Secret Management

Cloud Secret Manager

Secret Manager is a secure and convenient storage system for API keys, passwords, certificates, and other sensitive data. Secret Manager provides a central place and single source of truth to manage, access, and audit secrets across Google Cloud.

Enable API

1
gcloud services enable secretmanager.googleapis.com
Copied!

Create a Secret

1
echo -n "qwerty" | \
2
gcloud secrets create order-db-password --data-file=- --replication-policy=automatic
Copied!

List Secrets

1
gcloud secrets list
Copied!

Delete a Secret

1
gcloud secrets delete order-db-password
Copied!

Assign IAM Permission

You can finely control CRUD permissions for an account (user account, service account, a Google Group) to a secret. See the Secret Manager IAM access control for more information.
1
gcloud secrets add-iam-policy-binding --help
Copied!

Spring Cloud Secret Manager

You can easily get value from Secret Manager by using Spring Cloud GCP's Secret Manager starter.

Dependency

Add the Spring Cloud GCP Secret Manager starter:
Maven
Gradle
1
<dependency>
2
<groupId>org.springframework.cloud</groupId>
3
<artifactId>spring-cloud-gcp-starter-secretmanager</artifactId>
4
</dependency>
Copied!
1
compile group: 'org.springframework.cloud', name: 'spring-cloud-gcp-starter-secretmanager'
Copied!

Configuration

Secret Manager can be configured during Bootstrap phase, via bootstrap.properties. The starter automatically enables Secret Manager integration. But you can also disable it by configuring spring.cloud.gcp.secretmanager.enabled=false in a different Spring Boot profile.
Read Spring Cloud GCP Secret Manager configuration documentation for more details.

Property Source

You can access individual secrets in stored in Secret Manager by looking up property keys with the sm:// prefix.

@Value Annotation

You can inject the secret value by using the Value annotation.
1
@Value("sm://order-db-password") String databasePassword;
Copied!

Properties Mapping

You can refer to the secret value like any other properties, and reference the secret values in a properties file.
application.properties
1
spring.datasource.password=${sm://order-db-password}
Copied!
Mapping properties this way, rather than hard-coding the Secret Manager property key using @Value annotation can be help you utilize multiple profiles.
For example, you can have application-dev.properties with:
application.properties
1
spring.datasource.password=${sm://order-db-dev-password}
Copied!
And, for production, create an application-prod.properties with:
application-prod.properties
1
spring.datasource.password=${sm://order-db-prod-password}
Copied!

Property Key Syntax

Form
Example
Short
sm://order-db-password
Short - Versioned
sm://order-db-password/1
Short - Project Scoped and Versioned
sm://your-project/order-db-password/1
Long - Project Scoped
sm://projects/your-project/order-db-password/1
Long - Fully Qualified
sm://projects/your-project/secrets/order-db-password/versions/1

Local Development

Use Spring Boot Profile to differentiate local development profile vs deployed environments. For example, for local development, you can hard-code test credentials/values, but for the cloud environment, you can use a different profile.

Default Profile

Configure the default profile to disable Secret Manager
bootstrap.properties
1
spring.cloud.gcp.secretmanager.enabled=false
Copied!
Hard-code the local test credentials with the value as usual.
application.properties
1
...
2
spring.datasource.password=admin
Copied!

Production Profile

Configure the production profile to enable Secret Manager.
bootstrap-prod.properties
1
spring.cloud.gcp.secretmanager.enabled=true
Copied!
Configure production profile to retrieve the credential from Secret Manager.
application-prod.properties
1
...
2
spring.datasource.password=${sm://order-db-prod-password}
Copied!
Start your application with the profile, for example:
1
# From Maven
2
./mvnw spring-boot:run -Dspring-boot.run.profiles=prod
3
4
# From Java startup command
5
java -jar target/...jar -Dspring.profiles.active=prod
Copied!

Samples

Last modified 1yr ago