Your Google Cloud Platform [GCP] admin has to manage a bunch of API keys for external services that are accessed by different applications, which are used by a few teams. What is the best way to…

Question

Options

• AShare the information in a Github repository and grant access to the repo in IAM as required.
• BStore the information in Secret Manager and give IAM read permissions as re-quired.
• CStore the information in Kubernetes Secrets and only grant read permissions to users as
• DEncrypt the information and store it in Cloud Storage for centralized access. Give the decrypt key

• A
  14% (3)
• B
  73% (16)
• C
  5% (1)
• D
  9% (2)

Explanation

Google Cloud Secret Manager is the purpose-built service for storing, managing, and accessing sensitive data such as API keys, passwords, and credentials. It integrates natively with IAM, allowing granular, audited read access per service account or user without exposing the secret value. Option A (GitHub) is insecure for secrets even with IAM-gated access-secrets in repos risk accidental exposure and lack rotation/audit features. Option C (Kubernetes Secrets) are not centralized and are only practical within a Kubernetes cluster context. Option D (Cloud Storage + encryption) adds operational complexity by requiring separate key management and lacks the native versioning, rotation, and audit logging that Secret Manager provides.

No community discussion yet for this question.