Disable a parameter version

This page describes how to disable versions within a parameter.

Disabling parameter versions is helpful in the following scenarios:

  • If a specific version of a parameter represents a deprecated or outdated configuration, disabling it prevents accidental use.
  • If a version contains sensitive information that should no longer be accessible, disabling it mitigates security risks.
  • If you suspect that a specific version of a parameter is causing problems, disabling the version can help isolate the issue.
  • If you're testing new configurations or experimenting with different settings, you might disable versions temporarily.

Required roles

To get the permissions that you need to disable a parameter version, ask your administrator to grant you the Parameter Manager Admin (roles/parametermanager.admin) IAM role on the parameter, project, folder, or organization. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Disable a parameter version

To disable a parameter version, use one of the following methods:

Global parameters

Console

  1. In the Google Cloud console, go to the Secret Manager page.

    Go to Secret Manager

  2. Click Parameter Manager to go to the Parameter Manager page. You'll see the list of parameters for that project.

  3. Click the parameter name to access its versions. The parameter details page opens with the Versions tab in focus where you can see all the versions belonging to the selected parameter.

  4. Select the parameter version that you want to disable.

  5. Click the Actions menu associated with that version, and then click Disable.

  6. In the confirmation dialog that appears, click Disable.

gcloud

Before using any of the command data below, make the following replacements:

  • PARAMETER_VERSION_ID: the ID of the parameter version
  • PARAMETER_ID: the name of the parameter

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud parametermanager parameters versions update PARAMETER_VERSION_ID --parameter=PARAMETER_ID --location=global --disabled

Windows (PowerShell)

gcloud parametermanager parameters versions update PARAMETER_VERSION_ID --parameter=PARAMETER_ID --location=global --disabled

Windows (cmd.exe)

gcloud parametermanager parameters versions update PARAMETER_VERSION_ID --parameter=PARAMETER_ID --location=global --disabled

You should receive a response similar to the following:

Updated parameterVersion [range1].
createTime: '2024-11-14T10:07:12.883361876Z'
disabled: true
name: projects/production-1/locations/global/parameters/allowed_ip_ranges/versions/range1
updateTime: '2024-11-14T10:21:00.238113299Z'

REST

Before using any of the request data, make the following replacements:

  • PROJECT_ID: the Google Cloud project ID
  • PARAMETER_ID: the name of the parameter
  • PARAMETER_VERSION_ID: the ID of the parameter version

HTTP method and URL:

PATCH https://parametermanager.googleapis.com/v1/projects/PROJECT_ID/locations/global/parameters/PARAMETER_ID/versions/PARAMETER_VERSION_ID

Request JSON body:

{"disabled": true}

To send your request, choose one of these options:

curl

Save the request body in a file named request.json, and execute the following command:

curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://parametermanager.googleapis.com/v1/projects/PROJECT_ID/locations/global/parameters/PARAMETER_ID/versions/PARAMETER_VERSION_ID"

PowerShell

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method PATCH `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://parametermanager.googleapis.com/v1/projects/PROJECT_ID/locations/global/parameters/PARAMETER_ID/versions/PARAMETER_VERSION_ID" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "name": "projects/production-1/locations/global/parameters/allowed_ip_ranges/versions/range1",
  "createTime": "2024-10-15T08:39:05.191747694Z",
  "updateTime": "2024-10-15T08:39:05.530311092Z",
  "disabled": true
}

Python

To run this code, first set up a Python development environment and install the Secret Manager Python SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

def disable_param_version(
    project_id: str, parameter_id: str, version_id: str
) -> parametermanager_v1.ParameterVersion:
    """
    Disables a specific version of a specified global parameter
    in the specified project using the Google Cloud Parameter Manager SDK.

    Args:
        project_id (str): The ID of the project where the parameter is located.
        parameter_id (str): The ID of the parameter for
        which version is to be disabled.
        version_id (str): The ID of the version to be disabled.

    Returns:
        parametermanager_v1.ParameterVersion: An object representing the
        disabled parameter version.

    Example:
        disable_param_version(
            "my-project",
            "my-global-parameter",
            "v1"
        )
    """
    # Import the necessary library for Google Cloud Parameter Manager.
    from google.cloud import parametermanager_v1
    from google.protobuf import field_mask_pb2

    # Create the Parameter Manager client.
    client = parametermanager_v1.ParameterManagerClient()

    # Build the resource name of the parameter version.
    name = client.parameter_version_path(project_id, "global", parameter_id, version_id)

    # Get the current parameter version details.
    parameter_version = client.get_parameter_version(name=name)

    # Set the disabled field to True to disable the version.
    parameter_version.disabled = True

    # Define the update mask for the disabled field.
    update_mask = field_mask_pb2.FieldMask(paths=["disabled"])

    # Define the request to update the parameter version.
    request = parametermanager_v1.UpdateParameterVersionRequest(
        parameter_version=parameter_version, update_mask=update_mask
    )

    # Call the API to update (disable) the parameter version.
    response = client.update_parameter_version(request=request)

    # Print the parameter version ID that it was disabled.
    print(f"Disabled parameter version {version_id} for parameter {parameter_id}")

Regional parameters

Console

  1. In the Google Cloud console, go to the Secret Manager page.

    Go to Secret Manager

  2. Click Parameter Manager to go to the Parameter Manager page. You'll see the list of parameters for that project.

  3. Click the parameter name to access its versions. The parameter details page opens with the Versions tab in focus where you can see all the versions belonging to the selected parameter.

