets and objects with the new version, and let the scheduled version be destroyed.

Answer

Open a support case with Google Cloud to recover the key material from Google's escrow copy after it has been destroyed.

Answer

Import a copy of the destroyed key material back into the key ring using the Cloud KMS import job before the destruction completes.