管理对区域 Secret 的访问权限

本页面介绍了如何管理对区域级密钥的访问权限，包括 秘密材料如需详细了解访问权限控制和权限 请参阅使用 IAM 进行访问权限控制。

所需的角色

如需获取管理对 Secret 的访问权限所需的权限， 请让管理员授予您 Secret Manager Admin (roles/secretmanager.admin) IAM 角色（针对密钥、项目、文件夹或 组织。 如需详细了解如何授予角色，请参阅管理对项目、文件夹和组织的访问权限。

您也可以通过自定义角色或其他预定义角色来获取所需的权限。

授予访问权限

如需授予对 Secret 的访问权限，请使用以下方法之一：

控制台

  1. 转到 Google Cloud 控制台中的 Secret Manager 页面。

    前往 Secret Manager

  2. 前往区域 Secret 标签页。如需选择密钥，请点击 更改为 Secret 的名称。

  3. 如果面板尚未打开，请点击显示信息面板以打开面板。

  4. 在信息面板中，点击添加主账号。

  5. 在新主账号字段中，输入要添加的成员的电子邮件地址。

  6. 在选择角色列表中，选择 Secret Manager，然后选择 Secret Manager Secret Accessor。

gcloud

在使用下面的命令数据之前，请先进行以下替换：

  • SECRET_ID：密钥的 ID 或密钥的完全限定标识符
  • LOCATION：Secret 的 Google Cloud 位置
  • MEMBER：IAM 成员，例如用户、群组或服务账号

执行以下命令：

Linux、macOS 或 Cloud Shell

ggcloud secrets add-iam-policy-binding SECRET_ID --location=LOCATION \
    --member="MEMBER" \
    --role="roles/secretmanager.secretAccessor"

Windows (PowerShell)

ggcloud secrets add-iam-policy-binding SECRET_ID --location=LOCATION `
    --member="MEMBER" `
    --role="roles/secretmanager.secretAccessor"

Windows (cmd.exe)

ggcloud secrets add-iam-policy-binding SECRET_ID --location=LOCATION ^
    --member="MEMBER" ^
    --role="roles/secretmanager.secretAccessor"

REST

注意：与其他示例不同，它将替换整个 IAM 政策。

在使用任何请求数据之前，请先进行以下替换：

  • LOCATION：Secret 的 Google Cloud 位置
  • PROJECT_ID：包含 Secret 的 Google Cloud 项目
  • SECRET_ID：Secret 的 ID 或 Secret 的完全限定标识符
  • MEMBER：IAM 成员，例如用户、群组或服务账号

HTTP 方法和网址：

POST https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID:setIamPolicy

请求 JSON 正文： 

{"policy": {"bindings": [{"members": ["MEMBER"], "role": "roles/secretmanager.secretAccessor"}]}}

如需发送请求，请选择以下方式之一：

curl

将请求正文保存在名为 request.json 的文件中，然后执行以下命令： 

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID:setIamPolicy"

PowerShell

将请求正文保存在名为 request.json 的文件中，然后执行以下命令： 

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID:setIamPolicy" | Select-Object -Expand Content

您应该收到类似以下内容的 JSON 响应：

{
  "version": 1,
  "etag": "BwYhOrAmWFQ=",
  "bindings": [
    {
      "role": "roles/secretmanager.secretAccessor",
      "members": [
        "user:username@google.com"
      ]
    }
  ]
}

Go

如需运行此代码，请先设置 Go 开发环境并 安装 Secret Manager Go SDK。 在 Compute Engine 或 GKE 上，您必须使用 cloud-platform 范围进行身份验证。

import (
	"context"
	"fmt"
	"io"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"
	"google.golang.org/api/option"
)

// iamGrantAccess grants the given member access to the secret.
func IamGrantAccessWithRegionalSecret(w io.Writer, projectId, locationId, secretId, member string) error {
	// name := "projects/my-project/locations/my-location/secrets/my-secret"
	// member := "user:foo@example.com"

