Edit a secret

This page describes how to edit a secret's metadata. You can update many properties of a secret such as encryption type, rotation policy, expiration date, labels, and event notifications. You can also add annotations and set up aliases for secret versions. You can't edit the secret name or value and the replication policy. To add a new value to your secret, you must create a new secret version .

Important: To use Secret Manager with workloads running on Compute Engine or Google Kubernetes Engine, the underlying instance or node must have the cloud-platform OAuth scope. See accessing the Secret Manager API for more information.

Required roles

To get the permissions that you need to update a secret's metadata, ask your administrator to grant you the Secret Manager Admin ( roles/secretmanager.admin ) IAM role on the secret or project. For more information about granting roles, see Manage access to projects, folders, and organizations .

You might also be able to get the required permissions through custom roles or other predefined roles .

Edit a secret

To edit a secret, use one of the following methods:

Console

In the Google Cloud console, go to the Secret Manager page.

Go to Secret Manager
To edit a secret, use one of the following options:
- Locate the secret in the list and click the Actions menu associated with that secret. In the Actions menu, click Edit .
- Click the secret name to go to the secret details page. On the secret details page, click Edit secret .
On the Edit secret page, update the properties of the secret as required, and then click Update secret .

gcloud

Before using any of the command data below, make the following replacements:

SECRET_ID : the ID of the secret
KEY : the label key
VALUE : the corresponding value of the label

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud  
secrets  
update  
 SECRET_ID 
  
 \ 
  
--update-labels = 
  KEY 
 
 = 
 VALUE

Windows (PowerShell)

gcloud  
secrets  
update  
 SECRET_ID 
  
 ` 
  
--update-labels = 
  KEY 
 
 = 
 VALUE

Windows (cmd.exe)

gcloud  
secrets  
update  
 SECRET_ID 
  
^  
--update-labels = 
  KEY 
 
 = 
 VALUE

The response returns the updated secret.

REST

Before using any of the request data, make the following replacements:

PROJECT_ID : the Google Cloud project ID
SECRET_ID : the ID of the secret
KEY : the label key
VALUE : the corresponding value of the label

HTTP method and URL:

PATCH https://secretmanager.googleapis.com/v1/projects/ PROJECT_ID 
/secrets/ SECRET_ID 
?updateMask=labels

Request JSON body:

{'labels': {' KEY 
': ' VAL 
'}}

To send your request, choose one of these options:

curl

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell , which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list .

Save the request body in a file named request.json , and execute the following command:

curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://secretmanager.googleapis.com/v1/projects/ PROJECT_ID 
/secrets/ SECRET_ID 
?updateMask=labels"

PowerShell

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list .

Save the request body in a file named request.json , and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method PATCH `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://secretmanager.googleapis.com/v1/projects/ PROJECT_ID 
/secrets/ SECRET_ID 
?updateMask=labels" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "name": "projects/ PROJECT_ID 
/locations/ LOCATION 
/secrets/ SECRET_ID 
",
  "createTime": "2024-09-02T07:14:00.281541Z",
  "labels": {
    "key": "value"
  },
  "etag": "\"16211dc7d040b1\""
}

C#

To run this code, first set up a C# development environment and install the Secret Manager C# SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

  using 
  
  Google.Protobuf.WellKnownTypes 
 
 ; 
 using 
  
  Google.Cloud.SecretManager.V1 
 
 ; 
 public 
  
 class 
  
 UpdateSecretSample 
 { 
  
 public 
  
 Secret 
  
 UpdateSecret 
 ( 
 string 
  
 projectId 
  
 = 
  
 "my-project" 
 , 
  
 string 
  
 secretId 
  
 = 
  
 "my-secret" 
 ) 
  
 { 
  
 // Create the client. 
  
  SecretManagerServiceClient 
 
  
 client 
  
 = 
  
  SecretManagerServiceClient 
 
 . 
  Create 
 
 (); 
  
 // Build the secret with updated fields. 
  
 Secret 
  
 secret 
  
 = 
  
 new 
  
 Secret 
  
 { 
  
 SecretName 
  
 = 
  
 new 
  
  SecretName 
 
 ( 
 projectId 
 , 
  
 secretId 
 ), 
  
 }; 
  
 secret 
 . 
  Labels 
 
 [ 
 "secretmanager" 
 ] 
  
 = 
  
 "rocks" 
 ; 
  
 // Build the field mask. 
  
  FieldMask 
 
  
 fieldMask 
  
 = 
  
  FieldMask 
 
 . 
  FromString 
 
 ( 
 "labels" 
 ); 
  
 // Call the API. 
  
 Secret 
  
 updatedSecret 
  
 = 
  
 client 
 . 
  UpdateSecret 
 
 ( 
 secret 
 , 
  
 fieldMask 
 ); 
  
 return 
  
 updatedSecret 
 ; 
  
 } 
 }

Go

To run this code, first set up a Go development environment and install the Secret Manager Go SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

  import 
  
 ( 
  
 "context" 
  
 "fmt" 
  
 "io" 
  
 secretmanager 
  
 "cloud.google.com/go/secretmanager/apiv1" 
  
 "cloud.google.com/go/secretmanager/apiv1/secretmanagerpb" 
  
 "google.golang.org/genproto/protobuf/field_mask" 
 ) 
 // updateSecret updates the metadata about an existing secret. 
 func 
  
 updateSecret 
 ( 
 w 
  
 io 
 . 
 Writer 
 , 
  
 name 
  
 string 
 ) 
  
 error 
  
 { 
  
 // name := "projects/my-project/secrets/my-secret" 
  
 // Create the client. 
  
 ctx 
  
 := 
  
 context 
 . 
 Background 
 () 
  
 client 
 , 
  
 err 
  
 := 
  
 secretmanager 
 . 
  NewClient 
 
 ( 
 ctx 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "failed to create secretmanager client: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 defer 
  
 client 
 . 
  Close 
 
 () 
  
 // Build the request. 
  
 req 
  
 := 
  
& secretmanagerpb 
 . 
 UpdateSecretRequest 
 { 
  
 Secret 
 : 
  
& secretmanagerpb 
 . 
 Secret 
 { 
  
 Name 
 : 
  
 name 
 , 
  
 Labels 
 : 
  
 map 
 [ 
 string 
 ] 
 string 
 { 
  
 "secretmanager" 
 : 
  
 "rocks" 
 , 
  
 }, 
  
 }, 
  
 UpdateMask 
 : 
  
& field_mask 
 . 
 FieldMask 
 { 
  
 Paths 
 : 
  
 [] 
 string 
 { 
 "labels" 
 }, 
  
 }, 
  
 } 
  
 // Call the API. 
  
 result 
 , 
  
 err 
  
 := 
  
 client 
 . 
 UpdateSecret 
 ( 
 ctx 
 , 
  
 req 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "failed to update secret: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 fmt 
 . 
 Fprintf 
 ( 
 w 
 , 
  
 "Updated secret: %s\n" 
 , 
  
 result 
 . 
 Name 
 ) 
  
 return 
  
 nil 
 }

Java

To run this code, first set up a Java development environment and install the Secret Manager Java SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

  import 
  
 com.google.cloud.secretmanager.v1. Secret 
 
 ; 
 import 
  
 com.google.cloud.secretmanager.v1. SecretManagerServiceClient 
 
 ; 
 import 
  
 com.google.cloud.secretmanager.v1. SecretName 
 
 ; 
 import 
  
 com.google.protobuf. FieldMask 
 
 ; 
 import 
  
 com.google.protobuf.util. FieldMaskUtil 
 
 ; 
 import 
  
 java.io.IOException 
 ; 
 public 
  
 class 
 UpdateSecret 
  
 { 
  
 public 
  
 static 
  
 void 
  
 updateSecret 
 () 
  
 throws 
  
 IOException 
  
 { 
  
 // TODO(developer): Replace these variables before running the sample. 
  