  4. Select the parameter version that you want to disable.

  5. Click the Actions menu associated with that version, and then click Disable.

  6. In the confirmation dialog that appears, click Disable.

gcloud

Before using any of the command data below, make the following replacements:

  • PARAMETER_VERSION_ID: the ID of the parameter version
  • PARAMETER_ID: the name of the parameter
  • LOCATION: the Google Cloud location of the parameter

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud parametermanager parameters versions update PARAMETER_VERSION_ID --parameter=PARAMETER_ID --location=LOCATION --disabled

Windows (PowerShell)

gcloud parametermanager parameters versions update PARAMETER_VERSION_ID --parameter=PARAMETER_ID --location=LOCATION --disabled

Windows (cmd.exe)

gcloud parametermanager parameters versions update PARAMETER_VERSION_ID --parameter=PARAMETER_ID --location=LOCATION --disabled

You should receive a response similar to the following:

Updated parameterVersion [v1].
createTime: '2024-11-14T10:07:12.883361876Z'
disabled: true
name: projects/production-1/locations/us-central1/parameters/p1/versions/v1
updateTime: '2024-11-14T10:21:00.238113299Z'

REST

Before using any of the request data, make the following replacements:

  • LOCATION: the Google Cloud location of the parameter
  • PROJECT_ID: the Google Cloud project ID
  • PARAMETER_ID: the name of the parameter
  • PARAMETER_VERSION_ID: the ID of the parameter version

HTTP method and URL:

PATCH https://parametermanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/parameters/PARAMETER_ID/versions/PARAMETER_VERSION_ID

Request JSON body:

{"disabled": true}

To send your request, choose one of these options:

curl

Save the request body in a file named request.json, and execute the following command:

curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://parametermanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/parameters/PARAMETER_ID/versions/PARAMETER_VERSION_ID"

PowerShell

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method PATCH `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://parametermanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/parameters/PARAMETER_ID/versions/PARAMETER_VERSION_ID" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "name": "projects/production-1/locations/us-central1/parameters/p1/versions/v1",
  "createTime": "2024-11-22T05:24:41.338299211Z",
  "updateTime": "2024-11-22T05:35:12.630776330Z",
  "disabled": true
}

Python

To run this code, first set up a Python development environment and install the Secret Manager Python SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.

def disable_regional_param_version(
    project_id: str, location_id: str, parameter_id: str, version_id: str
) -> parametermanager_v1.ParameterVersion:
    """
    Disables a regional parameter version in the given project.

    Args:
        project_id (str): The ID of the GCP project
        where the parameter is located.
        location_id (str): The region where the parameter is stored.
        parameter_id (str): The ID of the parameter
        for which version is to be disabled.
        version_id (str): The version ID of the parameter to be disabled.

    Returns:
        parametermanager_v1.ParameterVersion: An object representing
        the disabled parameter version.

    Example:
        disable_regional_param_version(
            "my-project",
            "us-central1",
            "my-regional-parameter",
            "v1"
        )
    """

    # Import the Parameter Manager client library.
    from google.cloud import parametermanager_v1
    from google.protobuf import field_mask_pb2

    # Endpoint to call the regional parameter manager server.
    api_endpoint = f"parametermanager.{location_id}.rep.googleapis.com"

    # Create the Parameter Manager client for the specified region.
    client = parametermanager_v1.ParameterManagerClient(
        client_options={"api_endpoint": api_endpoint}
    )

    # Build the resource name of the parameter version for the specified region.
    name = client.parameter_version_path(
        project_id, location_id, parameter_id, version_id
    )

    # Get the current parameter version to update its state.
    parameter_version = client.get_parameter_version(request={"name": name})

    # Disable the parameter version.
    parameter_version.disabled = True

    # Create a field mask to specify which fields to update.
    update_mask = field_mask_pb2.FieldMask(paths=["disabled"])

    # Define the parameter version update request.
    request = parametermanager_v1.UpdateParameterVersionRequest(
        parameter_version=parameter_version,
        update_mask=update_mask,
    )

    # Update the parameter version.
    response = client.update_parameter_version(request=request)

    # Print the parameter version ID that it was disabled.
    print(
        f"Disabled regional parameter version {version_id} "
        f"for regional parameter {parameter_id}"
    )

What's next