A developer team stores a third-party API token that its Cloud Run service needs at runtime. The security team wants versioned storage, least-privilege access for the service account, and a record of each read. Which approach meets these needs?
Show answer and explanation
Answer: A
Secret Manager stores secrets encrypted at rest, keeps versions, and records access through audit logging. Granting the Secret Accessor role on that one secret to the Cloud Run service account follows least privilege, and the service reads the value at runtime rather than having it baked into the image. Bucket files, container images, and plain environment variables all expose the value more widely, and none gives a per-secret version history with access records.
Why the other options are wrong
- B. A bucket readable by all project members grants far more access than one service needs. It also lacks the per-secret versioning and access records a dedicated secret store provides.
- C. Baking the token into an image spreads it to every place the image is pulled or built. Rotating it means rebuilding and redeploying the image each time.
- D. Plain environment variables are visible to anyone who can view the revision configuration, and they offer no secret versioning or read-level audit trail.