Skip to main content
emisar

Google Secret Manager version metadata

v0.1.0

Inspect the availability and lifecycle timestamps of one exact global Secret Manager version without reading its payload, listing secrets or versions, or changing state.

1 allowed by default
Pack ID
gcp-secret-manager
Vendor
emisar
OS
linux
Actions
1
Required binaries. Install these binaries on the runner host before using the pack.
bash gcloud curl jq timeout

Install

New to emisar? Follow the quickstart to connect your host and AI agent, then install this pack below. Agents can use its actions through the CLI or MCP.

emisar pack install downloads and checks the pack, then compares its content hash with the --hash below before copying it into the runner's packs directory. The hash identifies the exact pack shown on this page. If the download was changed, the command rejects it. It also reloads a running runner, so you do not need to restart it yourself.

on the runner host 
sudo emisar pack install gcp-secret-manager --hash sha256:9b2458623122648186922e21494e3adb7a7e02fa0076d3e33f209e4f68eead31

Setup

Uses the runner host's gcloud identity and the cloud-platform OAuth scope. On Google Compute Engine, attach a dedicated service account; on another host, use a dedicated workload-identity gcloud configuration. The short-lived bearer is sent through curl stdin, never argv or output.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • CLOUDSDK_CONFIG

    Optional dedicated gcloud configuration directory.

  • CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE

    Optional workload-identity credential configuration created in Google Cloud IAM and supplied to gcloud with auth login --cred-file.

Notes

  • Enable the Secret Manager API. In Google Cloud Console, Secret Manager → the existing secret → Permissions, grant the runner identity a custom role containing only secretmanager.versions.get. Scope the grant to the secrets it operates. Metadata access does not require secretmanager.versions.access or Secret Accessor, and this pack never reads payloads.
  • Requires curl 7.76 or newer and GNU coreutils timeout. One credential read is bounded to ten seconds plus a one-second kill grace; one metadata GET has a 35-second deadline and an independent 64 KiB response cap.
  • The latest alias selects the most recently created version, including a disabled or destroyed version. An ENABLED state describes version state; it does not prove payload access, credential validity or enrollment usability. Missing versions and denied access remain failed actions with HTTP 404 or 403 respectively.
  • Targets use explicit project IDs, secret IDs and latest or positive numeric version IDs up to 32 digits. Global version resource names may return the canonical project number. Regional secrets and arbitrary version aliases are outside this deliberately narrow surface.
  • The fixed HTTPS API request selects only name, state, createTime and destroyTime. There is no endpoint override, host detection, protected-file grant, root requirement, listing or control action.

Verify it works

Runs gcp-secret-manager.version_details, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify gcp-secret-manager

Install and configure a pack walks through the whole sequence on a host.

Actions 1 total

View on GitHub
  • gcp-secret-manager.version_details script low Low: read-only or trivially reversible

    Show Secret Manager version metadata

    Show the resource name, state and creation/destruction timestamps of one global Secret Manager version. Read metadata only; never request or return the secret payload, list resources or change state. The latest alias means most recently created, including disabled and destroyed versions. Missing versions and denied metadata access fail with their provider HTTP codes. An ENABLED state does not prove payload access or that the stored credential is valid. Return a canonical numeric project name when the API supplies one.

    Arguments
    Name Type Required
    project string Yes
    secret string Yes
    version string No

    See the action source for defaults, validation, and limits.

    Link to this action View source on GitHub
← Back to registry
Pack reference  Publish your own