Integrating GCP Secret Manager with Spring Boot
Fast recall
Quick revision
Core answer
spring-cloud-gcp-starter-secretmanager dependency and reference secrets in application.properties using the sm:// URI scheme. Spring Cloud GCP resolves these at startup as standard Spring property values, enabling Secret Manager to act as a secure, auditable replacement for environment variables or plaintext config files.Security-conscious configuration management — understanding how to keep credentials out of code and environment variables while integrating cleanly with the Spring property system.
Hard-coding the secret version (`:latest` vs a pinned version number), which prevents rollback, or granting the app's service account the `secretmanager.admin` role instead of the minimal `secretmanager.secretAccessor` role.
Discuss secret rotation strategies, the difference between accessing secrets as property sources vs. the SecretManagerTemplate API, and how to handle bootstrap context refresh for runtime secret rotation.
Interview-ready guide
Interview answer
GCP Secret Manager stores secrets (database passwords, API keys, OAuth tokens) with versioning, audit logging, and IAM-controlled access. Spring Cloud GCP integrates it as a Spring PropertySource so secrets appear as regular application properties.
Spring Cloud GCP integration
- Add
spring-cloud-gcp-starter-secretmanager; configurespring.cloud.gcp.secretmanager.project-id; reference secrets with thesm://prefix:spring.datasource.password=${sm://my-db-password}resolves the secret at startup - Spring Cloud GCP fetches the secret value from Secret Manager when the ApplicationContext initializes — the resolved value is available as a standard Spring property, so
@Value("${spring.datasource.password}")works without any Secret Manager SDK calls in business code
Secret versioning
- Secret Manager maintains versions —
sm://my-db-passwordresolves the latest enabled version;sm://my-db-password/1resolves version 1 explicitly - During rotation: create a new version of the secret, update the database password to match, then disable the old version; running applications continue using the old version (cached at startup) until restarted
Authentication
- Secret Manager access requires the
Secret Manager Secret AccessorIAM role — grant it to the service account used by Cloud Run or GKE; on GKE with Workload Identity, the Kubernetes service account maps to a GCP service account with the role assigned - Application Default Credentials (
GOOGLE_APPLICATION_CREDENTIALSlocally, or the metadata server on GKE/Cloud Run) handles authentication automatically
Secret Manager vs environment variables
- Never store secrets as environment variables in Cloud Run or GKE pod specs — they appear in deployment logs, kubectl describe output, and Cloud Run revision configuration; Secret Manager keeps them out of the platform control plane
Integrating GCP Secret Manager with Spring Boot
Direct Answer
Add the spring-cloud-gcp-starter-secretmanager dependency and reference secrets in application.properties using the sm:// URI scheme. Spring Cloud GCP resolves these at startup as standard Spring property values, enabling Secret Manager to act as a secure, auditable replacement for environment variables or plaintext config files.
Common Mistakes & Pitfalls
Hard-coding the secret version (:latest vs a pinned version number), which prevents rollback, or granting the app's service account the secretmanager.admin role instead of the minimal secretmanager.secretAccessor role.
Check your understanding
Answer these without looking back at the article.
- How do you implement automatic secret rotation in a Spring Boot application on Cloud Run?
- What is the difference between Secret Manager and Cloud KMS in GCP?
- How do you test Spring Boot code that depends on Secret Manager properties locally?
Related interview prep categories
1Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.