LAB14_GCP_Secrets: Google Secret Manager

Secrets: Google Secret Manager

☁ GCP 🟢 Beginner Secret Manager Sensitive Data IAM

Scenario

Your application needs to securely connect to a 3rd-party API using a token. Hardcoding credentials in code or storing them raw in Terraform state isn't secure. Secret Manager centrally stores, encrypts, and versions secrets. You will provision a secret container and populate its first version, while understanding the limitations of managing secret contents in Terraform.

Your Objectives
  • Create a google_secret_manager_secret named api-token with automatic replication.
  • Create a google_secret_manager_secret_version to store the token string securely.
  • Mark the secret Data output as sensitive = true so it doesn't leak into CI/CD logs.

Additional Context

Replication: A Secret is a logical container. You must define its replication policy: "automatic" allows Google to replicate the secret data securely across available regions, natively providing HA. "user_managed" restricts replication to custom specific regions you dictate.

Risk Warning: While Terraform marks the output as `sensitive` in logs, the value itself is still saved in plain text within `terraform.tfstate`. For total secrecy, it's better to create the `google_secret_manager_secret` with Terraform, but populate the `_version` (the actual secret text) manually via the `gcloud CLI` or console so Terraform never touches the raw value.

variables.tf

variable "project_id" { type = string }
variable "api_secret_token" { 
  type = string
  sensitive = true
  description = "The token content for the 3rd party API" 
}

main.tf

provider "google" {
  project = var.project_id
}

# The logical container for the secret
resource "google_secret_manager_secret" "api_token" {
  secret_id = "external-api-token"

  # Let Google automatically replicate the key safely
  replication {
    auto {}
  }

  labels = {
    env = "production"
  }
}

# The actual content payload holding the secret string
resource "google_secret_manager_secret_version" "api_token_version" {
  secret      = google_secret_manager_secret.api_token.id
  secret_data = var.api_secret_token
}

# Optional: Grant an existing Service Account access to read the secret
# resource "google_secret_manager_secret_iam_member" "token_reader" {
#   secret_id = google_secret_manager_secret.api_token.id
#   role      = "roles/secretmanager.secretAccessor"
#   member    = "serviceAccount:[email protected]"
# }

outputs.tf

output "secret_version_id" {
  value = google_secret_manager_secret_version.api_token_version.id
}

Workflow Commands

terraform init
terraform apply -var="project_id=my-gcp-project-123" -var="api_secret_token=super_secret_value"

# Test retrieving the secret from GCP
gcloud secrets versions access latest --secret="external-api-token"

terraform destroy -var="project_id=my-gcp-project-123" -var="api_secret_token=super_secret_value"
✓ Expected Output After Apply
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Outputs:

secret_version_id = "projects/123000456111/secrets/external-api-token/versions/1"

Related Posts