GCP Secret Manager

Sync sends an environment's secrets to Google Cloud Secret Manager. Stashbase stays the source of truth: when a secret changes, Stashbase creates or updates it in GCP. Sync is one-way and never reads secret values back.

Set up

Connect your Google Cloud project once per workspace, with a service account.
Add the integration to an environment and choose the prefix and labels.

Connect GCP

To connect, provide:

Connection name: A name for the connection.
Project ID: The Google Cloud project ID where secrets are managed.
Client email: The service account client email.
Private key: The private key from your service account credentials.

Alternatively, you can paste the full service account JSON and the form will be filled automatically.

Example service account JSON (sanitized):

{
  "type": "service_account",
  "project_id": "project",
  "private_key_id": "c8833...",
  "private_key": "-----BEGIN PRIVATE KEY-----...",
  "client_email": "stashbase-integration@project.iam.gserviceaccount.com",
  "client_id": "10352....",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/...",
  "universe_domain": "googleapis.com"
}

Project setup

Enable API: Secret Manager API (secretmanager.googleapis.com).
Create a Service Account in the target GCP project.
Generate Service Account JSON key (or paste full JSON if your flow supports direct JSON input).

Required permissions

Minimum permissions for integration behavior:

secretmanager.secrets.list (connection validation + reconcile + cleanup discovery)
secretmanager.secrets.create
secretmanager.secrets.update (labels patch)
secretmanager.secrets.delete (stale/cleanup delete)
secretmanager.versions.add (write secret values)

Optional/not required by current sync:

secretmanager.versions.access (not needed; integration does not read secret payloads)

Practical role guidance:

Easiest: roles/secretmanager.admin
Least-privilege: custom role with only the 5 permissions above

Integration settings

Configure these settings when you add the integration to an environment.

Secret name prefix

Optional prefix to use for secret names in GCP Secret Manager. This helps to organize secrets and avoid naming conflicts.

Labels

The labels to apply to secrets created or updated by Stashbase in GCP Secret Manager. You can add custom labels in addition to the labels that Stashbase applies to all managed secrets. Stashbase automatically adds and manages integration labels that identify the workspace and environment ownership of each secret.

Deletion in GCP is irreversible (there is no AWS-style recovery window).