Key Management Service:Secret client

Instance RAM role

RamRoleArn

STS token

AccessKey

ClientKey (not recommended)

Java

You can install the secret client in your project using Maven.

<dependency>
    <groupId>com.aliyun</groupId>
    <artifactId>alibabacloud-secretsmanager-client</artifactId>
    <version>1.4.x</version>
</dependency>
<dependency>
  <groupId>com.aliyun</groupId>
  <artifactId>aliyun-java-sdk-core</artifactId>
  <version>4.5.x</version>
</dependency>

Python

For more information about the installation and source code, see aliyun-secretsmanager-client-python.

You can run the pip command to install the secret client.

# If the following command fails, replace pip with pip3
pip install aliyun-secret-manager-client

Go

For more information about the installation and source code, see aliyun-secretsmanager-client-go.

You can use the go get command to install the secret client.

go get -u github.com/aliyun/aliyun-secretsmanager-client-go

Java

The sample code for retrieving a credential value varies depending on the client initialization method. You can choose one of the following methods.

• Method 1: Initialize the client using environment variables or a secretsmanager.properties configuration file

  You can use either environment variables or a secretsmanager.properties configuration file.

  Environment variables

  The method for configuring environment variables varies by operating system. For more information, see Configure environment variables on Linux, macOS, and Windows.

  Instance RAM role

  Parameter	Parameter value
  credentials_type	Fixed value: ecs_ram_role.
  credentials_role_name	RAM role name.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  RamRoleArn

  Parameter	Parameter value
  credentials_type	Fixed value: ram_role.
  credentials_role_session_name	The name of the RAM role.
  credentials_role_arn	The ARN of the RAM role.
  credentials_access_key_id	AccessKey ID.
  credentials_access_secret	AccessKey secret.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  STS token

  Parameter	Parameter value
  credentials_type	Fixed value: sts.
  credentials_role_session_name	RAM role name.
  credentials_role_arn	The ARN of the RAM role.
  credentials_access_key_id	AccessKey ID.
  credentials_access_secret	AccessKey secret.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  AccessKey

  Parameter	Parameter value
  credentials_type	Fixed value: ak.
  credentials_access_key_id	AccessKey ID.
  credentials_access_secret	AccessKey secret.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  ClientKey

  Parameter	Parameter value
  credentials_type	Fixed value: client_key.
  client_key_password_from_env_variable	Indicates that the ClientKey password is obtained from a system environment variable. The value is the name of the system environment variable for the password. When you configure this parameter, you must configure the password in a system environment variable. You can customize the variable name.
  client_key_password_from_file_path	Indicates that the ClientKey password is obtained from a file. The value is the absolute or relative path of the password file. When you configure this parameter, you must configure the password in a file. You can customize the file name. Note Choose one of the two parameters: client_key_password_from_env_variable or client_key_password_from_file_path.
  client_key_private_key_path	Absolute or relative path of the ClientKey file. When you configure this parameter, you must save the ClientKey file to a suitable location. You can customize the file name.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  secretsmanager.properties configuration file

  The configuration file must be named secretsmanager.properties.

  The configuration file content varies depending on the authentication method.

  Instance RAM role

  # Access credential type
  credentials_type=ecs_ram_role
  # ECS RAM role name
  credentials_role_name=#credentials_role_name#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  RAMRoleArn

  # Access credential type
  credentials_type=ram_role
  # Role name
  credentials_role_session_name=#role name#
  # Resource ARN
  credentials_role_arn=#role arn#
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  STS token

  # Access credential type
  credentials_type=sts
  # Role name
  credentials_role_session_name=#role name#
  # Resource ARN
  credentials_role_arn=#role arn#
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  AccessKey

  # Access credential type
  credentials_type=ak
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  ClientKey

  # Access credential type
  credentials_type=client_key
  
  # Read the decryption password of the client key. You can read it from an environment variable or a file.
  client_key_password_from_env_variable=#your client key private key password environment variable name#
  client_key_password_from_file_path=#your client key private key password file path#
  
  # Path of the Client Key private key file
  client_key_private_key_path=#your client key private key file path#
  
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  The following sample code shows how to retrieve a credential value. Replace #secretName# with your credential name.

