[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eDatastream integrates with Secret Manager to securely store authentication resources like database passwords, utilizing secrets instead of plain text.\u003c/p\u003e\n"],["\u003cp\u003eSecrets in Secret Manager are global resources containing metadata and secret versions, which hold the actual data like API keys or passwords.\u003c/p\u003e\n"],["\u003cp\u003eSecrets are ideal for securely storing and managing sensitive data as binary blobs or text strings, while encryption keys are better suited for encrypting and decrypting data.\u003c/p\u003e\n"],["\u003cp\u003eTo use Secret Manager with Datastream, users must create a secret and can do so either through Secret Manager or while defining connection details, needing the \u003ccode\u003eSecret Manager Secret Accessor\u003c/code\u003e role.\u003c/p\u003e\n"],["\u003cp\u003eYou can enable customer-managed encryption keys (CMEK) to add an extra layer of security for your secrets.\u003c/p\u003e\n"]]],[],null,["# Use Secret Manager to store sensitive data\n\nDatastream integrates with [Secret Manager](/security/products/secret-manager)\nto let you securely store authentication resources, such as source database\npasswords. Rather than use a plain text password when creating a connection\nprofile, create and use a secret.\n\nWhat are secrets\n----------------\n\n**Secrets** are global resources that contain metadata, such as labels,\nannotations, and permissions.\n\nSecrets also have **secret versions**. Secret versions store the actual data for\nthe secret resource, such as API keys, passwords, or certificates. Each version\nhas a unique identifier or a timestamp.\n\nHow are secrets different from encryption keys\n----------------------------------------------\n\nManaging secrets is equally important as managing encryption keys, however it\nfocuses on a different area of data security. You might use one or the other,\ndepending on your use cases and types of sensitive information that you store.\n\nYou would typically select secrets to securely store and manage your sensitive\ndata as binary blobs or text strings. Secrets store the actual data, but to\naccess it, you need specific permissions which are defined in the secrets\nmetadata.\n\nOn the other hand, encryption keys are a better choice if you need to encrypt or\ndecrypt data. You can't view or extract the actual cryptographic data that is\nused for encryption. Key management systems such as Cloud Key Management Service are typically\nused to manage more demending scenarios, for example encrypting rows in a\ndatabase, or images and files.\n\nIf you need an additional layer of protection for your data, you can enable\ncustomer-managed encryption keys (CMEK), and use your own encryption keys\nstored in Cloud Key Management Service to secure secrets in Secret Manager. For more\ninformation about how to use CMEK with Datastream, see\n[Use customer-managed encryption keys (CMEK)](/datastream/docs/use-cmek).\n\nUse Secret Manager with Datastream\n----------------------------------\n\nTo store your sensitive data for use with Datastream, you need to create\na secret using Secret Manager. For more information, see\n[Create a secret](/secret-manager/docs/creating-and-accessing-secrets).\n\nYou can also create a secret when you define connection details for your\nconnection profile. For detailed information, see\n[Create connection profiles](/datastream/docs/create-connection-profiles).\n| **Note:** You can store your newly created secret in any Google Cloud project, it doesn't have to be the project where you created your stream.\n\n### Required roles\n\n\nTo get the permissions that\nyou need to use Secret Manager with Datastream,\n\nask your administrator to grant you the\n\n\n[Secret Manager Secret Accessor](/iam/docs/roles-permissions/secretmanager#secretmanager.secretAccessor) (`roles/secretmanager.secretAccessor`)\nIAM role on the Datastream service account.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined)."]]
