[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Cloud KMS resource consistency\n\nThis document provides information about the impact of consistency when\nCloud KMS resources are created or modified.\n\nSome operations to Cloud Key Management Service resources are strongly consistent,\nwhile others are eventually consistent. Eventually consistent operations\ntypically propagate within 1 minute, but may take several hours in exceptional\ncases.\n| **Note:** Fast \"eventually consistent\" operations are in **Preview**, meaning there may be times where operations become consistent in a time longer than what is documented.\n\nConsistency of key rings\n------------------------\n\nCreating a key ring is a strongly consistent operation. Upon creation, a key\nring is instantly available for use.\n\nConsistency of keys\n-------------------\n\nCreating a key is a strongly consistent operation. Upon creation, a key is\ninstantly available for use.\n\nConsistency of key versions\n---------------------------\n\nEnabling a key version is a strongly consistent operation. The enabled key\nversion is instantly available for encrypting and decrypting data.\n\nDisabling a key version is an eventually consistent operation. The key\nversion typically remains usable for encrypting and decrypting data for\nup to 1 minute after it is disabled. In exceptional cases, the key version\nremains usable for several hours after it is disabled. See the\n[Service Health dashboard](https://status.cloud.google.com/) for\nCloud KMS data freshness issues.\n\nChanging the primary key version, manually or during key rotation, is an\neventually consistent operation. While such eventually-consistent changes\npropagate, `Encrypt` operations for a `CryptoKey` might use the `CryptoKey`'s\nprevious primary version to encrypt.\n\nImpact of changing IAM access\n-----------------------------\n\nIf you need to prevent a user from using a Cloud KMS resource\nduring the time needed for propagation of an eventually consistent operation,\nremove the Identity and Access Management (IAM) permission for the resource. For example,\nyou can prevent a user from using a newly-disabled key version by removing\nthe IAM role that allows the user to access the key.\nIAM changes are consistent within seconds; to learn more, see\n[Access change propagation](/iam/docs/access-change-propagation)."]]
