---
title: "Using Secret Manager"
slug: "secretmanager-use"
updated: 2026-10-08T06:58:38Z
published: 2026-10-08T06:58:38Z
canonical: "guide.ncloud-docs.com/secretmanager-use"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using Secret Manager

Available in VPC

To create and manage secrets in Secret Manager, configure console access permissions first. For details about permissions, see [Secret Manager permissions management](/docs/en/secretmanager-subaccount) and the [Sub Account user guide](https://guide.ncloud-docs.com/docs/en/subaccount-overview).

## Secret Manager interface

The Secret Manager interface includes the following components:

![SECM_screen_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/SECM_screen.png?sv=2026-02-06&spr=https&st=2026-10-27T17%3A38%3A23Z&se=2026-10-27T18%3A38%3A23Z&sr=c&sp=r&sig=kSurKmHh0uTV%2BjjylyHxC2Mgb2N3lTf%2Fy%2FLrCeLrHAk%3D)

| Component | Description |
| --- | --- |
| ① Menu name | Service name and total number of secrets. |
| ② Basic features | Create secrets, view service details, and refresh the page. |
| ③ Secret list | Check the secret type and secret list. |
| ④ Detailed features | Check basic information, secret values, and logs. |
| ⑤ Detailed information on and features of secrets | Change secret information and status, request deletion, and change protection keys. |
| ⑥ Rotation information | Execute secret rotation and check the setting information. |

## Create a secret

To create a secret:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Secret Manager** > **Secret**.
2. In **(1) Enter basic secret information**, select the secret name and protection key.
3. In **(2) Set rotation**, choose whether to enable automatic rotation and select the rotation interval and trigger. The rotation interval and trigger are required only when automatic rotation is enabled. If there is no trigger, create a Cloud Functions trigger. For details about creating a trigger, see [Cloud Functions - Secret Manager type trigger](https://guide.ncloud-docs.com/docs/en/cloudfunctions-secretmanager-vpc).
4. Configure the secret in **Enter secret value**. A secret has key-value properties and is configured in the JSON format. (A secret supports up to 100 key-value pairs, and the maximum secret value size is 10,000 bytes.) Set at least 1 rotation target. For details about rotation targets, see [Secret rotation](/docs/en/secretmanager-use#%EC%8B%9C%ED%81%AC%EB%A6%BF%EA%B5%90%EC%B2%B4).
5. Review **Final confirmation** and complete secret creation.

              Note

              

A common use case is to store database connection information and retrieve it when an application loads. Enter the credentials for a database you have already configured as the secret value. If the target for the secret is NAVER Cloud Platform Cloud DB, see the following secret configuration example. For examples of secret rotation, see [Secret rotation action](/docs/en/secretmanager-rotate-action).

| DBMS | Required properties |
| --- | --- |
| MySQL | Host, Port, Username, Password |
| MSSQL | Host, Port, Username, Password |
| PostgreSQL | Host, Port, Username, Database, Password |

```
# JSON format example
{
    "cdbUser" : "test",
    "cdbPassword" : "test123",
    "cdbHost" : "db-c89**-**.cdb.ntruss.com",
    "cdbPort" : "3306",
    "cdbDatabase" : "test_db"
}
```

## View secret information

Check the secret list and secret type.

1. In the VPC environment of the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Secret Manager** > **Secret**.
2. When the secret list appears, check the type and name of the secret, or click the secret to see the details.  

![SECM_info2_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/SECM_info2.png?sv=2026-02-06&spr=https&st=2026-10-27T17%3A38%3A23Z&se=2026-10-27T18%3A38%3A23Z&sr=c&sp=r&sig=kSurKmHh0uTV%2BjjylyHxC2Mgb2N3lTf%2Fy%2FLrCeLrHAk%3D)
  - **Secret name**: The unique name of the secret.
  - **Status**: The status of the secret. For more information, see [Manage secret status](/docs/en/secretmanager-use#%EC%8B%9C%ED%81%AC%EB%A6%BF%EC%83%81%ED%83%9C%EA%B4%80%EB%A6%AC).
  - **Secret ID**: The unique identifier of the secret. Used to identify the secret in API calls.
  - **Protection key (key tag)**: The encryption key that protects the secret. It is managed in Key Management Service for encryption and decryption.
    - Default key (Secret Manager Default Key): A key managed directly by Secret Manager for each user. This key is also managed through Key Management Service, but you cannot view or manage it directly.
    - User-managed key (User Managed Key): A key you create and manage directly in Key Management Service. See User-managed key in [Key Management Service concepts](https://guide.ncloud-docs.com/docs/en/kms-info).
  - **Creation date**: When the secret was created.
  - **Description**: Additional information and a description of the secret.