 String 
  
 projectId 
  
 = 
  
 "your-project-id" 
 ; 
  
 String 
  
 secretId 
  
 = 
  
 "your-secret-id" 
 ; 
  
 updateSecret 
 ( 
 projectId 
 , 
  
 secretId 
 ); 
  
 } 
  
 // Update an existing secret. 
  
 public 
  
 static 
  
 void 
  
 updateSecret 
 ( 
 String 
  
 projectId 
 , 
  
 String 
  
 secretId 
 ) 
  
 throws 
  
 IOException 
  
 { 
  
 // Initialize client that will be used to send requests. This client only needs to be created 
  
 // once, and can be reused for multiple requests. After completing all of your requests, call 
  
 // the "close" method on the client to safely clean up any remaining background resources. 
  
 try 
  
 ( 
  SecretManagerServiceClient 
 
  
 client 
  
 = 
  
  SecretManagerServiceClient 
 
 . 
 create 
 ()) 
  
 { 
  
 // Build the name. 
  
  SecretName 
 
  
 secretName 
  
 = 
  
  SecretName 
 
 . 
 of 
 ( 
 projectId 
 , 
  
 secretId 
 ); 
  
 // Build the updated secret. 
  
  Secret 
 
  
 secret 
  
 = 
  
  Secret 
 
 . 
 newBuilder 
 () 
  
 . 
 setName 
 ( 
 secretName 
 . 
  toString 
 
 ()) 
  
 . 
  putLabels 
 
 ( 
 "secretmanager" 
 , 
  
 "rocks" 
 ) 
  
 . 
 build 
 (); 
  
 // Build the field mask. 
  
  FieldMask 
 
  
 fieldMask 
  
 = 
  
  FieldMaskUtil 
 
 . 
 fromString 
 ( 
 "labels" 
 ); 
  
 // Update the secret. 
  
  Secret 
 
  
 updatedSecret 
  
 = 
  
 client 
 . 
 updateSecret 
 ( 
 secret 
 , 
  
 fieldMask 
 ); 
  
 System 
 . 
 out 
 . 
 printf 
 ( 
 "Updated secret %s\n" 
 , 
  
 updatedSecret 
 . 
  getName 
 
 ()); 
  
 } 
  
 } 
 }

Node.js

To run this code, first set up a Node.js development environment and install the Secret Manager Node.js SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

  /** 
 * TODO(developer): Uncomment these variables before running the sample. 
 */ 
 // const name = 'projects/my-project/secrets/my-secret'; 
 // Imports the Secret Manager library 
 const 
  
 { 
 SecretManagerServiceClient 
 } 
  
 = 
  
 require 
 ( 
 ' @google-cloud/secret-manager 
' 
 ); 
 // Instantiates a client 
 const 
  
 client 
  
 = 
  
 new 
  
  SecretManagerServiceClient 
 
 (); 
 async 
  
 function 
  
 updateSecret 
 () 
  
 { 
  
 const 
  
 [ 
 secret 
 ] 
  
 = 
  
 await 
  
 client 
 . 
 updateSecret 
 ({ 
  
 secret 
 : 
  
 { 
  
 name 
 : 
  
 name 
 , 
  
 labels 
 : 
  
 { 
  
 secretmanager 
 : 
  
 'rocks' 
 , 
  
 }, 
  
 }, 
  
 updateMask 
 : 
  
 { 
  
 paths 
 : 
  
 [ 
 'labels' 
 ], 
  
 }, 
  
 }); 
  
 console 
 . 
 info 
 ( 
 `Updated secret 
 ${ 
 secret 
 . 
 name 
 } 
 ` 
 ); 
 } 
 updateSecret 
 ();

PHP

To run this code, first learn about using PHP on Google Cloud and install the Secret Manager PHP SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

  // Import the Secret Manager client library. 
 use Google\Cloud\SecretManager\V1\Secret; 
 use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient; 
 use Google\Cloud\SecretManager\V1\UpdateSecretRequest; 
 use Google\Protobuf\FieldMask; 
 /** 
 * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project') 
 * @param string $secretId  Your secret ID (e.g. 'my-secret') 
 */ 
 function update_secret(string $projectId, string $secretId): void 
 { 
 // Create the Secret Manager client. 
 $client = new SecretManagerServiceClient(); 
 // Build the resource name of the secret. 
 $name = $client->secretName($projectId, $secretId); 
 // Update the secret. 
 $secret = (new Secret()) 
 ->setName($name) 
 ->setLabels(['secretmanager' => 'rocks']); 
 $updateMask = (new FieldMask()) 
 ->setPaths(['labels']); 
 // Build the request. 
 $request = UpdateSecretRequest::build($secret, $updateMask); 
 $response = $client->updateSecret($request); 
 // Print the upated secret. 
 printf('Updated secret: %s', $response->getName()); 
 }

