Skip to main content
  • An Enkryptify workspace with admin access
  • A Google Cloud project
  • Permissions to create a Service Account and grant IAM roles in the project
Enkryptify connects to your GCP project using Service Account impersonation. You create a Service Account in your project with Secret Manager permissions, then grant Enkryptify the ability to impersonate it.
  • On your target Service Account the sync needs:
    • secretmanager.secrets.create
    • secretmanager.secrets.delete
    • secretmanager.secrets.get
    • secretmanager.secrets.list
    • secretmanager.versions.add
  • On the same Service Account: Service Account Token Creator (roles/iam.serviceAccountTokenCreator) to principal enkryptify@enkryptify.iam.gserviceaccount.com
The impersonated Service Account does not have secretmanager.versions.access, so it cannot read secret payloads from GCP. Enkryptify only writes versions and reads metadata. Secret values are never fetched from GCP.

​
Steps to complete

1

Create a new sync

  • Go to the Syncs tab of your project and click on GCP Secret Manager.
2

Create a Service Account (GCP Console)

  • Navigate to IAM & Admin → Service Accounts.
  • Create a new Service Account with an ID of your choosing. Create Service Account
3

Grant Secret Manager permissions to the Service Account

  • Create a new role with the following permissions (recommended):
    • secretmanager.secrets.create
    • secretmanager.secrets.delete
    • secretmanager.secrets.get
    • secretmanager.secrets.list
    • secretmanager.versions.add
  • OR use the following role:
    • Secret Manager Admin (roles/secretmanager.admin) Assign Service Account Permission
4

Enable Service Account impersonation

  • Grant Service Account Token Creator (roles/iam.serviceAccountTokenCreator) to enkryptify@enkryptify.iam.gserviceaccount.com on your Service Account.
    • Open the Service Account → Principals with access tab → Grant Access → add the principal and role. Grant Enkryptify Service Account Token Creator on your SA
5

Enable required APIs

  • Ensure these APIs are enabled on your project:
    • Cloud Resource Manager API
    • Secret Manager API
    • Service Usage API Enable required APIs
6

Authenticate in Enkryptify

  • In Enkryptify, enter your Project ID and the Service Account Email to impersonate.
7

Link an Enkryptify environment

  • Choose which Enkryptify environment to sync.