You are designing a new governance model for your organization's secrets that are stored in Secret Manager. Currently, secrets for Production and Non- Production applications are stored and accessed using service accounts. Your proposed solution must:
• Provide granular access to secrets
• Give you control over the rotation schedules for the encryption keys that wrap your secrets
• Maintain environment separation
• Provide ease of management Which approach should you take?
Select one answer.
Marked answer: C
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose C1
Agree with Medofree's comment, there is no right answer here. However, option C looks like the closest due the granular access to secrets requirement and the ease of management requirement . Option A would grant identities access to all the secrets in the project, you might be able use other settings with project level IAM bindings to achieve it, but it won't be easy to manage.
Chose C1
It's C, right? Answer A doesn't provide granular access. C still provides control over rotation, verify for yourself: Go to GCP Console -> Secrets Manager -> Create Secret -> Select Google Managed Encryption Key -> Enable "Set rotation period" and you will see the options
Chose C1
I think C is correct. Secrets granular management, separate projects and keys managements into google.
