An enterprise security team needs to establish automated secret rotation for database credentials stored in GCP Secret Manager according to Google Cloud recommended security practices. What is the correct sequence of steps to configure this automated rotation workflow?
- 1Create a Pub/Sub topic designated for transmitting secret rotation notification messages.
- 2Grant the Secret Manager Service Agent the Pub/Sub Publisher (roles/pubsub.publisher) role on the created Pub/Sub topic.
- 3Deploy the rotation Cloud Function that generates new credentials and creates a new secret version.
- 4Grant the Cloud Function runtime service account the Secret Manager Secret Version Manager (roles/secretmanager.secretVersionManager) role.
- 5Configure the rotation schedule and Pub/Sub topic reference on the target secret in Secret Manager.
Answer
The correct sequence starts with creating the Pub/Sub topic, granting the Secret Manager Service Agent the Pub/Sub Publisher role on that topic, deploying the rotation Cloud Function, granting its runtime service account the Secret Manager Secret Version Manager role, and finally configuring the rotation schedule on the target secret in Secret Manager.
To set up automated secret rotation in GCP Secret Manager using Cloud Functions, resources and permissions must be provisioned in dependency order. First, the Pub/Sub topic must be created to receive rotation events. Next, the Secret Manager Service Agent requires the Pub/Sub Publisher role on that topic. Then, the rotation Cloud Function is deployed, and its dedicated runtime service account is granted the Secret Manager Secret Version Manager role under least-privilege principles. Finally, the target secret in Secret Manager is updated with the rotation schedule pointing to the Pub/Sub topic.
Step-by-Step Solution
Key Concept
Secret Manager Automated Secret Rotation Architecture and Service Account Least Privilege Lifecycle