Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud service
Secret Manager
Topic in 2 exam domains
Also called: Cloud Secrets, Google Cloud Secret Manager, Google Secret Manager, SECRET_MANAGER
A Google Cloud service used to securely store sensitive data such as private keys.
Where this appears on the exam
1 objective in 1 of 5 domains
Related topics
FoundationsThis topicWorks alongsideAppliedApplication Default CredentialsFeaturecustomer-managed encryption keysFeatureIdentity and Access ManagementServicePub/SubServiceBigQueryServiceCloud StorageServiceCompute EngineServiceCloud MonitoringService
Secret ManagerService
Cloud Run functionsServiceCloud LoggingServiceCloud SQLServiceGKEServiceManaged Service for Apache AirflowServiceCloud ComposerServiceWorkflowsServiceCloud BuildServiceCloud RunServiceDataformServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- Application Default Credentials works with Secret Manager From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
- Cloud Run works with Secret Manager From the official documentation: “You can integrate Secret Manager with other Google Cloud products such as Cloud Run.”
- Managed Service for Apache Airflow works with Secret Manager From the official documentation: “You can [configure Secret Manager](/composer/docs/composer-3/configure-secret-manager) as your Airflow secrets backend.”
- Cloud Build works with Secret Manager From the official documentation: “You can substitute secrets from [Secret Manager](/secret-manager/docs) in Cloud Build.”
- Pub/Sub works with Secret Manager From the official documentation: “Receive notifications via Pub/Sub when Secret Manager resources change.”
- Secret Manager depends on Application Default Credentials From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
- Compute Engine works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
- GKE works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
- Cloud SQL works with Secret Manager From the official documentation: “Secret Manager attempts to update the credentials in your Cloud SQL instance.”
- customer-managed encryption keys secures Secret Manager From the official documentation: “In Secret Manager, you can use a CMEK to protect data at rest.”
- Identity and Access Management secures Secret Manager From the official documentation: “Secret Manager uses Identity and Access Management (IAM) for authorization.”
- Application Default Credentials secures Secret Manager From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
- Cloud Composer works with Secret Manager From the official documentation: “Once you configure Secret Manager for your Composer environment, you can store an SMTP password in Secret Manager:”
- Secret Manager works with Workflows From the official documentation: “You can use a Workflows connector to access Secret Manager within a workflow.”
- Cloud Run functions works with Secret Manager From the official documentation: “[Secret Manager](/secret-manager) stores the Cloud Run functions secrets.”
- Dataform works with Secret Manager From the official documentation: “To connect a remote repository through HTTPS, you need to create a Secret Manager secret with a personal access token, and share the secret with your default Dataform service agent.”
- Identity and Access Management configures Secret Manager From the official documentation: “This page describes the Identity and Access Management (IAM) roles you can use to configure Secret Manager.”
- Cloud Build depends on Secret Manager From the official documentation: “To include Docker credentials in your builds, you must first store your credentials in [Secret Manager](/secret-manager/docs), and then grant permission for Cloud Build to access the secret from Secret Manager.”
- Cloud Storage is an alternative to Secret Manager From the official documentation: “Your provisioning tools might need to be adapted to use Google Cloud Storage or Secret Manager to read such custom configuration lists.”
- customer-managed encryption keys works with Secret Manager From the official documentation: “If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including Secret Manager.”
- Dataform depends on Secret Manager From the official documentation: “Dataform uses the following Google Cloud services that have their own quota limits: - [BigQuery](/bigquery/quotas) - [Identity and Access Management](/iam/quotas) - [Cloud Monitoring](/monitoring/quotas) - [Secret Manager](/secret-manager/quotas)”
- Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials works with Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- BigQuery works with Cloud Storage From the official documentation: “External BigQuery data source backed by Cloud Storage”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- Application Default Credentials secures Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Pub/Sub depends on Application Default Credentials From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
- Cloud Run works with Cloud SQL From the official documentation: “Learn how to connect to Cloud SQL from Cloud Run”
- BigQuery works with Dataform From the official documentation: “You can define custom SQL commands for Dataform to run in BigQuery.”
- Application Default Credentials works with Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Cloud Logging works with customer-managed encryption keys From the official documentation: “To use Cloud Logging with Customer-managed encryption keys (CMEK), you must complete the steps in the [Enable CMEK for an organization](/logging/docs/routing/managed-encryption#enable) page in the Cloud Logging documentation.”
- Cloud SQL works with Cloud Storage From the official documentation: “When ingesting data from Cloud SQL, data is first staged to a Cloud Storage bucket.”
- BigQuery works with Cloud Monitoring From the official documentation: “You can use Monitoring to export your metrics to BigQuery.”
- Cloud Run works with Pub/Sub From the official documentation: “Route Cloud Pub/Sub events to Cloud Run”
- Cloud SQL works with Compute Engine From the official documentation: “Create a Compute Engine VM Instance to host a sample web app that connects to Cloud SQL.”
- Cloud Run works with Cloud Storage From the official documentation: “Route Cloud Storage events to Cloud Run”
- Application Default Credentials works with Cloud Run functions From the official documentation: “To authenticate to Cloud Run functions, set up Application Default Credentials.”
- Cloud Run functions depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run functions, set up Application Default Credentials.”
- Application Default Credentials secures Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- BigQuery is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- Cloud Logging works with GKE From the official documentation: “Enable Cloud Logging on GKE Clusters”
- Cloud Run functions works with Cloud Storage From the official documentation: “Set up functions in response to events in Cloud Storage:”
- Compute Engine is an alternative to GKE From the official documentation: “To use TPU7x, you can use Google Kubernetes Engine (GKE) or Compute Engine.”
- BigQuery works with Cloud Run functions From the official documentation: “BigQuery supports external function calls through Cloud Run functions.”
- Cloud Monitoring depends on Application Default Credentials From the official documentation: “To authenticate to Monitoring, set up Application Default Credentials.”
- Cloud Monitoring works with Cloud SQL From the official documentation: “You can also get more details by viewing the Cloud Monitoring logs for your Cloud SQL destination instance.”
- Cloud Monitoring works with GKE From the official documentation: “Enable Cloud Monitoring on GKE Clusters”
- Cloud Run depends on Pub/Sub From the official documentation: “Create a Pub/Sub topic that Cloud Scheduler will publish to and the Cloud Run function will subscribe to.”
- Cloud Run functions works with Pub/Sub From the official documentation: “Use Cloud Run functions to publish messages on Pub/Sub.”
- Cloud SQL works with Identity and Access Management From the official documentation: “This page describes how Cloud SQL is integrated with IAM .”
- customer-managed encryption keys secures Cloud Storage From the official documentation: “CMEKs encrypt data at rest in Cloud SQL, Cloud Storage, and within GKE clusters.”
- Application Default Credentials works with Workflows From the official documentation: “To authenticate to Workflows, set up Application Default Credentials.”
- BigQuery works with Pub/Sub From the official documentation: “createBigQuerySubscription creates a Pub/Sub subscription that exports messages to BigQuery.”
How learners score on this topic
Last updated