feat(secretmanager): Add Cloud SQL managed-rotation samples

secretmanager/snippets/create_secret_with_type.py

@@ -0,0 +1,94 @@
+#!/usr/bin/env python
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+command line application and sample code for creating a new secret with a
+secret type restriction.
+"""
+
+import argparse
+
+# [START secretmanager_create_secret_with_type]
+# Import the Secret Manager client library.
+from google.cloud import secretmanager
+
+
+def create_secret_with_type(
+    project_id: str,
+    secret_id: str,
+    secret_type: secretmanager.Secret.SecretType,
+) -> secretmanager.Secret:
+    """
+    Creates a new secret with the given secret type.
+    Note: CLOUD_SQL_DB_CREDENTIALS is only supported in the regional secret.
+
+    Args:
+        project_id (str): ID of the GCP project.
+        secret_id (str): ID of the secret.
+        secret_type (secretmanager.Secret.SecretType): Secret type restriction to apply.
+
+    Returns:
+        secretmanager.Secret: The created secret.
+    """
+
+    # Create the Secret Manager client.
+    client = secretmanager.SecretManagerServiceClient()
+
+    # Build the resource name of the parent project.
+    parent = f"projects/{project_id}"
+
+    # Create the secret, with the given secret type restriction.
+    response = client.create_secret(
+        request={
+            "parent": parent,
+            "secret_id": secret_id,
+            "secret": {
+                "replication": {"automatic": {}},
+                "secret_type": secret_type,
+            },
+        }
+    )
+
+    # Print the new secret name.
+    print(f"Created secret with secret type: {response.name}")
+
+    return response
+
+
+# [END secretmanager_create_secret_with_type]
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    parser.add_argument("project_id", help="id of the GCP project")
+    parser.add_argument("secret_id", help="id of the secret to create")
+    parser.add_argument(
+        "secret_type",
+        choices=[
+            t.name
+            for t in secretmanager.Secret.SecretType
+            if t.name not in ("SECRET_TYPE_UNSPECIFIED", "CLOUD_SQL_DB_CREDENTIALS")
+        ],
+        help="secret type restriction to apply",
+    )
+    args = parser.parse_args()
+
+    create_secret_with_type(
+        args.project_id,
+        args.secret_id,
+        secretmanager.Secret.SecretType[args.secret_type],
+    )

secretmanager/snippets/get_secret_type.py

@@ -0,0 +1,65 @@
+#!/usr/bin/env python
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+command line application and sample code for getting the secret type of a
+secret.
+"""
+
+import argparse
+
+# [START secretmanager_get_secret_type]
+# Import the Secret Manager client library.
+from google.cloud import secretmanager
+
+
+def get_secret_type(project_id: str, secret_id: str) -> secretmanager.Secret:
+    """
+    Gets the secret type of the given secret.
+
+    Args:
+        project_id (str): ID of the GCP project.
+        secret_id (str): ID of the secret.
+
+    Returns:
+        secretmanager.Secret: The secret, including its secret type.
+    """
+
+    # Create the Secret Manager client.
+    client = secretmanager.SecretManagerServiceClient()
+
+    # Build the resource name of the secret.
+    name = client.secret_path(project_id, secret_id)
+
+    # Get the secret.
+    response = client.get_secret(request={"name": name})
+
+    print(f"Found secret {response.name} with secret type {response.secret_type.name}")
+
+    return response
+
+
+# [END secretmanager_get_secret_type]
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    parser.add_argument("project_id", help="id of the GCP project")
+    parser.add_argument("secret_id", help="id of the secret to get the type of")
+    args = parser.parse_args()
+
+    get_secret_type(args.project_id, args.secret_id)

secretmanager/snippets/regional_samples/create_regional_secret_with_cloud_sql_credentials.py

