Application requesting secret
Cloud / Knowledge library
Google Cloud Secret Manager
Stores versioned secrets protected by Google Cloud IAM and audit logging
Why learn Google Cloud Secret Manager?
Teams use Google Cloud Secret Manager to adopt managed secrets without building the complete underlying platform themselves.
The problem it solves
Stores and controls application credentials, tokens, and other sensitive configuration
Where it came from
Google Cloud Secret Manager is Google Cloud's offering for managed secrets. Its closest catalog counterparts are Azure Key Vault Secrets and AWS Secrets Manager; they address the same broad need but are not feature-for-feature identical.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Explain the main responsibility of Google Cloud Secret Manager.
- Choose a workload that fits Google Cloud Secret Manager.
- Identify one operational tradeoff of Google Cloud Secret Manager.
- Compare Google Cloud Secret Manager with Azure Key Vault Secrets.
- Compare Google Cloud Secret Manager with AWS Secrets Manager.
Documentation and sources
- Google Cloud products at a glance (docs.cloud.google.com)
Connect the ideas
Alternatives
Real World Example
Securing Microservice Configuration Credentials
A financial services firm running distributed microservices on Google Cloud that require frequent access to third-party banking APIs.
The business problem
Hardcoded API keys and database credentials in source code repositories lead to security vulnerabilities and difficult rotation processes during credential compromise.
How this topic solves it
Secret Manager centralizes sensitive data storage, providing versioned secrets protected by Google Cloud IAM and audit logging to ensure only authorized services access specific credentials.
- Create a secret in Secret Manager to hold the sensitive API credential.
- Grant the specific microservice service account the Secret Manager Secret Accessor IAM role.
- Configure the application code to fetch the secret payload dynamically at runtime.
- Enable audit logging to monitor every access request to the secret for compliance.
The flow shows how a microservice retrieves a secret from the manager.
Access control check
Versioned secret store
Access record
- Microservice → Request Access → IAM Policy
- IAM Policy → Authorize → Secret Manager
- Secret Manager → Log Access → Audit Log
Expected business outcome
Improved security posture through centralized credential management, reduced risk of credential leakage, and simplified secret rotation without redeploying application code.
Limitations and checks
Secret Manager introduces a dependency on an external API call for every secret retrieval, which can impact application startup latency; check this by monitoring latency metrics in Cloud Monitoring.