A build step needs an npm access token. The team must avoid storing it in the repository or in trigger definitions. What should they do?
Show answer and explanation
Answer: A
Secret Manager is the appropriate store for credentials used by builds. Put the token there and grant the Cloud Build service account the Secret Manager Secret Accessor role on that specific secret, following least privilege. The build configuration can then reference the secret at runtime, so the value never appears in source code or trigger settings.
Why the other options are wrong
- B. Substitution values written into triggers are visible to anyone who can edit the trigger. This places the credential in configuration, which the team wants to avoid.
- C. Keeping a decryption key beside the encrypted file defeats the protection, since anyone with repository access can decrypt the token.
- D. A public bucket exposes the token to anyone who discovers the object, and a random name is not an access control.