This page provides an overview of labels, describes how to add labels to a secret, and how to view and update labels attached to a secret.
What are labels?
A label is a key-value pair that you can assign to Google Cloud Secret Manager secrets. They help you organize these resources and manage your costs at scale, with the granularity you need. You can attach a label to each resource, then filter the resources based on their labels. Information about labels is forwarded to the billing system that lets you break down your billed charges by label. With built-in billing reports, you can filter and group costs by resource labels. You can also use labels to query billing data exports.
Requirements for labels
The labels applied to a resource must meet the following requirements:
- Each resource can have up to 64 labels.
- Each label must be a key-value pair.
- Keys have a minimum length of 1 character and a maximum length of 63 characters, and cannot be empty. Values can be empty, and have a maximum length of 63 characters.
- Keys and values can contain only lowercase letters, numeric characters, underscores, and dashes. All characters must use UTF-8 encoding, and international characters are allowed. Keys must start with a lowercase letter or international character.
- The key portion of a label must be unique within a single resource. However, you can use the same key with multiple resources.
These limits apply to the key and value for each label, and to the individual Google Cloud resources that have labels. There is no limit on how many labels you can apply across all resources within a project.
Common uses of labels
Here are some common use cases for labels:
Team or cost center labels: Add labels based on team or cost center to distinguish Secret Manager secrets owned by different teams (for example,
team:researchandteam:analytics). You can use this type of label for cost accounting or budgeting.Component labels: For example,
component:redis,component:frontend,component:ingest, andcomponent:dashboard.Environment or stage labels: For example,
environment:productionandenvironment:test.State labels: For example,
state:active,state:readytodelete, andstate:archive.Ownership labels: Used to identify the teams that are responsible for operations, for example:
team:shopping-cart.
We don't recommend creating large numbers of unique labels, such as for timestamps or individual values for every API call. The problem with this approach is that when the values change frequently or with keys that clutter the catalog, this makes it difficult to effectively filter and report on resources.
Labels and tags
Labels can be used as queryable annotations for resources, but can't be used to set conditions on policies. Tags provide a way to conditionally allow or deny policies based on whether a resource has a specific tag, by providing fine-grained control over policies. For more information, see the Tags overview.
Create a secret with labels
To add a label when creating the secret, follow these steps:
Console
-
Go to the Secret Manager page in the Google Cloud console.
-
On the Secret Manager page, click the Regional secrets tab, and then click Create regional secret.
-
On the Create regional secret page, enter a name for the secret in the Name field.
-
Enter a value for the secret (for example,
abcd1234). You can also upload a text file containing the secret value using the Upload file option. This action automatically creates the secret version. -
Select the location where you want your regional secret to be stored from the Region list.
-
Go to the Labels section, and then click Add label.
-
Enter the key and corresponding value to create a label.
-
Click Create secret.
View labels on a secret
To view assigned labels, follow these steps:
Console
-
Go to the Secret Manager page in the Google Cloud console.
-
On the Secret Manager page, click the Regional secrets tab, and then select the secret whose labels you want to view.
-
If the Info Panel is closed, click Show Info Panel to display it.
-
In the panel, click the Labels tab. All the labels added to the secret are displayed.
Update labels
To update labels, follow these steps:
Console
-
Go to the Secret Manager page in the Google Cloud console.
-
On the Secret Manager page, click the Regional secrets tab.
-
Select the secret that you want to edit.
-
Open the Info Panel, and then click the Labels tab.
-
Update the existing value of a label and click Save.
You can also delete an existing label or add a new label. To edit the key of a label, add a new label with the same key name, and then delete the old label.
Remove labels
To remove labels, follow these steps:
Console
-
Go to the Secret Manager page in the Google Cloud console.
-
On the Secret Manager page, click the Regional secrets tab.
-
Select the secret that you want to edit.
-
Open the Info Panel, and then click the Labels tab.
-
Click Delete to remove the labels that you no longer require.
-
Click Save.