Prepare environment for Parameter Manager

This document shows you how to prepare your environment to get started with Parameter Manager.

Enable the Parameter Manager API

To enable the Parameter Manager API, follow these steps:

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

Install the Google Cloud CLI.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

Create or select a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

• Create a Google Cloud project:

  gcloud projects create PROJECT_ID

  Replace PROJECT_ID with a name for the Google Cloud project you are creating.

• Select the Google Cloud project that you created:

  gcloud config set project PROJECT_ID

  Replace PROJECT_ID with your Google Cloud project name.

Verify that billing is enabled for your Google Cloud project.

Enable the Parameter Manager API:

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

gcloud services enable parametermanager.googleapis.com 

Install the Google Cloud CLI.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

Create or select a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

• Create a Google Cloud project:

  gcloud projects create PROJECT_ID

  Replace PROJECT_ID with a name for the Google Cloud project you are creating.

• Select the Google Cloud project that you created:

  gcloud config set project PROJECT_ID

  Replace PROJECT_ID with your Google Cloud project name.

Verify that billing is enabled for your Google Cloud project.

Enable the Parameter Manager API:

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

gcloud services enable parametermanager.googleapis.com 

Configure Parameter Manager to use a regional endpoint

To create regional parameters, you must configure Parameter Manager to use regional endpoints. Regional endpoints are request endpoints that only allow requests to proceed if the affected resource exists in the location specified by the endpoint. Using regional endpoints lets you run your workloads in a manner that complies with data residency and data sovereignty requirements.

Regional endpoints use the following format:

SERVICE_NAME.LOCATION.rep.googleapis.com

To use regional endpoints, you must update your configuration with the regional endpoint address depending on how you access the Parameter Manager service.

gcloud

To configure the Google Cloud CLI to use regional endpoints, complete the following steps:

1. Make sure you're using the Google Cloud CLI 402.0.0 or newer.

2. Set the api_endpoint_overrides/parametermanager property to the regional endpoint you want to use:

   gcloud config set api_endpoint_overrides/parametermanager https://parametermanager.LOCATION.rep.googleapis.com/

   Replace LOCATION with the name of the supported Google Cloud location, such as us-central1.

REST

To connect to the Parameter Manager service using the API, replace the generic API endpoint URL (https://secretmanager.googleapis.com/v1/) with the specific regional endpoint that you want to use. Regional endpoints use the following format:

https://parametermanager.LOCATION.rep.googleapis.com/

Replace LOCATION with the name of the supported Google Cloud location, such as me-central2.

To see which locations support regional endpoints, see Parameter Manager regional endpoint locations.

Configure roles and permissions

Grant the Parameter Manager Admin role to the administrator to provide them with the necessary permissions to work with Parameter Manager.

• To grant the required role, use the following command:

  gcloud projects add-iam-policy-binding PROJECT_ID \
      --member user:USER_IDENTIFIER \
      --role=roles/parametermanager.admin
  

  Replace the following:

  • PROJECT_ID: your project ID
  • USER_IDENTIFIER: the identifier for the user account

What's next

• Learn about access control using Identity and Access Management (IAM) roles