Problem after revoking access to a secret about berglas

[sethvargo]

This is correct and working-as-intended. The help output for revoke also says this:

When executed, this command revokes the following IAM permissions for each
member:

  - roles/storage.legacyObjectReader on the Cloud Storage object
  - roles/cloudkms.cryptoKeyDecrypter on the Cloud KMS crypto key

[skurtzemann]

This is correct and working-as-intended. The help output for revoke also says this:

When executed, this command revokes the following IAM permissions for each
member:

  - roles/storage.legacyObjectReader on the Cloud Storage object
  - roles/cloudkms.cryptoKeyDecrypter on the Cloud KMS crypto key

Thanks for your response.

Do you planned to have a feature to revoke access to a specific secret without revoking roles/cryptoKeyDecrypter ?

Or as you say this is the intended working of revoke and it will not be changed ?

[sethvargo]

I'd be open to a flag that doesn't revoke the KMS permission, but the default has to stay as total revoke.