• An Enkryptify workspace with admin access
  • A Google Cloud project
  • Permissions to create a Service Account and grant IAM roles in the project
Enkryptify connects to your GCP project using Service Account impersonation. You create a Service Account in your project with Secret Manager permissions, then grant Enkryptify the ability to impersonate it.
  • On your target Service Account:
    • Service Usage Admin / roles/serviceusage.serviceUsageAdmin
    • Secret Manager Admin / roles/secretmanager.admin
  • On the same Service Account: Service Account Token Creator (roles/iam.serviceAccountTokenCreator) to principal enkryptify@enkryptify.iam.gserviceaccount.com

​
Steps to complete

1

Create a new sync

  • Go to the Syncs tab of your project and click on GCP Secret Manager. Create GCP Secret Manager sync screen in Enkryptify
2

Create a Service Account (GCP Console)

  • Navigate to IAM & Admin → Service Accounts. Service Account Page
  • Create a new Service Account with an ID of your choosing. Create Service Account
3

Grant Secret Manager permissions to the Service Account

  • Grant the following permissions to the Service Account:
    • Secret Manager Admin (roles/secretmanager.admin)
    • Service Usage Admin (roles/serviceusage.serviceUsageAdmin) Assign Service Account Permission
4

Enable Service Account impersonation

  • Grant Service Account Token Creator (roles/iam.serviceAccountTokenCreator) to enkryptify@enkryptify.iam.gserviceaccount.com on your Service Account.
    • Open the Service Account → PERMISSIONS tab → Grant Access → add the principal and role. Grant Enkryptify Service Account Token Creator on your SA
5

Enable required APIs

  • Ensure these APIs are enabled on your project:
    • Cloud Resource Manager API
    • Secret Manager API
    • Service Usage API
6

Authenticate in Enkryptify

  • In Enkryptify, enter your Project ID and the Service Account Email to impersonate. GCP service account impersonation configuration screen in Enkryptify
7

Link an Enkryptify environment

  • Choose which Enkryptify environment to sync. Environment selection for GCP Secret Manager sync in Enkryptify