GCP Cloud SQL

Doppler supports rotating secrets for each GCP Cloud SQL database - MySQL, Postgres, and SQL Server. Doppler utilizes the Cloud SQL Admin API to facilitate rotation. There's no need to expose your database to the internet and the GCP Service Account can be narrowly scoped.

Requirements

• Understand the Doppler rotation methodology
• GCP Account
  • Ability to create custom IAM roles
  • Ability to create a workload identity pool, or to create GCP Service Accounts and keys
• Access to or ability to create two database users

Overview

Configuring Doppler to facilitate rotation in Cloud SQL consists of:

1. Creating a narrowly scoped custom GCP role
2. Giving Doppler that role, either keylessly or with a GCP Service Account key
3. Providing the details of the Cloud SQL users to rotate between

Doppler supports two ways to authenticate to the Cloud SQL Admin API. Workload identity federation is recommended, since it leaves no credential stored in Doppler. Follow whichever section applies, then create the rotated secret.

GCP Custom Role

In order to scope Doppler's access as narrowly as possible, you'll first create a custom role for it to use.

1. In the GCP console, under IAM, navigate to RolesSelect Create Role
2. Provide a Title and ID. Use General Availability for Role Launch Stage
3. Select Add Permissions
4. In the filter section, search for and add cloudsql.users.update, cloudsql.users.list, and cloudsql.instances.get

5. Select Create

Note the Role ID you gave it — you'll reference it when granting access below.

workplace:<workplace-slug>:connection:<connection-id>

POOL_ID="doppler";
PROVIDER_ID="doppler";

# Get the current project's ID and number
PROJECT_ID="$(gcloud config get-value project --quiet)";
PROJECT_NUMBER="$(gcloud projects describe "$PROJECT_ID" --format='value(projectNumber)')";

# Create a workload identity pool for Doppler
gcloud iam workload-identity-pools create "$POOL_ID" \
  --location="global" \
  --display-name="Doppler";

# Create an OIDC provider in that pool which trusts Doppler's issuer
gcloud iam workload-identity-pools providers create-oidc "$PROVIDER_ID" \
  --location="global" \
  --workload-identity-pool="$POOL_ID" \
  --issuer-uri="https://api.doppler.com" \
  --attribute-mapping="google.subject=assertion.sub" \
  --display-name="Doppler";

# Print the provider resource name to paste into Doppler
echo "//iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$PROVIDER_ID";

principal://iam.googleapis.com/projects/123456789012/locations/global/workloadIdentityPools/doppler/subject/workplace:my-workplace:connection:00000000-0000-0000-0000-000000000000

For Cloud SQL, the Connect Doppler step above happens inside the Add Rotated Secret wizard described in Create the Rotated Secret in Doppler. Once that wizard finishes, come back here and grant the principal the custom role:

PROJECT_ID="$(gcloud config get-value project --quiet)";

# The Role ID of the custom role created above
ROLE_ID="dopplerCloudSQLRotation";

# The IAM principal shown under "Federation Identity" on the Doppler connection page
PRINCIPAL="principal://iam.googleapis.com/projects/.../subject/workplace:...:connection:...";

gcloud projects add-iam-policy-binding "$PROJECT_ID" \
  --member="$PRINCIPAL" \
  --role="projects/$PROJECT_ID/roles/$ROLE_ID";

Service Account Key Authentication

Use this method if you'd rather give Doppler a service account key than set up federation.

GCP Service Account

1. In the GCP console, navigate to Service Accounts
2. Select Create Service Account
3. Name your service account and provide an ID
4. Select Create and Continue
5. Under Grant this service account access to project, select the custom role you created above
6. Select Continue and then select Done

GCP Service Account Key

1. On GCP Service Account page, select the Service Account you just created above
2. Select the Keys tab
3. Select Add Key then Create New Key
4. Leave JSON selected and click Create. You will use the generated key below

Create the Rotated Secret in Doppler

1. Navigate to the Doppler config you would like to add a rotated secret to
2. Click the dropdown next to Add Secret and select Add Rotated Secret

3. Select the engine you'd like to rotate - MySQL, SQL Server, or Postgres
4. Choose how Doppler should authenticate:
   • Workload identity federation — name your integration, then enter the Workload identity provider resource name and Project ID
   • Service account key — name your integration and enter the Service Account key you created above

Cloud SQL Database Details

• Rotated Secret Name: The name of the rotated secret object; it will also prefix each of the secrets that Doppler injects into your config. For example, if DB_USER is entered, the following secrets would be injected into your config:
  • DB_USER_USER_HOST_NAME (MySQL only)
  • DB_USER_DATABASE_INSTANCE
  • DB_USER_DATABASE
  • DB_USER_USERNAME
  • DB_USER_PASSWORD
• Interval: How often your database passwords are rotated
• Database Instance: The name of your database

Users

During the rotation process, Doppler rotates between the database users you provide during the rotation configuration process. By providing the users to Doppler, Doppler doesn't need the ability to create new users - just update user passwords.

There are no requirements related to the users you provide.