Skip to main content

Set up Secret Guardian resources

This step creates the KMS key ring and key, the workload identity pool used for attestation, and the secrets the services read at deploy time.

Log in to gcloud with credentials that have access to the Secret Guardian project.

Enable Google Cloud APIs

gcloud services enable \
  cloudkms.googleapis.com \
  secretmanager.googleapis.com \
  iam.googleapis.com \
  sts.googleapis.com \
  --project=SECRET_GUARDIAN_PROJECT_ID

Apply

tofu -chdir=deploy/gcp/tf/bootstrap-secret-guardian init
tofu -chdir=deploy/gcp/tf/bootstrap-secret-guardian apply -var-file=../global.tfvars

What it creates

A key ring and key, plus a workload identity pool that gates access to them. The assertion on the pool's provider:

attribute_condition = "assertion.swname == 'CONFIDENTIAL_SPACE'"

grants KMS access only if the requesting VM runs Confidential Space. You can assert on more, such as a specific image digest or images signed by a given key. See the full list of attestation assertions.

With the policy engine enabled it also creates a Secret Manager secret for the policy-svc HMAC key.

Generate secrets

Generates the policy-svc HMAC key and stores it in Secret Manager.

The script expects the following binaries to be installed:

  • gcloud
  • openssl
  • tofu
  • jq
./deploy/gcp/scripts/generate-secrets-secret-guardian.sh

Re-running the script leaves existing values alone. With the policy engine disabled there is nothing to generate.