Serverless Expeditions — selected guide
Manage your Cloud Run secrets securely with Secret Manager
Fourteen episodes on service choice, architecture, scaling, state, security, operations, and delivery
Serverless design and operations through concrete examples: choosing a runtime, ordering events, managing relational state, undoing failed workflows, protecting secrets, and deploying changes safely. The selection also includes two AI-agent examples covering tools and database access.
In this collection Browse 14 summaries 8 of 14
Passwords in source code are visible to repository readers and difficult to vary between development and production. In this May 2021 demonstration, Google developer advocate Martin Omander moves a Cloud Run application's database password into Secret Manager, adding per-secret permissions without changing application code.
Key points
- Moving a secret out of code is only the first boundary: The presenter contrasts hard-coded credentials with environment files, which avoid the repository but still require protected storage 00:00–02:05(opens in a new tab).
- The demo applies per-secret least privilege: A custom Cloud Run service account that already has only a Cloud SQL role receives access to one database-password secret, then the plaintext environment value is replaced with a Secret Manager reference 02:05–04:11(opens in a new tab).
- The logging claim has a specific scope: The presenter says secret creation and updates are logged by default, and that he usually enables additional logging for secret access 04:11–05:14(opens in a new tab). The episode does not say every access is logged by default.
- How the code reads the secret affects updates: Martin describes three access paths: an environment variable, a mounted file, or a call to the Secret Manager client library. In the 2021 behavior shown, file reads and client-library calls can obtain the current value; an environment variable requires redeploying the Cloud Run service after the secret changes. Calling the library also requires application-code changes 04:11–06:15(opens in a new tab).
Full video: https://www.youtube.com/watch?v=JIE89dneaGo(opens in a new tab)