--- title: "Getting Started with GCP Secrets Manager" description: "Keep your credentials secure and useful in this getting started guide to the GCP Secrets Manager in the Google Cloud Platform!" canonical: "https://adamtheautomator.com/gcp-secrets-manager/" --- # Getting Started with GCP Secrets Manager > Keep your credentials secure and useful in this getting started guide to the GCP Secrets Manager in the Google Cloud Platform! Source: https://adamtheautomator.com/gcp-secrets-manager/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Getting Started with GCP Secrets Manager](https://adamtheautomator.com/wp-content/uploads/2022/12/gcp-secrets-manager.jpg) # Getting Started with GCP Secrets Manager [![](https://secure.gravatar.com/avatar/2788bb1a3f735603f81eca51d68daec56a9d97e805a10268fb2c20afcc76b81b?s=192&d=mm&r=g)Nicholas Xuan Nguyen](https://adamtheautomator.com/author/nicholas-xuan-nguyen/)21 December 20226 min. read Categories: [DevOps](/category/devops/) Tags:[Google Cloud](/tag/google-cloud/) Table of Contents * [Prerequisites](#prerequisites) * [Creating a New Google Cloud Project](#creating-a-new-google-cloud-project) * [Enabling the Secrets Manager API and Other APIs](#enabling-the-secrets-manager-api-and-other-apis) * [Generating an SSH Key Pair](#generating-an-ssh-key-pair) * [Creating a Secret in GCP Secrets Manager](#creating-a-secret-in-gcp-secrets-manager) * [Using a Secret to SSH Into an Ubuntu Machine](#using-a-secret-to-ssh-into-an-ubuntu-machine) * [Cleaning Up Resources](#cleaning-up-resources) * [Conclusion](#conclusion) API keys, SSH keys, passwords, and other secrets are the lifeblood of modern web applications. Keeping secrets secure yet accessible only to authorized users is critical. But how? Google Cloud Platform (GCP) Secrets Manager is up to the task. GCP Secrets Manager helps organizations manage and keep their secrets from prying eyes. And in this tutorial, you will learn how to start with GCP Secrets Manager and protect your sensitive data. Read on to up your security game with GCP Secrets Manager! ## Prerequisites This tutorial will be a hands-on demonstration. To follow along, be sure you have the following: * A GCP account with billing enabled to get access to the Secrets Manager service in the Cloud Console – But a [free trial](https://cloud.google.com/free) is available where you get $300 of free credit (enough for this tutorial). * A Ubuntu Linux VM instance to generate an SSH key – This tutorial uses Ubuntu 20.04, but any other recent version should also work. Related:[How to Install Ubuntu 20.04 \[Step-by-Step\]](https://adamtheautomator.com/install-ubuntu/) ## Creating a New Google Cloud Project Taking advantage of services in GCP, like the GCP Secrets Manager, requires a dedicated environment to work in, a Google Cloud Project. This project ensures all your associated resources are kept from messing with other projects. 1\. Open your web browser, navigate the [GCP Cloud Resource Manager](https://console.cloud.google.com/cloud-resource-manager) page, and click **CREATE PROJECT**, as shown below. ![Initiating creating a new Google Cloud project](https://adamtheautomator.com/wp-content/uploads/2022/12/image-224.png) Initiating creating a new Google Cloud project 2\. Next, provide your **Project name** and **Location** (a parent organization or folder), and click **CREATE** to finalize creating the project. You can use any name as long as it is globally unique within GCP. ![Creating a new Google Cloud project ](https://adamtheautomator.com/wp-content/uploads/2022/12/image-225.png) Creating a new Google Cloud project You will see a similar notification message, as shown below, which indicates your project has been created. ![Confirming the project has been created](https://adamtheautomator.com/wp-content/uploads/2022/12/image-226.png) Confirming the project has been created 3\. Once created, navigate to the [Project Selector](https://console.cloud.google.com/projectselector2/home/dashboard) page, and select the newly created project from the list. Doing so lets you set an active project to work on. ![Selecting the newly created project](https://adamtheautomator.com/wp-content/uploads/2022/12/image-227.png) Selecting the newly created project ## Enabling the Secrets Manager API and Other APIs API is the core of GCP Secrets Manager. And before you can use the GCP Secrets Manager service, you first need to enable the required APIs in your project. 