<p>I would recommend you use their Google Cloud Secrets Engine. Documentation is here: <a href="https://www.vaultproject.io/docs/secrets/gcp/index.html" rel="nofollow noreferrer">https://www.vaultproject.io/docs/secrets/gcp/index.html</a></p>

<p>Managing such sensitive secrets by any means other than a Vault service is dangerous. </p>

CC BY-SA 4.0
2019-12-07T02:31:51.787Z
2019-12-07T02:31:51.787Z
Steven K7FAQ
<p>Add the service account key to you repository is not a good practice when thinking about security.</p>

<p>The second solution may happen and should be a good practice to implement some key rotation process to avoid some dev using a compromised key. Even though, there are <a href="https://forsetisecurity.org/docs/latest/concepts/best-practices.html#service-accounts" rel="nofollow noreferrer">some guidance</a> which suggests to avoid the utilization of several keys (Also, I suppose there's a limit in the platform for Service Account key creation)</p>

<p>Take a look at <a href="https://cloud.google.com/kms/docs/iam" rel="nofollow noreferrer">Cloud KMS</a> that may have some suggestion for you on how to manage your keys</p>

CC BY-SA 4.0
2019-12-06T17:51:11.100Z
2019-12-06T17:51:11.100Z
manasouza
<p>How securely to keep google cloud service account key?</p>

<p>I want to ask about how we should securely keep service account key. The scenario looks like:</p>

<ul>
<li>Our product is connecting to BigQuery. </li>
<li>We have project which is used only by developers as playground.  </li>
<li>We need to run integration tests in pipelines and they needs service account to run correctly.</li>
<li>Developer also should be able to run integration tests locally.</li>
</ul>

<p>Where should I put the service account key? </p>

<p>I can add it to our repository, but I'm not sure if this solution is ok. (even it is only key with read-only permission to developer version of BigQuery).</p>

<p>The second solution is create a few keys. And every developer should has own. Then every developer have to care about key himself (and we can easy remove key when developer i.e quit job)</p>

<google-cloud-platform><devsecops>
How securely to keep google cloud service account key?
Mariusz
# How securely to keep google cloud service account key?

(Asked by: username_0 on 2019-12-04)

How securely to keep google cloud service account key?

I want to ask about how we should securely keep service account key. The scenario looks like:

* Our product is connecting to BigQuery.
* We have project which is used only by developers as playground.
* We need to run integration tests in pipelines and they needs service account to run correctly.
* Developer also should be able to run integration tests locally.

Where should I put the service account key?

I can add it to our repository, but I'm not sure if this solution is ok. (even it is only key with read-only permission to developer version of BigQuery).

The second solution is create a few keys. And every developer should has own. Then every developer have to care about key himself (and we can easy remove key when developer i.e quit job)

**Tags:** google-cloud-platform, devsecops


---

## 2 answers

### Answer by username_1 on 2019-12-07. Score: 1

I would recommend you use their Google Cloud Secrets Engine. Documentation is here: <https://www.vaultproject.io/docs/secrets/gcp/index.html>

Managing such sensitive secrets by any means other than a Vault service is dangerous.


---

### Answer by username_2 on 2019-12-06. Score: 0

Add the service account key to you repository is not a good practice when thinking about security.

The second solution may happen and should be a good practice to implement some key rotation process to avoid some dev using a compromised key. Even though, there are [some guidance](https://forsetisecurity.org/docs/latest/concepts/best-practices.html#service-accounts) which suggests to avoid the utilization of several keys (Also, I suppose there's a limit in the platform for Service Account key creation)

Take a look at [Cloud KMS](https://cloud.google.com/kms/docs/iam) that may have some suggestion for you on how to manage your keys


---

