Hi, how are you?

Following the breach this week, I started thinking about how I could have minimized the blast radius of events like this for my app and came to the conclusion that if I were to use an external secrets manager like "GCP Secrets Manager", then I would be able to use the audit logs feature that they have to see if any unauthorized 3rd party accessed my API keys.

This _is _possible today, but it requires the process to have GCP credentials in the environment variables, which kinda defeats the purpose.

Instead, can we get workload OIDC identities with short lived tokens to avoid saving long lived credentials as Railway secrets?

Also, as a bonus feature it would be really secure if the deployment had static IP pools that we could use to make sure that only Railway can access the secrets manager by applying IP access rules on the actual Secret Manager.

Is this something that you could please consider?

Thanks in advance