Fivetran External Secret Management with Google Secret Manager Setup Guide

Follow our setup guide to connect your Google Secret Manager to Fivetran to use it as an External Secret Manager.

Prerequisites

To connect your Google Secret Manager to Fivetran, you need the following:

A Google Cloud account with permissions to manage IAM and Secret Manager
A Fivetran account with the Account Administrator role
(Only for Hybrid Deployment) A Hybrid Deployment agent running on Google Kubernetes Engine or a Google Cloud virtual machine

Setup instructions

Select the tab for your deployment model:

Grant Fivetran access to your secrets

For each secret you want Fivetran to access:

Log in to the GCP console and go to Secret Manager.
Select the secret you want to use with Fivetran.
Click Permissions > Grant access.
In the Add principals field, enter the following Fivetran service account: orchestrator-prod-tf@fivetran-donkeys.iam.gserviceaccount.com
In the Assign roles field, select Secret Manager Secret Accessor.
Click Save.

Repeat these steps for each secret you want Fivetran to access.

Configure External Secret Manager in Fivetran

In the Fivetran dashboard, go to Account Settings > General > External Secrets Managers.
Click Create new secrets manager.
Select SaaS Deployment and Google Secret Manager.
Provide the following:
- Secret Manager Name: An internal name for this secrets manager in Fivetran.
- GCP Project ID: The ID of the Google Cloud project that contains your secrets.
Click Add secrets manager.

This guide assumes your Hybrid Deployment agent is running on Google Kubernetes Engine or a Google Cloud virtual machine.

Create a Google Cloud service account

Log in to the GCP console and go to IAM & Admin > Service Accounts.
Click Create service account.
Enter a name and optional description and click Create and continue.
Click Done. Make a note of the service account email address. You will need it in the following steps.

Link the service account to your Hybrid Deployment agent

Follow the instructions for the environment where your Hybrid Deployment agent is running:

Verify that your Google Kubernetes Engine cluster has Workload Identity enabled. If not, follow the Google documentation to enable it.
In the GCP console, go to IAM & Admin > Service Accounts and select the service account you created.
Click Permissions > Grant access.
Enter your service account email in the Add principals field.
Select Workload Identity User as the role and click Save.
In your terminal, run the following command to link your Google Cloud service account to the Kubernetes service account used by your Hybrid Deployment agent. Replace <namespace> with the namespace your agent runs in:
```
kubectl annotate serviceaccount hd-job-sa -n <namespace> \
  iam.gke.io/gcp-service-account=<service_account_email>
```

In the GCP console, go to Compute Engine > VM instances.
Select your VM instance and click Stop to stop it.
Click Edit.
Scroll to the Identity and API access section and replace the default service account with the service account you created.
Select Allow full access to all Cloud APIs.
Click Save.
Start your VM instance again.

Grant the service account access to your secrets

For each secret you want Fivetran to access:

In the GCP console, go to Secret Manager.
Select the secret you want to use with Fivetran.
Click Permissions > Grant access.
In the Add principals field, enter the service account email you created.
In the Assign roles field, select Secret Manager Secret Accessor.
Click Save.

Repeat these steps for each secret you want Fivetran to access.

Alternatively, you can assign the Secret Manager Secret Accessor role to the service account at the project level in IAM & Admin > IAM. This grants access to all secrets in the project.

Configure External Secret Manager in Fivetran

In the Fivetran dashboard, go to Account Settings > General > External Secrets Managers.
Click Create new secrets manager.
Select Hybrid Deployment and Google Secret Manager.
Provide the following:
- Secret Manager Name: An internal name for this secrets manager in Fivetran.
- GCP Project ID: The ID of the Google Cloud project that contains your secrets.
Click Add secrets manager.

Creating secrets in Google Secret Manager

Once your External Secret Manager is configured, you can create secrets by going to Secret Manager in the GCP console and clicking Create secret.

When setting up a connection or destination that uses ESM, enter the secret name (as shown in Google Secret Manager) in the corresponding ESM key field in the dashboard, not the secret value itself.