1\. In the Google Cloud Console, click the Activate Shell Icon (upper-right) to activate the Cloud Shell, and a new shell pane opens, as shown below. Cloud Shell is a browser-based shell that lets you manage and administer GCP resources from anywhere. ![Activating the Google Cloud Shell](https://adamtheautomator.com/wp-content/uploads/2022/12/image-228.png) Activating the Google Cloud Shell 2\. Next, run the following [`gcloud services`](https://cloud.google.com/sdk/gcloud/reference/services) command to `enable` the required APIs in the current project. This command enables the Cloud Run API, Cloud Build API, and Secrets Manager API. Related:[How to Deploy Scalable Containerized Apps With GCP Cloud Run](https://adamtheautomator.com/gcp-cloud-run/) ```bash gcloud services enable run.googleapis.com \ cloudbuild.googleapis.com \ secretmanager.googleapis.com ``` 3\. Now, click **AUTHORIZE** when prompted to give permissions for the `gcloud` CLI to enable the APIs. Related:[How to Perform a gcloud CLI Install and Manage Google Cloud](https://adamtheautomator.com/gcloud-cli-install/) ![Authorizing Cloud Shell ](https://adamtheautomator.com/wp-content/uploads/2022/12/image-229.png) Authorizing Cloud Shell You will see a similar success message when the APIs are enabled in your project, as shown below. ![Verifying required APIs are enabled](https://adamtheautomator.com/wp-content/uploads/2022/12/image-230.png) Verifying required APIs are enabled ## Generating an SSH Key Pair Now you have enabled the required APIs, you are almost ready to create your first secret. But first, you need data to store as a secret. For this tutorial, you will generate an SSH key pair to store as a secret, which you can use to SSH into an Ubuntu Linux instance. Related:[Google Key Management (GCP KMS) : Getting Started Guide](https://adamtheautomator.com/gcp-kms/) 1\. Open your terminal on your Ubuntu machine, and run the below `ssh-keygen` command. This command generates an SSH key pair named _`gcp-secrets-manager-demo`._ But of course, you can set your preferred name instead. This SSH key pair is of type `ed25519` with a key size of `250` bits. ```bash ssh-keygen -a 250 -t ed25519 -f gcp-secrets-manager-demo ``` Press Enter when prompted to accept the default values. You will see an output similar to the following image indicating the SSH key pair has been generated. ![Generating an SSH key pair](https://adamtheautomator.com/wp-content/uploads/2022/12/image-231.png) Generating an SSH key pair 2\. Next, run the `ls` command below to list all (`-la`) generated SSH key pairs. ```bash ls -la gcp-secrets-manager-demo* ``` If the SSH key pair generation worked correctly, you would see two files as follows:
Key FileKey File
gcp-secrets-manager-demoThe private SSH key. This key should only be accessible to you and never shared with anyone.
gcp-secrets-manager-demo.pubThe public SSH key. This key can safely be shared with other users as it holds no secrets.
![Listing all generated SSH key pairs](https://adamtheautomator.com/wp-content/uploads/2022/12/image-232.png) Listing all generated SSH key pairs Related:[Listing Files and Folders With the ls Command](https://adamtheautomator.com/linux-directory-commands/#Listing_Files_and_Folders_With_the_ls_Command) 3\. Lastly, open the private SSH key in your preferred text editor. ```bash nano gcp-secrets-manager-demo ``` Copy and save the private key, similar to the one below, in a safe place, as you will need this key later to create a secret. ![Copying the private key to a safe place](https://adamtheautomator.com/wp-content/uploads/2022/12/image-233.png) Copying the private key to a safe place ## Creating a Secret in GCP Secrets Manager With an SSH key generated, it is time to make the private key a secret stored in GCP Secrets Manager. The GCP Secrets Manager is the best storage option for API keys, SSH keys, database credentials, and so on (secrets). With GCP Secrets Manager, your secret is hidden and will not accidentally upload to GitHub or similar repositories. This behavior ensures secrets are secure, encrypted, and accessible only to authorized users. Navigate to the [Secret Manager page](https://console.cloud.google.com/security/secret-manager) in the GCP Cloud Console, and click **CREATE SECRET** to initiate creating a new secret. ![Initiating creating a new secret](https://adamtheautomator.com/wp-content/uploads/2022/12/image-234.png) Initiating creating a new secret Now, configure the following secret details: * **Name** – Enter a unique name for the secret, which must not contain any sensitive information. Note that this name can only contain lowercase letters, numbers, and hyphens. * Enter the private SSH key you copied in the last step of the “Generating an SSH Key Pair” section. * Keep other settings as is, and click **CREATE SECRET** to finalize creating your secret. ![Creating a secret in GCP Secrets Manager](https://adamtheautomator.com/wp-content/uploads/2022/12/image-235.png) Creating a secret in GCP Secrets Manager You will see an **Enabled** status similar to the one below, indicating that your secret is ready for use. ![Verifying the newly-created secret is ready](https://adamtheautomator.com/wp-content/uploads/2022/12/image-236.png) Verifying the newly-created