Filter lists of secrets and secret versions

This page explains the process of filtering secrets and secret versions in Secret Manager. In environments with numerous secrets, filtering helps quickly identify specific secrets or versions without manually scrolling through the entire list. You can filter based on criteria like labels, creation dates, or specific patterns within secret names, allowing for focused management of specific groups of secrets.

In Secret Manager, you can filter secrets and secret versions using the Filter option in the Google Cloud console or by specifying filter criteria within an API call. In the Google Cloud CLI, you can filter secrets and secret versions by including a filter string when listing secrets.

Filter secrets

To filter a secret, use one of the following methods:

Console

  1. In the Google Cloud console, go to the Secret Manager page.

    Go to Secret Manager

  2. In the Secrets table, click in the Filter field.

  3. Choose a filter property and its corresponding value, for example Location:asia-east1.

    The table is automatically filtered based on the values entered. The results are sorted by name in the ascending order.

gcloud

Before using any of the command data below, make the following replacements:

  • FILTER: the filter string, for example name:asecret OR name:bsecret. gcloud CLI also supports regular expressions, for example name ~ "secret_ab.*".

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud secrets list --filter="FILTER"

Windows (PowerShell)

gcloud secrets list --filter="FILTER"

Windows (cmd.exe)

gcloud secrets list --filter="FILTER"

REST

Before using any of the request data, make the following replacements:

  • PROJECT_ID: the Google Cloud project ID.
  • FILTER: the filter string. Filters are specified as the filter querystring parameter and must be URL-encoded. For example, the filter name:asecret OR name:bsecret would be URL-encoded as name%3Aasecret+OR+name%3Absecret. Regular expressions aren't supported in the API.

HTTP method and URL: 

GET https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets?filter=FILTER

Request JSON body: 

{}

To send your request, choose one of these options:

curl

Save the request body in a file named request.json, and execute the following command: 

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets?filter=FILTER"

PowerShell

Save the request body in a file named request.json, and execute the following command: 

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://secretmanager.googleapis.com/v1/projects/PROJECT_ID/secrets?filter=FILTER" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "secrets": [
    {
      "name": "projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID",
      "createTime": "2024-09-02T07:14:00.281541Z",
      "etag": "\"16211dd90b37e7\""
    }
  ]
}

Filter a secret version

To filter a secret version, do the following:

  • In the Google Cloud console, select a secret to access its versions, and then use the Filter option in the Versions table.

  • If you're using the Google Cloud CLI or the Secret Manager API, include a filter string when listing secret versions.