### Secret value

A secret contains a password used as a credential. This is called the secret value. Secret values are hidden by default to minimize unintended exposure. To view and edit secret values:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Secret Manager** > **Secret**.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. Click the **Secret value** tab.
4. Secret values are not displayed by default. To check the secret value, click **See secret value**.
5. After editing the secret value, click Save to apply your changes.

              Caution

              

Editing a secret value in Secret Manager does not guarantee that the password in use is changed. For example, if Secret Manager manages the ID and password for a MySQL database as a secret, editing the secret value does not change the actual database password.

#### Secret chain

Secret Manager manages rotated secret values through internal states called **stages**, based on their rotation history. As rotation progresses, secret values are retained in chronological order. This sequence is called a **secret chain**.

![SECM_04_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/SECM_04.png?sv=2026-02-06&spr=https&st=2026-10-27T17%3A38%3A23Z&se=2026-10-27T18%3A38%3A23Z&sr=c&sp=r&sig=kSurKmHh0uTV%2BjjylyHxC2Mgb2N3lTf%2Fy%2FLrCeLrHAk%3D)

The **ACTIVE** stage contains the secret value currently in use. The immediately preceding value is retained in the **PREVIOUS** stage, and the value before that is retained in the **SUSPENDED** stage. When a new rotation starts, the newly generated secret value is added to the **PENDING** stage until rotation completes. This process is called **chain shifting**.

![SECM_05_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/SECM_05.png?sv=2026-02-06&spr=https&st=2026-10-27T17%3A38%3A23Z&se=2026-10-27T18%3A38%3A23Z&sr=c&sp=r&sig=kSurKmHh0uTV%2BjjylyHxC2Mgb2N3lTf%2Fy%2FLrCeLrHAk%3D)

As shown in the secret chain transition diagram above, PENDING remains empty after rotation completes successfully. Normally, only the ACTIVE stage is used; however, PENDING or PREVIOUS stages may have to be applied depending on the progress of the rotation action. If a secret retrieval call during rotation returns a chain that includes PENDING, you can troubleshoot by retrying values in the order **ACTIVE -> PENDING**.

### View usage logs

All access actions to secrets are saved in Cloud Log Analytics as logs. To view secret usage history:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Secret Manager** > **Secret**.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. Click the **Check logs** tab.
4. Enter a search period or keyword to search logs.

## Manage secret status

### Secret status

Secret Manager manages secrets in a series of statuses, from their creation to deletion. The following diagram shows the sequence of secret states, known as the secret lifecycle.

![SECM_03_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/SECM_03.png?sv=2026-02-06&spr=https&st=2026-10-27T17%3A38%3A23Z&se=2026-10-27T18%3A38%3A23Z&sr=c&sp=r&sig=kSurKmHh0uTV%2BjjylyHxC2Mgb2N3lTf%2Fy%2FLrCeLrHAk%3D)

The secret lifecycle includes these states: Initial creation, available, temporarily suspended, rotation in progress, pending deletion, and final deletion. Each status of a secret is described as follows:

- Creation When a secret is created, it receives a unique identifier. Its value is encrypted with the designated protection key and saved in encrypted storage. Once creation is complete, the secret automatically becomes available.
- Available The secret is operating normally and can be viewed or rotated. You can suspend it temporarily or request to delete it.
- Temporarily suspended Use of the secret is temporarily suspended. You cannot change the protection key or view or edit the secret value. In this status, automatic rotation, which requires viewing and editing secret values, is not available either.
- Deletion requested Deletion has been requested. The secret is permanently deleted after a 7-day grace period. To delete the secret immediately without a grace period, click Delete immediately. As with a temporarily suspended secret, you cannot change the protection key, view or edit the secret value, or run automatic rotation. You can cancel the deletion request until the secret is permanently deleted. Canceling the request places the secret in the temporarily suspended state.
- Final deletion The secret has been permanently deleted. This is a logical state defined by Secret Manager. At the time of deletion, all related information, including the secret value, is deleted and cannot be recovered.

              Note

              

When deleting a secret, the Cloud Functions action created by the user for the rotation of secrets is not deleted.

