Stay organized with collections
Save and categorize content based on your preferences.
This topic provides information to help you determine why the state of an
imported key version is IMPORT_FAILED.
Cloud Key Management Service allows you to import user-provided cryptographic keys as new
key versions. The initial state for an imported key version is PENDING_IMPORT.
If the key material is imported successfully, the state of the imported key
version is updated to ENABLED. If key material isn't imported successfully,
the state of the key version is updated to IMPORT_FAILED.
Problems with the key's format
Formatting issues are a common cause of import failures. The following error
messages are typically caused by incorrectly formatted keys:
An argument to the import operation was malformed
The key material in the import request couldn't be unwrapped or wasn't
formatted correctly
Length errors are a specific variety of formatting error that
Cloud KMS can detect before it attempts to unwrap your key
material. The following length error messages are typically caused by
incorrectly formatted keys:
The following errors indicate a problem when manually wrapping keys for import.
An argument to the import operation was malformed
The key material in the import request couldn't be unwrapped or wasn't
formatted correctly
Using automatic key wrapping is recommended. If you cannot use automatic key
wrapping, verify that you are using the wrapping key from the correct import job
and try to wrap the key again.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[],[],null,["# Troubleshooting failed imports\n\nThis topic provides information to help you determine why the state of an\nimported key version is `IMPORT_FAILED`.\n\nCloud Key Management Service allows you to import user-provided cryptographic keys as new\nkey versions. The initial state for an imported key version is `PENDING_IMPORT`.\nIf the key material is imported successfully, the state of the imported key\nversion is updated to `ENABLED`. If key material isn't imported successfully,\nthe state of the key version is updated to `IMPORT_FAILED`.\n\nProblems with the key's format\n------------------------------\n\nFormatting issues are a common cause of import failures. The following error\nmessages are typically caused by incorrectly formatted keys:\n\n- `An argument to the import operation was malformed`\n\n- `The key material in the import request couldn't be unwrapped or wasn't\n formatted correctly`\n\nLength errors are a specific variety of formatting error that\nCloud KMS can detect before it attempts to unwrap your key\nmaterial. The following length error messages are typically caused by\nincorrectly formatted keys:\n\n- `Wrapped ECDSA key has invalid length of (length)`\n\n- `Wrapped key is too short`\n\n- `Wrapped key does not consist of 64-bit blocks`\n\n- `Wrapped key has invalid length`\n\nYou can learn more about [formatting keys for import](/kms/docs/formatting-keys-for-import).\n\nProblems wrapping a key\n-----------------------\n\nThe following errors indicate a problem when manually wrapping keys for import.\n\n- `An argument to the import operation was malformed`\n\n- `The key material in the import request couldn't be unwrapped or wasn't\n formatted correctly`\n\nUsing automatic key wrapping is recommended. If you cannot use automatic key\nwrapping, verify that you are using the wrapping key from the correct import job\nand try to [wrap the key](/kms/docs/wrapping-a-key) again."]]
