In the bucket advanced settings, select the customer-supplied key and then select a Cloud KMS encryption key.

Delete all existing objects and upload them again so they use the new customer-supplied key for encryption.

Rewrite all existing objects using gsutil rewrite to encrypt them with the new Customer-managed key.

In the bucket advanced settings, select the Customer-managed key and then select a Cloud KMS encryption key.

In the bucket advanced settings, select the Customer-managed key and then select a Cloud KMS encryption key.

Existing objects encrypted by Google-managed keys can still be decrypted by the new Customer-managed key.