Google Cloud secrets engine (API)
This is the API documentation for the Vault Google Cloud Platform (GCP) secrets engine. For general information about the usage and operation of the GCP secrets engine, please see these docs.
This documentation assumes the GCP secrets engine is enabled at the /gcp
path in Vault. Since it is possible to mount secrets engines at any path, please update your API calls accordingly.
Write config
POST
/gcp/config
This endpoint configures shared information for the secrets engine.
Parameters
credentials
(string:""
) - JSON credentials (either file contents or '@path/to/file') See docs for alternative ways to pass in to this parameter, as well as the required permissions.ttl
(int: 0 || string:"0s"
) – Specifies default config TTL for long-lived credentials (i.e. service account keys). Uses duration format strings.max_ttl
(int: 0 || string:"0s"
)– Specifies the maximum config TTL for long-lived credentials (i.e. service account keys). Uses duration format strings.**
Sample payload
Sample request
Rotate root credentials
Request to rotate the GCP service account credentials used by Vault for this mount. A new key will be generated for the service account, replacing the internal value, and then a deletion of the old service account key is scheduled. Note that this does not create a new service account, only a new version of the service account key.
This path is only valid if Vault has been configured to use GCP credentials via the config/
endpoint where "credentials" were specified. Additionally, the provided service account must have permissions to create and delete service account keys.
POST
/gcp/config/rotate-root
Sample request
Read config
GET
/gcp/config
Credentials will be omitted from returned data.
Sample request
Sample response
Create/Update roleset
POST
/gcp/roleset/:name
This method allows you to create a roleset or update an existing roleset. See docs for the GCP secrets backend to learn more about what happens when you create or update a roleset.
If you update a roleset's bindings, this will effectively revoke any secrets generated under this roleset.
Parameters
name
(string: <required>
): Required. Name of the role. Cannot be updated.secret_type
(string: "access_token"
): Type of secret generated for this role set. Accepted values:access_token
,service_account_key
. Cannot be updated.project
(string: <required>
): Name of the GCP project that this roleset's service account will belong to. Cannot be updated.bindings
(string: <required>
): Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string)token_scopes
(array: []
): List of OAuth scopes to assign toaccess_token
secrets generated under this role set (access_token
role sets only)
Sample payload
Sample bindings:
See bindings format docs for more information.
Sample request
Rotate roleset account
POST
/gcp/roleset/:name/rotate
204 (empty body)
This will rotate the service account this roleset uses to generate secrets. (this also replaces the key access_token
roleset). This can be used to invalidate old secrets generated by the roleset or fix issues if a roleset's service account (and/or keys) was changed outside of Vault (i.e. through GCP APIs/cloud console).
Sample request
Rotate roleset account key (access_token
roleset only)
access_token
roleset only)POST
/gcp/roleset/:name/rotate-key
204 (empty body)
This will rotate the service account key this roleset uses to generate access tokens. This does not recreate the roleset service account.
Sample request
Read roleset
GET
/gcp/roleset/:name
Parameters
name
(string:<required>
): Name of the roleset to read.
Sample request
Sample response
List rolesets
LIST
/gcp/rolesets
Sample request
Sample response
Delete roleset
This endpoint deletes an existing roleset by the given name.
DELETE
/gcp/roleset/:name
Parameters
name
(string:<required>
): Name of the roleset to delete.
Sample request
Create/Update static account
POST
/gcp/static-account/:name
This method allows you to create a static account or update an existing static account. See docs for the GCP secrets backend to learn more about what happens when you create or update a static account.
If you update a static account's bindings, this will effectively revoke any secrets generated under this static account.
Parameters
name
(string: <required>
): Name of the static account. Cannot be updated.secret_type
(string: "access_token"
): Type of secret generated for this static account. Accepted values:access_token
,service_account_key
. Cannot be updated.service_account_email
(string: <required>
): Email of the GCP service account to manage. Cannot be updated.bindings
(string
): Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string). Optional.token_scopes
(array: []
): List of OAuth scopes to assign toaccess_token
secrets generated under this static account (access_token
static accounts only)
Sample payload
Sample bindings:
See bindings format docs for more information.