	// Create the client.
	ctx := context.Background()
	//Endpoint to send the request to regional server
	endpoint := fmt.Sprintf("secretmanager.%s.rep.googleapis.com:443", locationId)
	client, err := secretmanager.NewClient(ctx, option.WithEndpoint(endpoint))

	if err != nil {
		return fmt.Errorf("failed to create regional secretmanager client: %w", err)
	}
	defer client.Close()

	name := fmt.Sprintf("projects/%s/locations/%s/secrets/%s", projectId, locationId, secretId)
	// Get the current IAM policy.
	handle := client.IAM(name)
	policy, err := handle.Policy(ctx)
	if err != nil {
		return fmt.Errorf("failed to get policy: %w", err)
	}

	// Grant the member access permissions.
	policy.Add(member, "roles/secretmanager.secretAccessor")
	if err = handle.SetPolicy(ctx, policy); err != nil {
		return fmt.Errorf("failed to save policy: %w", err)
	}

	fmt.Fprintf(w, "Updated IAM policy for %s\n", name)
	return nil
}

Java

如需运行此代码，请先设置 Java 开发环境并安装 Secret Manager Java SDK。 在 Compute Engine 或 GKE 上，您必须使用 cloud-platform 范围进行身份验证。

import com.google.cloud.secretmanager.v1.SecretManagerServiceClient;
import com.google.cloud.secretmanager.v1.SecretManagerServiceSettings;
import com.google.cloud.secretmanager.v1.SecretName;
import com.google.iam.v1.Binding;
import com.google.iam.v1.GetIamPolicyRequest;
import com.google.iam.v1.Policy;
import com.google.iam.v1.SetIamPolicyRequest;
import java.io.IOException;

public class IamGrantAccessWithRegionalSecret {

  public static void main(String[] args) throws IOException {
    // TODO(developer): Replace these variables before running the sample.

    // Your GCP project ID.
    String projectId = "your-project-id";
    // Location of the secret.
    String locationId = "your-location-id";
    // Resource ID of the secret to grant access to.
    String secretId = "your-secret-id";
    // IAM member, such as a user group or service account you want to grant access.
    String member = "user:foo@example.com";
    iamGrantAccessWithRegionalSecret(projectId, locationId, secretId, member);
  }

  // Grant a member access to a particular secret.
  public static Policy iamGrantAccessWithRegionalSecret(
      String projectId, String locationId, String secretId, String member)
      throws IOException {

    // Endpoint to call the regional secret manager sever
    String apiEndpoint = String.format("secretmanager.%s.rep.googleapis.com:443", locationId);
    SecretManagerServiceSettings secretManagerServiceSettings =
        SecretManagerServiceSettings.newBuilder().setEndpoint(apiEndpoint).build();

    // Initialize the client that will be used to send requests. This client only needs to be
    // created once, and can be reused for multiple requests.
    try (SecretManagerServiceClient client = 
        SecretManagerServiceClient.create(secretManagerServiceSettings)) {
      // Build the name from the version.
      SecretName secretName = 
          SecretName.ofProjectLocationSecretName(projectId, locationId, secretId);

      // Request the current IAM policy.
      Policy currentPolicy =
          client.getIamPolicy(
              GetIamPolicyRequest.newBuilder().setResource(secretName.toString()).build());

      // Build the new binding.
      Binding binding =
          Binding.newBuilder()
              .setRole("roles/secretmanager.secretAccessor")
              .addMembers(member)
              .build();

      // Create a new IAM policy from the current policy, adding the binding.
      Policy newPolicy = Policy.newBuilder().mergeFrom(currentPolicy).addBindings(binding).build();

      // Save the updated IAM policy.
      Policy updatedPolicy = client.setIamPolicy(
          SetIamPolicyRequest.newBuilder()
              .setResource(secretName.toString())
              .setPolicy(newPolicy)
              .build());

      System.out.printf("Updated IAM policy for %s\n", secretId);

      return updatedPolicy;
    }
  }
}

Node.js

如需运行此代码，请先设置 Node.js 开发环境并安装 Secret Manager Node.js SDK。 在 Compute Engine 或 GKE 上，您必须使用 cloud-platform 范围进行身份验证。

/**
 * TODO(developer): Uncomment these variables before running the sample.
 */
// const projectId = 'my-project';
// const locationId = 'my-location';
// const secretId = 'my-secret';
// const member = 'user:you@example.com';
//
// NOTE: Each member must be prefixed with its type. See the IAM documentation
// for more information: https://cloud.google.com/iam/docs/overview.

