General considerations
When dealing with application secrets, it is important to consider the level of exposure each solution creates. For example, secrets stored on the Compute Engine metadata server must be project-wide to be used by App Engine. This means that any service running on App Engine or Compute Engine, as well as any service able to authenticate against the metadata API, will be able to read these values. For many use cases, this is likely an acceptable level of exposure, but teams should evaluate the risks on a per-secret basis.
Another consideration when dealing with application secrets in App Engine is that these secrets may become readable through the use of the Stackdriver Debugger. If this is a concern, teams should leave ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access