- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Cloud
- Security
Securing Google Cloud Run Services with Secret Manager
In this hands-on lab, you will secure a Google Cloud Run application by replacing a plaintext notification token with a managed secret in Google Cloud Secret Manager. You will inspect the initial deployment, verify workload identity and IAM permissions, configure secure access to a specific secret version, and validate that the application continues to function without exposing sensitive credentials in its active configuration.
Lab Info
Table of Contents
-
Challenge
Inspect the existing deployment and determine where the sensitive value is exposed
- Examine the existing Cloud Run deployment to understand how the application receives its notification token.
- Identify the plaintext environment variable containing the sensitive value in the service configuration.
- Assess the security risk of exposing application credentials through ordinary deployment settings.
-
Challenge
Configure the service to run as the supplied workload identity
- Identify the dedicated service account supplied for the Cloud Run workload.
- Verify that the service account has the required permissions to access the managed secret.
- Configure Cloud Run to use the supplied workload identity for authenticated access to Secret Manager.
-
Challenge
Configure the application to consume the managed secret
- Examine the provisioned Secret Manager resource and confirm that the required secret version is available.
- Integrate the managed secret into Cloud Run using a version-specific reference.
- Enable the application to retrieve its notification token through the existing environment variable without modifying application code.
-
Challenge
Remove the embedded sensitive value from the previous configuration path
- Replace the original plaintext environment variable configuration with the Secret Manager reference.
- Review the updated Cloud Run revision to confirm that the sensitive value is no longer stored directly in its configuration.
- Verify that the active deployment retains the required secret reference without exposing the underlying token.
-
Challenge
Verify the application succeeds without exposing the secret in source or ordinary configuration
- Confirm that the secured Cloud Run revision is ready and serving application traffic.
- Test the application to verify successful operation using the managed secret.
- Validate that the sensitive value is absent from the application source code and the active Cloud Run configuration.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.