Status: IN
The `roles/cloudkms.admin` role does NOT grant encrypt or decrypt permissions; separate granular roles exist for encrypt-only, decrypt-only, and combined encrypter-decrypter.
Source: entries/2026/03/11/kms-encryption.md
JSON