Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Managing key versions

Written by
Updated at September 21, 2026
View in Markdown

You can make key versions primary (a primary key version is used for encryption and decryption by default) and destroy them. To create a new key version, rotate the key.

Making a version primary

Note

Updating the primary version of a key is an eventually consistent operation. Changes resulting from such operations take effect with a delay of up to three hours.

To make a version primary:

  1. In the management console, select the folder.
  2. Navigate to Key Management Service.
  3. In the left-hand panel, select Symmetric keys.
  4. Click the key in the list to open its attribute page.
  5. In the version row, click and select Make primary.

  1. Get a list of versions for the key:

    yc kms symmetric-key list-versions example-key

    Result:

    +----------------------+---------+--------+-----------+
|          ID          | PRIMARY | STATUS | ALGORITHM |
+----------------------+---------+--------+-----------+
| abjhduu82ao0******** | true    | ACTIVE | AES_128   |
| abj8cvn99nam******** | false   | ACTIVE | AES_128   |
| abjed9ciau8e******** | false   | ACTIVE | AES_256   |
| abjvejjvfktq******** | false   | ACTIVE | AES_128   |
+----------------------+---------+--------+-----------+

  2. Change the key version, specifying the version ID you need:

    yc kms symmetric-key set-primary-version example-key-1 \
  --version-id abj8cvn99nam********

Use the setPrimaryVersion REST API method for the SymmetricKey resource or the SymmetricKeyService/SetPrimaryVersion gRPC API call.

The next encryption or decryption request that does not specify a particular key version will use the new primary version.

Destroying a key version

You cannot destroy a key version right away; you can only schedule its destruction for the next day or later.

Alert

At the scheduled time and date, the key version is permanently destroyed. If you still have any data encrypted with this key version, you will not be able to decrypt it.

To destroy a version:

  1. In the management console, select the folder.
  2. Navigate to Key Management Service.
  3. In the left-hand panel, select Symmetric keys.
  4. Click the key in the list to open its attribute page.
  5. In the version row, click and select Schedule destruction.

The version will change its status to Scheduled for destruction, and the Destruction date column will show the scheduled destruction date.

To destroy a version:

  1. Get a list of versions for the key:

    yc kms symmetric-key list-versions example-key

    Result:

    +----------------------+---------+--------+-----------+
|          ID          | PRIMARY | STATUS | ALGORITHM |
+----------------------+---------+--------+-----------+
| abj8cvn99nam******** | true    | ACTIVE | AES_128   |
| abjed9ciau8e******** | false   | ACTIVE | AES_256   |
| abjhduu82ao0******** | false   | ACTIVE | AES_128   |
| abjvejjvfktq******** | false   | ACTIVE | AES_128   |
+----------------------+---------+--------+-----------+

  2. Schedule the destruction of the version:

    yc kms symmetric-key schedule-version-destruction example-key \
  --version-id abjed9ciau8e********

    The version will change its status to SCHEDULED_FOR_DESTRUCTION, and the destroy_at field will show the scheduled destruction time.

Use the scheduleVersionDestruction REST API method for the SymmetricKey resource or the SymmetricKeyService/ScheduleVersionDestruction gRPC API call.

Note

Scheduling key version destruction is an eventually consistent operation. Changes resulting from such operations take effect with a delay of up to three hours.

Canceling version destruction

If you scheduled the destruction of a key version, you can cancel it before the scheduled date:

  1. In the management console, select the folder.
  2. Navigate to Key Management Service.
  3. In the left-hand panel, select Symmetric keys.
  4. Click the key in the list to open its attribute page.
  5. In the version row, click and select Cancel destruction.

The version status will revert to Active.

  1. Get a list of versions for the key:

    yc kms symmetric-key list-versions example-key

    Result:

    +----------------------+---------+---------------------------+-----------+
|          ID          | PRIMARY |          STATUS           | ALGORITHM |
+----------------------+---------+---------------------------+-----------+
| abj8cvn99nam******** | true    | ACTIVE                    | AES_128   |
| abjed9ciau8e******** | false   | SCHEDULED_FOR_DESTRUCTION | AES_256   |
| abjhduu82ao0******** | false   | ACTIVE                    | AES_128   |
| abjvejjvfktq******** | false   | ACTIVE                    | AES_128   |
+----------------------+---------+---------------------------+-----------+

  2. Cancel the destruction of the version:

    yc kms symmetric-key cancel-version-destruction example-key \
  --version-id abjed9ciau8e********

    The version status will revert to ACTIVE.

Use the cancelVersionDestruction REST API method for the SymmetricKey resource or the SymmetricKeyService/CancelVersionDestruction gRPC API call.

Previous
Key
Next
Data encryption