This page describes how to edit a secret's metadata. You can update many properties of a secret such as encryption type, rotation policy, expiration date, labels, and event notifications. You can also add annotations and set up aliases for secret versions. You can't edit the secret name or value. To add a new value to your secret, you must create a new secret version.
Required roles
To get the permissions that you need to update a secret's metadata,
ask your administrator to grant you the
Secret Manager Admin (roles/secretmanager.admin
) IAM role on the secret or project.
For more information about granting roles, see Manage access to projects, folders, and organizations.
You might also be able to get the required permissions through custom roles or other predefined roles.
Edit a secret
To edit a secret, use one of the following methods:
Console
-
Go to the Secret Manager page in the Google Cloud console.
-
On the Secret Manager page, click the Regional secrets tab.
-
To edit a secret, use one of the following methods:
-
Locate the secret in the list and click the
Actions menu associated with that secret. In the Actions menu, click Edit. -
Click the secret name to go to the secret details page. On the secret details page, click
Edit secret.
-
-
On the Edit secret page, update the properties of the secret as required, and then click Update secret.
gcloud
Before using any of the command data below, make the following replacements:
- SECRET_ID: the ID of the secret or fully qualified identifier for the secret
- LOCATION: the Google Cloud location of the secret
- KEY: the label key
- VALUE: the corresponding value of the label
Execute the following command:
Linux, macOS, or Cloud Shell
gcloud secrets update SECRET_ID --location=LOCATION \ --update-labels=KEY=VALUE
Windows (PowerShell)
gcloud secrets update SECRET_ID --location=LOCATION ` --update-labels=KEY=VALUE
Windows (cmd.exe)
gcloud secrets update SECRET_ID --location=LOCATION ^ --update-labels=KEY=VALUE
The response returns the updated secret.
REST
Before using any of the request data, make the following replacements:
- LOCATION: the Google Cloud location of the secret
- PROJECT_ID: the Google Cloud project ID
- SECRET_ID: the ID of the secret or fully qualified identifier for the secret
- KEY: the label key
- VALUE: the corresponding value of the label
HTTP method and URL:
PATCH https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID?updateMask=labels
Request JSON body:
{'labels': {'KEY': 'VAL'}}
To send your request, choose one of these options:
curl
Save the request body in a file named request.json
,
and execute the following command:
curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID?updateMask=labels"
PowerShell
Save the request body in a file named request.json
,
and execute the following command:
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `
-Method PATCH `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID?updateMask=labels" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
{ "name": "projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID", "createTime": "2024-09-02T07:14:00.281541Z", "labels": { "key": "value" }, "etag": "\"16211dc7d040b1\"" }
Go
To run this code, first set up a Go development environment and install the Secret Manager Go SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Java
To run this code, first set up a Java development environment and install the Secret Manager Java SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Node.js
To run this code, first set up a Node.js development environment and install the Secret Manager Node.js SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Python
To run this code, first set up a Python development environment and install the Secret Manager Python SDK. On Compute Engine or GKE, you must authenticate with the cloud-platform scope.
Edit permissions and labels for multiple secrets
You can edit permissions and labels for multiple secrets using the Google Cloud console.
-
Go to the Secret Manager page in the Google Cloud console.
-
On the Secret Manager page, click the Regional secrets tab, and then select the secrets for which you want to edit the permissions and labels.
-
If the Info Panel is closed, click Show Info Panel to display it.
-
The permissions and labels configured for all the secrets are displayed in the Info Panelunder their corresponding tabs. Go to the individual tabs and update the values as required.
-
Click Save when done.
What's next
- Manage access to regional secrets
- Create rotation schedules
- Set up notifications on a regional secret