Google Cloud secrets engine (API)
This is the API documentation for the Vault Google Cloud Platform (GCP) secrets engine. For general information about the usage and operation of the GCP secrets engine, please see these docs.
This documentation assumes the GCP secrets engine is enabled at the /gcp
path
in Vault. Since it is possible to mount secrets engines at any path, please
update your API calls accordingly.
Write config
Method | Path |
---|---|
POST | /gcp/config |
This endpoint configures shared information for the secrets engine.
Parameters
credentials
(string:""
) - JSON credentials (either file contents or '@path/to/file') See docs for alternative ways to pass in to this parameter, as well as the required permissions.ttl
(int: 0 || string:"0s"
) – Specifies default config TTL for long-lived credentials (i.e. service account keys). Uses duration format strings.max_ttl
(int: 0 || string:"0s"
)– Specifies the maximum config TTL for long-lived credentials (i.e. service account keys). Uses duration format strings.**
Sample payload
Sample request
Rotate root credentials
Request to rotate the GCP service account credentials used by Vault for this mount. A new key will be generated for the service account, replacing the internal value, and then a deletion of the old service account key is scheduled. Note that this does not create a new service account, only a new version of the service account key.
This path is only valid if Vault has been configured to use GCP credentials via
the config/
endpoint where "credentials" were specified. Additionally, the
provided service account must have permissions to create and delete service
account keys.
Method | Path |
---|---|
POST | /gcp/config/rotate-root |
Sample request
Read config
Method | Path |
---|---|
GET | /gcp/config |
Credentials will be omitted from returned data.
Sample request
Sample response
Create/Update roleset
Method | Path |
---|---|
POST | /gcp/roleset/:name |
This method allows you to create a roleset or update an existing roleset. See docs for the GCP secrets backend to learn more about what happens when you create or update a roleset.
If you update a roleset's bindings, this will effectively revoke any secrets generated under this roleset.
Parameters
name
(string: <required>
): Required. Name of the role. Cannot be updated.secret_type
(string: "access_token"
): Type of secret generated for this role set. Accepted values:access_token
,service_account_key
. Cannot be updated.project
(string: <required>
): Name of the GCP project that this roleset's service account will belong to. Cannot be updated.bindings
(string: <required>
): Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string)token_scopes
(array: []
): List of OAuth scopes to assign toaccess_token
secrets generated under this role set (access_token
role sets only)
Sample payload
Sample bindings:
See bindings format docs for more information.
Sample request
Rotate roleset account
Method | Path | |
---|---|---|
POST | /gcp/roleset/:name/rotate | 204 (empty body) |
This will rotate the service account this roleset uses to generate secrets.
(this also replaces the key access_token
roleset). This can be used to invalidate
old secrets generated by the roleset or fix issues if a roleset's service account
(and/or keys) was changed outside of Vault (i.e. through GCP APIs/cloud console).
Sample request
Rotate roleset account key (access_token
roleset only)
Method | Path | |
---|---|---|
POST | /gcp/roleset/:name/rotate-key | 204 (empty body) |
This will rotate the service account key this roleset uses to generate access tokens. This does not recreate the roleset service account.
Sample request
Read roleset
Method | Path |
---|---|
GET | /gcp/roleset/:name |
Parameters
name
(string:<required>
): Name of the roleset to read.
Sample request
Sample response
List rolesets
Method | Path |
---|---|
LIST | /gcp/rolesets |
Sample request
Sample response
Delete roleset
This endpoint deletes an existing roleset by the given name.
Method | Path |
---|---|
DELETE | /gcp/roleset/:name |
Parameters
name
(string:<required>
): Name of the roleset to delete.
Sample request
Create/Update static account
Method | Path |
---|---|
POST | /gcp/static-account/:name |
This method allows you to create a static account or update an existing static account. See docs for the GCP secrets backend to learn more about what happens when you create or update a static account.
If you update a static account's bindings, this will effectively revoke any secrets generated under this static account.
Parameters
name
(string: <required>
): Name of the static account. Cannot be updated.secret_type
(string: "access_token"
): Type of secret generated for this static account. Accepted values:access_token
,service_account_key
. Cannot be updated.service_account_email
(string: <required>
): Email of the GCP service account to manage. Cannot be updated.bindings
(string
): Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string). Optional.token_scopes
(array: []
): List of OAuth scopes to assign toaccess_token
secrets generated under this static account (access_token
static accounts only)
Sample payload
Sample bindings:
See bindings format docs for more information.
Sample request
Rotate static account key (access_token
static account only)
Method | Path | |
---|---|---|
POST | /gcp/static-account/:name/rotate-key | 204 (empty body) |
This will rotate the service account key this static account uses to generate access tokens. This does not recreate the service account.
Sample request
Read static account
Method | Path |
---|---|
GET | /gcp/static-account/:name |
Parameters
name
(string:<required>
): Name of the static account to read.
This endpoint will only return bindings that are managed through the secrets engine. Bindings manually managed outside of Vault will not be returned.
Sample request
Sample response
List static accounts
Method | Path |
---|---|
LIST | /gcp/static-accounts |
Sample request
Sample response
Delete static account
This endpoint deletes an existing static account by the given name.
Method | Path |
---|---|
DELETE | /gcp/static-account/:name |
Parameters
name
(string:<required>
): Name of the static account to delete.
Sample request
Generate secret (IAM service account creds): OAuth2 access token
Method | Path |
---|---|
GET / POST | /gcp/roleset/:roleset/token |
GET / POST | /gcp/static-account/:static-account/token |
GET / POST | /gcp/token/:roleset (deprecated) |
Generates an OAuth2 token with the scopes defined on the roleset or static account. This OAuth access token can
be used in GCP API calls, e.g. curl -H "Authorization: Bearer $TOKEN" ...
Tokens are non-revocable and non-renewable and have a static TTL of an hour. The TTL configured
for the backend (either through the default system TTLs or through the config/
endpoint)
do not apply.
Parameters
roleset
(string:<required>
): Name of an roleset with secret typeaccess_token
to generate access_token under.static-account
(string:<required>
): Name of the static account with secret typeaccess_token
to generate access_token under.
Sample request
Sample response
Generate secret (IAM service account creds): service account key
Method | Path |
---|---|
GET / POST | /gcp/roleset/:roleset/key |
GET / POST | /gcp/static-account/:static-account/key |
GET / POST | /gcp/key/:roleset (deprecated) |
If using GET
('read'), the optional parameters will be set to their defaults. Use POST
if you
want to specify different values for these params.
These keys are renewable and have TTL/max TTL as defined by either the backend config or the system default if config was not defined.
Parameters
roleset
(string:<required>
): Name of an roleset with secret typeservice_account_key
to generate key under.static-account
(string:<required>
): Name of an static account with secret typeservice_account_key
to generate key under.key_algorithm
(string:"KEY_ALG_RSA_2048"
): Key algorithm used to generate key. Defaults to 2k RSA key You probably should not choose other values (i.e. 1k), but accepted values areenum(
ServiceAccountKeyAlgorithm
)
key_type
(string:"TYPE_GOOGLE_CREDENTIALS_FILE
): Private key type to generate. Defaults to JSON credentials file. Accepted values areenum(
ServiceAccountPrivateKeyType
)
ttl
(string: ""
): Specifies the Time To Live value provided using a duration format string. If not set, uses the system default value.
Sample payload
Sample request
Sample response
Revoking/Renewing secrets
See docs on how to renew and revoke leases. Note this only applies to service account keys.