const name = `projects/${projectId}/locations/${locationId}/secrets/${secretId}`;

// Imports the Secret Manager library
const {SecretManagerServiceClient} = require('@google-cloud/secret-manager');

// Adding the endpoint to call the regional secret manager sever
const options = {};
options.apiEndpoint = `secretmanager.${locationId}.rep.googleapis.com`;

// Instantiates a client
const client = new SecretManagerServiceClient(options);

async function grantAccessRegionalSecret() {
  // Get the current IAM policy.
  const [policy] = await client.getIamPolicy({
    resource: name,
  });

  // Add the user with accessor permissions to the bindings list.
  policy.bindings.push({
    role: 'roles/secretmanager.secretAccessor',
    members: [member],
  });

  // Save the updated IAM policy.
  await client.setIamPolicy({
    resource: name,
    policy: policy,
  });

  console.log(`Updated IAM policy for ${name}`);
}

grantAccessRegionalSecret();

Python

如需运行此代码，请先设置 Python 开发环境并安装 Secret Manager Python SDK。在 Compute Engine 或 GKE 上，您必须使用 cloud-platform 范围进行身份验证。

# Import the Secret Manager client library.
from google import iam
from google.cloud import secretmanager_v1


def iam_grant_access_with_regional_secret(
    project_id: str,
    location_id: str,
    secret_id: str,
    member: str,
) -> iam.v1.iam_policy_pb2.SetIamPolicyRequest:
    """
    Grants the given member access to a secret.
    """

    # Endpoint to call the regional secret manager sever.
    api_endpoint = f"secretmanager.{location_id}.rep.googleapis.com"

    # Create the Secret Manager client.
    client = secretmanager_v1.SecretManagerServiceClient(
        client_options={"api_endpoint": api_endpoint},
    )

    # Build the resource name of the secret.
    name = f"projects/{project_id}/locations/{location_id}/secrets/{secret_id}"

    # Get the current IAM policy.
    policy = client.get_iam_policy(request={"resource": name})

    # Add the given member with access permissions.
    policy.bindings.add(role="roles/secretmanager.secretAccessor", members=[member])

    # Update the IAM Policy.
    new_policy = client.set_iam_policy(request={"resource": name, "policy": policy})

    # Print data about the secret.
    print(f"Updated IAM policy on {secret_id}")

    return new_policy

撤消访问权限

如需撤消对 Secret 的访问权限，请使用以下方法之一：

控制台

  1. 转到 Google Cloud 控制台中的 Secret Manager 页面。

    前往 Secret Manager

  2. 前往区域 Secret 标签页。如需选择某个 Secret，请点击该 Secret 名称旁边的复选框。

  3. 如果面板尚未打开，请点击显示信息面板以打开面板。

  4. 在信息面板中，点击用户角色旁边的展开箭头以查看 有权访问该角色的用户或服务账号。

  5. 如需移除用户或服务账号，请点击删除 。

  6. 在显示的确认对话框中，点击移除。

gcloud

在使用下面的命令数据之前，请先进行以下替换：

  • SECRET_ID：密钥的 ID 或密钥的完全限定标识符
  • LOCATION：密钥的 Google Cloud 位置
  • MEMBER：IAM 成员，例如用户、群组或服务账号

执行以下命令：

Linux、macOS 或 Cloud Shell

gcloud secrets remove-iam-policy-binding SECRET_ID --location=LOCATION \
    --member="MEMBER" \
    --role="roles/secretmanager.secretAccessor"

Windows (PowerShell)

gcloud secrets remove-iam-policy-binding SECRET_ID --location=LOCATION `
    --member="MEMBER" `
    --role="roles/secretmanager.secretAccessor"

Windows (cmd.exe)

gcloud secrets remove-iam-policy-binding SECRET_ID --location=LOCATION ^
    --member="MEMBER" ^
    --role="roles/secretmanager.secretAccessor"

REST

注意：与其他示例不同，它将替换整个 IAM 政策。

在使用任何请求数据之前，请先进行以下替换：

  • LOCATION：Secret 的 Google Cloud 位置
  • PROJECT_ID：Google Cloud 项目 ID
  • SECRET_ID：Secret 的 ID 或 Secret 的完全限定标识符

