An enterprise security architecture team needs to implement automated, event-driven secret rotation for database credentials using GCP Secret Manager, Cloud Pub/Sub, and a Cloud Run function. What is the correct sequence of steps to configure this automated rotation workflow?
- 1Deploy a Cloud Run function containing the secret rotation logic and grant it permissions to access and update Secret Manager versions.
- 2Create a Cloud Pub/Sub topic designated to receive rotation notification events from Secret Manager.
- 3Grant the Secret Manager Service Agent the Pub/Sub Publisher role (roles/pubsub.publisher) on the newly created Pub/Sub topic.
- 4Configure an Eventarc trigger or Pub/Sub subscription to invoke the Cloud Run function upon receiving messages on the Pub/Sub topic.
- 5Configure the secret in Secret Manager with a rotation schedule interval and associate it with the Pub/Sub topic.
Answer
The correct sequence begins with deploying the Cloud Run rotation function, creating the target Pub/Sub topic, granting the Secret Manager Service Agent publisher permissions on that topic, subscribing the Cloud Run function to the topic, and finally enabling the rotation schedule on the secret linked to the topic.
Automated secret rotation in Google Cloud follows an event-driven pub/sub architectural model. First, the worker component (Cloud Run function) that interacts with database APIs and Secret Manager versions must be deployed. Second, a Pub/Sub topic acts as the event broker. Third, Secret Manager's service agent requires the Pub/Sub Publisher role on the topic to emit rotation events. Fourth, the Cloud Run function is subscribed to the topic so event delivery triggers rotation logic. Finally, setting the rotation frequency on the secret itself initiates the automated lifecycle.
Step-by-Step Solution
Key Concept
Secret Manager Event-Driven Automated Rotation Lifecycle