Google Cloud Secret Manager Integration

See External Secrets for more on the general topic of Secret Server and external vaults. For broader Secret Server documentation, see the Secret Server online help.

Introduction

The Google Cloud Secret Manager Integration simplifies management and governance of non-human identities (NHIs) and secrets stored in Google Cloud Platform (GCP). With Secret Manager you can centrally manage and update secrets across one or more GCP projects, and rotate passwords or values more frequently. With fine-grained roles and permissions, audit, and logging, the GCP integration provides increased governance, visibility, and awareness of secrets managed in Google Cloud Secret Manager without affecting development velocity or processes. The GCP integration is available on Secret Server Cloud, the Platform, and Secret Server On-Premise.

With the Google Cloud Secret Manager connector, you can:

  • Link external vaults to Secret Server.
  • Identify and categorize non-human identities into folders.
  • Manage and sync secrets from external vaults to a central Delinea vault.
  • Control access by applying fine-grained permissions.
  • Regularly rotate secrets to maintain a strong security posture.
  • Use Secret Server to keep external vaults in sync.

What is Google Cloud Secret Manager?

Google Cloud Secret Manager is a managed service for storing API keys, passwords, certificates, and other sensitive data on Google Cloud Platform. Secrets are encrypted at rest using Google-managed or customer-managed encryption keys, replicated across regions for high availability, and accessed through IAM-controlled APIs. The Delinea Google Cloud Secret Manager connector is a connection to GCP with GUI elements on the Secret Server side.

Google Cloud Secret Manager endpoints are internet-accessible over HTTPS (port 443). A Distributed Engine is only required when Secret Server's web server has restricted egress and cannot reach the public internet. See Distributed Engine Support for details.

Key features of Google Cloud Secret Manager include:

  • Access Control: Uses Google Cloud IAM with predefined and custom roles for fine-grained permissions on projects and individual secrets.
  • Auditing and Monitoring: Cloud Audit Logs records every secret access and administrative operation.
  • Encryption: Secrets are encrypted at rest with Google-managed keys by default, with the option to bring your own key (CMEK) via Cloud KMS.
  • Versioning: Each secret can have many versions; versions are auto-numbered and can be enabled, disabled, or destroyed independently.
  • Replication Policies: Choose automatic multi-region replication or specify user-managed replication locations.
  • Secrets Management: Securely stores and controls access to tokens, passwords, API keys, and certificates.

To use Google Cloud Secret Manager, the Secret Manager API must be enabled on the GCP project that holds the secrets. To learn more, see the Google Cloud Secret Manager documentation.

Connecting with GCP—The Service Account Setup Process

The following multi-part procedure makes GCP projects available in Secret Server.

Prerequisites

Enable the following APIs on the GCP project that will hold the secrets:

  • Secret Manager API—required for all secret read and write operations.
  • Cloud Resource Manager API—required for project discovery in the Automatic list input type.

Creating a Service Account and Granting Permissions

A service account is the GCP identity Secret Server uses to authenticate to Secret Manager. Two permission approaches are supported: predefined IAM roles (recommended) or a custom set of minimum permissions.

If you can use Google's built-in roles, assign the following to the service account:

  • roles/secretmanager.admin—full read and write access to secrets and versions.
  • roles/browser—grants resourcemanager.projects.get, required for project discovery in the Automatic list input type.

To assign roles:

  1. Go to https://console.cloud.google.com.
  2. Navigate to IAM & Admin > Service Accounts and create the service account (or open an existing one).
  3. Open IAM & Admin > IAM and grant the service account the Secret Manager Admin and Browser roles on the project.

Option B: Custom IAM Permissions (Minimum)

If your organization restricts predefined roles, create a custom role with the minimum permissions the integration requires:

Permission Description
secretmanager.secrets.list Lists secrets.
secretmanager.secrets.get Gets secret metadata (not the secret payload).
secretmanager.versions.access Accesses the payload of a secret.
secretmanager.secrets.create Creates a new secret.
secretmanager.versions.add Adds a new version to an existing secret.
secretmanager.versions.disable Disables a secret version.
resourcemanager.projects.get Gets information about a project (required for project discovery in Automatic list).
One of these two permission approaches must be configured for the Secret Server credential secret. If neither a predefined role nor an equivalent custom role is assigned, Secret Server cannot access the project's secrets.

