or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

data-types.mdiam-security.mdindex.mdsecret-management.mdsecret-version-management.md
tile.json

tessl/pypi-google-cloud-secret-manager

Google Cloud Secret Manager API client library for Python that stores, manages, and secures access to application secrets

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/google-cloud-secret-manager@2.24.x

To install, run

npx @tessl/cli install tessl/pypi-google-cloud-secret-manager@2.24.0

index.mddocs/

Google Cloud Secret Manager

Google Cloud Secret Manager API client library for Python that stores, manages, and secures access to application secrets. This comprehensive client provides both synchronous and asynchronous APIs for creating, storing, accessing, and managing secrets and their versions with built-in IAM integration, encryption options, and audit capabilities.

Package Information

  • Package Name: google-cloud-secret-manager
  • Language: Python
  • Installation: pip install google-cloud-secret-manager

Core Imports

from google.cloud import secretmanager

Specific client imports:

from google.cloud.secretmanager import SecretManagerServiceClient
from google.cloud.secretmanager import SecretManagerServiceAsyncClient

Type imports:

from google.cloud.secretmanager import Secret, SecretVersion, SecretPayload
from google.cloud.secretmanager import CreateSecretRequest, AddSecretVersionRequest
from google.cloud.secretmanager import Replication, CustomerManagedEncryption
from google.cloud.secretmanager import Topic, Rotation

Advanced imports for enterprise features:

# For IAM operations
from google.iam.v1 import iam_policy_pb2, policy_pb2

# For async operations
from google.cloud.secretmanager import SecretManagerServiceAsyncClient

# For pagination
from google.cloud.secretmanager import ListSecretsPager, ListSecretsAsyncPager

# For location operations
from google.cloud.location import locations_pb2

# For field masks (updates)
from google.protobuf import field_mask_pb2

Basic Usage

from google.cloud import secretmanager

# Initialize the client
client = secretmanager.SecretManagerServiceClient()

# Project path
project_id = "your-project-id"
parent = f"projects/{project_id}"

# Create a secret
secret_id = "my-secret"
secret = secretmanager.Secret()
secret.replication = secretmanager.Replication()
secret.replication.automatic = secretmanager.Replication.Automatic()

create_secret_request = secretmanager.CreateSecretRequest()
create_secret_request.parent = parent
create_secret_request.secret_id = secret_id
create_secret_request.secret = secret

response = client.create_secret(request=create_secret_request)
print(f"Created secret: {response.name}")

# Add a secret version with data
secret_name = response.name
payload = secretmanager.SecretPayload()
payload.data = b"my-secret-data"

add_version_request = secretmanager.AddSecretVersionRequest()
add_version_request.parent = secret_name
add_version_request.payload = payload

version_response = client.add_secret_version(request=add_version_request)
print(f"Added secret version: {version_response.name}")

# Access the secret data
access_request = secretmanager.AccessSecretVersionRequest()
access_request.name = version_response.name

access_response = client.access_secret_version(request=access_request)
data = access_response.payload.data.decode('utf-8')
print(f"Secret data: {data}")

Architecture

Google Cloud Secret Manager client follows Google API design patterns:

  • Client Classes: Synchronous (SecretManagerServiceClient) and asynchronous (SecretManagerServiceAsyncClient) clients providing identical APIs
  • Request/Response Pattern: All API operations use structured request objects and return response objects
  • Resource Hierarchy: Secrets belong to projects, secret versions belong to secrets
  • Transport Layer: Supports gRPC and REST protocols with automatic retries and authentication
  • Type Safety: Proto-based message types ensure type safety and schema validation

Capabilities

Secret Management

Core secret lifecycle operations including creating secrets with replication policies, retrieving secret metadata, updating configurations, and deleting secrets. Provides complete CRUD operations for secret resources.

def create_secret(self, request: CreateSecretRequest = None, **kwargs) -> Secret: ...
def get_secret(self, request: GetSecretRequest = None, **kwargs) -> Secret: ...
def update_secret(self, request: UpdateSecretRequest = None, **kwargs) -> Secret: ...
def delete_secret(self, request: DeleteSecretRequest = None, **kwargs) -> None: ...
def list_secrets(self, request: ListSecretsRequest = None, **kwargs) -> ListSecretsPager: ...

Secret Management

Secret Version Management

Managing secret versions and accessing secret data, including adding new versions, retrieving version metadata, accessing secret payloads, and controlling version lifecycle states (enabled/disabled/destroyed).

def add_secret_version(self, request: AddSecretVersionRequest = None, **kwargs) -> SecretVersion: ...
def get_secret_version(self, request: GetSecretVersionRequest = None, **kwargs) -> SecretVersion: ...
def access_secret_version(self, request: AccessSecretVersionRequest = None, **kwargs) -> AccessSecretVersionResponse: ...
def list_secret_versions(self, request: ListSecretVersionsRequest = None, **kwargs) -> ListSecretVersionsPager: ...
def enable_secret_version(self, request: EnableSecretVersionRequest = None, **kwargs) -> SecretVersion: ...
def disable_secret_version(self, request: DisableSecretVersionRequest = None, **kwargs) -> SecretVersion: ...
def destroy_secret_version(self, request: DestroySecretVersionRequest = None, **kwargs) -> SecretVersion: ...

Secret Version Management

IAM and Security

Identity and Access Management operations for controlling access to secrets, including setting IAM policies, retrieving current policies, and testing permissions. Provides fine-grained access control integration.

def set_iam_policy(self, request: SetIamPolicyRequest = None, **kwargs) -> Policy: ...
def get_iam_policy(self, request: GetIamPolicyRequest = None, **kwargs) -> Policy: ...
def test_iam_permissions(self, request: TestIamPermissionsRequest = None, **kwargs) -> TestIamPermissionsResponse: ...

IAM and Security

Data Types and Models

Core data structures including Secret, SecretVersion, SecretPayload, replication configurations, encryption settings, and all request/response types used throughout the API.

class Secret: ...
class SecretVersion: ...
class SecretPayload: ...
class Replication: ...
class CustomerManagedEncryption: ...

Data Types and Models

Error Handling

The client uses Google API Core exceptions:

from google.api_core import exceptions

try:
    secret = client.get_secret(request=get_request)
except exceptions.NotFound:
    print("Secret not found")
except exceptions.PermissionDenied:
    print("Access denied")
except exceptions.InvalidArgument as e:
    print(f"Invalid argument: {e}")

Async Usage

import asyncio
from google.cloud.secretmanager import SecretManagerServiceAsyncClient

async def manage_secrets():
    async with SecretManagerServiceAsyncClient() as client:
        # All methods are async versions of synchronous client
        secrets = []
        async for secret in await client.list_secrets(request=list_request):
            secrets.append(secret)
        return secrets

# Run async function
secrets = asyncio.run(manage_secrets())