load_flask_secrets_from_bucket.py

import os
import uuid
from google.cloud import storage, kms_v1


def load(app):
    config_file_name = "secrets-%s.cfg" % str(uuid.uuid4())

    storage_client = storage.Client()
    bucket = storage_client.get_bucket('vault')
    blob = bucket.blob('secrets.cfg')
    blob.download_to_filename(config_file_name)

    try:
        app.config.from_pyfile(config_file_name)

    finally:
        os.remove(config_file_name)