Secret Manager

Google Cloud Secret Manager is a fully managed service for storing, accessing, and managing sensitive data such as API keys, passwords, database credentials, TLS certificates, and private keys. It provides a central, secure location for secrets with versioning, audit logging, and fine-grained access control using Cloud IAM.

Secret Manager stores secrets as encrypted byte strings and automatically replicates them across multiple regions for high availability. Every access to a secret is logged in Cloud Audit Logs, giving you a complete audit trail of who accessed which secret and when. You can set fine-grained access control at the secret level - granting specific service accounts read access to only the secrets they need, following the principle of least privilege.

The below example shows how to create a secret, add a secret version, and access it using the gcloud CLI.

It gives the following output,

Created secret [db-password].
Created version [1] of secret [db-password].

MySecretP@ssw0rd123

NAME  STATE    CREATED
1     enabled  2024-01-15T10:30:00Z

The below example shows how to access a secret from a Python application at runtime, which is the recommended pattern for applications running on GCP - never hardcode secrets in source code or environment variables.

It gives the following output,

Secret accessed successfully
Length: 19 chars
Secret api-key created and version added.

Best Practices for Secret Manager:

Rotate secrets regularly - Add new versions and disable old ones. Applications should always fetch the latest version at startup, not cache secrets forever.

Use IAM bindings at secret level - Grant the roles/secretmanager.secretAccessor role to specific service accounts for only the secrets they need.

Never commit secrets to code - Replace all hardcoded credentials, .env files, and config files with Secret Manager API calls.