Integrate with GCP Secret Manager

1. Navigate to the Service Accounts page in the Google Cloud Console.

2. Create a new service account.

3. Provide Service account name and desired service account ID.

4. Click Create and Continue.

5. Grant the service account the Secret Manager Admin role.

6. Click Continue and click Done at the bottom of the form.

7. Click the service account you created.

8. Click Keys and then click Add Key.

9. Under key type select JSON. This will automatically download your credentials.json file.

1. Go to your terminal window

2. Export your GCP Project ID as an environment variable.

     $ export GCP_PROJECT_ID=<your project ID>
   

3. Set an active GCP project

    $ gcloud config set project $GCP_PROJECT_ID
   

4. Create a new Service Account

    $ gcloud iam service-accounts create hcp-vault-secrets \
      --description="<your description>" \
      --display-name="<your display name>"
   

5. Set a policy for the Service Account to administer secrets

   $ gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
     --member="serviceAccount:hcp-vault-secrets@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
     --role="roles/secretmanager.admin"
   

6. Generate a service account key

   $ gcloud iam service-accounts keys create service-account-key.json \
     --iam-account="hcp-vault-secrets@$GCP_PROJECT_ID.iam.gserviceaccount.com";
   

Use the Terraform Google provider to provision a service account and key with the required policy attached.

1. Follow the Terraform documentation to authenticate the Google provider.

2. Create a Terraform configuration file to create a service account and key.

     provider "google" {
      // See https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#authentication
      // for options on how to configure this provider. The following parameters or environment
      // variables are typically used.
      // Parameters:
      // credentials = ""
      // project = ""
      // region = ""
      // Environment variables:
      // GOOGLE_CREDENTIALS
      // GOOGLE_PROJECT
      // GOOGLE_REGION
    }
   
    data "google_project" "project" {}
    resource "google_service_account" "hcp_vault_secrets_integration" {
      account_id  = "hcp-vault-secrets-sync"
      description = "service account used by HCP Vault Secrets to sync secrets into the GCP secret manager service"
    }
   
    resource "google_project_iam_member" "hcp_vault_secrets_integration" {
      project = data.google_project.project.id
      role    = "roles/secretmanager.admin" # You can alternatively create a custom role with more narrow permissions
      member  = google_service_account.hcp_vault_secrets_integration.member
    }
   
    resource "google_service_account_key" "hcp_vault_secrets_integration" {
      service_account_id = google_service_account.hcp_vault_secrets_integration.name
      public_key_type    = "TYPE_X509_PEM_FILE"
    }
   
    resource "local_file" "hcp_vault_secrets_integration" {
      content  = base64decode(google_service_account_key.hcp_vault_secrets_integration.private_key)
      filename = "hvs-secrets-sync-credentials.json"
    }
   
    output "service_account_credentials_file_location" {
      value = abspath(local_file.hcp_vault_secrets_integration.filename)
    }
   

3. Initialize Terraform.

   $ terraform init
   
   ...snip...
   
   Terraform has been successfully initialized!
   

4. Run terraform apply to create a GCP service account and key.

   $ terraform apply
   

5. The generated file will be stored at the specified path.

   Apply complete! Resources: 4 added, 0 changed, 0 destroyed.
   
   Outputs:
   
   service_account_credentials_file_location = "/home/john-doe/terraform-local/hvs-gcp-setup/hvs-secrets-sync-credentials.json"