> ## Documentation Index
> Fetch the complete documentation index at: https://infisical-groups-phase-3.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Secret Manager

> How to sync secrets from Infisical to GCP Secret Manager

<Tabs>
  <Tab title="Usage">
    <AccordionGroup>
      <Accordion title="Connect with OAuth2">
        Prerequisites:

        * Set up and add envars to [Infisical Cloud](https://app.infisical.com)

        <Steps>
          <Step title="Authorize Infisical for GCP">
            Navigate to your project's integrations tab in Infisical.

            ![integrations](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations.png)

            Press on the GCP Secret Manager tile and select **Continue with OAuth**

            ![integrations GCP authorization options](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-auth-options.png)

            Grant Infisical access to GCP.

            ![integrations GCP authorization](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-auth.png)

            <Info>
              If this is your project's first cloud integration, then you'll have to grant
              Infisical access to your project's environment variables. Although this step
              breaks E2EE, it's necessary for Infisical to sync the environment variables to
              the cloud platform.
            </Info>
          </Step>

          <Step title="Start integration">
            In the **Connection** tab, select which Infisical environment secrets you want to sync to which GCP secret manager project. Lastly, press create integration to start syncing secrets to GCP secret manager.

            ![integrations GCP secret manager](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-create.png)

            Note that the GCP Secret Manager integration supports a few options in the **Options** tab:

            * Secret Prefix: If inputted, the prefix is appended to the front of every secret name prior to being synced.
            * Secret Suffix: If inputted, the suffix to appended to the back of every name of every secret prior to being synced.
            * Label in GCP Secret Manager: If selected, every secret will be labeled in GCP Secret Manager (e.g. as `managed-by:infisical`); labels can be customized.

            Setting a secret prefix, suffix, or enabling the labeling option ensures that existing secrets in GCP Secret Manager are not overwritten during the sync. As part of this process, Infisical abstains from mutating any secrets in GCP Secret Manager without the specified prefix, suffix, or attached label.

            ![integrations GCP secret manager options](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-create-options.png)

            ![integrations GCP secret manager](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager.png)

            <Warning>
              Using Infisical to sync secrets to GCP Secret Manager requires that you enable
              the Service Usage API and Cloud Resource Manager API in the Google Cloud project you want to sync secrets to. More on that [here](https://cloud.google.com/service-usage/docs/set-up-development-environment).
            </Warning>
          </Step>
        </Steps>
      </Accordion>

      <Accordion title="Connect with Service Account JSON">
        Prerequisites:

        * Set up and add envars to [Infisical Cloud](https://app.infisical.com)
        * Have a GCP project and have/create a [service account](https://cloud.google.com/iam/docs/service-account-overview) in it

        <Steps>
          <Step title="Authorize Infisical for GCP">
            Navigate to **IAM & Admin** page in GCP and add the **Secret Manager Admin** and **Service Usage Admin** roles to the service account.

            ![integrations GCP secret manager IAM](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-iam.png)

            <Info>
              For enhanced security, you may want to assign more granular permissions to the service account. At minimum,
              the service account should be able to read/write secrets from/to GCP Secret Manager (e.g. **Secret Manager Admin** role)
              and list which GCP services are enabled/disabled (e.g. **Service Usage Admin** role).
            </Info>

            Navigate to your project's integrations tab in Infisical.

            ![integrations](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations.png)

            Press on the GCP Secret Manager tile and paste in your **GCP Service Account JSON** (you can create and download the JSON for your
            service account in IAM & Admin > Service Accounts > Service Account > Keys).

            ![integrations GCP authorization IAM key](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-iam-key.png)

            ![integrations GCP authorization options](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-auth-options.png)

            <Info>
              If this is your project's first cloud integration, then you'll have to grant
              Infisical access to your project's environment variables. Although this step
              breaks E2EE, it's necessary for Infisical to sync the environment variables to
              the cloud platform.
            </Info>
          </Step>

          <Step title="Start integration">
            In the **Connection** tab, select which Infisical environment secrets you want to sync to the GCP secret manager project. Lastly, press create integration to start syncing secrets to GCP secret manager.

            ![integrations GCP secret manager](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-create.png)

            Note that the GCP Secret Manager integration supports a few options in the **Options** tab:

            * Secret Prefix: If inputted, the prefix is appended to the front of every secret name prior to being synced.
            * Secret Suffix: If inputted, the suffix to appended to the back of every name of every secret prior to being synced.
            * Label in GCP Secret Manager: If selected, every secret will be labeled in GCP Secret Manager (e.g. as `managed-by:infisical`); labels can be customized.

            Setting a secret prefix, suffix, or enabling the labeling option ensures that existing secrets in GCP Secret Manager are not overwritten during the sync. As part of this process, Infisical abstains from mutating any secrets in GCP Secret Manager without the specified prefix, suffix, or attached label.

            ![integrations GCP secret manager options](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-create-options.png)

            ![integrations GCP secret manager](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager.png)

            <Warning>
              Using Infisical to sync secrets to GCP Secret Manager requires that you enable
              the Service Usage API and Cloud Resource Manager API in the Google Cloud project you want to sync secrets to. More on that [here](https://cloud.google.com/service-usage/docs/set-up-development-environment).
            </Warning>
          </Step>
        </Steps>
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Self-Hosted Setup">
    Using the GCP Secret Manager integration (via the OAuth2 method) on a self-hosted instance of Infisical requires configuring an OAuth2 application in GCP
    and registering your instance with it.

    <Steps>
      <Step title="Create an OAuth2 application in GCP">
        Navigate to your project API & Services > Credentials to create a new OAuth2 application.

        ![integrations GCP secret manager config](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-config-api-services.png)
        ![integrations GCP secret manager config](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-config-new-app.png)

        Create the application. As part of the form, add to **Authorized redirect URIs**: `https://your-domain.com/integrations/gcp-secret-manager/oauth2/callback`.

        ![integrations GCP secret manager config](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-config-new-app-form.png)
      </Step>

      <Step title="Add your OAuth2 application credentials to Infisical">
        Obtain the **Client ID** and **Client Secret** for your GCP OAuth2 application.

        ![integrations GCP secret manager config](https://mintlify.s3-us-west-1.amazonaws.com/infisical-groups-phase-3/images/integrations/gcp-secret-manager/integrations-gcp-secret-manager-config-credentials.png)

        Back in your Infisical instance, add two new environment variables for the credentials of your GCP OAuth2 application:

        * `CLIENT_ID_GCP_SECRET_MANAGER`: The **Client ID** of your GCP OAuth2 application.
        * `CLIENT_SECRET_GCP_SECRET_MANAGER`: The **Client Secret** of your GCP OAuth2 application.

        Once added, restart your Infisical instance and use the GCP Secret Manager integration.
      </Step>
    </Steps>
  </Tab>
</Tabs>