How to secure env variables in gcp app engine app.yaml deployment file?

user_888469 0
Viewed 112

by the app.yaml configuration files documentation, its allows env variables like:

runtime: nodejs16 # or another supported version

instance_class: F2

env_variables:
  BUCKET_NAME: "example-gcs-bucket"
  DB_PASSWORD: "my_secret_pw"

However some of those variables may contain sensitive data like DB_PASSWORD.

The deployment yaml file is in the repository and the CI pipeline reffers it to deploy to the GCP App Engine service.

How can i secure the those variable value and prevent that anyone with repository acesses be able to see them?

google-app-engine
1 Answers

Storing db credentials in app.yaml file is not ideal. A better and more secure approach that you can consider is to use Cloud KMS:

  • Use a service account with encyrpt and decrypt permission (role) to encyrpt the credentials (secrets) file.
  • Upload the encrypted credential file to Cloud Storage.
  • Fetch the encrypted credential from GCS, decrypt and parse it at runtime in your application code

There is the How-to: Storing secrets that shows how to use Cloud KMS to store secrets in Cloud Storage.

user_177203630
Related