Parameter Manager supports the latest identifier, which lets you fetch the most recent parameter value without specifying a version ID. When you use the gcloud CLI or REST API, you can use latest to retrieve the most recent version of a parameter.

For more information, see Access a parameter version.

Parameter version comparison: You can compare two versions of a parameter to identify changes in their payload. This feature lets you audit modifications over time and debug issues related to specific parameter updates.

For more information, see Compare parameter versions.

Secret Manager is available in the following region:

• asia-southeast3 (Bangkok)

For more information, see Secret Manager locations.

For more information, see Synchronize secrets to Kubernetes Secrets.

Automatic secret rotation with the Secret Manager add-on for Google Kubernetes Engine (GKE): You can configure the Secret Manager add-on to automatically rotate secrets so that secrets updated in Secret Manager after initial pod deployment are automatically and periodically pushed to the pod. This feature is now Generally available (GA).

For more information, see Configure automatic rotation of secrets.

Enhanced tagging capabilities for Secret Manager: You can now add tags directly at the time of secret creation. This new feature lets you provide essential metadata for your resources and helps with better organization, cost tracking, and automated policy application from the time a secret is created. In addition to this, tagging for regional secrets is now fully supported, both during secret creation and for existing regional secrets. For more information, see the documentation on tags for global secrets and regional secrets.

Soft-enforced rate limits for modifying secrets and secret versions: We have introduced soft-enforced rate limits for the following operations in Secret Manager:

• AddSecretVersion
• UpdateSecret
• EnableSecretVersion
• DisableSecretVersion
• DestroySecretVersion

Soft enforcement lets us continue serving requests beyond the defined quota as long as our backend systems can comfortably handle the increased load. For details, see the Quotas and limits documentation.

The Secret Manager add-on for Google Kubernetes Engine (GKE) now supports the automatic rotation of secrets. You can configure the Secret Manager add-on to automatically rotate secrets so that secrets updated in Secret Manager after initial pod deployment are automatically and periodically pushed to the pod. This feature is available in Preview.

For more information, see Configure automatic rotation of secrets.

Parameter Manager, an extension to the Secret Manager service, is now Generally available (GA). Parameter Manager lets you store, access, and manage the lifecycle of workload parameters. You can interact with Parameter Manager using the console, gcloud CLI, REST API, and client libraries.

For information, see the Parameter Manager documentation.

Secret Manager is now available in the following region:

• europe-north2 (Stockholm)

For more information, see Secret Manager locations.

Parameter Manager, currently in Preview, now offers a console for storing, accessing, and managing the lifecycle of your workload parameters. For more information, see the Parameter Manager documentation.

Parameter Manager, an extension to the Secret Manager service, is available in Preview. You can use Parameter Manager to store, access, and manage the lifecycle of your workload parameters. For more information, see Parameter Manager overview.

Creating custom organization policies with Secret Manager resources is now in General Availability (GA). You can use custom organization policies to enhance secret security by enforcing rotation schedules, annotations, and expirations for secrets. You can also use custom organization policies to restrict secret types to manage costs. To learn more about using custom organization policies in Secret Manager, see Use custom organization policies.

Secret Manager is now available in the following region:

• northamerica-south1

For more information, see Secret Manager locations.

A weekly digest of client library updates from across the Cloud SDK.

Creating regional secrets using Secret Manager is now in Generally Availability (GA). Regional secrets let you store your sensitive data within a specific geographic location, ensuring it remains in that region at all times – whether at rest, in use, or in transit. Regional secrets are crucial for meeting data residency requirements and complying with regulatory mandates.

For information about all tasks related to creating and managing regional secrets, see the Regional service documentation.

A weekly digest of client library updates from across the Cloud SDK.

Secret Manager is now enabled for use with Cloud KMS Autokey.

Using keys generated by Autokey can help you consistently align with industry standards and recommended practices for data security, including the HSM protection level, separation of duties, key rotation, location, and key specificity. Keys requested using Autokey function identically to other Cloud HSM keys with the same settings.

For more information, see Enable customer-managed encryption keys for Secret Manager. To learn more about Cloud KMS Autokey, see Autokey overview.

A weekly digest of client library updates from across the Cloud SDK.

You can now create regional secrets using Secret Manager. When you create a regional secret, you specify the location where you want it to be stored. Your secret data remains within the chosen location at all times, whether it's at rest, in use, or in transit. This capability allows you to meet data residency requirements, which mandate that data remains within specified geographic boundaries, often due to regulatory or compliance reasons. The feature is in Preview.

For more information, see Data residency and regional secrets.

You can attach tags to secrets to conditionally grant or deny access to Secret Manager resources. For example, you can conditionally grant Identity and Access Management (IAM) roles based on whether a secret has a specific tag. This feature is in Preview. For more information, see Create and manage tags.

Secret Manager add-on for Google Kubernetes Engine (GKE) is now generally available (GA). With the add-on, you can access the secrets stored in Secret Manager as volumes mounted in Kubernetes Pods. You can install the Secret Manager add-on on both Standard clusters and Autopilot clusters. The Secret Manager add-on is a Google managed and officially supported version of the open source Kubernetes Secrets Store CSI driver.

For more information, see Use Secret Manager add-on with Google Kubernetes Engine.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.

A weekly digest of client library updates from across the Cloud SDK.