Secret Manager

Module: Secret Manager

Module flag: secretmanager Enabled by default: yes

---

Overview

The Secret Manager module lists secret metadata — names, labels, create times, and replication policies. Secret values are never read. This is by design: the tool provides inventory and audit capability without any risk of credential exposure.

---

Enable This Module

GCP_PROJECT_ID=my-project ./aura-tracker-gcp --modules secretmanager

---

Required GCP APIs

gcloud services enable secretmanager.googleapis.com

---

Required IAM Permissions

Role	Tools that need it
roles/secretmanager.viewer	All tools

roles/secretmanager.viewer grants access to list secrets and view metadata only. It does not grant access to secret values (secretmanager.versions.access is a separate permission never used by this module).

---

Tools

gcp_secretmanager_list

Lists secrets in the project.

Parameters:

Name	Required	Description
project_id	yes	GCP project ID
filter	no	Cloud Resource Manager filter expression

Returns: Secret name, create time, labels, replication type (AUTOMATIC / USER_MANAGED with regions), version count, next rotation time (if rotation is configured).

---

Prompt Examples

Inventory

"List all secrets in project my-project."

Rotation audit

"Which secrets in project my-project do not have automatic rotation configured?"

Label audit

"Which secrets in project my-project are missing the owner or service label?"

Usage audit (combined with topology)

"Cross-reference the secrets in project my-project with the Cloud Run services that reference them via environment variables."

---

Related Modules

Module flag	Why you'd combine it
topology	gcp_get_service_topology discovers which Cloud Run services reference each secret
iam	Audit which service accounts have secretmanager.versions.access on sensitive secrets
cloudrun	Find Cloud Run services that mount secrets as volumes or env vars