How to set environment variables/app secrets in Google App Engine

Question

The question is how can I set application secrets to make them available in application.yml?

On heroku I was doing it simply, by setting environment variable for dyno, and acces it as:

server:
  port: ${PORT}
security:
  user:
    password: ${USERPASSWORD}

eureka:
  client:
    register-with-eureka: false
    fetch-registry: false
  instance:
    hostname: localhost
    securePortEnabled: true
  password: ${EUREKAPASSWORD}

How to achieve that in Google App Engine? I was trying with datastore:

Unfornately I don't know how to inject those values into my *.yml file.

EDIT:

One more important thing to add. I am using maven appengine plugin to deploy my app via CI pipeline, so there is no possibility for me to push app.yaml file to App Engine

Answer 1

If you want to store secrets that are available to the app at runtime, keeping them in the datastore isn't a bad idea. I know of many apps that do that.

Here's an app used by the Khan Academy that's a good example of storing secret credentials in the datastore. It's in Python, but you can get the general idea. Note that on first admin login, it prompts for secrets to store.

Answer 2

Google has also a tutorial on how to store encrypted secrets. https://cloud.google.com/kms/docs/store-secrets

TLDR: a separate bucket to store the encrypted secrets, instances download it when needed, decrypt using Google KMS (https://cloud.google.com/kms/) and remove afterwards.