is it safe to store third party api keys in google cloud environment variables? Or Not?

Question

I'm not sure if I am misunderstanding something or if the firebase docs contradict themselves.

Here it seems to suggest to store api keys in in env variables: https://firebase.google.com/docs/functions/config-env For instance, to store the Client ID and API key for "Some Service", you might run: firebase functions:config:set someservice.key="THE API KEY" someservice.id="THE CLIENT ID"

But here it seems to say never to do it: https://firebase.google.com/support/guides/security-checklist#cloud_function_safety Cloud Function safety Never put sensitive information in a Cloud Function’s environment variables Often in a self-hosted Node.js app, you use environment variables to contain sensitive information like private keys. Do not do this in Cloud Functions.

Answer 1

There isn't only one correct answer. Generally, storing a critical/confidential data in plain text is a bad idea. It's better to use dedicated service to store the secret like secret manager.

However, you can imagine these use case:

• Your deployment is automatic and no human can access to your Cloud Functions parameters (and env vars) -> Your secret is kept secure even if in plain text in Cloud Functions env vars
• Your secret is stored in secret manager, but all the team members (and more) have the secret manager accessor role, and everyone can browse and see the secret in plain text. -> Even if you use secret manager, your IAM roles policy breaks the security and the confidentiality of the secret, it's public for everyone!

Think the security globally. There are best practices, but if you focus only on one topic, you can create bigger breach just beside!