Professional Cloud Security EngineerEnsuring data protectionMedium
A development team is using Google Cloud Secret Manager to store API keys and database credentials. To enhance security and comply with internal policies, they need to ensure that these secrets are automatically updated with new random values every 90 days. Additionally, they must ensure that only the latest active version of the secret is used by applications, and older versions are automatically disabled after a grace period. Which Secret Manager feature set should they leverage?
- ASecret Manager access control via IAM conditions
- BSecret Manager versioning and manual rotation
- CSecret Manager replication policies
- DSecret Manager automatic rotation with a custom rotation function
Show answer & explanationAnswer & explanation
Correct answer: D. Secret Manager automatic rotation with a custom rotation function
Secret Manager's automatic rotation feature, combined with a custom rotation function (typically a Cloud Function), allows secrets to be programmatically updated at a specified interval (e.g., 90 days). This rotation process creates new secret versions and can be configured to automatically disable older versions after a grace period, meeting all requirements.
Why the other options are wrong
- A. IAM conditions control who can access secrets but do not automate secret rotation or version management.
- B. Manual rotation requires human intervention and doesn't meet the 'automatically updated' requirement.
- C. Replication policies define where secret data is stored geographically but do not handle rotation or version lifecycle.
Secret Manager Automatic Rotation
A Google Cloud Secret Manager feature that automates the process of updating secrets at a specified interval, typically using a Cloud Function to generate and apply new secret values.
- Enhances security by regularly changing credentials.
- Reduces operational overhead for secret management.
- Supports custom logic for secret generation and update.
Memory trick: Rotate your secrets automatically, like clockwork.