Google Announces Cloud Functions’ Native Integration with Secret Manager
3272
Of your peers have already read this article.
2:00 Minutes
The most insightful time you'll spend today!
Google Cloud Functions provides a simple and intuitive developer experience to execute code from Google Cloud, Firebase, Google Assistant, or any web, mobile, or backend application. Oftentimes that code needs secrets—like API keys, passwords, or certificates—to authenticate to or invoke upstream APIs and services.
While Google Secret Manager is a fully-managed, secure, and convenient storage system for such secrets, developers have historically leveraged environment variables or the filesystem for managing secrets in Cloud Functions. This was largely because integrating with Secret Manager required developers to write custom code… until now. We listened to customer feedback and today we are announcing Cloud Functions has a native integration with Secret Manager!
This native integration has many key benefits including:
- Zero required code changes. Cloud functions that already consume secrets via environment variables or files bundled with the source upload simply require an additional flag during deployment. The Cloud Functions service resolves and injects the secrets at runtime and the plaintext values are only visible inside the process.
- Easy environment separation. It’s easy to use the same codebase across multiple environments, e.g., dev, staging, and prod, because the secrets are decoupled from the code and are resolved at runtime.
- Supports the 12-factor app pattern. Because secrets can be injected into environment variables at runtime, the native integration supports the 12-factor pattern while providing stronger security guarantees.
- Centralized secret storage, access, and auditing. Leveraging Secret Manager as the centralized secrets management solution enables easy management of access controls, auditing, and access logs.
Cloud Functions’ native integration with Secret Manager is available in preview to all Google Cloud customers today. Let’s take a deeper dive into this new integration.
Example
Suppose the following cloud function invoked via HTTP uses a secret token to invoke an upstream API:
const https = require('https');const token = process.env.TOKEN;exports.secretDemo = (req, res) => {https.get(`https://upstream-api.example.com?token=${token}`, (innerRes) => {innerRes.on('end', () => { res.send('OK') });}).on('error', (err) => {res.send(`Error: ${err}`);});}
Without Cloud Functions’ native integration with Secret Manager, this function is deployed via:
$ gcloud functions deploy "secretDemo" \--runtime "nodejs14" \--trigger-http \--allow-unauthenticated \--set-env-vars "TOKEN=abcd1234"
This approach has a number of drawbacks, the biggest of which being that anyone with viewer permissions on the Google Cloud project can see the environment variables set on a cloud function.
To improve the security of this code, migrate the secret to Secret Manager in the same project:
$ gcloud secrets create "token" \--replication-policy "automatic" \--data-file - <<< "abcd1234"
Finally, without changing any code in the function re-deploy with slightly different flags:
$ gcloud beta functions deploy "secretDemo" \--runtime "nodejs14" \--trigger-http \--allow-unauthenticated \--set-secrets "TOKEN=my_token:latest"
It’s truly that easy to migrate from hard-coded secrets to using secure secret storage with Secret Manager! To add even more layers of security, consider running each cloud function with a dedicated service account and practice the principle of least privilege. Learn more in the Secret Manager Best Practices guide.
Making security easy
Security and proper secrets management are core pillars of modern software development, and we’re excited to provide customers a way to improve the security of their cloud functions. To learn more about the new native integration, check out the Cloud Functions documentation. You can also learn more about Cloud Functions or learn more about Secret Manager.
5325
Of your peers have already watched this video.
31:30 Minutes
The most insightful time you'll spend today!
Enhancing Collaboration with Sheets, Python, and Google Cloud
See how you can enhance collaboration within your organization using Google Sheets. Watch to learn about a new set of tools to create custom functions that tap into the power of Python and to expose functions in a standardized fashion throughout your organization.
ANZ Bank Trusts Apigee to Deliver Secure and Compliant API Strategy
3040
Of your peers have already read this article.
3:30 Minutes
The most insightful time you'll spend today!
