Environment variables and secrets in GCP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What are environment variables in cloud applications?

Environment variables are key-value pairs used to store configuration settings outside the code. They help apps know things like database addresses or API keys without hardcoding them.

beginner

Why should secrets not be stored directly in environment variables?

Storing secrets directly in environment variables can expose sensitive data if logs or error messages leak them. Instead, secrets should be stored securely using dedicated secret management services.

beginner

What GCP service is recommended for managing secrets securely?

Google Cloud Secret Manager is the recommended service to store, manage, and access secrets securely in GCP projects.

intermediate

How does an application access secrets stored in Google Cloud Secret Manager?

The application uses the Secret Manager API or client libraries to fetch secrets at runtime, ensuring secrets are not stored in code or environment variables directly.

intermediate

What is a best practice when using environment variables and secrets in cloud apps?

Use environment variables for non-sensitive config and Secret Manager for sensitive data. Limit access permissions and rotate secrets regularly to keep data safe.

Which GCP service is designed specifically to store and manage secrets securely?

A Google Cloud Storage

B Google Cloud Pub/Sub

C Google Cloud Secret Manager

D Google Cloud Functions

Google Cloud Secret Manager is the dedicated service for securely storing and managing secrets.

Why is it risky to store secrets directly in environment variables?

A They can be exposed in logs or error messages

B They are encrypted automatically

C They are only accessible by admins

D They cannot be changed once set

Secrets in environment variables can accidentally appear in logs or error outputs, risking exposure.

What is a good use for environment variables in cloud apps?

A Storing database connection strings without passwords

B Storing user passwords

C Storing API keys in plain text

D Storing large files

Environment variables are good for non-sensitive config like database hostnames, but not for secrets.

How should an app retrieve secrets from Google Cloud Secret Manager?

A Downloading secrets manually before deployment

B Hardcoding secrets in the app code

C Storing secrets in environment variables permanently

D Using Secret Manager API or client libraries at runtime

Apps should fetch secrets securely at runtime using the Secret Manager API or libraries.

Which practice helps keep secrets safe in cloud environments?

A Share secrets openly among all team members

B Rotate secrets regularly and limit access permissions

C Store secrets in public repositories

D Use the same secret for all services

Regular rotation and strict access control reduce the risk of secret leaks.

Explain how environment variables and secrets should be managed in a GCP cloud application.

Think about separating config from secrets and how GCP helps secure secrets.

Describe the risks of storing secrets directly in environment variables and how to mitigate them.

Consider what can happen if secrets are exposed and how to keep them safe.