Python environment variables from Google Cloud Secret Manager

gcloud_secret_envvars.py

"""
Functionality to fetch environment variables using Google Cloud Secret Manager.

Environment variables with the GCLOUD_SECRET_ prefix will be filled with
secrets fetched from Google Cloud Secret Manager.

This way, you can use secrets for any environment variables without changing
any code, just the environment setup.
"""
import os

from google.cloud.secretmanager import SecretManagerServiceClient


SECRET_PREFIX = "GCLOUD_SECRET_"

def fetch_secrets(environ):
    environ = environ or os.environ
    secret_manager = SecretManagerServiceClient()
    for name, value in environ.items():
        if name.startswith(SECRET_PREFIX):
            secret = secret_manager.access_secret_version({'name': value}).payload.data
            environ[name.removeprefix(SECRET_PREFIX)] = secret