  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
  import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
  
  public class CacheClientEnvironmentSample {
  
      public static void main(String[] args) {
          try {
              // Build the secret client.
              SecretCacheClient client = SecretCacheClientBuilder.newClient();
              // Use the built client to get the credential information.
              SecretInfo secretInfo = client.getSecretInfo("#secretName#");
              System.out.println(secretInfo);
          } catch (CacheSecretException e) {
              e.printStackTrace();
          }
      }
  }

• Method 2: Initialize the client using a custom configuration file

  Note that you must define the configuration file name and path.

  Configuration file

  The configuration file content varies depending on the authentication method.

  Instance RAM role

  # Access credential type
  credentials_type=ecs_ram_role
  # ECS RAM role name
  credentials_role_name=#credentials_role_name#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  RAMRoleArn

  # Access credential type
  credentials_type=ram_role
  # Role name
  credentials_role_session_name=#role name#
  # Resource ARN
  credentials_role_arn=#role arn#
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  STS token

  # Access credential type
  credentials_type=sts
  # Role name
  credentials_role_session_name=#role name#
  # Resource ARN
  credentials_role_arn=#role arn#
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  AccessKey

  # Access credential type
  credentials_type=ak
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  ClientKey

  # Access credential type
  credentials_type=client_key
  
  # Read the decryption password of the client key. You can read it from an environment variable or a file.
  client_key_password_from_env_variable=#your client key private key password environment variable name#
  client_key_password_from_file_path=#your client key private key password file path#
  
  # Path of the Client Key private key file
  client_key_private_key_path=#your client key private key file path#
  
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  The following sample code shows how to retrieve a credential value. Replace #customConfigFileName# with your custom configuration file name and #secretName# with your credential name.

  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
  import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
  import com.aliyuncs.kms.secretsmanager.client.service.BaseSecretManagerClientBuilder;
  
  public class CacheClientCustomConfigFileSample {
  
      public static void main(String[] args) {
          try {
              SecretCacheClient client = SecretCacheClientBuilder.newCacheClientBuilder(
                      BaseSecretManagerClientBuilder.standard().withCustomConfigFile("#customConfigFileName#").build()).build();
              SecretInfo secretInfo = client.getSecretInfo("#secretName#");
              System.out.println(secretInfo);
          } catch (CacheSecretException e) {
              System.out.println("CacheSecretException:" + e.getMessage());
          }
      }
  }

• Method 3: Initialize the client by specifying parameters (accessKey, accessSecret, regionId)

  This method applies only to scenarios where AccessKey is used for authentication.

  Note

  The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. In addition, use a RAM user to call API operations or perform routine O&M. We recommend that you do not save the AccessKey ID and AccessKey Secret in your project code. If you do, the AccessKey pair may be leaked and the security of all the resources that belong to your account may be compromised.

  In this example, the AccessKey pair is saved in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to implement identity authentication.

  • For more information about how to configure authentication information, see Manage access credentials.

  • The method used to configure environment variables varies based on the operating system. For more information, see Configure environment variables in Linux, macOS, and Windows.

  The following sample code shows how to retrieve a credential value. Replace #regionId# with the actual region ID and #secretName# with your credential name.

  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
  import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
  import com.aliyuncs.kms.secretsmanager.client.service.BaseSecretManagerClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.utils.CredentialsProviderUtils;
  
  public class CacheClientSimpleParametersSample {
  
      public static void main(String[] args) {
          try {
              SecretCacheClient client = SecretCacheClientBuilder.newCacheClientBuilder(
                      BaseSecretManagerClientBuilder.standard().withCredentialsProvider(CredentialsProviderUtils
                              .withAccessKey(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"), System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"))).withRegion("#regionId#").build()).build();
              SecretInfo secretInfo = client.getSecretInfo("#secretName#");
              System.out.println(secretInfo);
          } catch (CacheSecretException e) {
              e.printStackTrace();
          }
      }
  }

Python

The sample code for retrieving a credential value varies depending on the client initialization method. You can choose one of the following methods.

• Method 1: Initialize the client using environment variables or a secretsmanager.properties configuration file

  You can use either environment variables or a secretsmanager.properties configuration file.

