Configure automatic rotation for Cloud SQL secrets

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This page describes how to configure automatic rotation for your Cloud SQL database credentials in Secret Manager.

Before you begin

• Ensure that your Cloud SQL instance uses a supported database engine flavor, such as PostgreSQL or SQL Server.
• Ensure that you are using a regional secret. Automatic rotation for Cloud SQL credentials is available only for regional secrets in Secret Manager. Global secrets don't support this feature.
• Ensure that you have an existing Cloud SQL instance and a database user. For more information, see Create instances and Create and manage users.
• Ensure that you have permissions to manage the IAM policies on your Cloud SQL instance. For more information, see Roles and permissions.

Note:

Automatic rotation can cause temporary application downtime. During the short window between the database update and the secret alias update, applications that use the old password might experience connection failures. Ensure that your applications implement robust error handling (retries) to fetch the latest version upon authentication failure.

Required roles

To get the permissions that you need to enable automatic rotation, ask your administrator to grant you a role that contains the following permissions:

• cloudsql.users.list
• cloudsql.users.update

You can get these permissions either with predefined roles or custom roles. To see which roles are associated with which permissions, refer to IAM roles for Cloud SQL.

For more information about granting roles, see Manage access to projects, folders, and organizations.

Create a Cloud SQL database credential secret

To enable automatic rotation, you must create a secret of the type Cloud SQL DB credentials.

Console

1. In the Google Cloud console, go to the Secret Manager page.

   Go to Secret Manager

2. On the Secret Manager page, click the Regional secrets tab, and then click Create regional secret.

3. On the Create regional secret page, enter a name for the secret in the Name field.

4. Select the Set secret type checkbox and choose Cloud SQL DB credentials as the secret type.

   Note: You can't manually add secret versions to secrets with the Cloud SQL DB credentials secret type. Secret Manager automatically creates and updates secret versions during the rotation process.

5. Choose the location where you want your regional secret to be stored from the Region list.

6. (Optional) In the Rotation section, configure the rotation schedule for your secret. If you don't configure a rotation schedule, you must rotate the secret manually.

   1. Select the Set rotation period checkbox.

   2. In the Rotation period list, select from the default options or select Custom to configure your own rotation schedule.

   3. In the Starting on field, enter the rotation period start date and time.

7. Click Create secret.

Grant permissions to the built-in secret identity

Each secret has a unique identifier that distinguishes it from all other resources in your Google Cloud project. You must grant the built-in identity the required permissions that are needed to update credentials on your Cloud SQL instance. For more information, see Granting roles to resources with built-in identities.

Console

1. On the secret details page, go to the Overview tab.

2. Locate and copy the IAM principal identifier of the secret.

   The identifier has the following format: principal://secretmanager.googleapis.com/projects/PROJECT_NUMBER/uid/secrets/SECRET_UID.

3. In the Google Cloud console, go to the IAM page.

   Go to IAM

4. Click Grant access.

   The Grant access panel appears.

5. In the New principals field, paste the identifier copied in previously.

6. From the Select a role list, select a role that grants the necessary permissions.

   For more information, see Required roles.

7. Click Save.

Rotate your secret

The rotation status of the newly created Cloud SQL secrets are Disabled until the first successful rotation. You must manually rotate your secret to verify permissions and start the automatic rotation schedule.

Note:

You can manually rotate your secret at any time to respond to a security incident or to test your rotation logic. Manual rotations don't affect the existing automatic schedule.

Console

1. In the Google Cloud console, go to the Secret Manager page.

   Go to Secret Manager

2. On the Secret Manager page, click the Regional secrets tab.

3. Click the secret name to go to the secret details page.

4. Click Rotate.

   The Rotate secret panel appears.

5. Specify the instance ID and the username of the Cloud SQL instance that you want to update.

6. (Optional) Expand the Additional settings section to enter a specific password. If left blank, Secret Manager automatically generates a strong, random password.

7. Click Rotate.

Secret Manager attempts to update the credentials in your Cloud SQL instance. If successful, the Rotation status changes to Enabled, and the scheduled automatic rotation timer begins.

What's next

• Learn how to set up rotation schedules for secrets.