Access a secret version

This page describes how to access a secret version. Accessing a secret version returns the secret contents and additional metadata about the secret version. To access a secret version using the Google Cloud CLI or the Secret Manager API, you must specify either its version ID or its alias, if assigned. You can also access the latest version of a secret by specifying latest as the version id.

Required roles

To get the permissions that you need to access a secret version, ask your administrator to grant you the Secret Manager Secret Accessor (roles/secretmanager.secretAccessor) IAM role on a secret. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Access a secret version

To access a secret, use one of the following methods:

Console

  1. In the Google Cloud console, go to the Secret Manager page.

    Go to Secret Manager

  2. On the Secret Manager page, click a secret to access its versions.

  3. On the secret details page, in the Versions tab, select the secret version that you want to access.

  4. Click the Actions menu associated with the secret version, and then click View secret value.

  5. A dialog appears displaying the value of the secret version. Click Done to exit the dialog.

gcloud

Access a secret version

Before using any of the command data below, make the following replacements:

  • VERSION_ID: the resource name of the secret version
  • SECRET_ID: the ID of the secret

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud secrets versions access VERSION_ID --secret=SECRET_ID

Windows (PowerShell)

gcloud secrets versions access VERSION_ID --secret=SECRET_ID

Windows (cmd.exe)

gcloud secrets versions access VERSION_ID --secret=SECRET_ID

Access a binary secret version

To write raw bytes to a file use --out-file flag:

Before using any of the command data below, make the following replacements:

  • VERSION_ID: the ID of the secret version
  • SECRET_ID: the ID of the secret
  • PATH_TO_SECRET: the full path (including file name) where you want to save the retrieved secret value

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud secrets versions access VERSION_ID --secret=SECRET_ID --out-file="PATH_TO_SECRET"

Windows (PowerShell)

gcloud secrets versions access VERSION_ID --secret=SECRET_ID --out-file="PATH_TO_SECRET"

Windows (cmd.exe)

gcloud secrets versions access VERSION_ID --secret=SECRET_ID --out-file="PATH_TO_SECRET"

Get the raw bytes

To get the raw bytes, have Cloud SDK print the response as base64-encoded and decode:

Before using any of the command data below, make the following replacements:

  • VERSION_ID: the ID of the secret version
  • SECRET_ID: the ID of the secret

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud secrets versions access VERSION_ID --secret=SECRET_ID --format='get(payload.data)' | tr '_-' '/+' | base64 -d

Windows (PowerShell)

gcloud secrets versions access VERSION_ID --secret=SECRET_ID --format='get(payload.data)' | tr '_-' '/+' | base64 -d

Windows (cmd.exe)

gcloud secrets versions access VERSION_ID --secret=SECRET_ID --format='get(payload.data)' | tr '_-' '/+' | base64 -d

The response contains the secret version.

REST

Access a secret version

Before using any of the request data, make the following replacements:

  • PROJECT_ID: the Google Cloud project ID
  • SECRET_ID: the ID of the secret
  • VERSION_ID: the ID of the secret version

HTTP method and URL: 

GET https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID/versions/VERSION_ID:access

Request JSON body: 

{}

To send your request, choose one of these options:

curl

Save the request body in a file named request.json, and execute the following command: 

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID/versions/VERSION_ID:access"

PowerShell

Save the request body in a file named request.json, and execute the following command: 

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `