Who can see the setting versus information about it?
Use a cloud identity for the running app. Google’s Secret Accessor role can be granted for one specific secret. A Viewer role can see descriptive information such as which secrets exist, without reading their private values. Check which role the app actually has.
How can you prepare a replacement without losing the old version too soon?
Create a replacement plan that starts with the system that accepts the setting. Decide which version the app should use and verify that change. The standard rotation schedule sends a notification. If you use that schedule, your workflow still has to replace the value. A disabled version can be enabled again. A destroyed version cannot be recovered.
What does Google count, and what should you keep?
Charges can depend on active versions, read operations and rotation notifications. Free allowances are shared across projects in one billing account. Keep the version references, app identities and location requirements. Before a move, check which changes the destination service requires.
Which of two apps should read the test setting?
Draw two fictional cloud identities. Only the appointment service should be able to read its test setting.
- Mark the allowed readGive the appointment service an arrow to that one label.
- Mark the expected denialLeave the unrelated reporting job with no read arrow. Write the result you would expect from each identity in a separately authorized test.