ANZ Bank is one of Australia’s top four banks and the largest bank in New Zealand by market capitalization. Headquartered in Melbourne, Victoria, we operate in more than 32 markets across Australia, New Zealand, Asia, Pacific, Europe, America and the Middle East. Our Payment team deals with all payment transaction types by providing highly secure, mission critical payment services to retail, institutional and international customers. The core payment platform is based on microservices architecture to support discreet payment processing requirements such as continuous volume growth, industry service level agreement (SLA) and complex payment orchestration and more. The API platform leverages APIs to perform specific business functions under the payment orchestration layer, which need to be resilient, scalable and heavy on security controls.
Simplifying our technology landscape
At ANZ, our mission is to improve the financial wellbeing and sustainability of our customers through reliable payment services. Over the past 12 months, we looked to simplify our technology landscape, to free up time so we could focus on implementing more customer-focused banking services. We needed an API management solution that would align to our API-first strategy, while also maintaining our high performance, security, and regulatory standards.
Specifically, the solution needed to:
- Simplify channel interactions with our platform;
- Improve developer experience and enable self-service;
- Ensure resilient fault tolerance;
- Improve our payment API security posture;
- Enable API-first digital enablement for both our internal and external payments customers;
- Have a scalable and transparent pricing model that ensured sustainable API programme growth.
Core focus on security and compliance
To meet our security and regulatory compliance standards an API solution would need to offer functionality including:
- Providing coarse-grained and fine-grained authorization and domain specific entitlements for API requests;
- Bundling APIs based on the nature of the channel;
- Integrating easily with established identity providers;
- Establishing patterns for connecting trusted upstream and downstream systems;
- Providing support for the industry standard OAuth 2.0 authorization protocol as per enterprise security standards.
We reviewed Apigee against other API management solutions and gateways, and determined it was the best fit for our needs. Not only did Apigee deliver on all our mission-critical requirements, but it also provided strong ease of use, feature-completeness and support for multiple coding languages.
Enabling smooth developer onboarding, processes and troubleshooting
Using Apigee has greatly improved developer onboarding and reduced the tedious steps involved in knowledge transfer and upskilling. The platform is easy for developers to use, and is backed by great documentation and video resources. These resources provide clear guidance about how to execute certain processes and troubleshoot as needed.
Overall, Apigee has delivered the features we need to manage the publication and consumption of APIs efficiently. We are now running eighteen APIs in production, including two APIs that enable payments through connection to our transaction database, and others that enable supporting services in the payment services platform team.
Our engineers and testers have found it easy to use the interface and Apigee API Management to deploy and test proxies. In addition, out of the box policies allow for fine-grained access control to handle and build proxies of varying degrees of complexity. These policies allow us to control security, manage traffic, mediate transformations and implement custom functionality via scripts.
We can now implement our fine-grained entitlement-based access control requirements, onboard new customers to the cloud and streamline payment channel onboarding. With Apigee, we are also integrating with other API management tools at the bank, in part to enable self-service for API providers and consumers by building a developer portal.
Thanks to Apigee, we are well positioned to adopt a decentralized API team model that will see different teams within payments and beyond create APIs, and ramp up to full production of our API-centric model in the near future. This is a key component of the bank’s broader cloud and API-first strategy that is designed to help ANZ become a more agile and adaptive technology organization. With the right components in place, can we help ANZ create opportunities and propositions that colleagues and customers love, ultimately helping ANZ realize its vision across Australia, New Zealand and international markets.
2,602 Uses of AI for Social Good, and What We Learned from Them
5246
Of your peers have already read this article.
12:30 Minutes
The most insightful time you'll spend today!
For the past few years, we’ve applied core Google AI research and engineering to projects with positive societal impact, including forecasting floods, protecting whales and predicting famine. Artificial intelligence has incredible potential to address big social, humanitarian and environmental problems, but in order to achieve this potential, it needs to be accessible to organizations already making strides in these areas. So, the Google AI Impact Challenge, which kicked off in October 2018, was our open call to organizations around the world to submit their ideas for how they could use AI to help address societal challenges.
“Accelerating social good with artificial intelligence” sheds light on the range of organizations using AI to address big problems. It also identifies several trends around the opportunities and challenges related to using AI for social good. Here are some of the things we learned—check out the report for more details.
