Key Management Service：Secret client

Instance RAM role of an ECS instance

Attach an instance RAM role to an ECS instance. For more information, see Grant ECS access to other Alibaba Cloud services by using instance RAM roles.

RAM role

1. Create a RAM role. When you create a RAM role, you must select Alibaba Cloud Account or IdP for the Select Trusted Entity parameter. For more information, see Create a RAM role.

2. Obtain the RamRoleArn of the RAM role. For more information, see View the information about a RAM role.

   Note

   RamRoleArn is the Alibaba Cloud Resource Name (ARN) of the RAM role, which is the ID of the RAM role to be assumed. Format: acs:ram::$accountID:role/$roleName. $accountID is the ID of the Alibaba Cloud account. $roleName is the name of the RAM role.

STS token

1. Create a RAM user or a RAM role. For more information, see Create a RAM user and Create a RAM role.

2. Grant the AliyunSTSAssumeRoleAccess permission to the RAM user or the RAM role. For more information, see Grant permissions to a RAM user and Grant permissions to a RAM role.

3. Use the RAM user or the RAM role to call the AssumeRole operation of STS to obtain an STS token. For more information, see AssumeRole.

Client key

Create an application access point (AAP) and then create a client key in the AAP. The configurations of the AAP vary based on the type of API. The following section describes the specific configurations:

• Access a KMS endpoint - KMS API

  When you create a network access rule, select Public or VPC for the Network Type parameter. When you create a policy, select Shared KMS Gateway for the Scope parameter.

• Access the endpoint of a KMS instance - KMS Instance API

  When you create a network access rule, select Private for the Network Type parameter. When you create a policy, select an instance ID for the Scope parameter.

For more information, see Create an AAP.

AccessKey pair (not recommended)

For more information, see Create an AccessKey pair.

Java

Visit alibabacloud-secretsmanager-client-java to view more installation information and source code.

Install the secret client in your project by using Maven.

<dependency>
    <groupId>com.aliyun</groupId>
    <artifactId>alibabacloud-secretsmanager-client</artifactId>
    <version>1.x.x</version>
</dependency>
<dependency>
  <groupId>com.aliyun</groupId>
  <artifactId>aliyun-java-sdk-core</artifactId>
  <version>4.x.x</version>
</dependency>

Python

Visit aliyun-secretsmanager-client-python to view more installation information and source code.

Run the pip command to install the secret client.

pip install aliyun-secret-manager-client

Go

Visit aliyun-secretsmanager-client-go to view more installation information and source code.

Run the go get command to use the secret client in your project.

go get -u github.com/aliyun/aliyun-secretsmanager-client-go

Java

• Method 1: Use environment variables or the secretsmanager.properties configuration file to build the secret client

  For more information about environment variables, see Appendix 1: Environment variables. For more information about configuration files, see Appendix 2: Configuration files. The name of the configuration file is fixed as secretsmanager.properties.

  Replace #secretName# in the sample code with the name of your secret.

  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
  import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
  
  public class CacheClientEnvironmentSample {
  
      public static void main(String[] args) {
          try {
              // Build the secret client.
              SecretCacheClient client = SecretCacheClientBuilder.newClient();
              // Use the secret client to retrieve secret information.
              SecretInfo secretInfo = client.getSecretInfo("#secretName#");
              System.out.println(secretInfo);
          } catch (CacheSecretException e) {
              e.printStackTrace();
          }
      }
  }

• Method 2: Use a custom configuration file to build the secret client

  For more information about configuration files, see Appendix 2: Configuration files. Specify the name and path of the custom configuration file.

  Replace #customConfigFileName# in the sample code with the name of the custom configuration file. Replace #secretName# with the name of your secret.

  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
  import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
  import com.aliyuncs.kms.secretsmanager.client.service.BaseSecretManagerClientBuilder;
  
  public class CacheClientCustomConfigFileSample {
  
      public static void main(String[] args) {
          try {
              SecretCacheClient client = SecretCacheClientBuilder.newCacheClientBuilder(
                      BaseSecretManagerClientBuilder.standard().withCustomConfigFile("#customConfigFileName#").build()).build();
              SecretInfo secretInfo = client.getSecretInfo("#secretName#");
              System.out.println(secretInfo);
          } catch (CacheSecretException e) {
              System.out.println("CacheSecretException:" + e.getMessage());
          }
      }
  }

• Method 3: Configure parameters such as accessKey, accessSecret, and regionId to build the secret client

  Note

  The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. We recommend that you do not save the AccessKey ID and AccessKey Secret in your project code. Otherwise, the AccessKey pair may be leaked and the security of all the resources that belong to your account may be compromised.

  In this example, the AccessKey pair is saved in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to implement identity authentication.

  • For more information about how to configure authentication information, see Manage access credentials.

  • The method that is used to configure environment variables varies based on the operating system. For more information, see Configure environment variables in Linux, macOS, and Windows.

  Replace #regionId# in the sample code with the actual region ID. Replace #secretName# with the name of your secret.

