Question

A fintech company stores database credentials and API tokens in Secret Manager. Their security policy requires that (1) all secret payloads be encrypted with keys the company controls and can audit, and (2) the credentials must never leave the EU region for data-residency compliance. A developer needs read access to only one specific secret without being granted access to all secrets in the project. Which combination of configurations satisfies all these requirements?

Accepted Answer

Create a regional secret in a europe-west location configured with a CMEK from a Cloud KMS key ring in the same region, and grant the developer roles/secretmanager.secretAccessor on that individual secret resource.

Answer

Create a global secret with automatic replication, enable Google-managed encryption, and grant the developer roles/secretmanager.admin at the project level.

Answer

Create a global secret with a user-managed replication policy limited to EU regions using Google-managed keys, and grant the developer roles/secretmanager.secretAccessor at the project level.

Answer

Create a regional secret in a europe-west location with Google-managed encryption, and grant the developer roles/secretmanager.viewer on the individual secret resource.