  Environment variables

  The method for configuring environment variables varies by operating system. For more information, see Configure environment variables on Linux, macOS, and Windows.

  Instance RAM role

  Parameter	Parameter value
  credentials_type	Fixed value: ecs_ram_role.
  credentials_role_name	RAM role name.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  RamRoleArn

  Parameter	Parameter value
  credentials_type	Fixed value: ram_role.
  credentials_role_session_name	The name of the RAM role.
  credentials_role_arn	The ARN of the RAM role.
  credentials_access_key_id	AccessKey ID.
  credentials_access_secret	AccessKey secret.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  STS token

  Parameter	Parameter value
  credentials_type	Fixed value: sts.
  credentials_role_session_name	RAM role name.
  credentials_role_arn	The ARN of the RAM role.
  credentials_access_key_id	AccessKey ID.
  credentials_access_secret	AccessKey secret.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  AccessKey

  Parameter	Parameter value
  credentials_type	Fixed value: ak.
  credentials_access_key_id	AccessKey ID.
  credentials_access_secret	AccessKey secret.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  ClientKey

  Parameter	Parameter value
  credentials_type	Fixed value: client_key.
  client_key_password_from_env_variable	Indicates that the ClientKey password is obtained from a system environment variable. The value is the name of the system environment variable for the password. When you configure this parameter, you must configure the password in a system environment variable. You can customize the variable name.
  client_key_password_from_file_path	Indicates that the ClientKey password is obtained from a file. The value is the absolute or relative path of the password file. When you configure this parameter, you must configure the password in a file. You can customize the file name. Note Choose one of the two parameters: client_key_password_from_env_variable or client_key_password_from_file_path.
  client_key_private_key_path	Absolute or relative path of the ClientKey file. When you configure this parameter, you must save the ClientKey file to a suitable location. You can customize the file name.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  secretsmanager.properties configuration file

  The configuration file must be named secretsmanager.properties.

  The configuration file content varies depending on the authentication method.

  Instance RAM role

  # Access credential type
  credentials_type=ecs_ram_role
  # ECS RAM role name
  credentials_role_name=#credentials_role_name#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  RAMRoleArn

  # Access credential type
  credentials_type=ram_role
  # Role name
  credentials_role_session_name=#role name#
  # Resource ARN
  credentials_role_arn=#role arn#
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  STS token

  # Access credential type
  credentials_type=sts
  # Role name
  credentials_role_session_name=#role name#
  # Resource ARN
  credentials_role_arn=#role arn#
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  AccessKey

  # Access credential type
  credentials_type=ak
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  ClientKey

  # Access credential type
  credentials_type=client_key
  
  # Read the decryption password of the client key. You can read it from an environment variable or a file.
  client_key_password_from_env_variable=#your client key private key password environment variable name#
  client_key_password_from_file_path=#your client key private key password file path#
  
  # Path of the Client Key private key file
  client_key_private_key_path=#your client key private key file path#
  
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  The following sample code shows how to retrieve a credential value. Replace #secretName# with your credential name.

  from alibaba_cloud_secretsmanager_client.secret_manager_cache_client_builder import SecretManagerCacheClientBuilder
  
  if __name__ == '__main__':
      # Build the secret client.
      secret_cache_client = SecretManagerCacheClientBuilder.new_client()
      # Use the built client to get the credential information.
      secret_info = secret_cache_client.get_secret_info("#secretName#")
      print(secret_info.__dict__)

• Method 2: Initialize the client by specifying parameters (accessKey, accessSecret, regionId)

  This method applies only to scenarios where AccessKey is used for authentication.

  Note

  The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. We recommend that you do not save the AccessKey ID and AccessKey Secret in your project code. Otherwise, the AccessKey pair may be leaked and the security of all the resources that belong to your account may be compromised.

  In this example, the AccessKey pair is saved in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to implement identity authentication.

  • For more information about how to configure authentication information, see Manage access credentials.

  • The method that is used to configure environment variables varies based on the operating system. For more information, see Configure environment variables in Linux, macOS, and Windows.