Creating a Service Account Key

Secret Server authenticates using a JSON service account key.

  1. In the GCP Console, navigate to IAM & Admin > Service Accounts and click the service account.

  2. Select the Keys tab and click Add Key > Create new key.

  3. Select JSON and click Create.

  4. The private key JSON file downloads automatically. Store it securely.

    You must download and copy the key contents at the time of creation. Google does not allow you to retrieve a key's private content later. If you do not save the file at this time, you have to create a new key.

Creating the GCP Credential Secret in Secret Server

  1. Access Secret Server.

  2. Create a new secret using the Google IAM Service Account Key template.

  3. Fill in the following fields:

    • Secret name: Give the secret an appropriate display name.
    • Email: The service account email (the client_email value from the downloaded JSON, for example <sa-name>@<project-id>.iam.gserviceaccount.com).
    • Private Key Id: The key ID (the private_key_id value from the JSON).
    • JSON Private Key: Upload the JSON key file downloaded in the previous step.
    • Optionally, fill in the Notes field.
    • Optionally, change the Site field to one you need, otherwise leave as Default.

  4. Select Create Secret to save your changes.

Firewall and Network Requirements

Secret Server communicates with Google Cloud Secret Manager over HTTPS (port 443).

  • GCP Secret Manager endpoints are internet-accessible—no Distributed Engine is required for basic connectivity.
  • If Secret Server is on a private network with restricted egress, a Distributed Engine with internet access is required. See Distributed Engine Support.

Requirements for direct connectivity from the Secret Server web server:

  • Outbound HTTPS (port 443) to secretmanager.googleapis.com and cloudresourcemanager.googleapis.com.
  • DNS resolution of *.googleapis.com from the web server.
  • If using a proxy for outbound traffic, ensure the proxy allows connections to *.googleapis.com on port 443.
If you intend to use the Automatic list feature to select projects, the service account must have the Cloud Resource Manager API enabled and either roles/browser or resourcemanager.projects.get.

  1. Access Secret Server.

  2. From the left navigation panel, select Secrets > External Secrets. The External Secrets page appears.

  3. Click the Create dropdown button and select Create External Vault Link. The Create External Vault Link page appears.

  4. For Type, select Google Secret Manager.

  5. For Site, leave at the default for operations to run on the Secret Server web server, or choose a non-local Site to route through a Distributed Engine. See Distributed Engine Support.

  6. For Credential secret, select the No secret selected link and choose the secret you created previously. A green Connected indicator confirms the credential can reach GCP.

  7. For Input type:

    1. If you choose Automatic list:

      1. Secret Server queries the credential's reachable GCP projects and presents them as a checklist.
      2. Click to select the checkboxes for the desired projects.

    2. If you choose Manual entry:

      1. External name (subtitle: Project ID): Type the GCP project ID. This name MUST exactly match the project ID in GCP to correctly link them.
      2. Display name: Automatically matches the External name unless you change it manually.

  8. Select Save.

  9. You are prompted to synchronize the external vault. This step performs a pull on the vault and then a push on each active and linked external secret. This pulls all the secrets from the linked GCP project into the Secret Server UI.

  10. Synchronize the vault. The external vault summary page will show these results:

    • Name of the vault.
    • State: enabled or disabled.
    • Last pull status.
    • Number of external secrets.
    • Credential secret used.

  11. Select the External Secrets tab to view the list of external secrets.

  12. Change the Status to All states to view the list of external secrets. All external secrets are initially disabled. This means no secrets are synchronized from Secret Server to the GCP project.

Project Discovery (Automatic List)

When Automatic list is chosen, Secret Server queries Google Cloud Resource Manager using the credential and presents the projects the service account can reach.

  • Requires the Cloud Resource Manager API enabled on at least one accessible project.
  • Requires roles/browser or an equivalent permission containing resourcemanager.projects.get.
  • Lists GCP projects accessible by the service account.

If permissions are missing, discovery fails. Use Manual entry instead and specify the project ID directly.

