Question

A development team stores third-party API credentials in Google Cloud Secret Manager. An application running on a Compute Engine instance needs to read the current value of one specific secret at runtime, but it must not be able to create, delete, modify, or list other secrets in the project. Following least-privilege principles, what should the security engineer configure?

Accepted Answer

Grant the instance's service account the roles/secretmanager.secretAccessor role scoped to that individual secret resource.

Answer

Grant the instance's service account the roles/secretmanager.admin role at the project level so it can retrieve the secret.

Answer

Grant the instance's service account the roles/secretmanager.viewer role scoped to the project.

Answer

Add the instance's service account as an Owner on the project and rely on VPC Service Controls to limit secret access.