🔒Google Secret Manager
Grant just-in-time read access to individual Google Secret Manager secrets through P0, on top of your existing Google Cloud IAM management integration.
The Google Secret Manager integration lets P0 grant just-in-time, time-limited read access to individual Google Secret Manager secrets. P0 grants access to one named secret at a time, so a requestor receives only the secret they need rather than project-wide secret access.
How it works
Google Secret Manager builds on your existing Google Cloud IAM management install:
A user requests access to a specific secret in a project through P0.
After approval, P0 delegates read access to that secret for the approved duration. P0 scopes the grant to the requested secret resource, not to the whole project.
When the access duration expires or an approver revokes access, P0 removes the grant.
What P0 can and cannot do with your secrets
Google Secret Manager uses your existing Google Cloud IAM management permissions and requires no new ones. That service account cannot read secret values.
On approval, P0 grants the requesting user roles/secretmanager.secretAccessor on the one requested secret, as a project-level binding with a condition that limits it to that secret. The user reads the secret through Google Cloud. P0 never sees or stores the value.
Before you begin
To set up Google Secret Manager, you need:
A P0 Google Cloud integration with IAM management installed on the project that holds the secrets. Google Secret Manager reuses that integration's IAM-write access, so install it first.
A P0 account with administrator access.
Setting up Google Secret Manager
Navigate to Integrations on p0.app and select the Google Secret Manager integration.
Select the Vault component.
Click the Add Project button.
Next select the Project identifier from the dropdown menu where your IAM management integration is installed and click Next.
Click Finish.
P0 can now grant just-in-time access to your Google Secret Manager secrets. See Requesting access to make your first request.
Requesting access
Users request access to a secret through the P0 app or a P0 notifier such as Slack:
Open p0.app and navigate to the Access Management page.
Click Request Access.
In the Resource dropdown, select Google Secret Manager.
Select the Secret manager project and enter the Secret name you need to read.
Enter a reason and a requested duration, then submit the request.
After an approver grants the request, P0 delegates read access to the secret for the approved duration.
Additional resources
Last updated