Google Secret Manager
Grant just-in-time read access to individual Google Secret Manager secrets through P0, on top of your existing Google Cloud IAM management integration.
Last updated
Grant just-in-time read access to individual Google Secret Manager secrets through P0, on top of your existing Google Cloud IAM management integration.
Google Secret Manager is a preview integration.
The Google Secret Manager integration lets P0 grant just-in-time, time-limited read access to individual Google Secret Manager secrets. P0 grants access to one named secret at a time, so a requestor receives only the secret they need rather than project-wide secret access.
Google Secret Manager builds on your existing Google Cloud IAM management install:
A user requests access to a specific secret in a project through P0.
After approval, P0 delegates read access to that secret for the approved duration. P0 scopes the grant to the requested secret resource, not to the whole project.
When the access duration expires or an approver revokes access, P0 removes the grant.
To set up Google Secret Manager, you need:
A P0 Google Cloud integration with IAM management installed on the project that holds the secrets. Google Secret Manager reuses that integration's IAM-write access, so install it first.
A P0 account with administrator access.
Navigate to Integrations on p0.app and select the Google Secret Manager integration.
Select the Vault component.
Select the project where your IAM management integration is installed.
Click Finish.
P0 can now grant just-in-time access to your Google Secret Manager secrets. See Requesting access to make your first request.
Users request access to a secret through the P0 app or a P0 notifier such as Slack:
Open p0.app and navigate to the Access Management page.
Click Request Access.
In the Resource dropdown, select Google Secret Manager.
Select the Secret manager project and enter the Secret name you need to read.
Enter a reason and a requested duration, then submit the request.
After an approver grants the request, P0 delegates read access to the secret for the approved duration.
Last updated