Thanks for detailed article, very helpful. In order to make it work on local machine, I have to add the service account as a member to that key with role “ Cloud KMS CryptoKey Encrypter/Decrypter”.