Create a role with these permissions, add the identity as a member of your key, and grant your role to the member:

Permissions:
  - cloudkms.cryptoKeyVersions.useToDecrypt
  - cloudkms.cryptoKeyVersions.useToEncrypt
  - cloudkms.cryptoKeys.get

Identity:
  id-xyz


Please confirm you've authorized the key for this identity: id-xyz (y/n): It may take up to 1 hour for the Kafka cluster to be ready. The organization admin will receive an email once the dedicated cluster is provisioned.
+----------------------+---------------------------+
| Current              | false                     |
| ID                   | lkc-def963                |
| Name                 | gcp-byok-test             |
| Type                 | DEDICATED                 |
| Cluster Size         | 1                         |
| Ingress Limit (MB/s) | 50                        |
| Egress Limit (MB/s)  | 150                       |
| Storage              | Infinite                  |
| Provider             | gcp                       |
| Region               | asia-southeast1           |
| Availability         | single-zone               |
| Status               | PROVISIONING              |
| Endpoint             | SASL_SSL://kafka-endpoint |
| Encryption Key ID    | xyz                       |
| REST Endpoint        | https://pkc-endpoint      |
+----------------------+---------------------------+
