the GCP Secrets Manager as a secrets store backendThe GCP Secrets Store uses the ZenML GCP Service Connector under the hood to authenticate with the GCP Secrets Manager API. This means that you can use any of the authentication methods supported by the GCP Service Connector to authenticate with the GCP Secrets Manager API.

The minimum set of permissions that must be attached to the implicit or configured GCP credentials are as follows:

secretmanager.secrets.create for the target GCP project (i.e. no condition on the name prefix)

secretmanager.secrets.get, secretmanager.secrets.update, secretmanager.versions.access, secretmanager.versions.add and secretmanager.secrets.delete for the target GCP project and for secrets that have a name starting with zenml-

This can be achieved by creating two custom IAM roles and attaching them to the principal (e.g. user or service account) that will be used to access the GCP Secrets Manager API with a condition configured when attaching the second role to limit access to secrets with a name prefix of zenml-. The following gcloud CLI command examples can be used as a starting point:

gcloud iam roles create ZenMLServerSecretsStoreCreator \

--project <your GCP project ID> \

--title "ZenML Server Secrets Store Creator" \

--description "Allow the ZenML Server to create new secrets" \

--stage GA \

--permissions "secretmanager.secrets.create"

gcloud iam roles create ZenMLServerSecretsStoreEditor \

--project <your GCP project ID> \

--title "ZenML Server Secrets Store Editor" \

--description "Allow the ZenML Server to manage its secrets" \

--stage GA \

--permissions "secretmanager.secrets.get,secretmanager.secrets.update,secretmanager.versions.access,secretmanager.versions.add,secretmanager.secrets.delete"

gcloud projects add-iam-policy-binding <your GCP project ID> \

--member serviceAccount:<your GCP service account email> \

--role projects/<your GCP project ID>/roles/ZenMLServerSecretsStoreCreator \

--condition None