mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-22 23:21:08 +02:00
0660ea6fac
* Update README Let contributors know that docs will now be located in UDR * Add comments to each mdx doc Comment has been added to all mdx docs that are not partials * chore: added changelog changelog check failure * wip: removed changelog * Fix content errors * Doc spacing * Update website/content/docs/deploy/kubernetes/vso/helm.mdx Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com> --------- Co-authored-by: jonathanfrappier <92055993+jonathanfrappier@users.noreply.github.com> Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
91 lines
3.3 KiB
Plaintext
91 lines
3.3 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: GCP secret import source
|
|
description: The Google Cloud Platform Secret Manager source imports secrets from GCP to Vault.
|
|
---
|
|
|
|
> [!IMPORTANT]
|
|
> **Documentation Update:** Product documentation, which were located in this repository under `/website`, are now located in [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs), colocated with all other product documentation. Contributions to this content should be done in the `web-unified-docs` repo, and not this one. Changes made to `/website` content in this repo will not be reflected on the developer.hashicorp.com website.
|
|
|
|
# GCP secret import source
|
|
|
|
Use the GCP Importer to read secret data from GCP Secrets Manager into your Vault
|
|
instance.
|
|
|
|
## Before you start
|
|
- **You must know the relevant GCP credentials**. You can provide the credentials
|
|
as environment variables, as explicit arguments, or use dynamic credentials
|
|
from an existing [GCP secrets plugin](/vault/docs/secrets/gcp) mount path.
|
|
|
|
## Step 1: Set GCP Identity permissions
|
|
|
|
To use GCP import, you must grant the associated GCP identity permission to read secrets:
|
|
|
|
```shell-session
|
|
"secretmanager.secrets.list",
|
|
"secretmanager.versions.access",
|
|
```
|
|
|
|
## Step 2: Define the Azure source
|
|
|
|
<Tabs>
|
|
<Tab heading="Static credentials">
|
|
|
|
The following configuration example uses Azure static credentials to
|
|
import secrets from Azure Key Vault:
|
|
|
|
|
|
```hcl
|
|
source_gcp {
|
|
name = "my-gcp-source-1"
|
|
credentials_file = "/path/to/credentials-file"
|
|
}
|
|
```
|
|
|
|
If `credentials_file` is set, then `vault_mount_path`, `vault_role_name`,`vault_namespace`,`vault_address` and `vault_credentials_file` must be unset.
|
|
|
|
</Tab>
|
|
<Tab heading="Dynamic credentials">
|
|
|
|
Alternatively, source credentials can also be derived dynamically using the [GCP Secret Engine](/vault/docs/secrets/gcp)
|
|
|
|
This uses the GCP secrets engine configured at the given `vault_address` to generate dynamic secrets in order to scan secrets in GCP Secret Manager.
|
|
|
|
```hcl
|
|
source_gcp {
|
|
name = "my-gcp-source-2"
|
|
vault_mount_path = "gcp"
|
|
vault_role_name = "my-gcp-role-1"
|
|
vault_namespace = "ns-1"
|
|
vault_address = "https://vault.example.com:8200"
|
|
vault_credentials_file = "/path/to/vault/token"
|
|
}
|
|
```
|
|
|
|
If one of `vault_mount_path`,`vault_role_name`, `vault_namespace`,`vault_address` or `vault_credentials_file` are set, then `credentials_file` must be unset.
|
|
|
|
</Tab>
|
|
</Tabs>
|
|
|
|
## Argument reference
|
|
|
|
Refer to the [HCL syntax](/vault/docs/import#hcl-syntax-1) for arguments common to all source types.
|
|
|
|
- `vault_mount_path` `(string: "")` - The Vault mount path to a pre-configured GCP
|
|
secrets engine used to generate dynamic credentials for the importer.
|
|
|
|
- `vault_role_name` `(string: "")` - GCP secrets plugin role used to generate
|
|
dynamic credentials for the importer. Only required for dynamic credentials.
|
|
|
|
- `vault_namespace` `(string: "")` - Vault namespace for the mount path
|
|
specified in `vault_mount_path`. Only required for dynamic credentials.
|
|
|
|
- `vault_address` `(string: "")` - The address of your Vault server. Only
|
|
required for dynamic credentials.
|
|
|
|
- `vault_credentials_file` `(string: "")` - Local path to a file containing a
|
|
valid token for the Vault server at `vault_address`. Only required for dynamic
|
|
credentials.
|
|
|
|
- `credentials_file` `(string: "")` - The path to the service account key credentials file to authenticate with.
|