Key Management Service:Use the instance RAM role attached to an ECS instance to securely access KMS

Alibaba Cloud SDK V1.0

package com.aliyuncs.kms.examples;

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.IAcsClient;
import com.aliyuncs.auth.AlibabaCloudCredentialsProvider;
import com.aliyuncs.auth.InstanceProfileCredentialsProvider;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.exceptions.ServerException;
import com.aliyuncs.kms.model.v20160120.*;
import com.aliyuncs.profile.DefaultProfile;

public class RamRoleTest {
    public static void main(final String[] args) throws Exception {
        String regionId = "<region-id>";
        DefaultProfile profile = DefaultProfile.getProfile(regionId);

        // Specify the instance RAM role. In this example, EcsRamRoleTest is used. 
        String roleName = "EcsRamRoleTest"; 

        // Configure the credential provider of the instance RAM role. 
        AlibabaCloudCredentialsProvider provider = new InstanceProfileCredentialsProvider(roleName);

        IAcsClient client = new DefaultAcsClient(profile, provider);

        ListKeysRequest request = new ListKeysRequest();
      
        try {
            ListKeysResponse response = client.getAcsResponse(request);
            System.out.println(new Gson().toJson(response));
        } catch (ServerException e) {
            e.printStackTrace();
        } catch (ClientException e) {
            System.out.println("ErrCode:" + e.getErrCode());
            System.out.println("ErrMsg:" + e.getErrMsg());
            System.out.println("RequestId:" + e.getRequestId());
        }

    }
}

Alibaba Cloud SDK V2.0

package com.aliyun.sample;

import com.aliyun.tea.*;

public class Sample {

    public static com.aliyun.kms20160120.Client createClient() throws Exception {
        com.aliyun.credentials.models.Config credentialConfig = new com.aliyun.credentials.models.Config();
        // The type of the credential.
        credentialConfig.type = "ecs_ram_role";
        // Optional. The name of the instance RAM role of the ECS instance. If you do not set this parameter, the role name is automatically obtained. However, we recommend that you enter the role name to reduce the number of requests.
        credentialConfig.roleName = "<your-ecsRamRoleName>";
        com.aliyun.credentials.Client credentialClient = new com.aliyun.credentials.Client(credentialConfig);

        com.aliyun.teaopenapi.models.Config kmsClientConfig = new com.aliyun.teaopenapi.models.Config()
        // Set the endpoint of KMS, for example, kms.cn-hangzhou.aliyuncs.com.
        .setEndpoint( "kms.cn-hangzhou.aliyuncs.com").
                setCredential(credentialClient);
        return new com.aliyun.kms20160120.Client(kmsClientConfig);

    }

    public static void main(String[] args_) throws Exception {
        java.util.List<String> args = java.util.Arrays.asList(args_);
        com.aliyun.kms20160120.Client client = Sample.createClient();
        com.aliyun.kms20160120.models.ListKeysRequest listKeysRequest = new com.aliyun.kms20160120.models.ListKeysRequest();
        com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
        try {
            client.listKeysWithOptions(listKeysRequest, runtime);
        } catch (TeaException error) {
            System.out.println(error.getMessage());
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            _error.printStackTrace();
        }        
    }
}

Secrets Manager Client

For more information, see Secrets Manager Client.

1. Configure the following parameters in system environment variables or the configuration file secretsmanager.properties.

   Parameter	Value
   credentials_type	Set the value to ecs_ram_role.
   credentials_role_session_name	The name of the RAM role.
   cache_client_region_id	The region ID in the [{"regionId":"<your region id>"}].format. Replace <your region id> with your actual region ID.

2. Construct Secrets Manager Client to obtain secret values.

   import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
   import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
   import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
   import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
   
   public class CacheClientEnvironmentSample {
   
       public static void main(String[] args) {
           try {
               // Construct Secrets Manager Client.
               SecretCacheClient client = SecretCacheClientBuilder.newClient();
               // Use Secrets Manager Client to obtain the secret information.
               SecretInfo secretInfo = client.getSecretInfo("#secretName#");
               System.out.println(secretInfo);
           } catch (CacheSecretException e) {
               e.printStackTrace();
           }
       }
   }

Secret JDBC client

The following example describes how to connect to a MySQL database by using JDBC. For more information, see Secret JDBC client.