  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
  import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
  import com.aliyuncs.kms.secretsmanager.client.service.BaseSecretManagerClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.utils.CredentialsProviderUtils;
  
  public class CacheClientSimpleParametersSample {
  
      public static void main(String[] args) {
          try {
              SecretCacheClient client = SecretCacheClientBuilder.newCacheClientBuilder(
                      BaseSecretManagerClientBuilder.standard().withCredentialsProvider(CredentialsProviderUtils
                              .withAccessKey(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"), System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"))).withRegion("#regionId#").build()).build();
              SecretInfo secretInfo = client.getSecretInfo("#secretName#");
              System.out.println(secretInfo);
          } catch (CacheSecretException e) {
              e.printStackTrace();
          }
      }
  }

Python

• Method 1: Use environment variables or the secretsmanager.properties configuration file to build the secret client

  For more information about environment variables, see Appendix 1: Environment variables. For more information about configuration files, see Appendix 2: Configuration files. The name of the configuration file is fixed as secretsmanager.properties.

  Replace #secretName# in the sample code with the name of your secret.

  from alibaba_cloud_secretsmanager_client.secret_manager_cache_client_builder import SecretManagerCacheClientBuilder
  
  if __name__ == '__main__':
      # Build the secret client.
      secret_cache_client = SecretManagerCacheClientBuilder.new_client()
      # Use the secret client to retrieve secret information.
      secret_info = secret_cache_client.get_secret_info("#secretName#")
      print(secret_info.__dict__)

• Method 2: Configure parameters such as accessKey, accessSecret, and regionId to build the secret client

  Note

  The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. We recommend that you do not save the AccessKey ID and AccessKey Secret in your project code. Otherwise, the AccessKey pair may be leaked and the security of all the resources that belong to your account may be compromised.

  In this example, the AccessKey pair is saved in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to implement identity authentication.

  • For more information about how to configure authentication information, see Manage access credentials.

  • The method that is used to configure environment variables varies based on the operating system. For more information, see Configure environment variables in Linux, macOS, and Windows.

  Replace #regionId# in the sample code with the actual region ID. Replace #secretName# with the name of your secret.

  import os
  
  from alibaba_cloud_secretsmanager_client.secret_manager_cache_client_builder import SecretManagerCacheClientBuilder
  from alibaba_cloud_secretsmanager_client.service.default_secret_manager_client_builder import DefaultSecretManagerClientBuilder
  
  if __name__ == '__main__':
      secret_cache_client = SecretManagerCacheClientBuilder.new_cache_client_builder(DefaultSecretManagerClientBuilder.standard() \
          .with_access_key(os.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"), os.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")) \
          .with_region("#regionId#").build()) \
      .build();
      secret_info = secret_cache_client.get_secret_info("#secretName#")
      print(secret_info.__dict__)

Go

• Method 1: Use environment variables or the secretsmanager.properties configuration file to build the secret client

  For more information about environment variables, see Appendix 1: Environment variables. For more information about configuration files, see Appendix 2: Configuration files. The name of the configuration file is fixed as secretsmanager.properties.

  Replace #secretName# in the sample code with the name of your secret.

  package main
  
  import (
      "fmt"
      "github.com/aliyun/aliyun-secretsmanager-client-go/sdk"
  )
  func main() { 
     // Build the secret client.
      client, err := sdk.NewClient()
      if err != nil {
          // Handle exceptions
          panic(err)
      }
     // Use the secret client to retrieve secret information.
      secretInfo, err := client.GetSecretInfo("#secretName#")
      if err != nil {
          // Handle exceptions
          panic(err)
      }
      fmt.Printf("SecretValue:%s\n",secretInfo.SecretValue)
  }

• Configure parameters such as accessKey, accessSecret, and regionId to build the secret client

  Note

  The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. We recommend that you do not save the AccessKey ID and AccessKey Secret in your project code. Otherwise, the AccessKey pair may be leaked and the security of all the resources that belong to your account may be compromised.

  In this example, the AccessKey pair is saved in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to implement identity authentication.

  • For more information about how to configure authentication information, see Initialize an SDK client and send API requests.

  • The method that is used to configure environment variables varies based on the operating system. For more information, see Configure environment variables in Linux, macOS, and Windows.

  Replace #regionId# in the sample code with the actual region ID. Replace #secretName# with the name of your secret.

  package main
  
  import (
  	"github.com/aliyun/aliyun-secretsmanager-client-go/sdk/service"
  	"github.com/aliyun/aliyun-secretsmanager-client-go/sdk"
  	"os"
  )
  
  func main() {
  	client, err := sdk.NewSecretCacheClientBuilder(service.NewDefaultSecretManagerClientBuilder().Standard().WithAccessKey(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"), os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")).WithRegion("#regionId#").Build()).Build()
  	if err != nil {
  		// Handle exceptions
  		panic(err)
  	}
  	secretInfo, err := client.GetSecretInfo("#secretName#")
  	if err != nil {
  		// Handle exceptions
  		panic(err)
  	}
  }