> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enkryptify.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Secret Manager

<AccordionGroup>
  <Accordion title="Prerequisites" icon="list-check">
    * An Enkryptify workspace with admin access
    * A Google Cloud project
    * Permissions to create a Service Account and grant IAM roles in the project
  </Accordion>

  <Accordion title="Permissions" icon="scroll-text">
    Enkryptify connects to your GCP project using Service Account impersonation. You create a Service Account in your project with Secret Manager permissions, then grant Enkryptify the ability to impersonate it.

    * On your target Service Account the sync needs:
      * `secretmanager.secrets.create`
      * `secretmanager.secrets.delete`
      * `secretmanager.secrets.get`
      * `secretmanager.secrets.list`
      * `secretmanager.versions.add`
    * On the same Service Account: `Service Account Token Creator` (`roles/iam.serviceAccountTokenCreator`) to principal `enkryptify@enkryptify.iam.gserviceaccount.com`

    > The impersonated Service Account does not have `secretmanager.versions.access`, so it cannot read secret payloads from GCP. Enkryptify only writes versions and reads metadata. Secret values are never fetched from GCP.
  </Accordion>
</AccordionGroup>

## Steps to complete

<Steps>
  <Step title="Create a new sync">
    * Go to the `Syncs` tab of your project and click on `GCP Secret Manager`.
  </Step>

  <Step title="Create a Service Account (GCP Console)">
    * Navigate to IAM & Admin → Service Accounts.
    * Create a new Service Account with an ID of your choosing.

          <img src="https://mintcdn.com/enkryptify-39ddac35/Pp9xbv0du_vx2mUv/images/sync/gcp/service-account-creation.png?fit=max&auto=format&n=Pp9xbv0du_vx2mUv&q=85&s=1b3492c6ce94d723937d41ae63efa235" alt="Create Service Account" width="2862" height="1920" data-path="images/sync/gcp/service-account-creation.png" />
  </Step>

  <Step title="Grant Secret Manager permissions to the Service Account">
    * Create a new role with the following permissions (**recommended**):
      * `secretmanager.secrets.create`
      * `secretmanager.secrets.delete`
      * `secretmanager.secrets.get`
      * `secretmanager.secrets.list`
      * `secretmanager.versions.add`
    * OR use the following role:
      * `Secret Manager Admin` (`roles/secretmanager.admin`)

            <img src="https://mintcdn.com/enkryptify-39ddac35/7M7rEiw2BfTKrSr1/images/sync/gcp/service-account-role.png?fit=max&auto=format&n=7M7rEiw2BfTKrSr1&q=85&s=7db487c1d1d7f70ec9a42cb7575446f8" alt="Assign Service Account Permission" width="2864" height="1920" data-path="images/sync/gcp/service-account-role.png" />
  </Step>

  <Step title="Enable Service Account impersonation">
    * Grant `Service Account Token Creator` (`roles/iam.serviceAccountTokenCreator`) to `enkryptify@enkryptify.iam.gserviceaccount.com` on your Service Account.
      * Open the Service Account → `Principals with access` tab → Grant Access → add the principal and role.

            <img src="https://mintcdn.com/enkryptify-39ddac35/7M7rEiw2BfTKrSr1/images/sync/gcp/service-account-principals.png?fit=max&auto=format&n=7M7rEiw2BfTKrSr1&q=85&s=ffb88701b73d2c7074d1dc0b5af5bdb9" alt="Grant Enkryptify Service Account Token Creator on your SA" width="2868" height="1924" data-path="images/sync/gcp/service-account-principals.png" />
  </Step>

  <Step title="Enable required APIs">
    * Ensure these APIs are enabled on your project:
      * Cloud Resource Manager API
      * Secret Manager API
      * Service Usage API

            <img src="https://mintcdn.com/enkryptify-39ddac35/Pp9xbv0du_vx2mUv/images/sync/gcp/gcp-enabled-service.png?fit=max&auto=format&n=Pp9xbv0du_vx2mUv&q=85&s=c8df8d731bb23bda51f65b1ce29c5126" alt="Enable required APIs" width="2874" height="1924" data-path="images/sync/gcp/gcp-enabled-service.png" />
  </Step>

  <Step title="Authenticate in Enkryptify">
    * In Enkryptify, enter your `Project ID` and the Service Account `Email` to impersonate.
  </Step>

  <Step title="Link an Enkryptify environment">
    * Choose which Enkryptify environment to sync.
  </Step>
</Steps>