Key Management Service:ECSインスタンスにアタッチされたインスタンスRAMロールを使用して、KMSに安全にアクセスする

Alibaba Cloud SDK V1.0

package com.aliyuncs.kms.examples;

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.IAcsClient;
import com.aliyuncs.auth.AlibabaCloudCredentialsProvider;
import com.aliyuncs.auth.InstanceProfileCredentialsProvider;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.exceptions.ServerException;
import com.aliyuncs.kms.model.v20160120.*;
import com.aliyuncs.profile.DefaultProfile;

public class RamRoleTest {
    public static void main(final String[] args) throws Exception {
        String regionId = "<region-id>";
        DefaultProfile profile = DefaultProfile.getProfile(regionId);

        // Specify the instance RAM role. In this example, EcsRamRoleTest is used. 
        String roleName = "EcsRamRoleTest"; 

        // Configure the credential provider of the instance RAM role. 
        AlibabaCloudCredentialsProvider provider = new InstanceProfileCredentialsProvider(roleName);

        IAcsClient client = new DefaultAcsClient(profile, provider);

        ListKeysRequest request = new ListKeysRequest();
      
        try {
            ListKeysResponse response = client.getAcsResponse(request);
            System.out.println(new Gson().toJson(response));
        } catch (ServerException e) {
            e.printStackTrace();
        } catch (ClientException e) {
            System.out.println("ErrCode:" + e.getErrCode());
            System.out.println("ErrMsg:" + e.getErrMsg());
            System.out.println("RequestId:" + e.getRequestId());
        }

    }
}

Alibaba Cloud SDK V2.0

package com.aliyun.sample;

import com.aliyun.tea.*;

public class Sample {

    public static com.aliyun.kms20160120.Client createClient() throws Exception {
        com.aliyun.credentials.models.Config credentialConfig = new com.aliyun.credentials.models.Config();
        // The type of the credential.
        credentialConfig.type = "ecs_ram_role";
        // Optional. The name of the instance RAM role of the ECS instance. If you do not set this parameter, the role name is automatically obtained. However, we recommend that you enter the role name to reduce the number of requests.
        credentialConfig.roleName = "<your-ecsRamRoleName>";
        com.aliyun.credentials.Client credentialClient = new com.aliyun.credentials.Client(credentialConfig);

        com.aliyun.teaopenapi.models.Config kmsClientConfig = new com.aliyun.teaopenapi.models.Config()
        // Set the endpoint of KMS, for example, kms.cn-hangzhou.aliyuncs.com.
        .setEndpoint( "kms.cn-hangzhou.aliyuncs.com").
                setCredential(credentialClient);
        return new com.aliyun.kms20160120.Client(kmsClientConfig);

    }

    public static void main(String[] args_) throws Exception {
        java.util.List<String> args = java.util.Arrays.asList(args_);
        com.aliyun.kms20160120.Client client = Sample.createClient();
        com.aliyun.kms20160120.models.ListKeysRequest listKeysRequest = new com.aliyun.kms20160120.models.ListKeysRequest();
        com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
        try {
            client.listKeysWithOptions(listKeysRequest, runtime);
        } catch (TeaException error) {
            System.out.println(error.getMessage());
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            _error.printStackTrace();
        }        
    }
}

Secrets Managerクライアント

詳細については、「シークレットクライアント」をご参照ください。

1. システム環境変数または設定ファイルsecretsmanager.propertiesに次のパラメーターを設定します。

   パラメーター	値
   credentials_type	値をecs_ram_roleに設定します。
   credentials_role_session_name	RAM ロールの名前です。
   cache_client_region_id	[{"regionId":"<your region ID>"}] 形式のリージョンid。 <your region id> を実際のリージョンIDに置き換えます。

2. Secrets Managerクライアントを構築してシークレット値を取得します。

   import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
   import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
   import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
   import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
   
   public class CacheClientEnvironmentSample {
   
       public static void main(String[] args) {
           try {
               // Construct Secrets Manager Client.
               SecretCacheClient client = SecretCacheClientBuilder.newClient();
               // Use Secrets Manager Client to obtain the secret information.
               SecretInfo secretInfo = client.getSecretInfo("#secretName#");
               System.out.println(secretInfo);
           } catch (CacheSecretException e) {
               e.printStackTrace();
           }
       }
   }

