The request came through. A change in production. A database query that must run now—but the credentials are locked tight.
GCP database access security is not a checkbox. It is a system of gates, policies, and cryptographic proofs. Moving between code and cloud requires more than simple permissions. It demands precise control over identity, service accounts, and key rotation. With Git checkout in play, the workflow becomes a chain: source control holds the changes, GCP holds the data, and the bridge between them must be hardened.
Start with IAM. Define roles at the narrowest possible scope. Avoid granting broad access to entire projects when only one dataset is needed. Attach service accounts to workloads, not individuals, and enforce short-lived credentials.
Use Secret Manager to store and deliver database passwords or certificates. Integrate retrieval into CI/CD pipelines triggered after Git checkout. This keeps secrets out of code and config files. Rotate them automatically. Audit the access logs. Every read or write against the database should have a trace.