I would like to keep my use access tokens to GCP encrypted in my operating system’s keychain and use them easily with gcloud CLI.

So, does aws-vault for gcp exist to secure my own tokesn when accessing gcp?

This is unrelated to AWS Secret Manager

2 Answers 2


It sounds like you want Google Secret manager.

From the documentation, it claims to:

Store API keys, passwords, certificates, and other sensitive data.

which sounds like it does what you want it to do.

However, you state

I would like to keep my tokens encrypted in my operating system’s keychain

-- I don't see why you would want to do that though, if you have secrets manager. The secrets manager should be the source of truth, and the machine should be authorised via IAM to access specific secrets on demand, not persisted in the OS keychain. If the OS is compromised, the secrets will be exposed, whilst the attacker would need to break secrets manager or IAM in order to access them if they are consumed uniquely from secrets manager.

  • 1
    I'm running gcloud CLI on command-line on my own laptop, how would secret manager help with that? I might not understand how it works but how do I authenticate myself to secret manager from my own laptop?
    – JtR
    Commented Oct 19, 2022 at 9:07
  • You missed the question: Google Secret Manager is a secret store, on the cloud. Sometimes we need other secrets on our computers, like the access creds for GCP or AWS. If you leave them unprotected, anyone stealing your computer can get access to your infra on the cloud.
    – Raffi
    Commented Mar 18, 2023 at 11:39
  • @Raffi that's the original question: how to keep secure GCP credentials, sadly the link in the original post has a name making sounds like AWS secret manager, which it is not.
    – Tensibai
    Commented Jul 5, 2023 at 13:22

Late answer, but for the record, Google Cloud Cli has built-in support for multi-account, with automatic credentials renewal, so there's no need for an external tool like aws-vault for AWS.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.