Create a Secure Source Manager instance

Secure Source Manager is a single-tenant service. A single Secure Source Manager instance should only include users from one Google Cloud customer unless multiple companies who have a contractual relationship need to use a single instance for collaboration.

If you're working with multiple companies and want to collaborate with them on source code, we recommend you create a separate instance for each company.

To create an instance with VPC Service Controls enabled, see Configure Secure Source Manager in a VPC Service Controls perimeter.

Before you begin

  1. Sign in to your Google Account.

    If you don't already have one, sign up for a new account.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Enable the Secure Source Manager API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  4. Install the Google Cloud CLI.

  5. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  6. To initialize the gcloud CLI, run the following command: 

    gcloud init

  7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  8. Enable the Secure Source Manager API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  9. Install the Google Cloud CLI.

  10. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  11. To initialize the gcloud CLI, run the following command: 

    gcloud init

Required roles

To get the permissions that you need to create a Secure Source Manager instance, ask your administrator to grant you the Secure Source Manager Instance Owner (roles/securesourcemanager.instanceOwner) IAM role on the Google Cloud project.

Secure Source Manager roles don't appear in the Google Cloud console until they have been granted to a principal. To grant a Secure Source Manager role for the first time, see Grant and revoke IAM roles.

Data encryption

By default, Google Cloud automatically encrypts data at rest using encryption keys managed by Google. If you have specific compliance or regulatory requirements related to the keys that protect your data, you can create Secure Source Manager instances encrypted with customer-managed encryption keys (CMEK).

Don't store sensitive data in instance IDs or label key-value pairs as they are not encrypted with CMEK.

If you are creating your first Secure Source Manager instance in your project, you must manually create the Secure Source Manager service agent by running the following command:

gcloud beta services identity create \
    --service=securesourcemanager.googleapis.com \
    --project=PROJECT_ID

Where PROJECT_ID is the project ID of the project where you will create your Secure Source Manager instance.

After you create the Secure Source Manager service agent, you must grant the Secure Source Manager Service Agent role (roles/securesourcemanager.serviceAgent) to the principal service-PROJECT-NUMBER@gcp-sa-sourcemanager.iam.gserviceaccount.com or the instance creation will fail.

Create an instance

To create an instance:

gcloud CLI

  1. Run the following command to create an instance. You might be asked to authenticate to the gcloud CLI.

    gcloud source-manager instances create INSTANCE_ID \
    --region=LOCATION \
    --project=PROJECT_ID \
    --kms-key=projects/KEY_PROJECT/locations/KEY_LOCATION/keyRings/KEYRING_NAME/cryptoKeys/KEY

    Where:

    • INSTANCE_ID is the permanent ID for the instance. The ID must use only lowercase letters, numbers, and hyphens, must start with a letter, and cannot be changed after you create it.

    • LOCATION is the region where you want to create the instance. For information on supported locations, see Locations.

    • PROJECT_ID is the project ID of the project you want to create an instance in.

    • -kms-key is an optional flag. Include if you want to use your own customer-managed encryption key (CMEK) to create the instance. CMEK keys must be in the same location that you are creating your instance in, but can be in a different project. Omit this flag if you want to use Google default encryption. If you want to encrypt your data using CMEK, replace the following:

      • KEY_PROJECT with the project you created your key in.
      • KEY_LOCATION with location of the key.
      • KEYRING_NAME with the name of your key ring.
      • KEY with the name of your key.

    A long-running create instance operation starts. The output looks like the following:

    Create request issued for [my-instance].
done: false
metadata:
  '@type': type.googleapis.com/google.cloud.securesourcemanager.v1.OperationMetadata
  apiVersion: v1
  createTime: '2023-02-27T20:57:52.315609549Z'
  requestedCancellation: false
  target: projects/my-project/locations/us-central1/instances/my-instance
  verb: create
name: projects/my-project/locations/us-central1/operations/operation-1234567894561-5ec69948c0f2b-60dd727f-a9b97a2e

    Where projects/my-project/locations/us-central1/operations/operation-1234567894561-5ec69948c0f2b-60dd727f-a9b97a2e is the OPERATION_NAME.

    It takes up to 60 minutes to create the instance.

  2. Note the OPERATION_NAME as you will need to use it to check the status of the operation.

  3. Check the status of the create operation by running the following command:

    gcloud source-manager operations describe OPERATION_NAME \
    --region=LOCATION

    Replace the following:

    • OPERATION_NAME with the operation name from your create command response.
    • LOCATION with the region where you want to create the instance. For information on supported locations, see Locations.

    Once the instance is ready, the response will look similar to the following:

    {
"name": "projects/my-project/locations/us-central1/operations/operation-123456789012-5ec69948c0f2b-60dd727f-a9b97a2e",
"metadata": {
  "@type": "type.googleapis.com/google.cloud.securesourcemanager.v1.OperationMetadata",
  "createTime": "2022-11-01T14:31:32.420469714Z",
  "endTime": "2022-11-01T14:48:34.140378114Z",
  "target": "projects/my-project/locations/us-central1/instances/test",
  "verb": "create",
  "requestedCancellation": false,