Sample request
Rotate static account key (access_token
static account only)
access_token
static account only)POST
/gcp/static-account/:name/rotate-key
204 (empty body)
This will rotate the service account key this static account uses to generate access tokens. This does not recreate the service account.
Sample request
Read static account
GET
/gcp/static-account/:name
Parameters
name
(string:<required>
): Name of the static account to read.
This endpoint will only return bindings that are managed through the secrets engine. Bindings manually managed outside of Vault will not be returned.
Sample request
Sample response
List static accounts
LIST
/gcp/static-accounts
Sample request
Sample response
Delete static account
This endpoint deletes an existing static account by the given name.
DELETE
/gcp/static-account/:name
Parameters
name
(string:<required>
): Name of the static account to delete.
Sample request
Create/Update impersonated account
POST
/gcp/impersonated-account/:name
This method allows you to create an impersonated account or update an existing impersonated account.
Parameters
name
(string: <required>
): Name of the impersonated account. Cannot be updated.service_account_email
(string: <required>
): Email of the GCP service account to manage. Cannot be updated.token_scopes
(array: []
): List of OAuth scopes to assign to access tokens generated under this impersonation account.ttl
(duration: ""
): Lifetime of the token generated. Defaults to 1 hour and is limited to a maximum of 12 hours. Uses duration format strings.
Sample payload
Sample request
Read impersonated account
GET
/gcp/impersonated-account/:name
Parameters
name
(string:<required>
): Name of the impersonated account to read.
Sample request
Sample response
List impersonated accounts
This endpoint lists the configured Vault roles for impersonated accounts.
LIST
/gcp/impersonated-accounts
Sample request
Sample response
Delete impersonated account
This endpoint deletes an existing impersonated account by the given name.
DELETE
/gcp/impersonated-account/:name
Parameters
name
(string:<required>
): Name of the impersonated account to delete.
Sample request
Generate secret (IAM service account creds): OAuth2 access token
GET
/ POST
/gcp/roleset/:roleset/token
GET
/ POST
/gcp/static-account/:static-account/token
GET
/ POST
/gcp/impersonated-account/:impersonated-account/token
GET
/ POST
/gcp/token/:roleset
(deprecated)
Generates an OAuth2 token with the scopes defined on the roleset, static account, or impersonated account. This OAuth access token can be used in GCP API calls, e.g. curl -H "Authorization: Bearer $TOKEN" ...
Tokens are non-revocable and non-renewable and have a static TTL of an hour. The TTL configured for the backend (either through the default system TTLs or through the config/
endpoint) do not apply.
Parameters
roleset
(string:<required>
): Name of an roleset with secret typeaccess_token
to generate access_token under.static-account
(string:<required>
): Name of the static account with secret typeaccess_token
to generate access_token under.impersonated-account
(string:<required>
): Name of the impersonated account to generate access_token_under.
Sample request
Roleset:
Static account:
Impersonated account:
Sample response
Generate secret (IAM service account creds): service account key
GET
/ POST
/gcp/roleset/:roleset/key
GET
/ POST
/gcp/static-account/:static-account/key
GET
/ POST
/gcp/key/:roleset
(deprecated)
If using GET
('read'), the optional parameters will be set to their defaults. Use POST
if you want to specify different values for these params.
These keys are renewable and have TTL/max TTL as defined by either the backend config or the system default if config was not defined.
Parameters
roleset
(string:<required>
): Name of an roleset with secret typeservice_account_key
to generate key under.static-account
(string:<required>
): Name of an static account with secret typeservice_account_key
to generate key under.key_algorithm
(string:"KEY_ALG_RSA_2048"
): Key algorithm used to generate key. Defaults to 2k RSA key You probably should not choose other values (i.e. 1k), but accepted values areenum(ServiceAccountKeyAlgorithm)
key_type
(string:"TYPE_GOOGLE_CREDENTIALS_FILE
): Private key type to generate. Defaults to JSON credentials file. Accepted values areenum(ServiceAccountPrivateKeyType)
ttl
(string: ""
): Specifies the Time To Live value provided using a duration format string. If not set, uses the system default value.
Sample payload
Sample request
Sample response
Revoking/Renewing secrets
See docs on how to renew and revoke leases. Note this only applies to service account keys.
Last updated