Question

A fintech company stores a third-party payment API key in Secret Manager. Their security policy requires the key to be replaced every 30 days without manual intervention, and applications must always be able to retrieve the current valid credential. The team wants to use Secret Manager's built-in capabilities. Which approach best meets these requirements?

Accepted Answer

Enable a Secret Manager rotation schedule that publishes to a Pub/Sub topic, and subscribe a Cloud Function that generates the new API key, adds it as a new secret version, and disables the old version.

Answer

Set a TTL of 30 days on the secret so Secret Manager automatically deletes and regenerates the payload when it expires.

Answer

Configure a Secret Manager rotation period of 30 days, which automatically calls the third-party provider's API to issue and store a new key version.

Answer

Grant applications the Secret Manager Admin role so they can rotate the secret value themselves on each access.