Answers: <p>I would recommend you use their Google Cloud Secrets Engine. Documentation is here: <a href="https://www.vaultproject.io/docs/secrets/gcp/index.html" rel="nofollow noreferrer">https://www.vaultproject.io/docs/secrets/gcp/index.html</a></p>
  
  <p>Managing such sensitive secrets by any means other than a Vault service is dangerous. </p>
  
Answers: CC BY-SA 4.0
Answers: 2019-12-07T02:31:51.787Z
Answers: 2019-12-07T02:31:51.787Z
Answers: Steven K7FAQ
Answers: <p>Add the service account key to you repository is not a good practice when thinking about security.</p>
  
  <p>The second solution may happen and should be a good practice to implement some key rotation process to avoid some dev using a compromised key. Even though, there are <a href="https://forsetisecurity.org/docs/latest/concepts/best-practices.html#service-accounts" rel="nofollow noreferrer">some guidance</a> which suggests to avoid the utilization of several keys (Also, I suppose there's a limit in the platform for Service Account key creation)</p>
  
  <p>Take a look at <a href="https://cloud.google.com/kms/docs/iam" rel="nofollow noreferrer">Cloud KMS</a> that may have some suggestion for you on how to manage your keys</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-12-06T17:51:11.100Z
Answers: 2019-12-06T17:51:11.100Z
Answers: manasouza
Body: <p>How securely to keep google cloud service account key?</p>
  
  <p>I want to ask about how we should securely keep service account key. The scenario looks like:</p>
  
  <ul>
  <li>Our product is connecting to BigQuery. </li>
  <li>We have project which is used only by developers as playground.  </li>
  <li>We need to run integration tests in pipelines and they needs service account to run correctly.</li>
  <li>Developer also should be able to run integration tests locally.</li>
  </ul>
  
  <p>Where should I put the service account key? </p>
  
  <p>I can add it to our repository, but I'm not sure if this solution is ok. (even it is only key with read-only permission to developer version of BigQuery).</p>
  
  <p>The second solution is create a few keys. And every developer should has own. Then every developer have to care about key himself (and we can easy remove key when developer i.e quit job)</p>
  
Tags: <google-cloud-platform><devsecops>
Title: How securely to keep google cloud service account key?
UserDisplayName: Mariusz
ThreadText: # How securely to keep google cloud service account key?
  
  (Asked by: username_0 on 2019-12-04)
  
  How securely to keep google cloud service account key?
  
  I want to ask about how we should securely keep service account key. The scenario looks like:
  
  * Our product is connecting to BigQuery.
  * We have project which is used only by developers as playground.
  * We need to run integration tests in pipelines and they needs service account to run correctly.
  * Developer also should be able to run integration tests locally.
  
  Where should I put the service account key?
  
  I can add it to our repository, but I'm not sure if this solution is ok. (even it is only key with read-only permission to developer version of BigQuery).
  
  The second solution is create a few keys. And every developer should has own. Then every developer have to care about key himself (and we can easy remove key when developer i.e quit job)
  
  **Tags:** google-cloud-platform, devsecops
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2019-12-07. Score: 1
  
  I would recommend you use their Google Cloud Secrets Engine. Documentation is here: <https://www.vaultproject.io/docs/secrets/gcp/index.html>
  
  Managing such sensitive secrets by any means other than a Vault service is dangerous.
  
  
  ---
  
  ### Answer by username_2 on 2019-12-06. Score: 0
  
  Add the service account key to you repository is not a good practice when thinking about security.
  
  The second solution may happen and should be a good practice to implement some key rotation process to avoid some dev using a compromised key. Even though, there are [some guidance](https://forsetisecurity.org/docs/latest/concepts/best-practices.html#service-accounts) which suggests to avoid the utilization of several keys (Also, I suppose there's a limit in the platform for Service Account key creation)
  
  Take a look at [Cloud KMS](https://cloud.google.com/kms/docs/iam) that may have some suggestion for you on how to manage your keys
  
  
  ---
  
  