Google Professional Cloud DevOps Engineer Question 218
Select 3Google Cloud PlatformYou are managing the CI/CD pipeline for a production application hosted on Google Cloud Platform. The pipeline requires access to sensitive credentials, such as database passwords and API keys, to deploy the application and run tests. Which of the following are best practices for managing these secrets securely in your CI/CD configuration?
- A
Store all secrets in plaintext within the CI/CD pipeline's configuration files for easier access.
- B
Use Secret Manager to store and manage secrets, and grant the CI/CD service account appropriate IAM permissions to access them.
- C
Encrypt secrets manually and store the encrypted values in the CI/CD pipeline's configuration files.
- D
Use environment variables to inject secrets into the CI/CD pipeline, and ensure these variables are sourced from a secure secret management service.
- E
Restrict access to secrets by using IAM roles and ensure the principle of least privilege is applied.
Show answer and explanation
Correct answers: B, D, E
Explanation
Managing secrets in a CI/CD pipeline requires following best practices to minimize security risks. Using tools like Secret Manager and IAM permissions ensures secrets are stored and accessed securely. Injecting secrets dynamically (e.g., through environment variables) avoids exposing them in plaintext or hardcoding them into configuration files. Applying the principle of least privilege further restricts access to secrets, reducing the risk of unauthorized access.
- A. Incorrect.
Storing secrets in plaintext within configuration files is a security risk as it exposes sensitive information to unauthorized access. This violates best practices for secure secret management.
- B. Correct.
Using Secret Manager to store and manage secrets securely is a best practice. Granting appropriate IAM permissions to the CI/CD service account ensures controlled access to secrets.
- C. Incorrect.
Manually encrypting secrets is error-prone and introduces operational overhead. Modern secret management solutions like Secret Manager automate encryption and decryption processes securely.
- D. Correct.
Using environment variables to inject secrets from a secure secret management service is a best practice, as it avoids hardcoding secrets directly into the CI/CD pipeline configuration.
- E. Correct.
Restricting access using IAM roles and applying the principle of least privilege ensures that only authorized entities can access secrets, minimizing security risks.