Secret Manager
SmartSRE provides rotation management and security for Google Secret Manager.
What SmartSRE Scans
| Category | Checks |
|---|---|
| Rotation | Secret age, rotation schedules |
| Versions | Old versions, cleanup opportunities |
| Replication | Replication configuration |
Findings
| Issue Type | Severity | Description |
|---|---|---|
stale_secret | Medium | Secret not rotated in 90+ days |
no_rotation_schedule | Low | Automatic rotation not configured |
too_many_versions | Low | > 10 versions retained |
single_region_replication | Low | Secret in only one region |
Available Fixes
| Operation | Description | Impact |
|---|---|---|
add_version | Create new secret version | Low |
disable_old_versions | Disable versions > 30 days | Low |
destroy_old_versions | Destroy disabled versions | Medium |
set_rotation_schedule | Configure automatic rotation | Low |
Required Permissions
For Scanning
roles/secretmanager.viewer
For Remediation
roles/secretmanager.admin
Best Practices
- Set rotation schedules — Automatic secret rotation
- Limit version retention — Disable old versions
- Use regional replication — Match application regions
- Audit secret access — Enable logging