Update data in Google Cloud Secret Manager using Node.js

Question

I have some data in Google Cloud Secret Manager is there any way to update that data. I am trying to update by using below code

client.updateSecret({
  secret: {
    name: 'projects/xyz/secrets/test',
    labels: {
      secretmanager: 'rocks',
    },
  },
  updateMask: {
    paths: ['labels'],
  },
}).then(res => {
  let [data] = res
  console.log('success in updating', data)
}).catch(rej => {
  console.log('erro in updating', rej)
})

Answer 1

Data in Secret Manager is stored on the Secret Version .

• Secret - contains the metadata about the secret including the name, timestamps, labels, etc.
• Secret Version - contains the actual secret data.

A Secret contains 0 or more Secret Versions . Secret Versions are immutable, so you cannot update the value inside. However, you can add a new Secret Version . This will create a new Secret Version and update the value of the "latest" pointer:

const [version] = await client.addSecretVersion({
  parent: parent,
  payload: {
    data: myNewPayload,
  },
});

For more information on versioning, check out:

• What is first-class versioning?
• Secret and secret version definitions

Answer 2

You can use this "Node.js" sample code as a reference to update the data in Google Cloud Secret Manager.

/**
 * TODO(developer): Uncomment these variables before running.
 */
// const name = 'projects/my-project/secrets/my-secret';

// Imports the Secret Manager library
const {SecretManagerServiceClient} = require('@google-cloud/secret-manager');

// Instantiates a client
const client = new SecretManagerServiceClient();

async function updateSecret() {
  const [secret] = await client.updateSecret({
    secret: {
      name: name,
      labels: {
        secretmanager: 'rocks',
      },
    },
    updateMask: {
      paths: ['labels'],
    },
  });

  console.info(`Updated secret ${secret.name}`);
}

updateSecret();

Refer to this documentation for more information.

Answer 3

Assuming the secret already exists, you need to create a secret version to update the secret data. Here's the method I use.

const { SecretManagerServiceClient } = require('@google-cloud/secret-manager');
const client = new SecretManagerServiceClient()
const parent = 'projects/YOUR_PROJECT' 

async function addSecretVersion(secretName, payload) {

    if (typeof payload != 'string') throw `Secret payload must be a string`
    const [version] = await client.addSecretVersion({
        parent: `${parent}/secrets/${secretName}`,
        payload: {
            data: Buffer.from(payload, 'utf8'),
        },
    })
    console.info(`Added secret version ${version.name}`)
}