kms (2)

Dan Putt

Google Cloud Build decrypting KMS Secrets

In trying to follow more best practices and create a true reference architecture for Java in GCP I was trying to store my service account credential files encrypted using KMS then pull them out and decrypt them using using GCP KMS Service.  In doing so though I kept getting an error through Cloud Build saying I didn't have decrypt permissions.  

It pains me to admit that this took me much longer to solve than it should have, mostly because of a deeply rooted I.D.ten.T. error.  

Continue reading...