Key Management Service:Use an instance RAM role to access KMS

Alibaba Cloud SDK V2.0

package com.aliyun.sample;

import com.aliyun.tea.*;

public class Sample {

    public static com.aliyun.kms20160120.Client createClient() throws Exception {
        com.aliyun.credentials.models.Config credentialConfig = new com.aliyun.credentials.models.Config();
        // Set the credential type.
        credentialConfig.type = "ecs_ram_role";
        // Optional. To reduce API calls, specify the instance RAM role name. If this parameter is omitted, the role name is retrieved automatically.
        credentialConfig.roleName = "<your-ecsRamRoleName>";
        com.aliyun.credentials.Client credentialClient = new com.aliyun.credentials.Client(credentialConfig);

        com.aliyun.teaopenapi.models.Config kmsClientConfig = new com.aliyun.teaopenapi.models.Config()
        // Set the KMS endpoint. Example: kms.cn-hangzhou.aliyuncs.com
        .setEndpoint( "kms.cn-hangzhou.aliyuncs.com").
                setCredential(credentialClient);
        return new com.aliyun.kms20160120.Client(kmsClientConfig);

    }

    public static void main(String[] args_) throws Exception {
        java.util.List<String> args = java.util.Arrays.asList(args_);
        com.aliyun.kms20160120.Client client = Sample.createClient();
        com.aliyun.kms20160120.models.ListKeysRequest listKeysRequest = new com.aliyun.kms20160120.models.ListKeysRequest();
        com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
        try {
            client.listKeysWithOptions(listKeysRequest, runtime);
        } catch (TeaException error) {
            System.out.println(error.getMessage());
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            _error.printStackTrace();
        }        
    }
}

Tab body

Secrets Manager Client

For more information, see Secrets Manager Client.

1. Configure the following parameters in the secretsmanager.properties file or as system environment variables.

   Parameter	Value
   credentials_type	Set to ecs_ram_role.
   credentials_role_session_name	A custom name for the role session, used for auditing.
   cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID.

2. Build the client to retrieve the secret value.

   import com.aliyuncs.kms.secretsmanager.client.v2.SecretCacheClient;
   import com.aliyuncs.kms.secretsmanager.client.v2.SecretCacheClientBuilder;
   import com.aliyuncs.kms.secretsmanager.client.v2.exception.CacheSecretException;
   import com.aliyuncs.kms.secretsmanager.client.v2.model.SecretInfo;
   
   public class CacheClientEnvironmentSample {
   
       public static void main(String[] args) {
           try {
               SecretCacheClient client = SecretCacheClientBuilder.newClient();
               SecretInfo secretInfo = client.getSecretInfo("#secretName#");
               System.out.println(secretInfo);
           } catch (CacheSecretException e) {
               e.printStackTrace();
           }
       }
   }

Secrets Manager JDBC Client

This section uses a MySQL database connection over JDBC as an example. For more information, see Secrets Manager JDBC Client.

1. In your project's application code, add a configuration file named secretsmanager.properties.

   ## Type of access credentials
   credentials_type=ecs_ram_role
   ## Name of the ECS RAM role
   credentials_role_name=#credentials_role_name#
   ## Region of the associated KMS instance
   cache_client_region_id=[{"regionId":"#regionId#"}]
   ## Custom refresh interval. Unit: milliseconds. Default: 6 hours. Minimum: 5 minutes.
   refresh_secret_ttl=21600000

2. Connect to the MySQL database over JDBC.

   import java.sql.Connection;
   import java.sql.DriverManager;
   import java.sql.SQLException;
   
   public class SecretManagerJDBCSample {
       public static void main(String[] args) throws Exception {
           // Load the Alibaba Cloud Secrets Manager JDBC driver com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver
           Class.forName("com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver");
           Connection connect = null;
           try {
               connect = DriverManager.getConnection("secrets-manager:mysql://<YOUR-MYSQL-IP>:<YOUR-MYSQL-PORT>/<YOUR-DATABASE-NAME>", "#your-mysql-secret-name#","");
           } catch(SQLException e) {
               e.printStackTrace();
           }
       }
   }

RAM secret plug-in

For more information, see RAM secret plug-in.