  The following sample code shows how to retrieve a credential value. Replace #regionId# with the actual region ID and #secretName# with your credential name.

  import os
  
  from alibaba_cloud_secretsmanager_client.secret_manager_cache_client_builder import SecretManagerCacheClientBuilder
  from alibaba_cloud_secretsmanager_client.service.default_secret_manager_client_builder import DefaultSecretManagerClientBuilder
  
  if __name__ == '__main__':
      secret_cache_client = SecretManagerCacheClientBuilder.new_cache_client_builder(DefaultSecretManagerClientBuilder.standard() \
          .with_access_key(os.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"), os.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")) \
          .with_region("#regionId#").build()) \
      .build();
      secret_info = secret_cache_client.get_secret_info("#secretName#")
      print(secret_info.__dict__)

Go

The sample code for retrieving a credential value varies depending on the client initialization method. You can choose one of the following methods.

• Method 1: Initialize the client using environment variables or a secretsmanager.properties configuration file

  You can use either environment variables or a secretsmanager.properties configuration file.

  Environment variables

  The method for configuring environment variables varies by operating system. For more information, see Configure environment variables on Linux, macOS, and Windows.

  Instance RAM role

  Parameter	Parameter value
  credentials_type	Fixed value: ecs_ram_role.
  credentials_role_name	RAM role name.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  RamRoleArn

  Parameter	Parameter value
  credentials_type	Fixed value: ram_role.
  credentials_role_session_name	The name of the RAM role.
  credentials_role_arn	The ARN of the RAM role.
  credentials_access_key_id	AccessKey ID.
  credentials_access_secret	AccessKey secret.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  STS token

  Parameter	Parameter value
  credentials_type	Fixed value: sts.
  credentials_role_session_name	RAM role name.
  credentials_role_arn	The ARN of the RAM role.
  credentials_access_key_id	AccessKey ID.
  credentials_access_secret	AccessKey secret.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  AccessKey

  Parameter	Parameter value
  credentials_type	Fixed value: ak.
  credentials_access_key_id	AccessKey ID.
  credentials_access_secret	AccessKey secret.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  ClientKey

  Parameter	Parameter value
  credentials_type	Fixed value: client_key.
  client_key_password_from_env_variable	Indicates that the ClientKey password is obtained from a system environment variable. The value is the name of the system environment variable for the password. When you configure this parameter, you must configure the password in a system environment variable. You can customize the variable name.
  client_key_password_from_file_path	Indicates that the ClientKey password is obtained from a file. The value is the absolute or relative path of the password file. When you configure this parameter, you must configure the password in a file. You can customize the file name. Note Choose one of the two parameters: client_key_password_from_env_variable or client_key_password_from_file_path.
  client_key_private_key_path	Absolute or relative path of the ClientKey file. When you configure this parameter, you must save the ClientKey file to a suitable location. You can customize the file name.
  cache_client_region_id	The format is [{"regionId":"<your region id>"}]. Replace <your region id> with your actual region ID. Important On Linux, when you use the export command to set an environment variable, add an escape character. For example, [{\"regionId\":\"<your region id>\"}].

  secretsmanager.properties configuration file

  The configuration file must be named secretsmanager.properties.

  The configuration file content varies depending on the authentication method.

  Instance RAM role

  # Access credential type
  credentials_type=ecs_ram_role
  # ECS RAM role name
  credentials_role_name=#credentials_role_name#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  RAMRoleArn

  # Access credential type
  credentials_type=ram_role
  # Role name
  credentials_role_session_name=#role name#
  # Resource ARN
  credentials_role_arn=#role arn#
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  STS token

  # Access credential type
  credentials_type=sts
  # Role name
  credentials_role_session_name=#role name#
  # Resource ARN
  credentials_role_arn=#role arn#
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  AccessKey

  # Access credential type
  credentials_type=ak
  # AccessKey ID
  credentials_access_key_id=#access key id#
  # AccessKey secret
  credentials_access_secret=#access key secret#
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  ClientKey

  # Access credential type
  credentials_type=client_key
  
  # Read the decryption password of the client key. You can read it from an environment variable or a file.
  client_key_password_from_env_variable=#your client key private key password environment variable name#
  client_key_password_from_file_path=#your client key private key password file path#
  
