Key Management Service：CreateSecret

The operation that you want to perform. Set the value to CreateSecret.

The name of the secret. The name must be unique in the current region.

The name can be up to 192 characters in length, and can contain letters, digits, and the following special characters: _ / + = . - @. The following list describes the naming conventions for different types of secrets:

• If you set SecretType to Generic, Rds, or Redis, the name cannot start with acs/. The value Generic specifies a generic secret, Rds an ApsaraDB RDS secret, and Redis an ApsaraDB for Redis or Tair secret.
• If you set SecretType to RAMCredentials, the value $Auto is used. In this case, KMS automatically generates a secret name that starts with acs/ram/user/. The name includes the display name of a required Resource Access Management (RAM) user.
• If you set SecretType to ECS, the name must start with acs/ecs/.

The initial version number. The version number must be unique within the secret.

The version number can be up to 64 characters in length.

The ID of the key that is used to encrypt the secret value.

The secret value. The value can be up to 30,720 bytes in length, which is equivalent to 30 KB in size. KMS uses the specified key to encrypt the secret value and then stores the secret value in the initial version.

• If you set SecretType to Generic, you can configure a custom secret value.
• If you set SecretType to Rds, the secret value is in the {"Accounts":[{"AccountName":"","AccountPassword":""}]} format. AccountName specifies the username of the account for the ApsaraDB RDS instance, and AccountPassword specifies the password of the account.
• If you set SecretType to Redis, the secret value is in the {"Accounts":[{"AccountName":"","AccountPassword":""}]} format. AccountName specifies the username of the account for the ApsaraDB for Redis instance, and AccountPassword specifies the password of the account.
• If you set SecretType to RAMCredentials, the secret value is in the {"AccessKeys":[{"AccessKeyId":"","AccessKeySecret":""}]} format. AccessKeyId specifies the AccessKey ID of the RAM user and AccessKeySecret specifies the AccessKey secret of the RAM user. You must specify all the AccessKey pairs of the RAM user.
• If you set SecretType to ECS, the secret value must be in one the following formats:
  • {"UserName":"","Password": ""}: This format is used when you set the value of SecretSubType to Password in the ExtendedConfig parameter. UserName specifies the username that is used to log on to the Elastic Compute Service (ECS) instance, and Password specifies the password that is used to log on to the ECS instance.
  • {"UserName":"","PublicKey": "", "PrivateKey": ""}: This format is used when you set the value of SecretSubType to SSHKey in the ExtendedConfig parameter. PublicKey specifies the SSH public key that is used to log on to the ECS instance, and PrivateKey specifies the SSH private key that is used to log on to the ECS instance.

The type of the secret value. Valid values:

• text (default)
• binary

The description of the secret.

The tags of the secret. A tag consists of a key-value pair.

A tag key or a tag value can be up to 128 characters in length and can contain letters, digits, and the following special characters: / \ _ - . + = : @

• A tag key cannot start with aliyun or acs:.
• You can specify up to 20 key-value pairs for each secret.

The type of the secret. Valid values:

• Generic (default): generic secret.
• Rds: ApsaraDB RDS secret.
• Redis: ApsaraDB for Redis secret.
• RAMCredentials: RAM secret.
• ECS: ECS secret.

The extended configuration of the secret. This parameter specifies the properties of the secret of the specific type. The value can be up to 1,024 characters in length.

