title: Google Cloud Functions - How to securely store service account private key when using Google Source Repository?
body: <p>I use Google Source Repository to store my Google Cloud Functions. (Git repo hosted by Google, basically)</p>
  
  <p>One of my function needs to access a private Google Sheet file, I therefore created a Service Account. <em>(With way too many rights since it's so hard to understand what exact rights we should give to a service account, and so hard to update later on, but I digress)</em></p>
  
  <p>Now, it's clearly not recommended to store the Service Account JSON file in the git repository itself for obvious reasons. Here is what it looks like (stripped from values)</p>
  
  <pre><code>{
    "type": "service_account",
    "project_id": "",
    "private_key_id": "",
    "private_key": "",
    "client_email": "",
    "client_id": "",
    "auth_uri": "",
    "token_uri": "",
    "auth_provider_x509_cert_url": "",
    "client_x509_cert_url": ""
  }
  </code></pre>
  
  <p>I have been looking at environment variables to configure for a Functions or something alike but didn't find anything. Tracking the key (and therefore potentially duplicating that file on several repositories) really doesn't sound such a good idea. But I haven't found any "proper" way to do it yet. And due to the way Google Functions work, I can't think of anything else but env variables.</p>