Google Cloud Platform
Advanced 17 min read Google Cloud Platform

Security & CI/CD on GCP

Secret Manager stores credentials with versioning and IAM; Cloud KMS manages encryption keys; Cloud Build automates the build-test-deploy pipeline; Terraform and Deployment Manager express infrastructure as code. Learn the secure, automated delivery stack and how to keep cost under control.

Secret ManagerCloud KMSencryptionCloud BuildpipelineDeployment ManagerTerraformIaCcost optimizationaudit logs
Prerequisites: Compute Engine & IAM Google Kubernetes Engine (GKE)
Introduction

What is this?

Secret Manager stores API keys, passwords and certificates as versioned secrets with IAM-controlled access and audit logging. Cloud KMS manages the encryption keys that protect data at rest. Cloud Build compiles and packages code into artifacts using a pipeline defined in cloudbuild.yaml. Deployment Manager and Terraform are the infrastructure-as-code tools. Together they give you a secure, automated delivery path from commit to production.

Motivation

Why do you need it?

  • Secrets in code and config are the number one leak vector — Secret Manager removes them.
  • Cloud KMS centralizes key management so you can encrypt, rotate and audit keys consistently.
  • Cloud Build automates the build-test-package flow in a reproducible pipeline.
  • Infrastructure as code (Terraform, Deployment Manager) makes environments reproducible and reviewable.
  • Cost optimization — committed use discounts, spot VMs, right-sizing — is part of the job.
Think about it

Mental model

Imagine

A secure vault and a factory floor

Think of

GCP security and CI/CD

Secret Manager is the bank vault: every credential has its own box (version), access is logged, and only badge holders (IAM) can open it. Cloud KMS is the master locksmith: it owns the master keys that encrypt everything else and rotates them on schedule. Cloud Build is the factory line: raw code goes in one end and a tested package comes out, with every step recorded. Terraform and Deployment Manager are the blueprints department: the whole factory is rebuilt exactly from drawings.

Mechanics

How it works

  • Secret Manager stores secret versions; IAM controls who may access or manage them, and version access is logged to Cloud Audit Logs.
  • Cloud KMS creates key rings and keys; you encrypt data with the key and rotate it on a schedule, with the old key kept for decryption.
  • Cloud Build reads cloudbuild.yaml from your repo, runs build and test steps in containers, and pushes artifacts to Artifact Registry.
  • Cloud Build can trigger on pushes, schedules or pull requests, and grants each build a service account with its own permissions.
  • Terraform or Deployment Manager declares the infrastructure; a CI pipeline applies it and re-plans to detect drift.

A secure CI/CD path from commit to production on GCP.

Store secrets in Secret Manager
Cloud KMS encrypts data
Cloud Build pipeline
Artifact in Artifact Registry
Terraform applies infrastructure
Deploy + rotate secrets and keys
Reference

Key commands

gcloud secrets create my-db-password --replication-policy=automatic

Create a secret with automatic replication.

gcloud secrets versions add my-db-password --data-file=-

Add a new version of a secret from stdin.

gcloud secrets versions access latest --secret=my-db-password

Retrieve the latest version of a secret.

gcloud secrets list

List the secrets in the project.

gcloud builds submit --config=cloudbuild.yaml

Run a build pipeline defined in cloudbuild.yaml.

gcloud services enable run.googleapis.com

Enable an API for the project — often the first step in a pipeline.

Hands-on

Examples

Store a secret and run a Cloud Build

Store a secret and run a Cloud Build
$ printf "db-password-xyz" | gcloud secrets create my-db-password \
    --data-file=- --replication-policy=automatic
Created version [1] of the secret [my-db-password].
 
$ gcloud secrets versions access latest --secret=my-db-password
db-password-xyz
 
$ gcloud builds submit --config=cloudbuild.yaml
Creating temporary tarball archive...
SUCCESS
DONE

gcloud secrets create with --data-file=- reads the value from stdin and creates version 1 without the secret ever landing in a file. versions access retrieves the current value for a verified consumer. gcloud builds submit runs the steps declared in cloudbuild.yaml and reports SUCCESS when the pipeline completes.

Real world

In production

  • Reference Secret Manager from Cloud Run, Cloud Functions and GKE so credentials never live in images.
  • Encrypt sensitive data and backups with Cloud KMS customer-managed keys and rotate them on a schedule.
  • Build a CI/CD pipeline with Cloud Build that runs tests, scans images, and deploys on merge.
  • Manage all infrastructure as code with Terraform and store state in a versioned Cloud Storage bucket.
  • Optimize cost with committed use discounts, spot VMs and right-sizing as part of the deployment workflow.
Guidelines

Best practices

  • Never commit secrets; load them from Secret Manager at runtime.
  • Grant the build service account the least privilege it needs to push artifacts and deploy.
  • Use Terraform with a remote state backend so the team shares one source of truth.
  • Rotate secrets and keys on a schedule and audit access with Cloud Audit Logs.
  • Enable deletion protection on secrets and databases so a mistaken command cannot destroy them.
Watch out

Common mistakes

  • Hardcoding credentials in config files or container images and calling it temporary.
  • Checking service account JSON keys into the repository.
  • Giving one broad role to the CI service account so a compromised build can do anything.
  • Running builds that are not reproducible because they depend on mutable tags.
  • Applying Terraform without a plan review and letting the environment drift.
Root cause analysis

Common issues

Error
Secret access denied
Root cause

The caller's IAM role lacks secretmanager.versions.access, or the secret version is disabled.

Fix

Grant roles/secretmanager.secretAccessor to the identity and check version states with gcloud secrets versions list.

Error
Cloud Build step failed
Root cause

The step's command or config is wrong, or the build service account lacks permission.

Fix

Read the build log for the exact step and error, fix the config, and verify the service account roles.

Error
Terraform plan shows unexpected drift
Root cause

Someone changed infrastructure outside of IaC.

Fix

Re-run the plan to see the difference, then update the Terraform config to match reality.

When things break

Debugging tips

  • Check Cloud Build logs in the console or with gcloud builds log <build-id>.
  • Verify the build's service account has IAM permission for the deploy target before debugging the pipeline.
  • Use gcloud secrets versions access and gcloud secrets versions list to confirm which version is current.
  • For KMS errors, check the key ring, location and key version state — disabled keys break encryption.
  • Test gcloud builds submit in a small repo before running the full pipeline.
Interviews

Interview checkpoint

Practice

Hands-on lab

Secure a File and Run a Local Pipeline
30 min · advanced
In progress
Objectives
  • Store a secret with locked-down file permissions
  • Verify the secret is readable only by the owner
  • Compute and store an integrity checksum
  • Write and run a strict-mode build pipeline script

Secure a File and Run a Local Pipeline

30 min · advanced

0/6 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/3
1

Which GCP service stores API keys and passwords as versioned, IAM-protected entries?

2

Cloud KMS is a managed service for creating and rotating encryption keys.

3

A Cloud Build step cannot push an image to Artifact Registry. What should you check first?

Quick reference

Cheat sheet

Security services
Secret ManagerVersioned, IAM-protected secrets
Cloud KMSManaged encryption keys with rotation
Cloud Audit LogsWho did what, when
Org policiesConstraints applied to the hierarchy
CI/CD
Cloud BuildContainerized build pipeline
Artifact RegistryStores images and packages
TerraformDeclarative IaC with remote state
Deployment ManagerNative GCP IaC
Go deeper

Official documentation

Secret Manager Overview
docs
Cloud KMS Overview
docs
Cloud Build Overview
docs
Deployment Manager Overview
docs
Terraform on Google Cloud
docs