- Documentation
- Internals
- SDKs
- API Reference
- Changelog
- Contributing
- Blog
- Slack
- GitHub
Getting Started
Guides
- Organization
- Project
- Folders
- Reference and Import Secrets
- Webhooks
- Point-in-Time Recovery
- Secret Versioning
- Audit Logs
- Service token
- IP Allowlisting
- MFA
SSO
Deployment options
- All environment variables
- Configure email service
- Configure Redis
- Configure SSO
- FAQ
- Overview
AWS
Digital Ocean
- Heroku
- Vercel
- Netlify
- Render
- Railway
- Fly.io
- Laravel Forge
- Supabase
- Northflank
- Terraform Cloud
- TeamCity
- Cloudflare Pages
- Checkly
- Qovery
- HashiCorp Vault
- Azure Key Vault
- GCP Secret Manager
- Cloud 66
- Windmill
- GitHub Actions
- GitLab
- CircleCI
- Travis CI
- Bitbucket
- Codefresh
Overview
Platform
Self-host Infisical
Integrations
3rd-party Integrations
GCP Secret Manager
Usage
Self-Hosted Setup
Prerequisites:
- Set up and add envars to Infisical Cloud
Navigate to your project’s integrations tab
Authorize Infisical for GCP
Press on the GCP Secret Manager tile and select Continue with OAuth
Grant Infisical access to GCP.
If this is your project’s first cloud integration, then you’ll have to grant Infisical access to your project’s environment variables. Although this step breaks E2EE, it’s necessary for Infisical to sync the environment variables to the cloud platform.
Start integration
In the Connection tab, select which Infisical environment secrets you want to sync to which GCP secret manager project. Lastly, press create integration to start syncing secrets to GCP secret manager.
Note that the GCP Secret Manager integration supports a few options in the Options tab:
- Secret Prefix: If inputted, the prefix is appended to the front of every secret name prior to being synced.
- Secret Suffix: If inputted, the suffix to appended to the back of every name of every secret prior to being synced.
- Label in GCP Secret Manager: If selected, every secret will be labeled in GCP Secret Manager (e.g. as
managed-by:infisical); labels can be customized.
Setting a secret prefix, suffix, or enabling the labeling option ensures that existing secrets in GCP Secret Manager are not overwritten during the sync. As part of this process, Infisical abstains from mutating any secrets in GCP Secret Manager without the specified prefix, suffix, or attached label.
Using Infisical to sync secrets to GCP Secret Manager requires that you enable the Service Usage API and Cloud Resource Manager API in the Google Cloud project you want to sync secrets to. More on that here.
Prerequisites:
- Set up and add envars to Infisical Cloud
- Have a GCP project and have/create a service account in it
Grant the service account permissions for GCP Secret Manager
Navigate to IAM & Admin page in GCP and add the Secret Manager Admin and Service Usage Admin roles to the service account.
For enhanced security, you may want to assign more granular permissions to the service account. At minimum, the service account should be able to read/write secrets from/to GCP Secret Manager (e.g. Secret Manager Admin role) and list which GCP services are enabled/disabled (e.g. Service Usage Admin role).
Navigate to your project’s integrations tab
Authorize Infisical for GCP
Press on the GCP Secret Manager tile and paste in your GCP Service Account JSON (you can create and download the JSON for your service account in IAM & Admin > Service Accounts > Service Account > Keys).
If this is your project’s first cloud integration, then you’ll have to grant Infisical access to your project’s environment variables. Although this step breaks E2EE, it’s necessary for Infisical to sync the environment variables to the cloud platform.
Start integration
In the Connection tab, select which Infisical environment secrets you want to sync to the GCP secret manager project. Lastly, press create integration to start syncing secrets to GCP secret manager.
Note that the GCP Secret Manager integration supports a few options in the Options tab:
- Secret Prefix: If inputted, the prefix is appended to the front of every secret name prior to being synced.
- Secret Suffix: If inputted, the suffix to appended to the back of every name of every secret prior to being synced.
- Label in GCP Secret Manager: If selected, every secret will be labeled in GCP Secret Manager (e.g. as
managed-by:infisical); labels can be customized.
Setting a secret prefix, suffix, or enabling the labeling option ensures that existing secrets in GCP Secret Manager are not overwritten during the sync. As part of this process, Infisical abstains from mutating any secrets in GCP Secret Manager without the specified prefix, suffix, or attached label.
Using Infisical to sync secrets to GCP Secret Manager requires that you enable the Service Usage API and Cloud Resource Manager API in the Google Cloud project you want to sync secrets to. More on that here.