Manage access to Secrets Manager

Last update: October 05 2026Open in Markdown

Access to Secrets Manager is governed by:

• projects — define access within an isolated group of resources;
• roles — define access of control panel users, service users, and groups within an account and a project.

Access within projects

All secrets in Secrets Manager are added to a specific project. You can group secrets by different projects and configure user permissions based on which projects they need access to.

Access within roles

Access to Secrets Manager is granted by Secrets Manager roles and global roles. For more information about role types, see the Role reference guide.

Role group	Role	Access
Secrets Manager roles	secrets.admin	Secrets management
	secrets.viewer	Viewing secrets
	secrets.consumer	Viewing and using secrets
Global roles	member	Management of Secrets Manager and other products, account, billing, and projects
	iam.admin	Management of access to Secrets Manager and other products
	iam.viewer	Viewing access to Secrets Manager and other products
	reader	Viewing secrets of Secrets Manager and all products, account, billing, and projects

Secrets Manager roles

secrets.admin

The secrets.admin role gives access to managing secrets in Secrets Manager.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available operations in Secrets Manager	In the Account access scope: managing secrets (adding, deleting) in all projects; managing secret versions (adding, changing the current version, deleting) in all projects; viewing secret content in all projects
	In the Project access scope: managing secrets (adding, deleting) in your project; managing secret versions (adding, changing the current version, deleting) in your project; viewing secret content in your project

secrets.viewer

The secrets.viewer role gives access to viewing everything managed by secrets.admin.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available operations in Secrets Manager	In the Account access scope: viewing the list of secrets and information about them, excluding secret content, in all projects
	In the Project access scope: viewing the list of secrets and information about them, excluding secret content, in your project

secrets.consumer

The secrets.consumer role gives access to viewing and using secrets in Secrets Manager.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available operations in Secrets Manager	In the Account access scope: viewing the list of secrets and information about them in all projects; viewing secret content in all projects
	In the Project access scope: viewing the list of secrets and information about them in your project; viewing secret content in your project

Global roles

member

The member role gives full access to all services. Does not give access to managing control panel users, service users, user groups, and federations.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available operations in Secrets Manager	In the Account access scope: managing secrets (adding, deleting) in all projects; managing secret versions (adding, changing the current version, deleting) in all projects; viewing secret content in all projects
	In the Project access scope: managing secrets (adding, deleting) in your project; managing secret versions (adding, changing the current version, deleting) in your project; viewing secret content in your project

iam.admin

The iam.admin role gives access to managing users and does not give access to managing the product and billing. It does not allow managing your own account: changing permissions, managing notifications, deleting the user. The first user with the iam.admin role is created by the Account Owner.

Access scopes	Account
Who can be assigned	users; service users; user groups
Available operations in Secrets Manager	Manage control panel users, service users, and user groups

iam.viewer

The iam.viewer role gives access to viewing everything managed by iam.admin.

Access scopes	Account
Who can be assigned	users; service users; user groups
Available operations in Secrets Manager	View control panel users, service users, and user groups

reader

The reader role gives access to viewing everything managed by member in the same scope.

Access scopes	account; project
Who can be assigned	users; service users; user groups
Available operations in Secrets Manager	In the Account access scope: viewing the list of secrets and information about them, excluding secret content, in all projects
	In the Project access scope: viewing the list of secrets and information about them, excluding secret content, in your project