Handling secrets in Google App Engine Standard Environment

Question

If I need to store API keys, passwords, or other sensitive information for a Google App Engine app running in the standard environment to access (let's say in order to access third-party services), what are my best options for doing so?

Answer 1

I've heard good things about KMS

https://cloud.google.com/kms/

Easily Encrypt Secrets

Wrap secrets up to 64KiB in size, to allow you to protect secrets like user credentials and API tokens. Take plaintext secrets out of source code, deployment managers, containers, and metadata, and make these accessible to users as well as service accounts via decryption using the Cloud KMS API.