HTTP 方法和网址：

POST https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID:setIamPolicy

请求 JSON 正文： 

{"policy": {"bindings": []}}

如需发送请求，请选择以下方式之一：

curl

将请求正文保存在名为 request.json 的文件中，然后执行以下命令： 

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID:setIamPolicy"

PowerShell

将请求正文保存在名为 request.json 的文件中，然后执行以下命令： 

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://secretmanager.LOCATION.rep.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/secrets/SECRET_ID:setIamPolicy" | Select-Object -Expand Content

您应该收到类似以下内容的 JSON 响应：

{
  "version": 1,
  "etag": "BwYhOtzsOBk="
}

Go

如需运行此代码，请先设置 Go 开发环境并安装 Secret Manager Go SDK。在 Compute Engine 或 GKE 上，您必须使用 cloud-platform 范围进行身份验证。

import (
	"context"
	"fmt"
	"io"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"
	"google.golang.org/api/option"
)

// iamRevokeAccess revokes the given member's access on the secret.
func IamRevokeAccessWithRegionalSecret(w io.Writer, projectId, locationId, secretId, member string) error {
	// name := "projects/my-project/locations/my-location/secrets/my-secret"
	// member := "user:foo@example.com"

	// Create the client.
	ctx := context.Background()
	//Endpoint to send the request to regional server
	endpoint := fmt.Sprintf("secretmanager.%s.rep.googleapis.com:443", locationId)
	client, err := secretmanager.NewClient(ctx, option.WithEndpoint(endpoint))

	if err != nil {
		return fmt.Errorf("failed to create regional secretmanager client: %w", err)
	}
	defer client.Close()

	name := fmt.Sprintf("projects/%s/locations/%s/secrets/%s", projectId, locationId, secretId)

	// Get the current IAM policy.
	handle := client.IAM(name)
	policy, err := handle.Policy(ctx)
	if err != nil {
		return fmt.Errorf("failed to get policy: %w", err)
	}

	// Grant the member access permissions.
	policy.Remove(member, "roles/secretmanager.secretAccessor")
	if err = handle.SetPolicy(ctx, policy); err != nil {
		return fmt.Errorf("failed to save policy: %w", err)
	}

	fmt.Fprintf(w, "Updated IAM policy for %s\n", name)
	return nil
}

Java

要运行此代码，请先设置 Java 开发环境并 安装 Secret Manager Java SDK。 在 Compute Engine 或 GKE 上，您必须使用 cloud-platform 范围进行身份验证。

import com.google.cloud.secretmanager.v1.SecretManagerServiceClient;
import com.google.cloud.secretmanager.v1.SecretManagerServiceSettings;
import com.google.cloud.secretmanager.v1.SecretName;
import com.google.iam.v1.Binding;
import com.google.iam.v1.GetIamPolicyRequest;
import com.google.iam.v1.Policy;
import com.google.iam.v1.SetIamPolicyRequest;
import java.io.IOException;

public class IamRevokeAccessWithRegionalSecret {

  public static void main(String[] args) throws IOException {
    // TODO(developer): Replace these variables before running the sample.

    // Your GCP project ID.
    String projectId = "your-project-id";
    // Location of the secret.
    String locationId = "your-location-id";
    // Resource ID of the secret to revoke access to.
    String secretId = "your-secret-id";
    // IAM member, such as a user group or service account you want to revoke access.
    String member = "user:foo@example.com";
    iamRevokeAccessWithRegionalSecret(projectId, locationId, secretId, member);
  }

  // Revoke a member access to a particular secret.
  public static Policy iamRevokeAccessWithRegionalSecret(
      String projectId, String locationId, String secretId, String member)
      throws IOException {

    // Endpoint to call the regional secret manager sever
    String apiEndpoint = String.format("secretmanager.%s.rep.googleapis.com:443", locationId);
    SecretManagerServiceSettings secretManagerServiceSettings =
        SecretManagerServiceSettings.newBuilder().setEndpoint(apiEndpoint).build();