1. Add the configuration file managed_credentials_providers.properties to the runtime code of your project.

   credentials_type=ecs_ram_role
   ## Name of the ECS RAM role
   credentials_role_name=#credentials_role_name#
   ## Region of the associated KMS instance
   cache_client_region_id=[{"regionId":"#regionId#"}]

2. Obtain an Alibaba Cloud SDK for Java client and call cloud services.

   The following example shows how to call the DescribeInstanceStatus operation of ECS:

   Note

   Before you run the sample code, add the aliyun-java-sdk-ecs dependency to your pom.xml file.

   import com.aliyuncs.IAcsClient;
   import com.aliyuncs.ecs.model.v20140526.DescribeInstanceStatusRequest;
   import com.aliyuncs.ecs.model.v20140526.DescribeInstanceStatusResponse;
   import com.aliyun.kms.secretsmanager.plugin.sdkcore.ProxyAcsClient;
   import com.aliyuncs.exceptions.ClientException;
   import com.aliyuncs.exceptions.ServerException;
   
   public class AliyunSdkProviderSample {
       public static void main(String[]args) {
           String secretName="******";
           /*
             If the application cannot read the default configuration file (managed_credentials_providers.properties) from the classpath or an executable JAR file, or if you need to use a custom configuration file name, you can call the following code to specify a custom configuration file. The file is read in the following order:
             1. If "your-config-name" is an absolute path, the file is read from that path.
             2. If "your-config-name" is only a file name, the file is read from the classpath first, and then from the executable JAR file.
           */
           //ConfigLoader.setConfigName("your-config-name");
           
           // 1. Obtain an IAcsClient by using aliyun-java-sdk-managed-credentials-provider.
           IAcsClient client = null;
           try {
               client = new ProxyAcsClient("<the regionId of ECS>", secretName);
           } catch (ClientException e) {
                e.printStackTrace();
            }
           // 2. Call an ECS API operation to implement your business logic.
           DescribeInstanceStatusRequest request = new DescribeInstanceStatusRequest();
           DescribeInstanceStatusResponse response;
           try {
                response = client.getAcsResponse(request);
           } catch (ServerException e) {
                e.printStackTrace();
            } catch (ClientException e) {
                e.printStackTrace();
            }
           // 3. Shut down the client to release resources used by the plug-in.
           client.shutdown();
       }
   }

Alibaba Cloud SDK V1.0 (Not Recommended)

package com.aliyuncs.kms.examples;

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.IAcsClient;
import com.aliyuncs.auth.AlibabaCloudCredentialsProvider;
import com.aliyuncs.auth.InstanceProfileCredentialsProvider;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.exceptions.ServerException;
import com.aliyuncs.kms.model.v20160120.*;
import com.aliyuncs.profile.DefaultProfile;

public class RamRoleTest {
    public static void main(final String[] args) throws Exception {
        String regionId = "<region-id>";
        DefaultProfile profile = DefaultProfile.getProfile(regionId);

        // Set the RAM role. This topic uses EcsRamRoleTest as an example.
        String roleName = "EcsRamRoleTest"; 

        // Create the credentials provider for the instance RAM role.
        AlibabaCloudCredentialsProvider provider = new InstanceProfileCredentialsProvider(roleName);

        IAcsClient client = new DefaultAcsClient(profile, provider);

        ListKeysRequest request = new ListKeysRequest();
      
        try {
            ListKeysResponse response = client.getAcsResponse(request);
            System.out.println(new Gson().toJson(response));
        } catch (ServerException e) {
            e.printStackTrace();
        } catch (ClientException e) {
            System.out.println("ErrCode:" + e.getErrCode());
            System.out.println("ErrMsg:" + e.getErrMsg());
            System.out.println("RequestId:" + e.getRequestId());
        }

    }
}