### Change secret status

To change the status of a secret:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Secret Manager** > **Secret**.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. Click **Suspend using** to change the status of an available secret.
4. Click **Resume using** to change the status of a temporarily suspended secret.

## Change the protection key

Secret values are encrypted and protected by designated protection keys. All protection keys are managed in Key Management Service. To change the secret protection key:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Secret Manager** > **Secret**.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. Under Protection key, click **Edit**.
4. When the available keys are listed, select the key you want to use and click Edit.
5. If you select a user-managed key, delegate permission to use the key for encryption and decryption to Secret Manager.
6. If you need a new key, click **Create Key Management Service key** and create it in the Key Management Service console.

              Caution

              

- With the new Region-isolated key feature in Key Management Service (KMS), you can now use Region-isolated keys with Secret Manager.
- Secrets linked to global keys before the update remain usable. However, global keys are no longer available for new secret integrations.
- For details, see [Key Management Service overview](https://api.ncloud-docs.com/docs/en/security-kms).

## Secret rotation

To keep secrets secure, rotate them regularly. Secret Manager cannot change your secrets arbitrarily, so rotation is handled by actions you define. When the secret rotation is executed, it renews the property value of the secret set as the **Rotation target** by default. You can also change other values, but it is not recommended for smooth operation. It is generally recommended to designate only confidential values (such as passwords) that require renewal as the rotation targets. Also, Cloud Functions triggers must be registered to execute the rotation action. For details about creating a secret rotation trigger, see [Cloud Functions - Secret Manager type trigger](https://guide.ncloud-docs.com/docs/en/cloudfunctions-secretmanager-vpc).

For details about the secret rotation process and action definitions, see [Secret rotation](/docs/en/secretmanager-rotate-action).

### Configure secret rotation

To configure secret rotation:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Secret Manager** > **Secret**.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. You can execute the rotation action periodically by enabling **Automatic rotation** in the rotation information section. (A trigger must be registered to enable automatic rotation.)
4. When the automatic rotation is enabled, the automatic rotation cycle is set to 90 days by default. To change the rotation interval, click **Edit** for **Automatic rotation cycle**.
5. To change the mapped trigger, click **Edit** for **Trigger**. However, you cannot change trigger mapping while rotation is in progress.
6. In the **Progress status** item, the previous rotation execution information is displayed.

### Execute secret rotation

Secrets with automatic rotation enabled are rotated automatically. You can also rotate them manually at any time.

              Caution

              

Manual rotation does not affect the next scheduled automatic rotation.

To run secret rotation:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Secret Manager** > **Secret**.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. In the Rotation information section, click **Execute rotation** to run the trigger.

### Retry, cancel, and roll back secret rotation

Whether the secret rotation process is completed is determined depending on the secret rotation process strategy. If the final **Complete Rotation** notification is not received, the rotation action is considered to have failed.

![SECM_06_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/SECM_06.png?sv=2026-02-06&spr=https&st=2026-10-27T17%3A38%3A23Z&se=2026-10-27T18%3A38%3A23Z&sr=c&sp=r&sig=kSurKmHh0uTV%2BjjylyHxC2Mgb2N3lTf%2Fy%2FLrCeLrHAk%3D)

The secret rotation statuses and their features are as follows:

- **Normal**: You can run the next rotation when the status is **Normal**. After rotation completes, the secret is updated to the new value, and the former ACTIVE value moves to PREVIOUS. Use **Rollback** to restore the previously used secret value from PREVIOUS to ACTIVE.
- **Rotation in progress**: A rotation event has triggered execution, but completion has not yet been reported.
- **Rotation failed**: If rotation does not complete successfully, the status changes to **Rotation failed**. You can then select **Retry** or **Cancel action**.

              Caution

              

Rollback only changes the secret chains in Secret Manager, and the value of the secrets managed by Secret Manager and the actual secrets applied to the service using it may differ from each other. Similarly, canceling an action immediately stops Secret Manager from tracking the rotation operation. It no longer checks whether the action runs or what the rotation result is. As a result, the secret value may differ from the value actually in use. To ensure proper operation, use rollback or action cancellation only when necessary.

## Delete a secret

To permanently delete a secret:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Secret Manager** > **Secret**.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. Click **Deletion request** to request a secret deletion.
4. Enter the secret name and confirm the deletion of the secret.
5. A secret is permanently deleted 7 days after deletion is requested. To delete it immediately without a grace period, click **Delete now**.

              Caution

              

Be careful when you delete a secret, as the deleted secrets cannot be recovered.