Secret Management

Cloud Secret Manager

Secret Manager is a secure and convenient storage system for API keys, passwords, certificates, and other sensitive data. Secret Manager provides a central place and single source of truth to manage, access, and audit secrets across Google Cloud.

Enable API

gcloud services enable

Create a Secret

echo -n "qwerty" | \
  gcloud secrets create order-db-password --data-file=- --replication-policy=automatic

List Secrets

gcloud secrets list

Delete a Secret

gcloud secrets delete order-db-password

Assign IAM Permission

You can finely control CRUD permissions for an account (user account, service account, a Google Group) to a secret. See the Secret Manager IAM access control for more information.

gcloud secrets add-iam-policy-binding --help

Spring Cloud Secret Manager

You can easily get value from Secret Manager by using Spring Cloud GCP's Secret Manager starter.


Add the Spring Cloud GCP Secret Manager starter:



Secret Manager can be configured during Bootstrap phase, via The starter automatically enables Secret Manager integration. But you can also disable it by configuring in a different Spring Boot profile.

Read Spring Cloud GCP Secret Manager configuration documentation for more details.

Property Source

You can access individual secrets in stored in Secret Manager by looking up property keys with the sm:// prefix.

@Value Annotation

You can inject the secret value by using the Value annotation.

@Value("sm://order-db-password") String databasePassword;

Properties Mapping

You can refer to the secret value like any other properties, and reference the secret values in a properties file.

Mapping properties this way, rather than hard-coding the Secret Manager property key using @Value annotation can be help you utilize multiple profiles.

For example, you can have with:

And, for production, create an with:

Property Key Syntax





Short - Versioned


Short - Project Scoped and Versioned


Long - Project Scoped


Long - Fully Qualified


Local Development

Use Spring Boot Profile to differentiate local development profile vs deployed environments. For example, for local development, you can hard-code test credentials/values, but for the cloud environment, you can use a different profile.

Default Profile

Configure the default profile to disable Secret Manager

Hard-code the local test credentials with the value as usual.

Production Profile

Configure the production profile to enable Secret Manager.

Configure production profile to retrieve the credential from Secret Manager.

Start your application with the profile, for example:

# From Maven
./mvnw spring-boot:run

# From Java startup command
java -jar target/...jar


Last updated