Add a secret version

Secret data is immutable and most operations take place on secret versions. A secret version contains the actual secret data, along with state and metadata about the secret. This page describes how to add a secret version.

For more information about versioning, see this video on versioning.

Required roles

To get the permissions that you need to add a secret version, ask your administrator to grant you the following IAM roles on a secret:

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

IAM roles can't be granted on a secret version.

Add a secret version

To add a secret version, use one of the following methods:

Console

  1. In the Google Cloud console, go to the Secret Manager page.

    Go to Secret Manager

  2. On the Secret Manager page, locate the secret for which you want to add the new version.

  3. Click the Actions menu associated with that secret, and then click Add new version. The Add new version dialog appears.

  4. In the Secret value field, enter a value for the secret such as abcd1234. Alternatively, you can upload a file containing the secret value.

  5. Click Add new version.

gcloud

Add a secret version from the contents of a file on disk

Before using any of the command data below, make the following replacements:

  • SECRET_ID: the ID of the secret
  • FILE_PATH: the full path (including file name) to the file containing the version details

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud secrets versions add SECRET_ID --data-file="FILE_PATH"

Windows (PowerShell)

gcloud secrets versions add SECRET_ID --data-file="FILE_PATH"

Windows (cmd.exe)

gcloud secrets versions add SECRET_ID --data-file="FILE_PATH"

The response contains the newly created secret version.

Add a secret version directly on the command line

You can also add a secret version directly on the command line, but this is discouraged because it appears as plaintext in the list of processes and may be captured by other system users. Note that the command with the plaintext will also be in your shell history.

  echo -n "SECRET_DATA" | \
      gcloud secrets versions add SECRET_ID --data-file=-

Replace the following:

  • SECRET_DATA: the data that you want to store in the secret version
  • SECRET_ID: the ID of the secret or fully qualified identifier for the secret

Optional: Add a version from a file's contents when first creating a secret

Before using any of the command data below, make the following replacements:

  • SECRET_ID: the ID of the secret
  • FILE_PATH: the full path (including file name) to the file containing the version details

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud secrets create SECRET_ID --data-file="FILE_PATH"

Windows (PowerShell)

gcloud secrets create SECRET_ID --data-file="FILE_PATH"

Windows (cmd.exe)

gcloud secrets create SECRET_ID --data-file="FILE_PATH"

The response contains the newly created secret version.

REST

Base64-encode the secret data and save it as a shell variable.

$ SECRET_DATA=$(echo "seCr3t" | base64)

Before using any of the request data, make the following replacements:

  • PROJECT_ID: the Google Cloud project ID
  • SECRET_ID: the ID of the secret

HTTP method and URL: 

POST https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID:addVersion

Request JSON body: 

{"payload": {"data": "${SECRET_DATA}"}}

To send your request, choose one of these options:

curl

Save the request body in a file named request.json, and execute the following command: 

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID:addVersion"

PowerShell

Save the request body in a file named request.json, and execute the following command: 

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets/SECRET_ID:addVersion" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "name": "projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID/versions/1",
  "createTime": "2024-03-25T08:24:13.153705Z",
  "state": "ENABLED",
  "etag": "\"161477e6071da9\""
}

C#

To run this code, first set up a C# development environment and install the Secret Manager C# SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope. 


using System.Text;
using