Question

A developer accidentally committed a database password into a public Git repository. The password is stored in Secret Manager as secret version 4, which multiple Cloud Run services currently reference by the alias 'latest'. The security team must immediately stop applications from using the compromised value while preserving the ability to audit what was leaked, and then roll all services onto a new credential with minimal downtime. What is the recommended sequence of actions?

Accepted Answer

Add a new secret version (version 5) with the rotated password, then disable version 4 so it can still be inspected in audit logs but can no longer be accessed by applications.

Answer

Immediately destroy secret version 4 and create a new secret resource entirely, then update every Cloud Run service to point to the new secret.

Answer

Update the IAM policy on the secret to remove secretAccessor from the Cloud Run service accounts until the incident is closed.

Answer

Enable a CMEK on the existing secret so that version 4 becomes cryptographically unreadable, then push a new plaintext version.