Distributed Engine Support

The cross-vault Distributed Engine concept and procedure are documented on the External Secrets parent page. GCP-specific guidance:

GCP Secret Manager endpoints are internet-accessible, so a Distributed Engine is only needed when Secret Server's web server cannot reach the public internet (restricted egress). Assign the vault to a non-local Site whose Distributed Engine has internet access.

To route a GCP vault through a Distributed Engine:

  1. Create a non-local Site in Admin > Distributed Engine.
  2. Register and activate an engine on that Site with outbound HTTPS access to *.googleapis.com.
  3. Edit the external vault and set the Site dropdown to the non-local Site.

Managing External Secrets

  1. Log into Secret Server.

  2. Navigate to Secrets > External Secrets. The External Secret grid appears.

    After you have linked at least one external vault, you will see a list of external secrets here.

  3. In the grid you can:

    • Search for a specific secret.
    • View all secrets, enabled or disabled.
    • View only "enabled" or "disabled" secrets.
    • View or manage permissions.
    • View audit events.
    • View the log.

  4. Select a secret in the grid. Now, you can perform a few more actions:

    • Set remote value: Sets a new value on the external secret in GCP.

    • View remote value: View the current value on the external secret in GCP.

    • Push: Propagates the changes made through edits to the secret(s).

    • Edit: Modify the secret and set properties.

    • Enable or disable synchronization for the secret.

    • Select a secret to link to. That secret serves as the master secret in Secret Server.

      You can link one or more external secrets to a single master secret. You can sync the same secret from a single master secret to secrets in multiple GCP projects.

    • Perform Remote Password Changing (RPC) on the master, which propagates to all the enabled linked external secrets.

    • Transform, which allows you to select the fields you want updated on the external secret(s).

      Transforms are defined in the secret template for the master secret. For example, Password (password) links the password field from the master secret and updates all linked enabled external secrets with the value of the password field.

      You can also define a string format and insert field values from the linked secret using $secret.slug.notation. For example, Password: $secret.slug.password sets the external secret value as password 1234pass, where 1234pass is the actual password from the master secret. Transform allows you to copy and paste the slug name or simply click on the + sign to add it in the box below.

Bulk Operations with the External Secret Grid

The external secret grid provides a central location in Secret Server to manage external secrets. When selecting external secrets in the grid, you can select to push or edit these items all at once, which is a bulk operation. This is useful for linking multiple external secrets from one or more projects to a single master secret.

Performing a bulk operation on multiple external secrets:

  1. Select all or a few secrets from the grid.

  2. Push and Edit are now available actions for these secrets.

    • Push allows for changes from the master secret or secrets in Secret Server to affect the linked secrets in GCP.

    • Edit allows you to perform additional bulk actions such as:

      • Toggle the Synchronization enabled/disabled state.

      • Select Apply to all or Cancel.

        Note: The heading shows the number of secrets that will be affected by this bulk action.

Simultaneously Creating Master and External Secrets in GCP

How to create a new master secret along with an external secret at the same time in GCP:

  1. Access Secret Server.
  2. Create a secret using any template. For this example, use the Password secret template.
  3. Fill in the secret name, username, and password fields and select Create Secret. The secret loads automatically on the screen.
  4. Select External Secrets from the left-hand menu.
  5. Click Create, then select Create external secret from the drop-down.
  6. Type in the name of the External secret. This will become the secret name in the selected GCP project.
  7. Choose the External vault where you want to create this secret from the drop-down.
  8. Choose whether to enable Synchronization or not by selecting the checkbox.
  9. For Linked Secret, click on No secret selected and choose the secret you just created.
  10. If you want to sync a field with the external secret, add it to the Transform section.
  11. From the Merge secret field drop-down choose Password (password) to sync passwords from the master secret to the linked secret in GCP.
  12. Select Save to keep your changes.

Version Behavior

Google Cloud Secret Manager treats every secret as a container for an ordered list of versions:

  • Versions are auto-numbered (1, 2, 3, …) by GCP.
  • When Secret Server writes a new version, the previous version is set to DISABLED in GCP.
  • Disabled versions cannot be accessed but are not destroyed—they remain visible in version history and can be re-enabled through the GCP Console or API.