> ## Documentation Index
> Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Secret Manager

> Connect your Qovery cluster to GCP Secret Manager using ESO

<Info>
  Available on **GCP Managed Clusters**. You can also access GCP Secret Manager from an AWS Managed Cluster using cross-cloud static credentials.
</Info>

## From a GCP Managed Cluster

<Tabs>
  <Tab title="GCP Automatic Authentication">
    <Info>
      This authentication gives you access to **all secrets** located in the same GCP project as your cluster.
    </Info>

    <Warning>
      You must add the `Secret Manager Viewer` role to the GCP service account associated with your Qovery cluster.

      <Frame>
        <img src="https://mintcdn.com/qovery/6fdDvhSOOcJ9uNJR/images/configuration/secret-manager-access/gcp-secret-manager-viewer.png?fit=max&auto=format&n=6fdDvhSOOcJ9uNJR&q=85&s=2a568d094315a87f83b524e3660da230" alt="Add Secrets Manager Viewer permission" width="3420" height="2144" data-path="images/configuration/secret-manager-access/gcp-secret-manager-viewer.png" />
      </Frame>
    </Warning>

    Qovery automatically creates the GCP IAM Service Account with the necessary permissions.

    The following information is required:

    * Your GCP Project ID
    * The target GCP Region where your secrets live
    * The secret manager access name

    <Frame>
      <img src="https://mintcdn.com/qovery/6fdDvhSOOcJ9uNJR/images/configuration/secret-manager-access/sma-automatic-gcp-secret-manager.png?fit=max&auto=format&n=6fdDvhSOOcJ9uNJR&q=85&s=0405319391e3ec0ba15bdcf99922f1d5" alt="Automatic GCP Secret Manager authentication" width="3420" height="2144" data-path="images/configuration/secret-manager-access/sma-automatic-gcp-secret-manager.png" />
    </Frame>
  </Tab>

  <Tab title="GCP Static Credentials">
    Qovery provides the following script to run in your GCP Console:

    ```
    curl https://setup.qovery.com/create_secret_manager_credentials_gcp.sh | \
    bash -s -- $GOOGLE_CLOUD_PROJECT qovery_secrets_manager_role qovery-secrets-manager-sa
    ```

    The following information is required:

    * The `key.json` generated by the script
    * Your GCP Project ID
    * The target GCP Region where your secrets live
    * The secret manager access name

    <Frame>
      <img src="https://mintcdn.com/qovery/6fdDvhSOOcJ9uNJR/images/configuration/secret-manager-access/sma-aws-with-gcp-creds.png?fit=max&auto=format&n=6fdDvhSOOcJ9uNJR&q=85&s=7922d1d1083be5d41ae245cb9ec6a459" alt="GCP Static Credentials Secret Manager" width="3420" height="2145" data-path="images/configuration/secret-manager-access/sma-aws-with-gcp-creds.png" />
    </Frame>
  </Tab>
</Tabs>

## From an AWS Managed Cluster (cross-cloud)

You can access GCP Secret Manager from an AWS cluster using static credentials.

Qovery provides the following script to run in your GCP Console:

```
curl https://setup.qovery.com/create_secret_manager_credentials_gcp.sh | \
bash -s -- $GOOGLE_CLOUD_PROJECT qovery_secrets_manager_role qovery-secrets-manager-sa
```

The following information is required:

* The `key.json` generated by the script
* Your GCP Project ID
* The target GCP Region where your secrets live
* The secret manager access name

<Frame>
  <img src="https://mintcdn.com/qovery/6fdDvhSOOcJ9uNJR/images/configuration/secret-manager-access/sma-aws-with-gcp-creds.png?fit=max&auto=format&n=6fdDvhSOOcJ9uNJR&q=85&s=7922d1d1083be5d41ae245cb9ec6a459" alt="AWS GCP Secret Manager" width="3420" height="2145" data-path="images/configuration/secret-manager-access/sma-aws-with-gcp-creds.png" />
</Frame>

***

[← Back to Secret Manager Integration overview](/configuration/integrations/secret-managers/secret-manager-access#reference-the-external-secrets-in-your-service)
