Methods for protecting service account keys in GCP

[shegde]

we have service account keys under service-account folder ..which has private keys . how can we protect them and what are the possible methods to store the json key files ?

[kolban]

I think my initial answer is to use Google Cloud Secret Manager.  However, to help further, can you clarify "service-account folder" ... is this a local folder/directory on a workstation or somewhere else?  How are the service account keys being used?  Do you have a high level description or diagram showing what needs to be authenticated, where it runs and what it is calling?

[shegde]

By default SA keys will be downloaded in /service-account directory, which is in our workstation and we will be using the json key path in our override files. so if we store the SA keys in google cloud secret manager how are we going to mention the key path in override files or how to access that in out override files?