What problem does it solve? Hardcoding API keys, database passwords, and private keys in source code or environment variables creates serious security risks. This Skill provides a standard operating procedure for storing credentials in Google Cloud Secret Manager and granting access only through least-privilege IAM service accounts. ## Core Features & Use Cases - Least-Privilege Service Accounts: Create dedicated runtime service accounts for Cloud Run services and ADK agents instead of relying on over-privileged default accounts. - Secret Provisioning & IAM Binding: Create secrets in Secret Manager, add payload versions, and bind the granular roles/secretmanager.secretAccessor role scoped to individual secrets. - Runtime Secret Access in Python: Retrieve secret payloads dynamically at runtime using the official google-cloud-secretmanager SDK, with verification commands and troubleshooting for common 403/404 errors. - Use Case: When deploying a Cloud Run backend that needs a GitHub App private key, follow this procedure to store the key in Secret Manager, bind access to the runtime service account, and read it securely at runtime. ## Quick Start Use the gcp-iam-secret-manager skill to create a least-privilege service account and store my GitHub App private key in Secret Manager.
