Secret data is immutable and most operations take place on secret versions. A secret version contains the actual secret data, along with state and metadata about the secret. This topic describes how to add a secret version.
Required roles
To get the permissions that you need to add a secret version, ask your administrator to grant you the following IAM roles on a secret:
-
Secret Manager Secret Version Adder (
roles/secretmanager.secretVersionAdder
) -
Secret Manager Secret Version Manager (
roles/secretmanager.secretVersionManager
)
For more information about granting roles, see Manage access to projects, folders, and organizations.
You might also be able to get the required permissions through custom roles or other predefined roles.
Add a secret version
Console
-
Go to the Secret Manager page in the Google Cloud console.
-
On the Secret Manager page, click View more
and select Add new version. -
In the Add new version dialog, in the Secret value field, enter a value for the secret (e.g.
abcd1234
). -
Click the Add new version button.
gcloud
To use Secret Manager on the command line, first Install or upgrade to version 378.0.0 or higher of the Google Cloud CLI. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Add a secret version from the contents of a file on disk:
$ gcloud secrets versions add secret-id --data-file="/path/to/file.txt"
You can also add a secret version directly on the command line, but this is discouraged because it appears as plaintext in the list of processes and may be captured by other system users. Note that the command with the plaintext will also be in your shell history.
$ echo -n "this is my super secret data" | \
gcloud secrets versions add secret-id --data-file=-
Optionally: Add a version from a file's contents when first creating a secret:
$ gcloud secrets create secret-id --data-file="/path/to/file.txt"
C#
To run this code, first set up a C# development environment and install the Secret Manager C# SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Go
To run this code, first set up a Go development environment and install the Secret Manager Go SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Java
To run this code, first set up a Java development environment and install the Secret Manager Java SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Node.js
To run this code, first set up a Node.js development environment and install the Secret Manager Node.js SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
PHP
To run this code, first learn about using PHP on Google Cloud and install the Secret Manager PHP SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Python
To run this code, first set up a Python development environment and install the Secret Manager Python SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Ruby
To run this code, first set up a Ruby development environment and install the Secret Manager Ruby SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
API
These examples use curl to demonstrate using the API. You can generate access tokens with gcloud auth print-access-token. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Base64-encode the secret data and save it as a shell variable.
$ SECRET_DATA=$(echo "seCr3t" | base64)
Invoke the API using curl.
$ curl "https://secretmanager.googleapis.com/v1/projects/project-id/secrets/secret-id:addVersion" \
--request "POST" \
--header "authorization: Bearer $(gcloud auth print-access-token)" \
--header "content-type: application/json" \
--data "{\"payload\": {\"data\": \"${SECRET_DATA}\"}}"
Secret version states
A secret version can be in one of the following states at any given time:
Enabled - In this state, the secret version can be accessed and described. This is the default state for a new secret version.
Disabled - In this state, the secret version cannot be accessed, but the secret's contents still exist. The secret version can be re-enabled to restore access.
Destroyed - In this state, the secret version's contents are discarded. The secret version cannot be changed to another state.
What's next
- Learn how to access a secret version.
- Learn how to assign an alias to a secret version.
- Learn how to list secret versions and view version details.