title: Accessing Google Secrets from an application running on a Google Cloud VM instance - Assigning Cloud APIs to VM
body: <p>I'm using Google Secrets to store API keys and other application specific &quot;secrets&quot;. When I deploy my application to a VM instance using a docker container, I want it to access the Google Secrets using the VM's associated service account.</p>
  <p>I have gotten this working using the following:</p>
  <ul>
  <li>Assigning the &quot;Secret Manager Secret Accessor&quot; permission to the Service Account.<a href="https://i.stack.imgur.com/7ZjXv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7ZjXv.png" alt="enter image description here" /></a></li>
  <li>Giving my VM access to all APIs:</li>
  <li><a href="https://i.stack.imgur.com/Ld8KS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Ld8KS.png" alt="enter image description here" /></a></li>
  </ul>
  <p>From a security perspective and recommended best practice, I don't want to give access to all APIs. The default access option doesn't work and I can't figure out from the list which options to enable to allow access to Google Secrets from my VM.</p>
  <p><a href="https://i.stack.imgur.com/UURhr.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/UURhr.png" alt="enter image description here" /></a></p>
  <p>TLDR - Which Cloud API(s) do I need to give my Google Compute VM instance access to so that it can access  Google Secrets without giving it access to all of the Cloud APIs?</p>