如何在Google Secret Manager中指定europe-north1地域创建密钥？

原创建密钥代码：

from google.cloud import secretmanager


def create_secret(secret_id):
    # Create the Secret Manager client.
    client = secretmanager.SecretManagerServiceClient()

    # Build the resource name of the parent project.
    PROJECT_ID = "123456789"
    parent = f"projects/{PROJECT_ID}"

    # Build a dict of settings for the secret
    secret = {'replication': {'automatic': {}}}

    # Create the secret
    response = client.create_secret(secret_id=secret_id, parent=parent, secret=secret)

    # Print the new secret name.
    print(f'Created secret: {response.name}')

运行时触发错误：

Constraint constraints/gcp.resourceLocations violated for
[orgpolicy:projects/123456789] attempting to create a secret in
[global]

完整回溯信息：

Traceback (most recent call last):
  File "C:\Users\bruker\Code\auto\venv\lib\site-packages\google\api_core\grpc_helpers.py", line 72, in error_remapped_callable
    return callable_(*args, **kwargs)
  File "C:\Users\bruker\Code\auto\venv\lib\site-packages\grpc\_channel.py", line 946, in __call__
    return _end_unary_response_blocking(state, call, False, None)
  File "C:\Users\bruker\Code\auto\venv\lib\site-packages\grpc\_channel.py", line 849, in _end_unary_response_blocking
    raise _InactiveRpcError(state)
grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
    status = StatusCode.FAILED_PRECONDITION
    details = "Constraint constraints/gcp.resourceLocations violated for [orgpolicy:projects/123456789] attempting to create a secret in [global]. For more information, see https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations."
    debug_error_string = "UNKNOWN:Error received from peer ipv4:1.2.3.4:443 {created_time:"2022-12-02T12:16:38.059799917+00:00", grpc_status:9, grpc_message:"Constraint constraints/gcp.resourceLocations violated for [orgpolicy:projects/123456789] attempting to create a secret in [global]. For more information, see https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations."}"
>

因管理员设置地域约束，仅允许在europe-north1存储密钥，需修改代码指定地域创建密钥。

修改secret字典中的replication配置，将自动复制改为指定地域复制，指定europe-north1作为密钥存储地域：

修改后的代码：

from google.cloud import secretmanager


def create_secret(secret_id):
    # Create the Secret Manager client.
    client = secretmanager.SecretManagerServiceClient()

    # Build the resource name of the parent project.
    PROJECT_ID = "123456789"
    parent = f"projects/{PROJECT_ID}"

    # 替换自动复制为指定地域复制，指定europe-north1
    secret = {
        'replication': {
            'user_managed': {
                'replicas': [
                    {
                        'location': 'europe-north1'
                    }
                ]
            }
        }
    }

    # Create the secret
    response = client.create_secret(secret_id=secret_id, parent=parent, secret=secret)

    # Print the new secret name.
    print(f'Created secret: {response.name}')

关键修改说明 #

• 原代码使用{'replication': {'automatic': {}}}，会默认将密钥存储在global地域，触发地域约束
• 修改为user_managed模式，并在replicas列表中指定允许的地域europe-north1，满足组织政策要求

内容的提问来源于stack exchange，提问作者Europa