• If you set SecretType to Generic, you do not need to configure this parameter.
• If you set SecretType to Rds, you must configure the following fields in the ExtendedConfig parameter:
  • SecretSubType: required. The subtype of the secret. Valid values:
    • SingleUser: KMS manages the ApsaraDB RDS secret in single-account mode. When the secret is rotated, the password of the specified account is reset to a new random password.
    • DoubleUsers: KMS manages the ApsaraDB RDS secret in dual-account mode. One account is referenced by the ACSCurrent version, and the other account is referenced by the ACSPrevious version. When the secret is rotated, the password of the account referenced by the ACSPrevious version is reset to a new random password. Then, KMS switches the referenced accounts between the ACSCurrent and ACSPrevious versions.
  • DBInstanceId: required. The ID of the ApsaraDB RDS instance to which the ApsaraDB RDS account belongs.
  • CustomData: optional. The custom data. The value is a collection of key-value pairs in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). Example: {"Key1": "v1", "fds":"fdsf"}. The default value is a pair of empty braces ({}).
• If you set SecretType to Redis, you must configure the following fields in the ExtendedConfig parameter:
  • SecretSubType: required. The subtype of the secret. Valid values:
    • DoubleUsers: KMS manages the ApsaraDB for Redis secret in dual-account mode. One account is referenced by the ACSCurrent version, and the other account is referenced by the ACSPrevious version. When the secret is rotated, the password of the account referenced by the ACSPrevious version is reset to a new random password. Then, KMS switches the referenced accounts between the ACSCurrent and ACSPrevious versions.
  • AccountName: required. The username of the account that is used to log on to the ApsaraDB for Redis database.
  • CloneAccountName: required. The username of the account for the ApsaraDB for Redis database, which is the value of AccountName appended with the _clone suffix.
  • AccountPrivilege: required. The permissions to access the ApsaraDB for Redis database.
  • InstanceId: required. The ID of the ApsaraDB for Redis instance.
  • RegionId: required. The ID of the region where the ApsaraDB for Redis instance resides.
  • CustomData: optional. The custom data. The value is a collection of key-value pairs in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). Example: {"Key1": "v1", "fds":"fdsf"}. The default value is a pair of empty braces ({}).
• If you set SecretType to RAMCredentials, you must configure the following fields in the ExtendedConfig parameter:
  • SecretSubType: required. The subtype of the secret. Set the value to RamUserAccessKey.
  • UserName: required. The name of the RAM user.
  • CustomData: optional. The custom data. The value is a collection of key-value pairs in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). The default value is a pair of empty braces ({}).
• If you set SecretType to ECS, you must configure the following fields in the ExtendedConfig parameter:
  • SecretSubType: required. The subtype of the secret. Valid values:
    • Password: the password that is used to log on to the ECS instance.
    • SSHKey: the SSH public key and private key that are used to log on to the ECS instance.
  • RegionId: required. The ID of the region in which the ECS instance resides.
  • InstanceId: required. The ID of the ECS instance.
  • CustomData: optional. The custom data. The value is a collection of key-value pairs in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). The default value is a pair of empty braces ({}).

Specifies whether to enable automatic rotation. Valid values:

• true
• false (default)

The interval for automatic rotation. Valid values: 6 hours to 8,760 hours (365 days).

The value is in the integer[unit] format. integer indicates the time period. unit: indicates the unit of the time period.

The unit can be d (day), h (hour), m (minute), or s (second). If the value is 7d or 604800s, automatic rotation is performed at a 7-day interval.

The ID of the KMS instance.

The content of the secret policy. The value is in the JSON format. The value can be up to 32,768 bytes in length.

For more information about secret policies, see Overview. If you do not configure this parameter, the default secret policy is used.

A secret policy contains the following content:

• Version: the version of the secret policy. Set the value to 1.
• Statement: the statement of the secret policy. Each secret policy contains one or more statements.

Example:

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "Enable RAM User Permissions",
            "Effect": "Allow",
            "Principal": {
              "RAM": ["acs:ram::123456789012:root"]
            },
            "Action": [
                "kms:*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Statement description:

• Sid: optional. The identifier of a custom statement. The value can be up to 128 characters in length and can contain letters, digits, and the following special characters: _ / + = . @ -
• Effect: required. Specifies whether the permissions in a policy statement are allowed or denied. Valid values: Allow and Deny.
• Principal: required. The authorization principal of the policy. The following principals are supported: the current Alibaba Cloud account to which the secret belongs, RAM users and RAM roles of the current Alibaba Cloud account, and RAM users and RAM roles of other Alibaba Cloud accounts.
• Action: Required. The API operation that you want to allow or deny. The value must start with kms:. For more information about the API operation scope, see Overview. If you specify permissions outside the scope, the permissions do not take effect.
• Resource: required. Set the value to an asterisk (*), which specifies the current secret.
• Condition: optional. The conditions that are required for a policy to take effect. Conditions allow you to evaluate the context of an API request to determine whether a policy statement applies. Format: "Condition": {"condition operator": {"condition key": "condition value"}}. For more information, see Overview.

The request ID.

Indicates whether automatic rotation is enabled. Valid values:

• Enabled: indicates that automatic rotation is enabled.
• Disabled: indicates that automatic rotation is disabled.
• Invalid: indicates that the status of automatic rotation is abnormal. In this case, Secrets Manager cannot automatically rotate the secret.

The secret name.

The version number of the secret.

The time when the next rotation is performed.

The type of the secret. Valid values:

• Generic: generic secret.
• Rds: ApsaraDB RDS secret.
• Redis: ApsaraDB for Redis secret.
• RAMCredentials: RAM secret.
• ECS: ECS secret.

The interval for automatic rotation.

The value is in the integer[unit] format. integer indicates the time period and unit indicates the unit of the time period. The value of unit is fixed as s, which indicates seconds. If the value is 604800s, automatic rotation is performed at a 7-day interval.

The Alibaba Cloud Resource Name (ARN) of the secret.

The extended configuration of the secret.

The ID of the KMS instance.