Access Secret Manager of multiple google cloud projects using google-cloud-secretmanager client library in java

Question

I using GCP Secret manager to store passwords using the google-cloud-secretmanager client library (Java). The client library is expecting the service account key (json) file path for a gcp project in environment variable. I am able to do it for single project, but when I try to access Secret manager of multiple GCP projects, I don't know how to set the keys for different projects in environment variable. Need help in setting the keys in environment or is there a way to set it using java code.

I am using this maven dependency

  <dependency>
    <groupId>com.google.cloud</groupId>
    <artifactId>google-cloud-secretmanager</artifactId>
  </dependency>

https://cloud.google.com/secret-manager/docs/reference/libraries

Thanks in advance.

Answer 1

Like most Google Cloud services, Google Secret Manager supports cross-project permissions. You can grant your service account access to secrets in other projects by applying the IAM permission to the service account. Even though the service account resides in project-a, it can still be given permission to access Secret Manager secrets in project-b:

gcloud secrets add-iam-policy-binding "my-secret" \
  --project "project-b"
  --member "serviceAccount:[email protected]"

As an aside, the client library does not require the path to a JSON service account key. It accepts one, but you can provide authentication via multiple paths, including Application Default Credentials (preferred).