Secret Manager release notes

Parameter Manager enforces the location organization policy (constraints/gcp.resourceLocations) on resources in the global location.

If your organization policy restricts allowed resource locations, you must explicitly allow the global location in the policy. Otherwise, attempts to create global resources fail.

This helps ensure that Parameter Manager consistently applies the location organization policy checks to global resources.

For more information, see Defining resource locations.

Automatic rotation of regional Cloud SQL database credentials in Secret Manager is available in Preview. This feature lets you automatically generate secure passwords, update target Cloud SQL database instances (PostgreSQL or SQL Server), and rotate secret versions on a configured schedule without custom Cloud Run functions.

For more information, see Automatic rotation of Cloud SQL secrets.

Parameter templates are available in Preview. This feature lets you define standardized configuration blueprints and securely substitute environment-specific variables from parameter versions during deployment.

For more information, see Parameter templates overview.

Secret Manager supports multi-region storage. You can choose between a single region or a multi-region location when you create a regional secret in the Google Cloud console.

For more information, see Create a regional secret.

Secret Manager is available in the following multi-regions:

• United States (us)
• European Union (eu)
• Canada (ca)
• India (in)

For more information, see Secret Manager locations.

Secret Manager and Parameter Manager integrate with the Agent Development Kit (ADK) to retrieve secrets and parameters securely at runtime. This integration prevents the exposure of sensitive credentials to the LLM context window or conversation history.

For more information, see the following resources:

• Manage secrets for external services in Agent Development Kit
• Parameter Manager integration with Agent Development Kit

The integrated secret synchronization feature is generally available (GA). You can automatically synchronize secrets from Secret Manager into Kubernetes Secret objects within your Google Kubernetes Engine (GKE) clusters.

For more information, see Synchronize secrets to Kubernetes Secrets.

Parameter Manager supports the latest identifier, which lets you fetch the most recent parameter value without specifying a version ID. When you use the gcloud CLI or REST API, you can use latest to retrieve the most recent version of a parameter.

For more information, see Access a parameter version.

Parameter version comparison: You can compare two versions of a parameter to identify changes in their payload. This feature lets you audit modifications over time and debug issues related to specific parameter updates.

For more information, see Compare parameter versions.

Secret Manager is available in the following region:

• asia-southeast3 (Bangkok)

For more information, see Secret Manager locations.

For more information, see Synchronize secrets to Kubernetes Secrets.

Automatic secret rotation with the Secret Manager add-on for Google Kubernetes Engine (GKE): You can configure the Secret Manager add-on to automatically rotate secrets so that secrets updated in Secret Manager after initial pod deployment are automatically and periodically pushed to the pod. This feature is now Generally available (GA).

For more information, see Configure automatic rotation of secrets.

Enhanced tagging capabilities for Secret Manager: You can now add tags directly at the time of secret creation. This new feature lets you provide essential metadata for your resources and helps with better organization, cost tracking, and automated policy application from the time a secret is created. In addition to this, tagging for regional secrets is now fully supported, both during secret creation and for existing regional secrets. For more information, see the documentation on tags for global secrets and regional secrets.

Soft-enforced rate limits for modifying secrets and secret versions: We have introduced soft-enforced rate limits for the following operations in Secret Manager:

• AddSecretVersion
• UpdateSecret
• EnableSecretVersion
• DisableSecretVersion
• DestroySecretVersion

Soft enforcement lets us continue serving requests beyond the defined quota as long as our backend systems can comfortably handle the increased load. For details, see the Quotas and limits documentation.

The Secret Manager add-on for Google Kubernetes Engine (GKE) now supports the automatic rotation of secrets. You can configure the Secret Manager add-on to automatically rotate secrets so that secrets updated in Secret Manager after initial pod deployment are automatically and periodically pushed to the pod. This feature is available in Preview.

For more information, see Configure automatic rotation of secrets.

Parameter Manager, an extension to the Secret Manager service, is now Generally available (GA). Parameter Manager lets you store, access, and manage the lifecycle of workload parameters. You can interact with Parameter Manager using the console, gcloud CLI, REST API, and client libraries.

For information, see the Parameter Manager documentation.

Secret Manager is now available in the following region:

• europe-north2 (Stockholm)

For more information, see Secret Manager locations.

Parameter Manager, currently in Preview, now offers a console for storing, accessing, and managing the lifecycle of your workload parameters. For more information, see the Parameter Manager documentation.

