Google Professional Cloud Developer Question 105
Select 3Google Cloud PlatformYou are developing a serverless application that uses sensitive API keys to connect to external services. To securely store, access, and rotate these secrets, you decide to use Google Cloud Secret Manager. How should you implement this to ensure secure access and proper key rotation?
- A
Store the API keys in Secret Manager and grant the application service account 'Secret Manager Secret Accessor' role to access the secrets.
- B
Store the API keys in environment variables for the application, and update them manually during key rotation.
- C
Configure automatic secret version rotation in Secret Manager by setting a rotation policy and using a Cloud Function to update the secret.
- D
Encrypt the API keys using Cloud Key Management Service (KMS) and store the encrypted keys in Cloud Storage.
- E
Use the Secret Manager API in your application code to fetch the secrets dynamically during runtime instead of hardcoding them.
Show answer and explanation
Correct answers: A, C, E
Explanation
To securely store, access, and rotate application secrets, Secret Manager is the recommended solution on Google Cloud. By granting the application service account appropriate roles, configuring automatic secret rotation, and fetching secrets dynamically at runtime, you ensure both security and ease of management. Avoid insecure practices like hardcoding secrets or using environment variables, as they increase the risk of exposure.
- A. Correct.
Correct: Granting the application service account the 'Secret Manager Secret Accessor' role ensures the application can securely access the secrets stored in Secret Manager without exposing them unnecessarily.
- B. Incorrect.
Incorrect: Storing sensitive secrets in environment variables is not a secure practice as it increases the risk of unintentional exposure. Manual key rotation is error-prone and lacks automation.
- C. Correct.
Correct: Configuring automatic secret version rotation in Secret Manager ensures secrets are rotated securely and consistently. Using a Cloud Function for rotation helps automate the process.
- D. Incorrect.
Incorrect: While encrypting keys with Cloud KMS and storing them in Cloud Storage is secure, this approach is less practical for managing dynamic secrets like API keys compared to using Secret Manager.
- E. Correct.
Correct: Fetching secrets dynamically at runtime using the Secret Manager API prevents hardcoding and ensures the application always uses the latest version of the secret.