AI is globally relevant
We received 2,602 applications from six continents and 119 countries, with projects addressing a wide range of issue areas, from education to the environment. Some of the applicants had experience with AI, but 55 percent of not-for-profit organizations and 40 percent of for-profit social enterprises reported no prior experience with AI.
Similar projects can benefit from shared resources
When we reviewed all the applications, we saw that many people are trying to tackle the same problems and are even using the same approaches to do so. For example, we received more than 30 applications proposing to use AI to identify and manage agricultural pests. The report includes a list of common project submissions, which will hopefully encourage people to collaborate and share resources with others working to solve similar problems.
You don’t need to be an expert to use AI for social good
AI is becoming more accessible as new machine learning libraries and other open-source tools, such as Tensorflow and ML Kit, reduce the technical expertise required to implement AI. Organizations no longer need someone with a deep background in AI, and they don’t have to start from scratch. More than 70 percent of submissions, across all sectors and organization types, used existing AI frameworks to tackle their proposed challenge.
Successful projects combine technical ability with sector expertise
Few organizations had both the social sector and AI technical expertise to successfully design and implement their projects from start to finish. The most comprehensive applications established partnerships between nonprofits with deep sector expertise, and academic institutions or technology companies with technical experience.
ML isn’t the only answer
Some problems can be addressed by using alternative methods to AI—and result in faster, simpler and cheaper execution. For example, several organizations proposed using machine learning to match underserved populations to legal knowledge and tools. While AI could be helpful, similar results could be achieved through a well-designed website. While we’ve seen the impact AI can have in solving big problems, you shouldn’t rule out more simple approaches as well.
Global momentum around AI for social good is growing—and many organizations are already using AI to address a wide array of societal challenges. As more social sector organizations recognize AI’s potential, we all have a role to play in supporting their work for a better world.
3568
Of your peers have already downloaded this article
2:30 Minutes
The most insightful time you'll spend today!
After undergoing an agile transformation, ING realized it needed a standardized platform to support the work their developers were doing. “Our DevOps teams got empowered to be autonomous,” says Thijs Ebbers, Infrastructure Architect.
“It has benefits, you get all kinds of ideas. But a lot of teams are going to devise the same wheel. Teams started tinkering with Docker, Docker Swarm, Kubernetes, Mesos. Well, it’s not really useful for a company to have one hundred wheels, instead of one good wheel,” Ebbers added.
Using Kubernetes for container orchestration and Docker for containerization, the ING team began building an internal public cloud for its CI/CD pipeline and green-field applications. The pipeline, which has been built on Mesos Marathon, will be migrated onto Kubernetes.
The bank-account management app Yolt in the U.K. (and soon France and Italy) market already is live hosted on a Kubernetes framework. At least two greenfield projects currently on the Kubernetes framework will be going into production later this year. By the end of 2018, the company plans to have converted a number of APIs used in the banking customer experience to cloud-native APIs and host these on the Kubernetes-based platform.
“Cloud native technologies are helping our speed, from getting an application to test to acceptance to production,” says Infrastructure Architect Onno Van der Voort. “If you walk around ING now, you see all these DevOps teams, doing stand-ups, demoing. They try to get new functionality out there really fast.”
Find out how.
A Run-through of an Innovative 2021 with Apigee
3392
Of your peers have already read this article.
1:30 Minutes
The most insightful time you'll spend today!
Apigee is committed to continually innovating new capabilities and solutions for our customers, and 2021 saw new product launches, partnerships, and best practices for managing your expanding range of business-critical use cases. Here are some of our favorite stories from 2021.
Spotting the trends in APIs
Our State of API Economy 2021 Report surveyed over 700 IT leaders globally and identified five key API trends that emerged post-COVID. SaaS and hybrid cloud-based API deployments are increasing with half of all respondents reporting increases in these areas, and AI- and ML-powered API management is also gaining traction, with usage growing 230% year-over-year among Apigee customers. Business metrics like Net Promoter Score (NPS) and speed-to-market are API users’ preferred way to measure success, and API ecosystems are increasingly innovation drivers, with high-maturity organizations much more likely to focus on building a developer ecosystem or B2B partner ecosystem around their API. Finally, API security and governance is more important than ever, as research showed that increased investment in security and governance was a high priority. Check out the blog to explore these five trends in more detail.