  # Path of the Client Key private key file
  client_key_private_key_path=#your client key private key file path#
  
  # Associated KMS service region
  cache_client_region_id=[{"regionId":"#regionId#"}]

  The following sample code shows how to retrieve a credential value. Replace #secretName# with your credential name.

  package main
  
  import (
      "fmt"
      "github.com/aliyun/aliyun-secretsmanager-client-go/sdk"
  )
  func main() { 
     // Build the secret client.
      client, err := sdk.NewClient()
      if err != nil {
          // Handle exceptions
          panic(err)
      }
     // Use the built client to get the credential information.
      secretInfo, err := client.GetSecretInfo("#secretName#")
      if err != nil {
          // Handle exceptions
          panic(err)
      }
      fmt.Printf("SecretValue:%s\n",secretInfo.SecretValue)
  }

• Initialize the client by specifying parameters (accessKey, accessSecret, regionId)

  This method applies only to scenarios where AccessKey is used for authentication.

  Note

  The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. We recommend that you do not save the AccessKey ID and AccessKey Secret in your project code. Otherwise, the AccessKey pair may be leaked and the security of all the resources that belong to your account may be compromised.

  In this example, the AccessKey pair is saved in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to implement identity authentication.

  • For more information about how to configure authentication information, see Manage access credentials.

  • The method that is used to configure environment variables varies based on the operating system. For more information, see Configure environment variables in Linux, macOS, and Windows.

  The following sample code shows how to retrieve a credential value. Replace #regionId# with the actual region ID and #secretName# with your credential name.

  package main
  
  import (
  	"github.com/aliyun/aliyun-secretsmanager-client-go/sdk/service"
  	"github.com/aliyun/aliyun-secretsmanager-client-go/sdk"
  	"os"
  )
  
  func main() {
  	client, err := sdk.NewSecretCacheClientBuilder(service.NewDefaultSecretManagerClientBuilder().Standard().WithAccessKey(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"), os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")).WithRegion("#regionId#").Build()).Build()
  	if err != nil {
  		// Handle exceptions
  		panic(err)
  	}
  	secretInfo, err := client.GetSecretInfo("#secretName#")
  	if err != nil {
  		// Handle exceptions
  		panic(err)
  	}
  }

Java

You can install the secret client in your project using Maven.

<dependency>
    <groupId>com.aliyun</groupId>
    <artifactId>alibabacloud-secretsmanager-client</artifactId>
    <version>1.4.x</version>
</dependency>
<dependency>
  <groupId>com.aliyun</groupId>
  <artifactId>aliyun-java-sdk-core</artifactId>
  <version>4.5.x</version>
</dependency>

Python

For more information about the installation and source code, see aliyun-secretsmanager-client-python.

You can run the pip command to install the secret client.

# If the following command fails, replace pip with pip3
pip install aliyun-secret-manager-client

Go

For more information about the installation and source code, see aliyun-secretsmanager-client-go.

You can use the go get command to install the secret client.

go get -u github.com/aliyun/aliyun-secretsmanager-client-go

Java

The sample code for retrieving a credential value varies depending on the client initialization method. You can choose one of the following methods.

• Method 1: Initialize the client using environment variables or a secretsmanager.properties configuration file

  You can use either environment variables or a secretsmanager.properties configuration file.

  Environment variables

  • Method 1: Retrieve the ClientKey password from an environment variable

    Parameter

    Parameter value

    cache_client_dkms_config_info

    The parameter value format is [{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromEnvVariable":"<YOUR_PASSWORD_ENV_VARIABLE>","clientKeyFile":"<your ClientKey file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]. With this method, you also need to configure the content of the ClientKey's Credential Password (ClientKeyPassword) in an environment variable. You can customize the variable name. After configuration, replace <YOUR_PASSWORD_ENV_VARIABLE> with the variable name. For example, on a Linux operating system: export cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromEnvVariable":"passwordFromEnvVariable","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  • Method 2: Retrieve the ClientKey password from a file

    The downloaded ClientKey Credential Password (ClientKeyPassword) file is named clientKey_****_Password.txt by default. You can change the file name, but you must replace <your Client Key file path> in the value of cache_client_dkms_config_info with the new file path.

