<p>Late answer, but for the record, Google Cloud Cli has built-in support for multi-account, with automatic credentials renewal, so there's no need for an external tool like aws-vault for AWS.</p>
<p><a href="https://cloud.google.com/sdk/docs/authorizing" rel="nofollow noreferrer">https://cloud.google.com/sdk/docs/authorizing</a></p>

CC BY-SA 4.0
2024-05-10T10:44:46.633Z
2024-05-10T10:44:46.633Z
Kien Truong
<p>It sounds like you want <a href="https://cloud.google.com/secret-manager" rel="nofollow noreferrer">Google Secret manager</a>.</p>
<p>From the documentation, it claims to:</p>
<blockquote>
<p>Store API keys, passwords, certificates, and other sensitive data.</p>
</blockquote>
<p>which sounds like it does what you want it to do.</p>
<p>However, you state</p>
<blockquote>
<p>I would like to keep my tokens encrypted in my operating system’s keychain</p>
</blockquote>
<p>-- I don't see why you would want to do that though, if you have secrets manager. The secrets manager should be the source of truth, and the machine should be authorised via IAM to access specific secrets on demand, not persisted in the OS keychain. If the OS is compromised, the secrets will be exposed, whilst the attacker would need to break secrets manager or IAM in order to access them if they are consumed uniquely from secrets manager.</p>

CC BY-SA 4.0
2022-10-19T09:07:38.703Z
I'm running gcloud CLI on command-line on my own laptop, how would secret manager help with that? I might not understand how it works but how do I authenticate myself to secret manager from my own laptop?
JtR
CC BY-SA 4.0
2023-03-18T11:39:35.670Z
You missed the question: Google Secret Manager is a secret store, on the cloud. Sometimes we need other secrets on our computers, like the access creds for GCP or AWS. If you leave them unprotected, anyone stealing your computer can get access to your infra on the cloud.
Raffi
CC BY-SA 4.0
2023-07-05T13:22:29.447Z
@Raffi that's the original question: how to keep secure GCP credentials, sadly the link in the original post has a name making sounds like AWS secret manager, which it is not.
Tensibai
CC BY-SA 4.0
2022-10-08T06:01:44.083Z
2022-10-08T06:01:44.083Z
Bruce Becker
<p>I would like to keep my use access tokens to GCP encrypted in my operating system’s keychain and use them easily with gcloud CLI.</p>
<p>So, does <a href="https://github.com/99designs/aws-vault" rel="nofollow noreferrer">aws-vault</a> for gcp exist to secure my own tokesn when accessing gcp?</p>
<p>This is unrelated to <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html" rel="nofollow noreferrer">AWS Secret Manager</a></p>

<amazon-web-services><gcp><encryption>
Is there aws-vault kind of tool for GCP?
JtR
# Is there aws-vault kind of tool for GCP?

(Asked by: username_0 on 2022-10-07)

I would like to keep my use access tokens to GCP encrypted in my operating system’s keychain and use them easily with gcloud CLI.

So, does [aws-vault](https://github.com/99designs/aws-vault) for gcp exist to secure my own tokesn when accessing gcp?

This is unrelated to [AWS Secret Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html)

**Tags:** amazon-web-services, gcp, encryption


---

## 2 answers

### Answer by username_1 on 2024-05-10. Score: 0

Late answer, but for the record, Google Cloud Cli has built-in support for multi-account, with automatic credentials renewal, so there's no need for an external tool like aws-vault for AWS.

<https://cloud.google.com/sdk/docs/authorizing>


---

### Answer by username_2 on 2022-10-08. Score: 0

It sounds like you want [Google Secret manager](https://cloud.google.com/secret-manager).

From the documentation, it claims to:

> Store API keys, passwords, certificates, and other sensitive data.

which sounds like it does what you want it to do.

However, you state

> I would like to keep my tokens encrypted in my operating system’s keychain

-- I don't see why you would want to do that though, if you have secrets manager. The secrets manager should be the source of truth, and the machine should be authorised via IAM to access specific secrets on demand, not persisted in the OS keychain. If the OS is compromised, the secrets will be exposed, whilst the attacker would need to break secrets manager or IAM in order to access them if they are consumed uniquely from secrets manager.

> **Comments:**
> **username_0**: I'm running gcloud CLI on command-line on my own laptop, how would secret manager help with that? I might not understand how it works but how do I authenticate myself to secret manager from my own laptop?  
> **username_3**: You missed the question: Google Secret Manager is a secret store, on the cloud. Sometimes we need other secrets on our computers, like the access creds for GCP or AWS. If you leave them unprotected, anyone stealing your computer can get access to your infra on the cloud.  
> **username_4**: @username_3 that's the original question: how to keep secure GCP credentials, sadly the link in the original post has a name making sounds like AWS secret manager, which it is not.  

---

