You use Cloud Build to build and deploy your application. You want to securely incorporate database credentials and other application secrets into the build pipeline. You also want to minimize the…

Question

Options

• ACreate a Cloud Storage bucket and use the built-in encryption at rest. Store the secrets in the
• BEncrypt the secrets and store them in the application repository. Store a decryption key in a
• CUse client-side encryption to encrypt the secrets and store them in a Cloud Storage bucket. Store
• DUse Cloud Key Management Service (Cloud KMS) to encrypt the secrets and include them in

• A
  12% (6)
• B
  4% (2)
• C
  2% (1)
• D
  82% (40)

Explanation

Cloud Build has native integration with Cloud KMS (Key Management Service), allowing secrets to be encrypted with a KMS key and stored securely (e.g., in source control or a config file). Cloud Build can automatically decrypt them at build time using the kmsKeyName field in the build config - no custom decryption code needed. This minimizes development effort while meeting security requirements. Option A stores secrets in Cloud Storage with at-rest encryption, but at-rest encryption protects against physical media theft, not unauthorized access by principals with bucket read permissions. Option B stores encrypted secrets in the repo but requires managing a decryption key separately, adding complexity. Option C uses client-side encryption, which requires writing custom encryption/decryption logic. Option D leverages KMS's managed key lifecycle and Cloud Build's built-in KMS support - the most secure and lowest-effort approach.

No community discussion yet for this question.