    Parameter

    Parameter value

    cache_client_dkms_config_info

    The parameter value format is: [{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromFilePath":"< your password file path >","clientKeyFile":"<your Client Key file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]. For example, on a Linux operating system: export cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromFilePath":"C:\RamSecretPlugin\src\main\resources\clientKeyPassword.txt","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  Description of each configuration item:

  Configuration Item	Parameter descriptions	Description
  Region ID	The region ID where the KMS instance is located.	For specific region IDs, see Regions and zones.
  Endpoint	The domain name of the KMS instance. The format is {instance ID}.kms.aliyuncs.com.	Go to the Instances page. On the instance details page, the Instance VPC Endpoint is the endpoint.
  clientKeyFile	The absolute or relative path of the ClientKey file in JSON format.	The ClientKey file contains the Application Access Secret (ClientKeyContent), which is downloaded when a ClientKey is created in an application access point (AAP). The default file name is ClientKey_******.json. Credential password: The Credential Password (ClientKeyPassword) that is downloaded when you create the ClientKey in AAP. By default, this password is in the ClientKey_******_password.txt file. Important The ClientKey file and the credential password have a one-to-one correspondence. You can only obtain them when you create the ClientKey. If you did not save them during creation, you must create a new ClientKey in the AAP. For more information, see Create an application access point.
  passwordFromFilePath or passwordFromEnvVariable	passwordFromFilePath: The absolute or relative path to the file that contains the credential password. passwordFromEnvVariable: The value is the name of an environment variable that contains the credential password.
  Ignore SSL certificates	Specifies whether to ignore the validity check of the KMS instance SSL certificate. KMS instances have built-in SSL certificates and use the SSL/TLS protocol for authentication and encrypted communication. The valid values are: true: Ignores the validity check. Note If the value is set to true, you do not need to configure caFilePath. false: Performs the validity check.	In a production environment, you must set this parameter to false.
  caFilePath	The absolute or relative path of the KMS instance CA certificate file. The KMS instance CA certificate is used to check the validity of the KMS instance SSL certificate. For example, it checks whether the SSL certificate was issued by the corresponding CA, is within its validity period, and corresponds to the domain name of the KMS instance (endpoint).	Go to the Instances page. On the instance details page, click Download in the Instance CA Certificate section.

  secretsmanager.properties configuration file

  The configuration file must be named secretsmanager.properties.

  The configuration parameter is cache_client_dkms_config_info. cache_client_dkms_config_info uses a JSON array format. You can configure multiple KMS instances to achieve higher service availability and disaster recovery.

  • Method 1: Retrieve the ClientKey password from an environment variable

    The configuration file content is:

    cache_client_dkms_config_info=[{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromEnvVariable":"<YOUR_PASSWORD_ENV_VARIABLE>","clientKeyFile":"<your ClientKey file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]

    With this method, you also need to configure an environment variable with a custom name for the Credential Password (ClientKeyPassword). After configuration, replace <YOUR_PASSWORD_ENV_VARIABLE> with the variable name. For example:

    cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromEnvVariable":"passwordFromEnvVariable","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  • Method 2: Retrieve the ClientKey password from a file

    By default, the downloaded file for the ClientKey Credential Password (ClientKeyPassword) is named clientKey_****_Password.txt. If you change the file name, you must replace <your Client Key file path> in the cache_client_dkms_config_info value with the new file path.

    The configuration file content is:

    cache_client_dkms_config_info=[{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromFilePath":"< your password file path >","clientKeyFile":"<your Client Key file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]

    For example:

    cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromFilePath":"C:\RamSecretPlugin\src\main\resources\clientKeyPassword.txt","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  Description of each configuration item:

