How do i handle secrets in Google Cloud Functions?

问题

What is the common practice here? There seems to be no tools provided by gcloud. I'm deploying functions from local machine for now, so I can hardcode secrets, but this seems inappropriate. Also, what about CI/CD? I would need to pass secrets as environment variables in this case. Is this even possible atm?

回答1:

Since making my comment, I've found a relatively simple way to do this - provide a config .json file. Here's an example I hacked together based on their Slack function example:

config.json file in the same directory as index.js:

{
  "foo": "bar"
}

index.js

const config = require('./config.json');

exports.envTest = (req, res) => {
  res.status(200).send(config.foo);
};

When you deploy the function and go to the URL, you should get the response bar.

Pros and cons:

Pros:

Easy to set up and configure right in your IDE
Config file can be put into .gitignore to ensure your secrets don't end up the repo
File itself can be stored in a secure location and only given to individual responsible for deploying the functions

Cons:

Clunky in comparison to proper secret management
Requires attention to ensure the file doesn't fall into the wrong hands
File can be read in plaintext in the Google Cloud console by looking at the function source

On the whole, it's a far cry from a real secrets management system, but it's workable enough to hold me over until this feature eventually makes it into the Cloud Functions core.

回答2:

You should use Cloud Key Management Service(KMS).
Don't push pure secrets to Cloud Functions with files or environment variables.

One solution is followings:

Create key on Cloud KMS
Encrypt secret file with that key
Upload encrypted secret file to Google Cloud Storage(GCS) (Accessible by specified user)
In Cloud Function Execution, get uploaded secret file from GCS, decrypt, and use it

[Ref] Secret management using the Google Cloud Platform

回答3:

You can use the Secret Manager for this. Follow the instructions on the link to add a secret.

The only GOTCHA I found is that by default the service account doesn't have read-access to the secrets, you've got to manually grant permissions, like so:

来源：https://stackoverflow.com/questions/47667422/how-do-i-handle-secrets-in-google-cloud-functions

标签

google-cloud-platform

google-cloud-functions