Secret Manager overview

Secret Manager is a secrets and credential management service that lets you store and manage sensitive data such as API keys, usernames, passwords, certificates, and more.

A secret is a global resource that contains a collection of metadata and secret versions. The metadata can include labels, annotations, and permissions.

A secret version stores the actual secret data, such as API keys, passwords, or certificates. Each version is identified by a unique ID or timestamp.

Using Secret Manager, you can do the following:

  • Manage rollback, recovery, and auditing using versions: Versions help you manage gradual rollouts and emergency rollback, If a secret is accidentally changed or compromised, you can revert to a previous, known-good version. This minimizes potential downtime and security breaches. Versioning maintains a historical record of changes made to a secret, including who made the changes and when. It helps you audit secret data and track any unauthorized access attempts. You can pin secret versions to specific workloads and add aliases for easier access to secret data. You can also disable or destroy secret versions that you don't require.

  • Encrypt your secret data in transit and at rest: All secrets are encrypted by default, both in transit using TLS and at rest with AES-256-bit encryption keys. For those requiring more granular control, you can encrypt your secret data with Customer-Managed Encryption Keys (CMEK). Using CMEK, you can generate new encryption keys or import existing ones to meet your specific requirements.

  • Manage access to secrets using fine-grained Identity and Access Management (IAM) roles and conditions: With IAM roles and permissions, you can provide granular access to specific Secret Manager resources. You can segregate responsibilities for accessing, managing, auditing, and rotating secrets.

  • Ensure high availability and disaster recovery with secret replication: You can replicate your secrets across multiple regions to ensure high availability and disaster recovery for your applications regardless of their geographic location. You can choose between the following replication policies:

    • Automatic replication: Google Cloud decides the regions considering availability and latency. You are only charged for one location.

    • User managed replication: You can select a custom set of regions depending on your requirements. You are charged per location.