0

I want to deploy a node application on a google cloud compute engine micro instance from a source control repo.

As part of this deployment I want to use KMS to store database credentials rather than having them in my source control. To get the credentials from KMS I need to authenticate on the instance with GCLOUD in the first place.

Is it safe to just install the GCloud CLI as part of a startup script and let the default service account handle the authentication? Then use this to pull in the decrypted details and save them to a file?

The docs walkthrough development examples, but I've not found anything about how this should work in production, especially as I obviously don't want to store the GCloud credentials in source control either.

TommyBs
  • 9,354
  • 4
  • 34
  • 65

1 Answers1

1

Yes, this is exactly what we recommend: use the default service account to authenticate to KMS and decrypt a file with the credentials in it. You can store the resulting data in a file, but I usually either pipe it directly to the service that needs it or put it in tmpfs so it's only stored in RAM.

You can check the encrypted credentials file into your source repository, store it in Google Cloud Storage, or elsewhere. (You create the encrypted file by using a different account, such as your personal account or another service account, which has wrap but not unwrap access on the KMS key, to encrypt the credentials file.)

If you use this method, you have a clean line of control:

  • Your administrative user authentication gates the ability to run code as the trusted service account.
  • Only that service account can decrypt the credentials.
  • There is no need to store a secret in cleartext anywhere

Thank you for using Google Cloud KMS!

Tim Dierks
  • 2,168
  • 15
  • 28
  • is it fine to use systemd ExecStartPre to run the glcoud to decrypt the file? – pra Jul 26 '18 at 10:07
  • Yes, that's exactly the intent, although I'm not a systemd expert and can't speak to the pros & cons of that specific mechanism. – Tim Dierks Jul 29 '18 at 16:47