シークレットJDBCクライアント

次の例では、JDBCを使用してMySQLデータベースに接続する方法を説明します。 詳細については、「Secret JDBC client」をご参照ください。

1. 構成ファイルsecretsmanager.propertiesをプロジェクトのコードに追加します。

   ## The type of the access credential.
   credentials_type=ecs_ram_role
   ## The name of the instance RAM role that is attached to your ECS instance.
   credentials_role_name=#credentials_role_name#
   ## The region of the KMS instance.
   cache_client_region_id=[{"regionId":"#regionId#"}]
   ## The custom rotation interval. Default value: 21600000. Minimum value: 300000. Unit: milliseconds. The default value is equivalent to 6 hours, and the minimum value is equivalent to 5 minutes.
   refresh_secret_ttl=21600000

2. JDBCを使用してMySQLデータベースに接続します。

   import java.sql.Connection;
   import java.sql.DriverManager;
   import java.sql.SQLException;
   
   public class SecretManagerJDBCSample {
       public static void main(String[] args) throws Exception {
           // Load the secret JDBC client (SDK name: com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver).
           Class.forName("com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver");
           Connection connect = null;
           try {
               connect = DriverManager.getConnection("secrets-manager:mysql://<YOUR-MYSQL-IP>:<YOUR-MYSQL-PORT>/<YOUR-DATABASE-NAME>", "#your-mysql-secret-name#","");
           } catch(SQLException e) {
               e.printStackTrace();
           }
       }
   }

RAMシークレットプラグイン

詳細については、「RAMシークレットプラグイン」をご参照ください。

1. 構成ファイルmanaged_credentials_providers.propertiesをアプリケーションの作業ディレクトリに追加します。

   credentials_type=ecs_ram_role
   ## The name of the instance RAM role that is attached to your ECS instance.
   credentials_role_name=#credentials_role_name#
   ## The region of the KMS instance.
   cache_client_region_id=[{"regionId":"#regionId#"}]

2. Alibaba Cloud SDK for Javaのクライアントを作成し、クラウドサービスを呼び出します。

   次のサンプルコードは、ECSのDescribeInstanceStatus操作を呼び出す方法の例を示しています。

   次のサンプルコードを実行する場合、ecsのaliyun-java-sdk-ECS依存関係をpom.xmlファイルに追加します。

   import com.aliyuncs.IAcsClient;
   import com.aliyuncs.ecs.model.v20140526.DescribeInstanceStatusRequest;
   import com.aliyuncs.ecs.model.v20140526.DescribeInstanceStatusResponse;
   import com.aliyun.kms.secretsmanager.plugin.sdkcore.ProxyAcsClient;
   import com.aliyuncs.exceptions.ClientException;
   import com.aliyuncs.exceptions.ServerException;
   
   public class AliyunSdkProviderSample {
       public static void main(String[]args) {
           String secretName="******";
           /*
             If the application cannot be set to read the default configuration file (managed_credentials_providers.properties) from the classpath and executable jar package, 
             or if you want to specify a custom file name, you can use the following code to configure a custom file:
             1. If your-config-name is set to a value in the Absolute path + File name format, the system reads the configuration file in the absolute path.
             2. If your-config-name is set to a file name, the system first accesses classpath to read the configuration file and then accesses the executable JAR package to read the configuration file.
           */
           //ConfigLoader.setConfigName("your-config-name");
           
           // 1. Create a client (SDK name: aliyun-java-sdk-managed-credentials-provider).
           IAcsClient client = null;
           try {
               client = new ProxyAcsClient("<the regionId of ECS>", secretName);
           } catch (ClientException e) {
                e.printStackTrace();
            }
           // 2. Call an API operation of ECS to implement business functionality.
           DescribeInstanceStatusRequest request = new DescribeInstanceStatusRequest();
           DescribeInstanceStatusResponse response;
           try {
                response = client.getAcsResponse(request);
           } catch (ServerException e) {
                e.printStackTrace();
            } catch (ClientException e) {
                e.printStackTrace();
            }
           // 3. Shut down the client to release plug-in-related resources. 
           client.shutdown();
       }
   }