Question

Your team runs a Vertex AI Pipeline that trains a model and then calls an external third-party API to register the resulting model artifact. The API requires a secret token. During code review, a colleague notices the token is currently hard-coded as a default value in a pipeline component's Python function signature and is therefore compiled into the pipeline YAML stored in a shared Artifact Registry. What is the most secure and maintainable way to provide this token to the component at runtime?

Accepted Answer

Store the token in Secret Manager and have the component fetch it at runtime using the pipeline's service account, which is granted the Secret Manager Secret Accessor role.

Answer

Pass the token as a pipeline runtime parameter each time the pipeline is submitted, so it is not stored in the compiled YAML.

Answer

Encrypt the token with a customer-managed encryption key (CMEK) and keep it as the component's default argument in the compiled pipeline.

Answer

Set the token as an environment variable in the component's base container image and rebuild the image whenever it rotates.