A Cloud Run service needs to access a secret stored in Secret Manager at runtime. Which approach follows Google's security best practices?
-
A
Mount the secret as an environment variable or volume using Secret Manager integration
-
B
Download the secret during the container build and bake it into the image
-
C
Store the secret in a Cloud Storage bucket and download it at startup
-
D
Pass the secret as a build argument in the Dockerfile