1. Add the configuration file secretsmanager.properties to the code of your project.

   ## The type of the access credential.
   credentials_type=ecs_ram_role
   ## The name of the instance RAM role that is attached to your ECS instance.
   credentials_role_name=#credentials_role_name#
   ## The region of the KMS instance.
   cache_client_region_id=[{"regionId":"#regionId#"}]
   ## The custom rotation interval. Default value: 21600000. Minimum value: 300000. Unit: milliseconds. The default value is equivalent to 6 hours, and the minimum value is equivalent to 5 minutes.
   refresh_secret_ttl=21600000

2. Use JDBC to connect to a MySQL database.

   import java.sql.Connection;
   import java.sql.DriverManager;
   import java.sql.SQLException;
   
   public class SecretManagerJDBCSample {
       public static void main(String[] args) throws Exception {
           // Load the secret JDBC client (SDK name: com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver).
           Class.forName("com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver");
           Connection connect = null;
           try {
               connect = DriverManager.getConnection("secrets-manager:mysql://<YOUR-MYSQL-IP>:<YOUR-MYSQL-PORT>/<YOUR-DATABASE-NAME>", "#your-mysql-secret-name#","");
           } catch(SQLException e) {
               e.printStackTrace();
           }
       }
   }

RAM secret plug-in

For more information, see RAM secret plug-in.

1. Add the configuration file managed_credentials_providers.properties to the working directory of your application.

   credentials_type=ecs_ram_role
   ## The name of the instance RAM role that is attached to your ECS instance.
   credentials_role_name=#credentials_role_name#
   ## The region of the KMS instance.
   cache_client_region_id=[{"regionId":"#regionId#"}]

2. Create a client of Alibaba Cloud SDK for Java and call a cloud service.

   The following sample code provides an example on how to call the DescribeInstanceStatus operation of ECS.

   When you run the following sample code, add the aliyun-java-sdk-ecs dependency of ECS to the pom.xml file.

   import com.aliyuncs.IAcsClient;
   import com.aliyuncs.ecs.model.v20140526.DescribeInstanceStatusRequest;
   import com.aliyuncs.ecs.model.v20140526.DescribeInstanceStatusResponse;
   import com.aliyun.kms.secretsmanager.plugin.sdkcore.ProxyAcsClient;
   import com.aliyuncs.exceptions.ClientException;
   import com.aliyuncs.exceptions.ServerException;
   
   public class AliyunSdkProviderSample {
       public static void main(String[]args) {
           String secretName="******";
           /*
             If the application cannot be set to read the default configuration file (managed_credentials_providers.properties) from the classpath and executable jar package, 
             or if you want to specify a custom file name, you can use the following code to configure a custom file:
             1. If your-config-name is set to a value in the Absolute path + File name format, the system reads the configuration file in the absolute path.
             2. If your-config-name is set to a file name, the system first accesses classpath to read the configuration file and then accesses the executable JAR package to read the configuration file.
           */
           //ConfigLoader.setConfigName("your-config-name");
           
           // 1. Create a client (SDK name: aliyun-java-sdk-managed-credentials-provider).
           IAcsClient client = null;
           try {
               client = new ProxyAcsClient("<the regionId of ECS>", secretName);
           } catch (ClientException e) {
                e.printStackTrace();
            }
           // 2. Call an API operation of ECS to implement business functionality.
           DescribeInstanceStatusRequest request = new DescribeInstanceStatusRequest();
           DescribeInstanceStatusResponse response;
           try {
                response = client.getAcsResponse(request);
           } catch (ServerException e) {
                e.printStackTrace();
            } catch (ClientException e) {
                e.printStackTrace();
            }
           // 3. Shut down the client to release plug-in-related resources. 
           client.shutdown();
       }
   }