.TH "GCLOUD_BETA_SECRETS_REPLICATION_UPDATE" 1



.SH "NAME"
.HP
gcloud beta secrets replication update \- update a secret replica's metadata



.SH "SYNOPSIS"
.HP
\f5gcloud beta secrets replication update\fR \fISECRET\fR [\fB\-\-remove\-cmek\fR\ |\ \fB\-\-location\fR=\fIREPLICA\-LOCATION\fR\ \fB\-\-set\-kms\-key\fR=\fISET\-KMS\-KEY\fR] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

\fB(BETA)\fR Update a secret replica's metadata (e.g. cmek policy). This command
will return an error if given a secret that does not exist or if given a
location that the given secret doesn't exist in.

The \-\-remove\-kms\-key flag is only valid for Secrets that have an automatic
replication policy or exist in a single location. To remove keys from a Secret
with multiple user managed replicas, please use the set\-replication command.



.SH "EXAMPLES"

To remove CMEK from a secret called 'my\-secret', run:

.RS 2m
$ gcloud beta secrets replication update my\-secret \-\-remove\-cmek
.RE

To set the CMEK key on an automatic secret called my\-secret to a specified KMS
key, run:

.RS 2m
$gcloud beta secrets replication update my\-secret
\-\-set\-kms\-key=projects/my\-project/locations/global/keyRings/my\-keyring/cryptoKeys/my\-key
.RE

To set the CMEK key on a secret called my\-secret to a specified KMS key in a
specified location in its replication, run:

.RS 2m
$gcloud beta secrets replication update my\-secret
\-\-set\-kms\-key=projects/my\-project/locations/us\-central1/keyRings/my\-keyring/cryptoKeys/my\-key
\-\-location=us\-central1
.RE



.SH "POSITIONAL ARGUMENTS"

.RS 2m
.TP 2m

Secret resource \- The secret to update. This represents a Cloud resource.
(NOTE) Some attributes are not given arguments in this group but can be set in
other ways.

To set the \f5project\fR attribute:
.RS 2m
.IP "\(em" 2m
provide the argument \f5SECRET\fR on the command line with a fully specified
name;
.IP "\(em" 2m
provide the argument \f5\-\-project\fR on the command line;
.IP "\(em" 2m
set the property \f5core/project\fR.
.RE
.sp

This must be specified.


.RS 2m
.TP 2m
\fISECRET\fR

ID of the secret or fully qualified identifier for the secret.

To set the \f5secret\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5SECRET\fR on the command line.
.RE
.sp


.RE
.RE
.sp

.SH "FLAGS"

.RS 2m
.TP 2m

Replication update.

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-remove\-cmek\fR

Remove customer managed encryption key so that future versions will be encrypted
by a Google managed encryption key.

.TP 2m

CMEK Update.


.RS 2m
.TP 2m
\fB\-\-location\fR=\fIREPLICA\-LOCATION\fR

Location of replica to update. For secrets with automatic replication policies,
this can be omitted.

.TP 2m
\fB\-\-set\-kms\-key\fR=\fISET\-KMS\-KEY\fR

New KMS key with which to encrypt and decrypt future secret versions.


.RE
.RE
.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "NOTES"

This command is currently in beta and might change without notice. This variant
is also available:

.RS 2m
$ gcloud secrets replication update
.RE