Google Secret Manager - Can it be used for storing usernames and passwords of API users?

user_1131904 0
Viewed 195

Consider an API that receives HTTPS requests, and uses HTTP basic authentication. Whenever it receives a request, the application needs to check whether the username/password combination in the header is valid. There can be thousands of users, each one with their own keys.

I'm wondering if Google Secret Manager is suitable for this use case. That is:

  • I could store each API username/password in Secret Manager, using the username as secret ID.
  • Then, whenever a request comes in, the application would: (1) lookup the credential for the username present in the Authorization header, (2) compare the header password with the one retrieved from Secret Manager, (3) reject the request if there is a mismatch.

Would Google Secret Manager be efficient and advisable for the case described above?

google-secret-manager
1 Answers

It is technically possible because there's no limit on the number of secrets in a GCP project. However, it could quickly become expensive. Each secret is $0.06/mo. That means each user costs you $0.72/yr. At 1M users, that's $720k/yr + API operational costs.

There's also the latency to consider. You'll need to make an API call to Secret Manager in the context of a user's request. This could easily double the round-trip latency. The architecture you're thinking about is correct, but Secret Manager isn't really an LDAP or authentication server.

user_3657380
Related