Lesson 07 — Secret Manager

Welcome

Modern cloud applications rely on numerous sensitive credentials to communicate securely with other systems and services.

These secrets may include:

API Keys
Database Credentials
Access Tokens
OAuth Credentials
Encryption Keys
Certificates
SSH Keys
Third-Party Service Credentials

Improper storage or management of these secrets is one of the leading causes of cloud security incidents.

Google Cloud Secret Manager provides a secure, centralized service for storing, managing, and controlling access to sensitive information.

From a Cloud Penetration Tester’s perspective, Secret Manager is a high-value assessment area because compromised secrets can provide attackers with access to cloud resources, applications, databases, and external services.

This lesson introduces Secret Manager from an enterprise cloud security assessment perspective.

Learning Objectives

After completing this lesson, you will be able to:

Understand Google Secret Manager architecture.
Explain the purpose of secrets management.
Review Secret Manager access controls.
Understand secret versioning.
Assess secret rotation strategies.
Evaluate encryption and auditing.
Identify common secrets management security risks.
Apply enterprise best practices for secret governance.

Business Scenario

You are working as a Cloud Penetration Tester at CloudNova Technologies.

A customer has migrated multiple business applications to Google Cloud Platform.

Their applications rely on:

Database credentials
API tokens
OAuth secrets
TLS certificates
Service Account credentials
Third-party integrations

The customer wants assurance that sensitive credentials are securely stored, access is appropriately controlled, and secret management follows enterprise security standards.

Your objective is to assess the organisation’s secrets management implementation and identify any security risks.

What is Google Secret Manager?

Google Secret Manager is a managed service that securely stores sensitive information used by cloud applications and services.

Instead of embedding credentials directly into application code or configuration files, organisations store secrets centrally and retrieve them securely when required.

This approach improves:

Security
Centralised management
Access control
Secret rotation
Auditing
Compliance

Secret Manager Architecture

A simplified architecture looks like:

Application

↓

Google Secret Manager

↓

IAM Policy

↓

Encrypted Secret

↓

Cloud Audit Logs

↓

Monitoring & Alerting

Applications retrieve secrets only after successful authentication and authorisation.

What is a Secret?

A secret is any sensitive piece of information that must be protected.

Examples include:

Database passwords
API keys
OAuth client secrets
TLS certificates
SSH private keys
Encryption credentials
Service Account credentials
Application tokens

Compromise of any of these secrets may allow unauthorised access to business systems.

Secret Versions

Each secret can have multiple versions.

Versioning allows organisations to:

Rotate credentials.
Roll back changes.
Maintain availability.
Support application updates.
Simplify credential lifecycle management.

During assessments, review whether obsolete or unused versions remain accessible.

Access Control

Access to secrets is controlled through Google Cloud IAM.

Security reviews should assess:

IAM policies
User permissions
Group permissions
Service Account access
Application access
Cross-project access

Verify that only authorised identities have permission to access sensitive secrets.

Encryption

Google Secret Manager encrypts secrets before storage.

Enterprise environments may use:

Google-managed encryption
Customer-managed encryption keys (CMEK)

Review whether encryption aligns with organisational security requirements and regulatory obligations.

Secret Rotation

Secrets should not remain unchanged indefinitely.

Organisations should implement rotation procedures for:

Database credentials
API keys
Certificates
OAuth secrets
Application credentials

During assessments verify:

Rotation frequency
Rotation procedures
Ownership
Automation
Expired secrets

Logging & Auditing

Every access to sensitive secrets should be monitored.

Review:

Cloud Audit Logs
IAM changes
Secret access history
Administrative activity
Monitoring alerts
SIEM integration

Proper logging supports incident response and forensic investigations.

Common Secret Management Security Risks

During enterprise assessments, common observations include:

Secrets stored in source code repositories
Hardcoded application credentials
Excessive IAM permissions
Unused secrets
Outdated secret versions
Missing rotation policies
Shared credentials
Weak access governance
Insufficient audit logging

These issues increase the likelihood of credential compromise and unauthorised access.

Enterprise Secret Management Best Practices

Secure organisations typically:

Store secrets in Secret Manager.
Apply the Principle of Least Privilege.
Rotate secrets regularly.
Enable comprehensive auditing.
Protect encryption keys.
Remove unused secrets.
Separate environments (Development, Test, Production).
Review secret access periodically.
Integrate secrets management into CI/CD pipelines.

Enterprise Skills You Will Develop

By completing this lesson you will learn how to:

Review Secret Manager deployments.
Assess IAM permissions.
Evaluate secret lifecycle management.
Review encryption implementation.
Assess auditing and monitoring.
Identify enterprise secret management risks.
Perform professional cloud security reviews.

Key Takeaways

After completing this lesson you should understand:

Google Secret Manager architecture.
Secret lifecycle management.
IAM access controls.
Secret versioning.
Encryption.
Secret rotation.
Audit logging.
Enterprise secret management best practices.

Knowledge Check

You should now be able to answer:

What is Google Secret Manager?
Why should organisations avoid hardcoded credentials?
How does Secret Manager improve cloud security?
Why is secret rotation important?
What role does IAM play in protecting secrets?
What are the most common enterprise secret management security risks?

Next Lesson

➡️ Lesson 08 — Cloud Logging

In the next lesson, you will learn how to assess Google Cloud Logging, review audit logs, logging architecture, security monitoring, and enterprise visibility to support cloud penetration testing, threat detection, and incident investigations.