You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine. Which option should you recommend?

Secret Manager is the purpose-built Google Cloud service for storing and managing sensitive data such as API keys, passwords, and certificates. It provides a centralized, versioned, and secure storage location with fine-grained access control through IAM permissions and detailed audit logging. Applications running on Compute Engine can be granted an IAM role to securely access these secrets at runtime, which is the best practice for handling sensitive configuration data.

A. Cloud Key Management Service (KMS) stores and manages cryptographic keys for encryption/decryption, but it does not store the secret data itself.
B. Compute Engine guest attributes are not designed for sensitive data and lack the robust access control, versioning, and auditing features of Secret Manager.
C. Compute Engine custom metadata is not encrypted and is visible in the console. Google documentation explicitly warns against using it to store sensitive information.

1. Google Cloud Documentation, "Secret Manager overview". It states, "Secret Manager is a secure and convenient storage system for API keys, passwords, certificates, and other sensitive data."

2. Google Cloud Documentation, "Storing and retrieving secrets". This guide provides a tutorial on using Secret Manager from a Compute Engine instance.

3. Google Cloud Documentation, "Storing sensitive information in instance metadata". This page explicitly states, "Compute Engine strongly recommends that you do not store sensitive data in instance metadata."