Python

To run this code, first set up a Python development environment and install the Secret Manager Python SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

  def 
  
 update_secret 
 ( 
 project_id 
 : 
 str 
 , 
 secret_id 
 : 
 str 
 ) 
 - 
> secretmanager 
 . 
 UpdateSecretRequest 
 : 
  
 """ 
 Update the metadata about an existing secret. 
 """ 
 # Import the Secret Manager client library. 
 from 
  
 google.cloud 
  
 import 
 secretmanager 
 # Create the Secret Manager client. 
 client 
 = 
 secretmanager 
 . 
 SecretManagerServiceClient 
 () 
 # Build the resource name of the secret. 
 name 
 = 
 client 
 . 
 secret_path 
 ( 
 project_id 
 , 
 secret_id 
 ) 
 # Update the secret. 
 secret 
 = 
 { 
 "name" 
 : 
 name 
 , 
 "labels" 
 : 
 { 
 "secretmanager" 
 : 
 "rocks" 
 }} 
 update_mask 
 = 
 { 
 "paths" 
 : 
 [ 
 "labels" 
 ]} 
 response 
 = 
 client 
 . 
 update_secret 
 ( 
 request 
 = 
 { 
 "secret" 
 : 
 secret 
 , 
 "update_mask" 
 : 
 update_mask 
 } 
 ) 
 # Print the new secret name. 
 print 
 ( 
 f 
 "Updated secret: 
 { 
 response 
 . 
 name 
 } 
 " 
 )

Ruby

To run this code, first set up a Ruby development environment and install the Secret Manager Ruby SDK . On Compute Engine or GKE, you must authenticate with the cloud-platform scope .

  # project_id = "YOUR-GOOGLE-CLOUD-PROJECT"  # (e.g. "my-project") 
 # secret_id  = "YOUR-SECRET-ID"             # (e.g. "my-secret") 
 # Require the Secret Manager client library. 
 require 
  
 "google/cloud/secret_manager" 
 # Create a Secret Manager client. 
 client 
  
 = 
  
 Google 
 :: 
 Cloud 
 :: 
  SecretManager 
 
 . 
  secret_manager_service 
 
 # Build the resource name of the secret. 
 name 
  
 = 
  
 client 
 . 
 secret_path 
  
 project 
 : 
  
 project_id 
 , 
  
 secret 
 : 
  
 secret_id 
 # Create the secret. 
 secret 
  
 = 
  
 client 
 . 
 update_secret 
 ( 
  
 secret 
 : 
  
 { 
  
 name 
 : 
  
 name 
 , 
  
 labels 
 : 
  
 { 
  
 secretmanager 
 : 
  
 "rocks" 
  
 } 
  
 }, 
  
 update_mask 
 : 
  
 { 
  
 paths 
 : 
  
 [ 
 "labels" 
 ] 
  
 } 
 ) 
 # Print the updated secret name. 
 puts 
  
 "Updated secret: 
 #{ 
 secret 
 . 
 name 
 } 
 "

Edit permissions and labels for multiple secrets

You can edit permissions and labels for multiple secrets using the Google Cloud console.

In the Google Cloud console, go to the Secret Manager page.

Go to Secret Manager
On the Secret Manager page, select the secrets for which you want to edit the permissions and labels.
If the Info Panel is closed, click Show Info Panel to display it.
The permissions and labels configured for all the secrets are displayed in the Info Panel under their corresponding tabs. Go to the individual tabs and update the values as required.
Click Save when done.

What's next

Learn how to manage access to secrets .
Learn how to set up rotation schedules for secrets .
Learn how to set up notifications on a secret .
Learn how to enable Customer-Managed Encryption Keys (CMEK) for Secret Manager .

Edit a secret Stay organized with collections Save and categorize content based on your preferences.

Required roles

Edit a secret

Console

gcloud

Linux, macOS, or Cloud Shell

Windows (PowerShell)

Windows (cmd.exe)

REST

curl

PowerShell

C#

Go

Java

Node.js

PHP

Python

Ruby

Edit permissions and labels for multiple secrets

What's next

Edit a secret