Disabling a CMEK key isn't a soft lock — it's permanent, by design.
Database Center gives one aggregated fleet-wide view.
A routine 90-day key rotation disabled an old version, and a secondary AlloyDB replica referencing that specific version (not an alias) went offline within minutes. Every rotation runbook must enumerate every resource referencing a key, replicas included.
CMEK
You control the Cloud KMS key — revoke it, revoke access, independent of any IAM change
Database Center
AI-assisted, one view across Cloud SQL, Spanner, Bigtable, AlloyDB