Question

A financial services company operating in Germany must store an API key in Secret Manager. Compliance requires that all secret material physically reside only within EU regions and never be replicated outside the EU. The team is about to create the secret using the default settings. What should they configure to satisfy this data residency requirement?

Accepted Answer

Create the secret with a user-managed replication policy specifying only europe-west3 (and optionally other EU regions)

Answer

Create the secret with the automatic replication policy, which Google restricts to the caller's billing account region

Answer

Enable CMEK on the secret using a global Cloud KMS key so that the encryption anchors the data to the EU

Answer

Apply an organization policy that restricts Secret Manager to EU regions after the secret is created with default replication