> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/3.0/harness-platform-resources/secrets/secrets-management/add-google-kms-secrets-manager.md).

# Add Google KMS as a Harness secret manager

You can use Google [Cloud Key Management Service](https://cloud.google.com/security-key-management) (Cloud KMS) as a Harness Secret Manager. Once Google KMS is added as a secret manager, you can create encrypted secrets in Google KMS and use them in your Harness account.

This topic describes how to add a Google KMS Secret Manager in Harness.

#### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

* [Harness' key concepts](/harness-ai/new-to-harness-platform/overview.md)
* [Harness Secret Manager Overview](/harness-ai/use-harness-platform/secrets/secrets-management/harness-secret-manager-overview.md)
* [Store authentication credentials](/harness-ai/use-harness-platform/secrets/secrets-management/store-authentication-credentials.md)

#### Add a Secret Manager <a href="#add-a-secret-manager" id="add-a-secret-manager"></a>

To add Google KMS as a secret manager, you’ll need to set up a Harness Project. If you haven't already, refer to [Create Organizations and Projects](/harness-ai/new-to-harness-platform/get-started.md#create-an-organization).

You can add connectors from any module in your Project under Project Setup, or in your Organization or Account Resources:

1. In **Connectors**, select **Connector**.
2. Under **Secret Managers**, select **GCP KMS**.

**GCP Key Management Service Settings**

Basic Information:

* **Name**: Enter a unique name for the secret manager.
* **ID**: Harness will auto-generate an ID based on the name. You can edit this ID during initial setup but not after saving.
* **Description**: Optional description of the secret manager.
* **Tags**: Tag the secret manager for easy search and organization.

#### Details Settings <a href="#details-settings" id="details-settings"></a>

To obtain the values for the Details settings, you'll need a Google Cloud Symmetric Key.

1. In the [Google Cloud Console](https://console.cloud.google.com/), select your project.
2. Select **Security** > **Key** **Management**.
3. Select/create a key ring. Select/create a key in the key ring.
4. To create resources in this or the next step, go to Google Cloud's [Creating Symmetric Keys](https://cloud.google.com/kms/docs/creating-keys) topic. Open the Actions menu (⋮), and then select **Copy Resource Name**.
5. A reference to the key is now on your clipboard.

   Paste the reference into an editor. You can now copy and paste its substrings into each of the Harness Secret Manager's **Details** settings as shown below.

#### Configure Credentials <a href="#configure-credentials" id="configure-credentials"></a>

Harness supports two credential types for authenticating with Google KMS: Service Account Key and OpenID Connect (OIDC). Follow the steps below to configure the appropriate credentials for your setup.

**1. Service Account Key**

To configure a Service Account Key for Google KMS in Harness, refer to our [Service Account Key Setup Guide](/harness-ai/use-harness-platform/connectors/cloud-providers/ref-cloud-providers/gcs-connector-settings-reference.md#specify-credentials-here). This guide covers all steps for creating and downloading the key file, uploading it to Harness, and attaching it to the GCP KMS connector.

**Permissions Required**: To use the Service Account Key with Google KMS, ensure the following role is assigned to the service account in Google Cloud:

* **Cloud KMS CryptoKey Encrypter/Decrypter** (`roles/cloudkms.cryptoKeyEncrypterDecrypter`): Allows the service account to encrypt and decrypt data using KMS keys.
  * In Google Cloud Console, go to **IAM & Admin > IAM**.
  * Locate your service account, select Edit, and add the **Cloud KMS CryptoKey Encrypter/Decrypter** role.

**2. OpenID Connect (OIDC)**

For setting up OIDC, refer to our [OIDC Setup Guide](/harness-ai/use-harness-platform/connectors/cloud-providers/ref-cloud-providers/gcs-connector-settings-reference.md#use-openid-connect-oidc) for detailed steps on configuring a workload identity pool and identity provider with Harness.

**Permissions Required**: When using OIDC with Google KMS, ensure the identity provider in Google Cloud is granted the following permissions:

* **Cloud KMS CryptoKey Encrypter/Decrypter** (`roles/cloudkms.cryptoKeyEncrypterDecrypter`): Grants encryption and decryption access to KMS keys within Google Cloud.
  * In **IAM & Admin > Workload Identity Federation**, select your identity pool.
  * Assign the **Cloud KMS CryptoKey Encrypter/Decrypter** role to the identity provider associated with the workload identity pool.

#### Set up delegates <a href="#set-up-delegates" id="set-up-delegates"></a>

In **Delegates** **Setup**, use [**Selectors**](/harness-ai/use-harness-platform/delegates/delegate/manage-delegates/select-delegates-with-selectors.md#option-select-a-delegate-for-a-connector-using-tags) to select any specific delegates that you want this Connector to use. Select **Save and Continue**.

#### Test Connection <a href="#test-connection" id="test-connection"></a>

In **Connection Test**, select **Finish** after your connection is successful.