## The symptom
Creating secrets in GCP Secret Manager from an AWS Lambda using the Node.js
client fails with:
```
Error: Could not load the default credentials
```
even when `projectId` and the path to a service-account JSON key file are
passed to the `SecretManagerServiceClient` constructor. Setting
`GOOGLE_APPLICATION_CREDENTIALS` at runtime works, but passing the key file
path directly does not.
## The recommended fix
The Google-recommended approach for AWS-to-GCP auth is Workload Identity
Federation instead of long-lived service-account keys: configure a workload
identity pool for the AWS account and use google.auth with the external-account
credentials file. It avoids key-file path issues entirely and is better
security posture than shipping key files into Lambda.
## The fallback
Setting `process.env.GOOGLE_APPLICATION_CREDENTIALS` at runtime before
constructing the client works. Do this as early as possible in the handler
setup, before any client is constructed.
## The general lesson
When a client library documents credential discovery via env var, the
constructor options sometimes do not cover every auth path. If the constructor
arg fails but the env var works, prefer the documented primary path (here
Workload Identity Federation) over fighting the constructor.