Connecting Yuki to Your GCP Secret Manager

info

Yuki reads your Snowflake key directly from your own Google Cloud Secret Manager, on demand, using its own identity. Your key is never copied or stored by Yuki. You grant read access once, scoped to secrets named yuki-* - after that, any yuki- secret you add works automatically, and nothing else in your project is exposed.

What You'll Need

• A Google Cloud project that holds (or will hold) your secret in Secret Manager
• Permission to grant IAM roles on that project

The Access You Grant

One read-only role, granted to a Yuki-owned service account, scoped to only your yuki-* secrets:

Field	Value
Service account	proxy-secret-reader@yuki-infra-project.iam.gserviceaccount.com
Role	Secret Manager Secret Accessor (roles/secretmanager.secretAccessor)
Scope	Only secrets named yuki-*, current and future. All other secrets stay private.

Step 1 - Grant Access

Choose one of the following options.

Option A - Script (Recommended)

Run in your terminal (uses your current gcloud login). Replace the project ID:

PROJECT_ID="<your-gcp-project-id>"

gcloud services enable secretmanager.googleapis.com --project="$PROJECT_ID"

PROJECT_NUMBER="$(gcloud projects describe "$PROJECT_ID" --format='value(projectNumber)')"

gcloud projects add-iam-policy-binding "$PROJECT_ID" \
  --member="serviceAccount:proxy-secret-reader@yuki-infra-project.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor" \
  --condition="title=yuki-prefix-only,description=Yuki reads only yuki-* secrets,expression=resource.name.startsWith('projects/${PROJECT_NUMBER}/secrets/yuki-')"

Option B - Google Cloud Console (Manual)

1. Enable the API: Console → APIs & Services → Library → search Secret Manager API → Enable.
2. Grant access: Console → IAM & Admin → IAM → Grant access.

   • New principals: proxy-secret-reader@yuki-infra-project.iam.gserviceaccount.com

   • Role: Secret Manager Secret Accessor

   • Click Add IAM condition, open the Condition Editor, and paste the following (replace PROJECT_NUMBER with your project's number):

     resource.name.startsWith("projects/PROJECT_NUMBER/secrets/yuki-")

   • Click Save.

Step 2 - Create Your Secret

1. Console → Secret Manager → Create secret.
2. Name: must start with yuki- (e.g., yuki-snowflake-prod). You'll share this name with Yuki.
3. Value: a JSON object holding your Snowflake private key, and its passphrase if the key has one - not the raw PEM:

{
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEv...\n-----END PRIVATE KEY-----",
  "passphrase": ""
}

The line breaks inside the key must be escaped as \n, which is what any JSON editor or json.dumps produces for you. You choose the field names; you'll tell Yuki what they are in Step 3.

tip

Yuki always reads the latest version of the secret, so you can rotate the key anytime without redoing any of these steps.

Step 3 - Register It in Yuki

In Yuki, go to Security → Key Pair Authentication, turn on Self-Stored Key, and set Secret Store to GCP. Then fill in:

• GCP Secret Resource Name: projects/<your-project-id>/secrets/<your-yuki-secret>/versions/latest
• Private Key Property: the JSON field holding the key, for example private_key
• Passphrase Property: the JSON field holding the passphrase, if your key has one

You can also do this while adding an integration, on the Key-pair users step.

Revoking Access

Remove the IAM binding (or delete the role grant) at any time. Yuki loses access immediately, and nothing of your key is ever retained on Yuki's side.