@@ -0,0 +1,98 @@
+#!/usr/bin/env python
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Command line application and sample code for creating a new secret with type
+CLOUD_SQL_DB_CREDENTIALS, eligible for managed rotation.
+"""
+
+import argparse
+
+# [START secretmanager_create_regional_secret_with_cloud_sql_credentials]
+# Import the Secret Manager client library.
+from google.cloud import secretmanager_v1
+
+
+def create_regional_secret_with_cloud_sql_credentials(
+    project_id: str,
+    location_id: str,
+    secret_id: str,
+) -> secretmanager_v1.Secret:
+    """
+    Creates a new regional secret with type CLOUD_SQL_DB_CREDENTIALS.
+
+    Args:
+        project_id (str): ID of the GCP project.
+        location_id (str): Location of the regional secret, e.g. us-central1.
+        secret_id (str): ID of the secret.
+
+    Returns:
+        secretmanager_v1.Secret: The created secret.
+    """
+
+    # Endpoint to call the regional Secret Manager API.
+    api_endpoint = f"secretmanager.{location_id}.rep.googleapis.com"
+
+    # Create the Secret Manager client.
+    client = secretmanager_v1.SecretManagerServiceClient(
+        client_options={"api_endpoint": api_endpoint},
+    )
+
+    # Build the resource name of the parent project.
+    parent = f"projects/{project_id}/locations/{location_id}"
+
+    # Create the secret.
+    response = client.create_secret(
+        request={
+            "parent": parent,
+            "secret_id": secret_id,
+            "secret": {
+                "secret_type": secretmanager_v1.Secret.SecretType.CLOUD_SQL_DB_CREDENTIALS,
+            },
+        }
+    )
+
+    # Print the new secret name.
+    print(f"Created secret: {response.name}")
+
+    # Grant this identity the Cloud SQL User rotate IAM permissions to enable
+    # managed rotation.
+    print(
+        "Grant the Cloud SQL User rotate IAM permissions to enable managed "
+        f"rotation to: {response.policy_member.iam_policy_uid_principal}"
+    )
+
+    return response
+
+
+# [END secretmanager_create_regional_secret_with_cloud_sql_credentials]
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    parser.add_argument("project_id", help="id of the GCP project")
+    parser.add_argument(
+        "location_id",
+        help="id of the location where secret is to be created; must match "
+        "the Cloud SQL instance's region",
+    )
+    parser.add_argument("secret_id", help="id of the secret to create")
+    args = parser.parse_args()
+
+    create_regional_secret_with_cloud_sql_credentials(
+        args.project_id, args.location_id, args.secret_id
+    )

secretmanager/snippets/regional_samples/enable_regional_secret_managed_rotation.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Command line application and sample code to enable managed rotation of a
+CLOUD_SQL_DB_CREDENTIALS typed secret.
+"""
+
+import argparse
+
+# [START secretmanager_enable_regional_secret_managed_rotation]
+# Import the Secret Manager client library.
+from google.cloud import secretmanager_v1
+
+
+def enable_regional_secret_managed_rotation(
+    project_id: str,
+    location_id: str,
+    secret_id: str,
+    instance_id: str,
+    username: str,
+) -> secretmanager_v1.SecretVersion:
+    """
+    Enables managed rotation of a CLOUD_SQL_DB_CREDENTIALS typed secret.
+    It validates and enables the rotation, adding a version and sets the
+    passed password (optional).
+    Note: AddSecretVersion is disabled on the CLOUD_SQL_DB_CREDENTIALS
+    currently and for any necessary manual rotations please trigger
+    rotate_secret.
+
+    Args:
+        project_id (str): ID of the GCP project.
+        location_id (str): Location of the regional secret, e.g. us-central1.
+        secret_id (str): ID of the secret.
+        instance_id (str): Cloud SQL instance ID (or resource name).
+        username (str): Database user whose password is rotated.
+
+    Returns:
+        secretmanager_v1.SecretVersion: The version created when rotation is enabled.
+    """
+
+    # Endpoint to call the regional Secret Manager API.
+    api_endpoint = f"secretmanager.{location_id}.rep.googleapis.com"
+
+    # Create the Secret Manager client.
+    client = secretmanager_v1.SecretManagerServiceClient(
+        client_options={"api_endpoint": api_endpoint},
+    )
+
+    # Build the resource name of the secret.
+    parent = f"projects/{project_id}/locations/{location_id}/secrets/{secret_id}"
+
+    # Enable managed rotation.
+    response = client.enable_managed_rotation(
+        request={
+            "parent": parent,
+            "cloud_sql_single_user_credentials": {
+                "instance_id": instance_id,
+                "username": username,
+            },
+        }
+    )
+
+    print(f"Enabled managed rotation, created secret version: {response.name}")
+
+    return response
+
+
+# [END secretmanager_enable_regional_secret_managed_rotation]
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    parser.add_argument("project_id", help="id of the GCP project")
+    parser.add_argument("location_id", help="id of location where secret is stored")
+    parser.add_argument(
+        "secret_id",
+        help="id of the Cloud SQL DB credentials secret to enable rotation on",
+    )
+    parser.add_argument(
+        "instance_id",
+        help="bare id of the Cloud SQL instance (no project or region prefix)",
+    )
+    parser.add_argument("username", help="username of the Cloud SQL database user")
+    args = parser.parse_args()
+
+    enable_regional_secret_managed_rotation(
+        args.project_id,
+        args.location_id,
+        args.secret_id,
+        args.instance_id,
+        args.username,
+    )