Your application artifacts are being built and deployed via a CI/CD pipeline. You want the CI/CD pipeline to securely access application secrets. You also want to more easily rotate secrets in case…

Prompting developers for secrets at build time is manual, prone to human error, does not scale, and does not address the need for easy rotation or automated access for the CI/CD pipeline.

Storing secrets in plain text or even encrypted in a configuration file within Git is a significant security risk, as the repository history retains the secrets and access control is less granular than dedicated secret management solutions.

Storing secrets in Cloud Storage, encrypted by a key managed in Cloud Key Management Service (KMS), provides a secure and centralized location for secrets. Granting the CI/CD pipeline's service account appropriate IAM roles allows it to securely retrieve and decrypt secrets at runtime without exposing them directly in source code, and KMS facilitates easy key rotation.

Encrypting secrets in the source code repository and storing a decryption key separately is complex to manage, and the encrypted secrets are still part of the repository history, which is not ideal for robust secret management and rotation compared to a dedicated secret management solution like KMS.