Google Professional Cloud Developer Question 103
Single answerGoogle Cloud PlatformYou are developing a cloud-native application that requires secure storage and access to API keys and database credentials. The application is deployed to Google Cloud and needs to ensure secrets are rotated automatically to meet compliance requirements. Which solution should you implement to meet these requirements?
- A
Use Google Secret Manager to securely store secrets, configure IAM roles for access, and set up automatic secret rotation.
- B
Store secrets in a Cloud Storage bucket, encrypt them with Cloud Key Management Service (Cloud KMS), and manage rotation manually.
- C
Embed the secrets directly in the application code and redeploy the application whenever the secrets change.
- D
Use Compute Engine instance metadata to store secrets and access them only from the application’s host VM.
Show answer and explanation
Correct answer: A
Explanation
The best solution for securely storing, accessing, and automatically rotating secrets in Google Cloud is to use Google Secret Manager. It is designed specifically for secret management, supports automatic rotation, integrates with IAM for fine-grained access control, and ensures compliance with security and regulatory requirements. The other options either lack essential features like automatic rotation or introduce significant security risks.
- A. Correct.
Google Secret Manager is the recommended solution for securely storing and accessing application secrets. It supports automatic rotation and integrates with IAM for granular access control, meeting both security and compliance requirements.
- B. Incorrect.
Storing secrets in Cloud Storage with Cloud KMS encryption is a possible solution, but it requires manual rotation of secrets, which does not fulfill the automatic rotation requirement.
- C. Incorrect.
Embedding secrets directly in application code is highly insecure and violates best practices for managing secrets, as it exposes sensitive data and complicates updates.
- D. Incorrect.
Using Compute Engine instance metadata for storing secrets is not intended for secret management and poses security risks, as it does not provide robust access control or automatic rotation.