Policy: GCP > CIS v5.0 > 1 - Identity and Access Management > 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

Determine if confidential information is stored in your functions in cleartext

For each function, review its build and runtime environment variables (the Variables tab in the Cloud Functions console, or gcloud functions describe <function_name>; buildConfig.environmentVariables and serviceConfig.environmentVariables in the Cloud Functions v2 API) and determine whether any of them hold data that should not be publicly accessible, such as passwords, tokens or keys. Secrets should be referenced through Secret Manager instead (serviceConfig.secretEnvironmentVariables or serviceConfig.secretVolumes).

Determine if the Secret Manager API is enabled for your project

Run gcloud services list within the project and check that the Secret Manager API (secretmanager.googleapis.com) is in the list.

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in GCP > CIS v5.0 > 1 - Identity and Access Management > Maximum Attestation Duration, which by default follows GCP > CIS v5.0 > Maximum Attestation Duration. Set to a blank value to clear the attestation.