    // Initialize the client that will be used to send requests. This client only needs to be
    // created once, and can be reused for multiple requests.
    try (SecretManagerServiceClient client = 
        SecretManagerServiceClient.create(secretManagerServiceSettings)) {
      // Build the name from the version.
      SecretName secretName = 
          SecretName.ofProjectLocationSecretName(projectId, locationId, secretId);

      // Request the current IAM policy.
      Policy policy =
          client.getIamPolicy(
              GetIamPolicyRequest.newBuilder().setResource(secretName.toString()).build());

      // Search through bindings and remove matches.
      String roleToFind = "roles/secretmanager.secretAccessor";
      for (Binding binding : policy.getBindingsList()) {
        if (binding.getRole() == roleToFind && binding.getMembersList().contains(member)) {
          binding.getMembersList().remove(member);
        }
      }

      // Save the updated IAM policy.
      Policy updatedPolicy = client.setIamPolicy(
          SetIamPolicyRequest.newBuilder()
              .setResource(secretName.toString())
              .setPolicy(policy)
              .build());

      System.out.printf("Updated IAM policy for %s\n", secretId);

      return updatedPolicy;
    }
  }
}

Node.js

要运行此代码，请先设置 Node.js 开发环境并 安装 Secret Manager Node.js SDK。 在 Compute Engine 或 GKE 上，您必须使用 cloud-platform 范围进行身份验证。

/**
 * TODO(developer): Uncomment these variables before running the sample.
 */
// const projectId = 'my-project';
// const locationId = 'my-location';
// const secretId = 'my-secret';
// const versionId = 'my-version';
// const member = 'user:you@example.com';
//
// NOTE: Each member must be prefixed with its type. See the IAM documentation
// for more information: https://cloud.google.com/iam/docs/overview.

const name = `projects/${projectId}/locations/${locationId}/secrets/${secretId}`;

// Imports the Secret Manager library
const {SecretManagerServiceClient} = require('@google-cloud/secret-manager');

// Adding the endpoint to call the regional secret manager sever
const options = {};
options.apiEndpoint = `secretmanager.${locationId}.rep.googleapis.com`;

// Instantiates a client
const client = new SecretManagerServiceClient(options);

async function grantAccessRegionalSecret() {
  // Get the current IAM policy.
  const [policy] = await client.getIamPolicy({
    resource: name,
  });

  // Build a new list of policy bindings with the user excluded.
  for (const i in policy.bindings) {
    const binding = policy.bindings[i];
    if (binding.role !== 'roles/secretmanager.secretAccessor') {
      continue;
    }

    const idx = binding.members.indexOf(member);
    if (idx !== -1) {
      binding.members.splice(idx, 1);
    }
  }

  // Save the updated IAM policy.
  await client.setIamPolicy({
    resource: name,
    policy: policy,
  });

  console.log(`Updated IAM policy for ${name}`);
}

grantAccessRegionalSecret();

Python

如需运行此代码，请先设置 Python 开发环境并 安装 Secret Manager Python SDK。 在 Compute Engine 或 GKE 上，您必须使用 cloud-platform 范围进行身份验证。

# Import the Secret Manager client library.
from google import iam
from google.cloud import secretmanager_v1


def iam_revoke_access_with_regional_secret(
    project_id: str,
    location_id: str,
    secret_id: str,
    member: str,
) -> iam.v1.iam_policy_pb2.SetIamPolicyRequest:
    """
    Revokes the given member access to a secret.
    """

    # Endpoint to call the regional secret manager sever.
    api_endpoint = f"secretmanager.{location_id}.rep.googleapis.com"

    # Create the Secret Manager client.
    client = secretmanager_v1.SecretManagerServiceClient(
        client_options={"api_endpoint": api_endpoint},
    )

    # Build the resource name of the secret.
    name = f"projects/{project_id}/locations/{location_id}/secrets/{secret_id}"

    # Get the current IAM policy.
    policy = client.get_iam_policy(request={"resource": name})

    # Remove the given member's access permissions.
    accessRole = "roles/secretmanager.secretAccessor"
    for b in list(policy.bindings):
        if b.role == accessRole and member in b.members:
            b.members.remove(member)

    # Update the IAM Policy.
    new_policy = client.set_iam_policy(request={"resource": name, "policy": policy})

    # Print data about the secret.
    print(f"Updated IAM policy on {secret_id}")

    return new_policy

后续步骤