Can I access Google Secrets Manager secrets externally

Question

I am writing an app that I will be hosting in Google Cloud Functions with some config stored in Secrets Manager. I would like to share this information with another node app that is running on my local machine. Is this possible? I have tried using the npm package but I can’t figure out how I can authenticate to get access to the manager.

I am using a service key to access firestore:

import { initializeApp } from "firebase/app";
import { getFirestore } from "firebase/firestore";
const service_key = {
    apiKey: myKey,
    authDomain: "my-poroject.firebaseapp.com",
    projectId: "my-poroject",
    storageBucket: "my-poroject.appspot.com",
    messagingSenderId: "0123456789",
    appId: "0:00000000:web:00000000000000"
 }
const app = initializeApp(service_Key);
export const db = getFirestore(app);

This all works perfectly, but I can't see how I would apply the key or 'app' when using secret manager:

const {SecretManagerServiceClient} = require('@google-cloud/secret-manager');
const client = new SecretManagerServiceClient();

Answer 1

As public cloud provider, most of the Google Cloud services are publicly accessible. So YES, you can access the secret from outside.

However, you must have the required credentials and permissions to access the secrets.

You can use a service account key file, which is also a secret (and I never recommend that option, but in some cases, it's useful), to generate an access token and to query safely secret manager. The problem is the service account key file, it's a secret to protect secret... The security level depends on your external platform.

You can also have a look to Identity Federation Pool that can help you to use your already known identity and to be transparently authenticated on Google Cloud. It's very powerful and you no longer need secret on your side and you increase your security posture.