Launching new capabilities with Apigee X
We announced Apigee X, our next-generation platform that brings the powerful scale of Google technologies to Apigee API Management and allows enterprises to power API programs for enhanced scale, security, and automation. Apigee X customers can harness the capabilities of Cloud CDN to maximize the availability and performance of APIs across the globe, deploying across more than two dozen Google Cloud regions and enhancing caching at over 100 locations. Apigee X customers can apply solutions like Cloud Armor web application firewall for enhanced API security and Cloud Identity and Access Management (IAM) for authenticating and authorizing access to the Apigee platform. Apigee X also enhances automation by applying Google Cloud’s AI and ML capabilities to historical API metadata to detect anomalies, predict traffic, and ensure compliance. To read more about these features, check out our blogs on Apigee X and Cloud Armor, Apigee X and Cloud CDN, and Apigee X and AI.
Making new connections with Apigee Integration
Apigee brought our successful API-first approach to integration this year with the release of Apigee Integration. This silo-busting solution lets customers connect existing data and applications, and surface them as easily accessible APIs. Apigee Integration brings together the best of API management and integration into one unified platform so IT teams can scale their operations, improve developer productivity, and increase the speed to market. The platform comes with built-in connectors to Salesforce, Cloud SQL (MySQL, PostgreSQL), Cloud Pub/Sub and BigQuery, with connectors for additional third-party applications and databases on their way. Advanced integration patterns also serve our customers with even more use cases. Check out our launch blog and our Next session video for more details.
Managing GraphQL APIs with Apigee
The exponential rise in digital services adoption among enterprises now generates petabytes of data every minute. You can harness the power of this data with query languages like GraphQL, accessing the data your app needs with one single request. The growing popularity of GraphQL APIs and their business-critical use cases mean it’s important to manage them with full life cycle capabilities, much like you manage your REST APIs. Last year we compared REST and GraphQL and introduced best practices for managing GraphQL APIs. You can also read our blog announcing Apigee’s support for the management of GraphQL APIs, and our partnership with StepZen to deliver these capabilities. To dive deeper into building GraphQL APIs, check out our Next session video.
Looking back at the year’s top stories
2021 was the year of the customer, and we published the following stories to show how API management helps enterprises modernize their applications, build digital ecosystems, and generate value for their customers and their own organizations:
- Telco:
- Retail:
- Financial services:
- Energy:
That’s a wrap for 2021! We hope you have a safe and happy holiday season, and we can’t wait to see what the new year brings for us. Stay tuned in 2022 for product launch announcements, partnerships, tips, and stories of how organizations like yours are innovating with Apigee.
More Relevant Stories for Your Company
Learn Modern App Development Practices to Ship Software Faster
Cloud-native, Kubernetes, Serverless have been the hottest and most widely discussed topics given the velocity and agility benefits. Learn more about how you can leverage these modern app development practices to ship software faster, while reducing costs and improving security and compliance. Learn how Google Cloud lets you modernize existing
Deploying Ray on GKE: Distributed Computing Made Easy
The rapidly evolving landscape of distributed computing demands efficient and scalable frameworks. Ray.io is an open-source framework to easily scale up Python applications across multiple nodes in a cluster. Ray provides a simple API for building distributed, parallelized applications, especially for deep learning applications. Google Kubernetes Engine (GKE) is a managed container orchestration
How This Leading Trading Company Uses APIs to Build Fintech Apps Quickly and Cost-Effectively
Tradier uses the Apigee API management platform from Google to abstract the legacy complexities of capital markets so that developers can build FinTech applications in an agile, nimble, and quick fashion at minimal cost. The company embodies the evolution of what cloud technology can enable in the form of an API-first business delivered
A Road to Possibilities: Google Maps Platform Website
For more than 15 years, developers have used Google Maps Platform to deliver location-based experiences to their end users and used location intelligence to optimize their businesses. Along this journey, we’ve made a variety of changes to better support our community as needs have changed and new industries and technologies
