Use Secrets Manager for Managing Secrets in Google Cloud Run functions (formerly Cloud Functions)

Sign in to the Google Cloud Management Console.

Select the GCP project that you want to examine from the console top navigation bar.

Navigate to the Cloud Run console available at https://console.cloud.google.com/functions.

In the navigation panel, choose Services. Click on the name (link) of the service that you want to examine.

Select the Containers tab and examine the Variables & Secrets section. Plain-text environment variables are listed with their raw keys and values, while secrets referenced from Secret Manager are listed as environment variables or mounted volumes. Determine if the plain-text environment variables are storing secret information such as access keys, API keys, user passwords, database credentials, access tokens, and sensitive configuration settings. If the plain-text environment variables defined for the selected Google Cloud function contain secret, sensitive information, the function configuration is not secure and compliant.

Repeat steps no. 4 and 5 for each Google Cloud function deployed within the selected GCP project.

Repeat steps no. 2 – 6 for each project available in your Google Cloud Platform (GCP) account.

Run projects list command (Windows/macOS/Linux) with custom query filters to list the ID of each GCP project available within your Google Cloud account:

gcloud projects list
--format="table(projectId)"

The command output should return the requested GCP project identifier(s):

PROJECT_ID
cc-web-app-project-112233
cc-bigdata-project-123123

Run functions list command (Windows/macOS/Linux) using the ID of the GCP project that you want to examine as the identifier parameter and custom filtering to describe the name, region, and generation of each function deployed within the selected project:

gcloud functions list
--project cc-web-app-project-112233
--format="table(name.basename():label=NAME, name.scope('locations').segment(0):label=REGION, environment:label=GENERATION)"

The command output should return the requested function identifier(s), along with their region and generation:

NAME                  REGION       GENERATION
cc-worker-function    us-central1  GEN_1
cc-project5-function  us-central1  GEN_2

Run run services list command (Windows/macOS/Linux) using the ID of the same GCP project as the identifier parameter and custom filtering to describe the name and region of each Cloud Run service deployed within the selected project. This command does not return 1st-gen functions, since 1st-gen functions are not Cloud Run services:

gcloud run services list
--project cc-web-app-project-112233
--format="table(metadata.name:label=NAME, region:label=REGION)"

The command output should return the requested Cloud Run service identifier(s). 2nd-gen functions (shown as GEN_2 in step 4) are deployed as Cloud Run services and appear here as well; 1st-gen functions (GEN_1) do not:

NAME                  REGION
cc-project5-function  us-central1

Run functions describe command (Windows/macOS/Linux) using the name of the function that you want to examine as the identifier parameter and custom filters to describe the runtime and build environment variables defined for the selected function:

gcloud functions describe cc-worker-function
--format="json(serviceConfig.environmentVariables,buildConfig.environmentVariables)"

The command output should return the requested key/value pairs (i.e. runtime and build environment variables):

{
  "serviceConfig": {
    "environmentVariables": {
      "CC_API_KEY": "ABCD1234ABCD1234ABCD1234"
    }
  },
  "buildConfig": {
    "environmentVariables": {
      "CC_BUILD_VER": "2.4"
    }
  }
}

Check the key/value pairs returned by the functions describe command output to determine if your environment variables are storing secret information such as access keys, API keys, user passwords, database credentials, access tokens, and sensitive configuration settings. If the environment variables configured for the selected Google Cloud function contain secret and/or sensitive information, the function configuration is not secure and compliant.

If the selected function is a 2nd-gen function (i.e. it also appears in the run services list output from step 6), run run services describe command (Windows/macOS/Linux) using the name of the Cloud Run service as the identifier parameter and custom filters to describe the environment variables defined directly on the underlying Cloud Run service:

gcloud run services describe cc-project5-function
--format="json(spec.template.spec.containers[0].env)"

The command output should return the requested key/value pairs (i.e. container environment variables):

{
  "spec": {
    "template": {
      "spec": {
        "containers": [
          {
            "env": [
              {
                "name": "CC_API_KEY",
                "value": "ABCD1234ABCD1234ABCD1234"
              }
            ]
          }
        ]
      }
    }
  }
}

Check the key/value pairs returned by the run services describe command output to determine if your environment variables are storing secret information such as access keys, API keys, user passwords, database credentials, access tokens, and sensitive configuration settings. This step may surface environment variables configured directly on the Cloud Run service that are not reflected in the functions describe output. If the environment variables configured for the selected Cloud Run service contain secret and/or sensitive information, the function configuration is not secure and compliant.

Repeat steps no. 7 - 10 for each Google Cloud function deployed within the selected GCP project.

Repeat steps no. 3 - 12 for each project created within your Google Cloud Platform (GCP) account.

Sign in to the Google Cloud Management Console.

Select the GCP project that you want to access from the console top navigation bar.

Navigate to the API Library page available at https://console.cloud.google.com/apis/library.

Type Secret Manager API in the Search for API & Services search box and press Enter.

Click on the name of the Secret Manager API to open the API overview page.

