Google Professional Cloud Security Engineer Question 309
Select 3Google Cloud PlatformYour organization is building a cloud-native application that requires storing API keys and database credentials securely. The application runs on Google Kubernetes Engine (GKE) and accesses these secrets at runtime. Which of the following best practices should you follow to securely manage and access these secrets using Secret Manager?
- A
Grant the GKE service account the roles/secretmanager.secretAccessor role.
- B
Store secrets in environment variables for easy access by the application.
- C
Enable Secret Manager's audit logs to monitor access to secrets.
- D
Use Kubernetes ConfigMaps to store and manage sensitive information like API keys.
- E
Rotate secrets regularly and update the application with the new versions automatically.
Show answer and explanation
Correct answers: A, C, E
Explanation
To securely manage secrets with Secret Manager in a GKE environment, you should grant the necessary permissions to the service account, enable audit logging to monitor access, and implement secret rotation to reduce potential risks. Avoid using insecure practices like storing secrets in environment variables or ConfigMaps, as these approaches do not provide the same level of security as Secret Manager.
- A. Correct.
Granting the GKE service account the roles/secretmanager.secretAccessor role ensures that the application running in GKE has the necessary permissions to access secrets stored in Secret Manager. This is a secure and recommended approach.
- B. Incorrect.
Storing secrets in environment variables is not a secure practice because environment variables can be easily accessed or leaked, leading to potential security risks.
- C. Correct.
Enabling Secret Manager's audit logs is a best practice to monitor and track access to secrets. This helps in identifying unauthorized access or potential security breaches.
- D. Incorrect.
Kubernetes ConfigMaps are not designed to handle sensitive data securely. For managing sensitive information like API keys, Secret Manager is the recommended solution.
- E. Correct.
Rotating secrets regularly and updating the application with the new versions ensures that secrets are up-to-date and minimizes the risk of unauthorized access in case a secret is compromised.