  Configuration Item	Parameter descriptions	Description
  Region ID	The region ID where the KMS instance is located.	For specific region IDs, see Regions and zones.
  Endpoint	The domain name of the KMS instance. The format is {instance ID}.kms.aliyuncs.com.	Go to the Instances page. On the instance details page, the Instance VPC Endpoint is the endpoint.
  clientKeyFile	The absolute or relative path of the ClientKey file in JSON format.	The ClientKey file contains the Application Access Secret (ClientKeyContent), which is downloaded when a ClientKey is created in an application access point (AAP). The default file name is ClientKey_******.json. Credential password: The Credential Password (ClientKeyPassword) that is downloaded when you create the ClientKey in AAP. By default, this password is in the ClientKey_******_password.txt file. Important The ClientKey file and the credential password have a one-to-one correspondence. You can only obtain them when you create the ClientKey. If you did not save them during creation, you must create a new ClientKey in the AAP. For more information, see Create an application access point.
  passwordFromFilePath or passwordFromEnvVariable	passwordFromFilePath: The absolute or relative path to the file that contains the credential password. passwordFromEnvVariable: The value is the name of an environment variable that contains the credential password.
  Ignore SSL certificates	Specifies whether to ignore the validity check of the KMS instance SSL certificate. KMS instances have built-in SSL certificates and use the SSL/TLS protocol for authentication and encrypted communication. The valid values are: true: Ignores the validity check. Note If the value is set to true, you do not need to configure caFilePath. false: Performs the validity check.	In a production environment, you must set this parameter to false.
  caFilePath	The absolute or relative path of the KMS instance CA certificate file. The KMS instance CA certificate is used to check the validity of the KMS instance SSL certificate. For example, it checks whether the SSL certificate was issued by the corresponding CA, is within its validity period, and corresponds to the domain name of the KMS instance (endpoint).	Go to the Instances page. On the instance details page, click Download in the Instance CA Certificate section.

  The following sample code shows how to retrieve a credential value. Replace #secretName# with your credential name.

  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
  import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
  
  public class CacheClientEnvironmentSample {
  
      public static void main(String[] args) {
          try {
              // Build the secret client.
              SecretCacheClient client = SecretCacheClientBuilder.newClient();
              // Use the built client to get the credential information.
              SecretInfo secretInfo = client.getSecretInfo("#secretName#");
              System.out.println(secretInfo);
          } catch (CacheSecretException e) {
              e.printStackTrace();
          }
      }
  }

• Method 2: Initialize the client using a custom configuration file

  You must define the configuration file name and path.

  Configuration file

  The configuration parameter is cache_client_dkms_config_info. cache_client_dkms_config_info uses a JSON array format. You can configure multiple KMS instances to achieve higher service availability and disaster recovery.

  • Method 1: Retrieve the ClientKey password from an environment variable

    The configuration file content is:

    cache_client_dkms_config_info=[{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromEnvVariable":"<YOUR_PASSWORD_ENV_VARIABLE>","clientKeyFile":"<your ClientKey file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]

    With this method, you also need to configure an environment variable with a custom name for the Credential Password (ClientKeyPassword). After configuration, replace <YOUR_PASSWORD_ENV_VARIABLE> with the variable name. For example:

    cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromEnvVariable":"passwordFromEnvVariable","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  • Method 2: Retrieve the ClientKey password from a file

    By default, the downloaded file for the ClientKey Credential Password (ClientKeyPassword) is named clientKey_****_Password.txt. If you change the file name, you must replace <your Client Key file path> in the cache_client_dkms_config_info value with the new file path.

    The configuration file content is:

    cache_client_dkms_config_info=[{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromFilePath":"< your password file path >","clientKeyFile":"<your Client Key file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]

    For example:

    cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromFilePath":"C:\RamSecretPlugin\src\main\resources\clientKeyPassword.txt","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  Description of each configuration item:

