Integrate with GCP Secret Manager

HCP Vault Secrets allows users to automatically synchronize application secrets to GCP Secret Manager. This guide walks you through the configuration process.

Prerequisites:

Existing GCP project and billing account
Secrets Manager API enabled in the target GCP project
Ability to create service accounts and keys
An HCP Vault Secrets application and secret(s)

Generating Service Account Key

The HCP Vault Secrets integration with GCP requires a service account and key in the target GCP project.

Refer to the Google Cloud IAM documentation for more information.

Navigate to the Service Accounts page in the Google Cloud Console.
Create a new service account.
Provide Service account name and desired service account ID.
Click Create and Continue.
Grant the service account the Secret Manager Admin role.
Click Continue and click Done at the bottom of the form.
Click the service account you created.
Click Keys and then click Add Key.
Under key type select JSON. This will automatically download your credentials.json file.

Go to your terminal window
Export your GCP Project ID as an environment variable.
```
  $ export GCP_PROJECT_ID=<your project ID>
```

Set an active GCP project

 $ gcloud config set project $GCP_PROJECT_ID

Create a new Service Account

 $ gcloud iam service-accounts create hcp-vault-secrets \
   --description="<your description>" \
   --display-name="<your display name>"

Set a policy for the Service Account to administer secrets

$ gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
  --member="serviceAccount:hcp-vault-secrets@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/secretmanager.admin"

Generate a service account key

$ gcloud iam service-accounts keys create service-account-key.json \
  --iam-account="hcp-vault-secrets@$GCP_PROJECT_ID.iam.gserviceaccount.com";

Use the Terraform Google provider to provision a service account and key with the required policy attached.

Follow the Terraform documentation to authenticate the Google provider.

Create a Terraform configuration file to create a service account and key.

  provider "google" {
   // See https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#authentication
   // for options on how to configure this provider. The following parameters or environment
   // variables are typically used.
   // Parameters:
   // credentials = ""
   // project = ""
   // region = ""
   // Environment variables:
   // GOOGLE_CREDENTIALS
   // GOOGLE_PROJECT
   // GOOGLE_REGION
 }

 data "google_project" "project" {}
 resource "google_service_account" "hcp_vault_secrets_integration" {
   account_id  = "hcp-vault-secrets-sync"
   description = "service account used by HCP Vault Secrets to sync secrets into the GCP secret manager service"
 }

 resource "google_project_iam_member" "hcp_vault_secrets_integration" {
   project = data.google_project.project.id
   role    = "roles/secretmanager.admin" # You can alternatively create a custom role with more narrow permissions
   member  = google_service_account.hcp_vault_secrets_integration.member
 }

 resource "google_service_account_key" "hcp_vault_secrets_integration" {
   service_account_id = google_service_account.hcp_vault_secrets_integration.name
   public_key_type    = "TYPE_X509_PEM_FILE"
 }

 resource "local_file" "hcp_vault_secrets_integration" {
   content  = base64decode(google_service_account_key.hcp_vault_secrets_integration.private_key)
   filename = "hvs-secrets-sync-credentials.json"
 }

 output "service_account_credentials_file_location" {
   value = abspath(local_file.hcp_vault_secrets_integration.filename)
 }

Initialize Terraform.

$ terraform init

...snip...

Terraform has been successfully initialized!

Run terraform apply to create a GCP service account and key.
```
$ terraform apply
```

The generated file will be stored at the specified path.

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

Outputs:

service_account_credentials_file_location = "/home/john-doe/terraform-local/hvs-gcp-setup/hvs-secrets-sync-credentials.json"

Configure GCP Secret Manager integration

Navigate to the HCP Vault Secrets app you would like to integrate with your GCP project. Select Integrations from the sidebar then click on the GCP Secret Manager card to initiate the setup.
If this is your first time configuring a GCP integration, you will be presented with two simple fields:
- Name is the unique identifier and display name for this integration. It cannot be changed.
- Service account credentials is a unique credential file value used in your GCP account to securely delegate access to HCP Vault Secrets. You can either upload a credentials.json file or use the code block to paste it in. Instructions to provision this role can be found below.
Once all fields are populated, click Save and sync secrets to complete the configuration process. It will immediately sync all your existing app secrets into GCP Secret Manager.
The synchronization of existing app secrets to GCP Secret Manager will begin. All future modifications to the app's secrets such as adding, updating, or deleting a secret are automatically replicated to GCP Secret Manager.