On the API overview page, choose ENABLE to enable the Secret Manager API for your GCP project.

Navigate to Secret Manager page at https://console.cloud.google.com/security/secret-manager.

A Secret Manager secret is an encrypted wrapper around a collection of secret data versions. Choose CREATE SECRET and follow the setup wizard to create the Secret Manager secret that will replace the secret information stored in cleartext within the function environment variable.

For Name, enter the name of the environment variable that you are replacing. This will be the secret variable that will be referenced in your code.

For Secret value, enter the value from the environment variable that you are replacing. This is the actual value of the variable that will be referenced from your code.

Configure the secret encryption, replication policy, secret rotation and expiration based on your application requirements, then choose CREATE SECRET to create your new Secret Manager secret.

To grant your function's service account access to the new secret, open the newly created Secret Manager secret, select the PERMISSIONS tab, and choose GRANT ACCESS.

On the Grant access to "[secret-name]" panel, enter the service account that your function uses for its identity in the New principals box and select Secret Manager Secret Accessor from the Role dropdown list. Choose SAVE to apply the changes.

Modify your function configuration to use the new secret managed by Secret Manager. Navigate to the Cloud Run console available at https://console.cloud.google.com/run.

In the navigation panel, choose Services. Click on the name (link) of the service that you want to configure, then choose EDIT & DEPLOY NEW REVISION.

Select the Containers tab and choose the Variables & Secrets tab.

Under Secrets exposed as environment variables, choose ADD SECRET REFERENCE and follow the setup process to create the secret reference that will replace the secret information stored in cleartext within the function environment variable. Choose DONE to save the changes.

Choose DEPLOY to deploy the new revision.

After the secret information that replaced the environment variable has been successfully referenced, you can safely remove the non-compliant environment variable from your function configuration. Choose EDIT & DEPLOY NEW REVISION, select the Containers tab, and choose the Variables & Secrets tab.

Use the Delete item (trash bin icon) button to remove any plain-text environment variable that holds secret, sensitive information, listed under Variables & Secrets. Per the note above, this applies only to runtime environment variables — a non-compliant build-time environment variable must be removed from your build configuration directly, since it cannot be referenced from Secret Manager.

Choose DEPLOY to deploy the new revision.

Repeat steps no. 7 - 21 for each Google Cloud function deployed within the selected GCP project.

Repeat steps no. 2 – 22 for each GCP project available in your Google Cloud Platform (GCP) account.

Run services enable command (Windows/macOS/Linux) using the ID of the GCP project that you want to configure as the identifier parameter, to enable the Secret Manager API for the selected project:

gcloud services enable secretmanager.googleapis.com
--project cc-web-app-project-112233

If successful, the command output should return the ID and status of the performed operation:

Operation "operations/acat.p0-123456789012-abcd1234-abcd-1234-abcd-1234abcd1234" finished successfully.

Run secrets create command (Windows/macOS/Linux) to create the Secret Manager secret that will replace the secret information stored in cleartext within the specified function environment variable:

gcloud secrets create CC_API_KEY
--replication-policy automatic
--data-file="secret-file.txt"

If successful, the command output should return the version of the newly created secret:

Created version [1] of the secret [CC_API_KEY]

Run secrets add-iam-policy-binding command (Windows/macOS/Linux) to grant your function's service account access to the new Secret Manager secret:

gcloud secrets add-iam-policy-binding CC_API_KEY
--member="[service-account-name]"
--role="roles/secretmanager.secretAccessor"

The command output should return the new policy available for the configured Secret Manager secret:

Updated IAM policy for secret [CC_API_KEY].
bindings:
- members:
  - serviceAccount:[service-account-name]
  role: roles/secretmanager.secretAccessor
etag: ABCD1234ABCD
version: 1

Run functions deploy command (Windows/macOS/Linux) using the name of the function that you want to configure as the identifier parameter, to bind the new Secret Manager secret as a secret environment variable and redeploy the function:

gcloud functions deploy cc-worker-function
--update-secrets=CC_API_KEY=CC_API_KEY:1

If successful, the command output should return the ID and status of the performed operation:

Operation "operations/acat.p1-123456789012-abcd1234-abcd-1234-abcd-1234abcd1234" finished successfully.

After the secret information that replaced the environment variable has been successfully referenced, you can safely remove the non-compliant environment variable from your function configuration. Run functions deploy command (Windows/macOS/Linux) using the name of the environment variable that you want to delete as the identifier parameter, to remove the specified variable from your function configuration and redeploy the function:

gcloud functions deploy cc-worker-function
--remove-env-vars CC_API_KEY

If successful, the command output should return the ID and status of the performed operation:

Operation "operations/acat.p1-123456789012-abcd1234-abcd-1234-abcd-1234abcd1234" finished successfully.

Repeat steps no. 3 - 10 for each Google Cloud function deployed within the selected GCP project.

Repeat steps no. 1 – 11 for each GCP project available in your Google Cloud Platform (GCP) account.