From 48aadc6f47d5c03b76f9cbc3db491de7324b0cd3 Mon Sep 17 00:00:00 2001
From: hc-github-team-secure-vault-core
 <82990506+hc-github-team-secure-vault-core@users.noreply.github.com>
Date: Fri, 10 Mar 2023 10:43:21 -0500
Subject: [PATCH] backport of commit 7f14a9e4246458fe232d9e89e97aa6b84b73c6a1
 (#19504)

Co-authored-by: Robert <17119716+robmonte@users.noreply.github.com>
---
 website/content/docs/secrets/gcp.mdx | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/website/content/docs/secrets/gcp.mdx b/website/content/docs/secrets/gcp.mdx
index 9d9940c0d590..eef36380d71b 100644
--- a/website/content/docs/secrets/gcp.mdx
+++ b/website/content/docs/secrets/gcp.mdx
@@ -294,8 +294,10 @@ $ curl -H "Authorization: Bearer ya29.c.ElodBmNPwHUNY5gcBpnXcE4ywG4w1k..."
 
 ### Service Account Keys
 
-To generate service account keys, read from `gcp/.../key`. The roleset or static
-account must have been created as type `service_account_key`:
+To generate service account keys, read from `gcp/.../key`. Vault returns the service
+account key data as a base64-encoded string in the `private_key_data` field. This can
+be read by decoding it using `base64 --decode "ewogICJ0e..."` or another base64 tool of
+your choice. The roleset or static account must have been created as type `service_account_key`:
 
 ```shell-session
 $ vault read gcp/roleset/my-key-roleset/key