You are building an application that runs on Cloud Run. The application needs to access a third- party API by using an API key. You need to determine a secure way to store and use the API key in…

Storing the API key in Google Cloud Secret Manager provides a centralized, secure, and versioned way to manage sensitive data. Referencing the secret as an environment variable in Cloud Run is a standard and secure practice that injects the secret into the application at runtime without hardcoding it or committing it to source control.

While Secret Manager is correct, mounting the secret under `/sys/api_key` (or any file path) is typically used for specific scenarios like Kubernetes secrets mounted as volumes, but environment variables are the more common and often simpler recommended approach for secrets in Cloud Run, and `/sys` is a system directory not for application secrets.

Cloud Key Management Service (Cloud KMS) is primarily for managing cryptographic keys for encryption, not for storing arbitrary secrets like API keys directly for application consumption as environment variables.

Encrypting the API key with Cloud KMS and passing the encrypted key requires the application to decrypt it, which adds complexity and means the decryption key itself needs to be managed securely, whereas Secret Manager handles direct injection more efficiently.