secret is ready ## Using a Secret to SSH Into an Ubuntu Machine You have successfully created a secret in GCP Secrets Manager. Now what? That secret will just sit there unless you put it to good use. Since your secret is an SSH private key, you will SSH into your Ubuntu machine using your secret. Before SSHing into your Linux machine, you first have to get access to your secret: 1\. Run the [`gcloud secrets`](https://cloud.google.com/sdk/gcloud/reference/secrets) command below in your Google Cloud Shell to obtain the data (the SSH private key you stored) associated with your secret. Replace the `my-ssh-key` with the actual name of your secret and `1` with the version of your secret. Doing so lets you verify the correct version of the secret you plan to use. ```bash gcloud secrets versions access 1 --secret=my-ssh-key ``` ![Obtaining the data associated with the newly-created secret](https://adamtheautomator.com/wp-content/uploads/2022/12/image-237.png) Obtaining the data associated with the newly-created secret 2\. Next, run the below command to write out your secret’s (`my-ssh-key`) value (version `1`) to a text file (_`gcp-secrets-manager-demo.txt`_) in raw text format. This command does not provide output to the Cloud Shell, but you will later test your secret in the following steps. ```bash gcloud secrets versions access 1 --secret=my-ssh-key > gcp-secrets-manager-demo.txt ``` 3\. Lastly, run the following [`ssh`](https://www.ssh.com/academy/ssh/command) command to connect to your Ubuntu instance. In the command below, you use the private SSH key saved to the `gcp-secrets-manager-demo.txt` text file. Ensure you replace `username` with your actual username and `ip-address` with the IP address of your instance. `ssh -i gcp-secrets-manager-demo.txt username@ip-address` Enter the password associated with the username when prompted, and you will now be successfully logged in to your Ubuntu instance, as shown below. As you can see, no one other than authorized users (you, in this case) can access the private SSH key stored in GCP Secrets Manager. ![Connecting to your Ubuntu instance](https://adamtheautomator.com/wp-content/uploads/2022/12/image-238.png) Connecting to your Ubuntu instance ## Cleaning Up Resources You have managed to SSH into your Ubuntu machine without exposing your secret to anyone. But keep in mind that you will incur charges to your GCP account unless you clean up your resources. To clean up your resources, delete your project and the resources associated with it: Open the [GCP Cloud Resource Manager](https://console.cloud.google.com/cloud-resource-manager) on your browser, tick the checkbox next to the project name, and click **DELETE** to delete the entire project. ![Deleting a project](https://adamtheautomator.com/wp-content/uploads/2022/12/image-239.png) Deleting a project Now, type in the **Project ID**, and click **SHUT DOWN** to confirm the deletion. ![Confirming the project deletion](https://adamtheautomator.com/wp-content/uploads/2022/12/image-240.png) Confirming the project deletion ## Conclusion Securely storing and managing secrets can be challenging for IT professionals, but with GCP Secrets Manager, you are in good hands. And in this tutorial, you have learned how to store sensitive data as secrets securely. At this point, you are now confident in managing secrets securely in GCP Secrets Manager. But SSHing into a remote machine is just one of the perks of having secrets. Now, why not [rotate your secrets](https://cloud.google.com/secret-manager/docs/secret-rotation) to keep them even more secure? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fgcp-secrets-manager%2F&text=Getting%20Started%20with%20GCP%20Secrets%20Manager)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fgcp-secrets-manager%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fgcp-secrets-manager%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2022/12/gcp-cloud-functions.jpg) ### [GCP Cloud Functions Customize Your Serverless Workflow](/gcp-cloud-functions/) Learn how to build and deploy scalable, serverless applications using GCP Cloud Functions. This tutorial covers essential concepts and best practices for streamlined workflows. ![](https://adamtheautomator.com/wp-content/uploads/2023/01/google-cloud-storage-python.jpg) ### [How to Install & Use the Google Cloud Storage Python Client](/google-cloud-storage-python-client/) Discover how to use the Google Cloud Storage Python client in your projects and make your DevOps pipelines work even better! ![](https://adamtheautomator.com/wp-content/uploads/2022/12/gsutil.jpg) ### [Learning the gsutil Command Through Examples](/gsutil/) Discover the many uses of the gsutil command and learn through examples how to utilize this command-line tool to make your management job easier! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)