CODEWITHSUNDEEP
google-cloud-kmsgoogle-secret-manager
Dan Holevoet
Dan Holevoet

Reputation: 9183

How should I store secrets for use in Google Cloud Platform?

If I had credentials I need to store in Google Compute Engine or Google App Engine for use at build time, how should I store them? Is there something better than storing them in code, or in a bucket?

Upvotes: 2

Views: 2010

Answers (2)

sethvargo
sethvargo

Reputation: 26997

As of December 2019, you should store secrets with Google Secret Manager:

$ echo "ABC1234..." | gcloud beta secrets create "my-api-key" \
  --data-file=- \
  --replication-policy "automatic"

You can use the Secret Manager REST APIs to access secrets, or a client library.

Upvotes: 1

Dan Holevoet
Dan Holevoet

Reputation: 9183

One option is to encrypt the secrets with a key from Cloud KMS, and store them either in a storage bucket or keep them in the binary. This lets you manage permissions and logging on the key, to indirectly manage who accesses the secret.

Upvotes: 2

Related Questions