Parameter Manager, an extension to the Secret Manager service, is available in Preview. You can use Parameter Manager to store, access, and manage the lifecycle of your workload parameters. For more information, see Parameter Manager overview.

Creating custom organization policies with Secret Manager resources is now in General Availability (GA). You can use custom organization policies to enhance secret security by enforcing rotation schedules, annotations, and expirations for secrets. You can also use custom organization policies to restrict secret types to manage costs. To learn more about using custom organization policies in Secret Manager, see Use custom organization policies.

Secret Manager is now available in the following region:

• northamerica-south1

For more information, see Secret Manager locations.

A weekly digest of client library updates from across the Cloud SDK.

Creating regional secrets using Secret Manager is now in Generally Availability (GA). Regional secrets let you store your sensitive data within a specific geographic location, ensuring it remains in that region at all times – whether at rest, in use, or in transit. Regional secrets are crucial for meeting data residency requirements and complying with regulatory mandates.

For information about all tasks related to creating and managing regional secrets, see the Regional service documentation.

A weekly digest of client library updates from across the Cloud SDK.

Secret Manager is now enabled for use with Cloud KMS Autokey.

Using keys generated by Autokey can help you consistently align with industry standards and recommended practices for data security, including the HSM protection level, separation of duties, key rotation, location, and key specificity. Keys requested using Autokey function identically to other Cloud HSM keys with the same settings.

For more information, see Enable customer-managed encryption keys for Secret Manager. To learn more about Cloud KMS Autokey, see Autokey overview.

A weekly digest of client library updates from across the Cloud SDK.

You can now create regional secrets using Secret Manager. When you create a regional secret, you specify the location where you want it to be stored. Your secret data remains within the chosen location at all times, whether it's at rest, in use, or in transit. This capability allows you to meet data residency requirements, which mandate that data remains within specified geographic boundaries, often due to regulatory or compliance reasons. The feature is in Preview.

For more information, see Data residency and regional secrets.

You can attach tags to secrets to conditionally grant or deny access to Secret Manager resources. For example, you can conditionally grant Identity and Access Management (IAM) roles based on whether a secret has a specific tag. This feature is in Preview. For more information, see Create and manage tags.

Secret Manager add-on for Google Kubernetes Engine (GKE) is now generally available (GA). With the add-on, you can access the secrets stored in Secret Manager as volumes mounted in Kubernetes Pods. You can install the Secret Manager add-on on both Standard clusters and Autopilot clusters. The Secret Manager add-on is a Google managed and officially supported version of the open source Kubernetes Secrets Store CSI driver.

For more information, see Use Secret Manager add-on with Google Kubernetes Engine.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

Delayed destruction of secret versions is now generally available (GA). You can set up a duration for delayed destruction at the time of creating or updating a secret. When a destruction delay duration is configured for a secret, destroying a version of that secret will disable the version and prevent its use. However, it won't be immediately destroyed. Instead, it will remain scheduled for destruction for the specified delay duration. After that duration expires, the version will be permanently destroyed. Secret Manager administrators can restore a secret version that is scheduled for destruction by either enabling or disabling it during the delay period.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

To learn more, see Delay destruction of secret versions.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

For more information, see Use Secret Manager add-on with Google Kubernetes Engine.

A weekly digest of client library updates from across the Cloud SDK.

Secret Manager is now available in the following region:

• africa-south1

For more information, see Secret Manager locations.

Generally available: Key Access Justifications is now generally available with Secret Manager. Key Access Justifications works by adding a field to your Cloud External Key Manager requests that allows you to view the reason for each request. You can automatically approve or deny these requests, based on the justification. For more information, see Key Access Justifications.

A weekly digest of client library updates from across the Cloud SDK.

For more information, refer to the overview of Key Access Justifcations.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

Secret Manager is now available in the following region:

• me-central2

For more information, see Secret Manager locations.

Secret Manager is now available in the following region:

• europe-west10

For more information, see Secret Manager locations.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

Secret Manager is now available in the following region:

• me-central1

For more information, see Secret Manager locations.

Secret Manager is now available in the following region:

• europe-west12

For more information, see Secret Manager locations.

Support for aliases in Secret Manager is now generally available. You can use an alias to get and access a version using a resource path name. A given alias string can only be bound to a single version. You can, however, assign multiple aliases to a secret version.

Support for Annotations in Secret Manager is now generally available. Annotations are used to define custom metadata about a secret.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.