Professional Cloud Security EngineerEnsuring data protectionEasy
A development team is using Google Cloud Secret Manager to store database credentials and API keys. They need to ensure that these secrets are automatically rotated every 90 days without manual intervention to enhance security and reduce the risk of compromise. Which feature of Secret Manager should they configure?
- ASecret Manager automatic rotation with a custom rotation function.
- BIAM conditions to restrict secret access after 90 days.
- CCloud KMS key rotation for the secrets' encryption keys.
- DSecret Manager versioning with a Cloud Functions trigger for rotation.
Show answer & explanationAnswer & explanation
Correct answer: A. Secret Manager automatic rotation with a custom rotation function.
Secret Manager's automatic rotation feature, combined with a custom rotation function (typically implemented as a Cloud Function), is designed to automatically generate and rotate new secret versions at a specified interval, such as every 90 days, without manual intervention.
Why the other options are wrong
- B. IAM conditions control access, not the rotation of the secret values. Restricting access after 90 days would break applications, not rotate credentials.
- C. Cloud KMS key rotation applies to the encryption keys used for Secret Manager, not the secret values (credentials/API keys) themselves.
- D. Versioning manages different secret values but doesn't automate the rotation process itself; a Cloud Function trigger would be needed, but automatic rotation is a built-in feature.
Secret Manager Automatic Rotation
A Google Cloud Secret Manager feature that automatically rotates secret values at a specified interval by invoking a custom rotation function (typically a Cloud Function), enhancing security and reducing manual overhead.
- Automates the process of generating new secret values.
- Configurable rotation schedule (e.g., every 90 days).
- Requires a custom rotation function (e.g., Cloud Function).
- Reduces risk by regularly changing credentials.
Memory trick: For secrets to stay fresh, 'Automatic Rotation' is the best, preventing any security test!