  Configuration Item	Parameter descriptions	Description
  Region ID	The region ID where the KMS instance is located.	For specific region IDs, see Regions and zones.
  Endpoint	The domain name of the KMS instance. The format is {instance ID}.kms.aliyuncs.com.	Go to the Instances page. On the instance details page, the Instance VPC Endpoint is the endpoint.
  clientKeyFile	The absolute or relative path of the ClientKey file in JSON format.	The ClientKey file contains the Application Access Secret (ClientKeyContent), which is downloaded when a ClientKey is created in an application access point (AAP). The default file name is ClientKey_******.json. Credential password: The Credential Password (ClientKeyPassword) that is downloaded when you create the ClientKey in AAP. By default, this password is in the ClientKey_******_password.txt file. Important The ClientKey file and the credential password have a one-to-one correspondence. You can only obtain them when you create the ClientKey. If you did not save them during creation, you must create a new ClientKey in the AAP. For more information, see Create an application access point.
  passwordFromFilePath or passwordFromEnvVariable	passwordFromFilePath: The absolute or relative path to the file that contains the credential password. passwordFromEnvVariable: The value is the name of an environment variable that contains the credential password.
  Ignore SSL certificates	Specifies whether to ignore the validity check of the KMS instance SSL certificate. KMS instances have built-in SSL certificates and use the SSL/TLS protocol for authentication and encrypted communication. The valid values are: true: Ignores the validity check. Note If the value is set to true, you do not need to configure caFilePath. false: Performs the validity check.	In a production environment, you must set this parameter to false.
  caFilePath	The absolute or relative path of the KMS instance CA certificate file. The KMS instance CA certificate is used to check the validity of the KMS instance SSL certificate. For example, it checks whether the SSL certificate was issued by the corresponding CA, is within its validity period, and corresponds to the domain name of the KMS instance (endpoint).	Go to the Instances page. On the instance details page, click Download in the Instance CA Certificate section.

  The following sample code shows how to retrieve a credential value. Replace #customConfigFileName# with your custom configuration file name and #secretName# with your credential name.

  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
  import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
  import com.aliyuncs.kms.secretsmanager.client.service.BaseSecretManagerClientBuilder;
  
  public class CacheClientCustomConfigFileSample {
  
      public static void main(String[] args) {
          try {
              SecretCacheClient client = SecretCacheClientBuilder.newCacheClientBuilder(
                      BaseSecretManagerClientBuilder.standard().withCustomConfigFile("#customConfigFileName#").build()).build();
              SecretInfo secretInfo = client.getSecretInfo("#secretName#");
              System.out.println(secretInfo);
          } catch (CacheSecretException e) {
              System.out.println("CacheSecretException:" + e.getMessage());
          }
      }
  }

• Method 3: Initialize the client by specifying parameters (accessKey, accessSecret, regionId)

  This method applies only to scenarios where AccessKey is used for authentication.

  Note

  The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. In addition, use a RAM user to call API operations or perform routine O&M. We recommend that you do not save the AccessKey ID and AccessKey Secret in your project code. If you do, the AccessKey pair may be leaked and the security of all the resources that belong to your account may be compromised.

  In this example, the AccessKey pair is saved in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to implement identity authentication.

  • For more information about how to configure authentication information, see Manage access credentials.

  • The method used to configure environment variables varies based on the operating system. For more information, see Configure environment variables in Linux, macOS, and Windows.

  The following sample code shows how to retrieve a credential value. Replace #regionId# with the actual region ID and #secretName# with your credential name.

  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClient;
  import com.aliyuncs.kms.secretsmanager.client.SecretCacheClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.exception.CacheSecretException;
  import com.aliyuncs.kms.secretsmanager.client.model.SecretInfo;
  import com.aliyuncs.kms.secretsmanager.client.service.BaseSecretManagerClientBuilder;
  import com.aliyuncs.kms.secretsmanager.client.utils.CredentialsProviderUtils;
  
  public class CacheClientSimpleParametersSample {
  
      public static void main(String[] args) {
          try {
              SecretCacheClient client = SecretCacheClientBuilder.newCacheClientBuilder(
                      BaseSecretManagerClientBuilder.standard().withCredentialsProvider(CredentialsProviderUtils
                              .withAccessKey(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"), System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"))).withRegion("#regionId#").build()).build();
              SecretInfo secretInfo = client.getSecretInfo("#secretName#");
              System.out.println(secretInfo);
          } catch (CacheSecretException e) {
              e.printStackTrace();
          }
      }
  }

Python

The sample code for retrieving a credential value varies depending on the client initialization method. You can choose one of the following methods.

• Method 1: Initialize the client using system environment variables or a secretsmanager.properties configuration file

  You can use either environment variables or a secretsmanager.properties configuration file.

  Environment variables

  • Method 1: Retrieve the ClientKey password from an environment variable

    Parameter

    Parameter value

    cache_client_dkms_config_info

    The parameter value format is [{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromEnvVariable":"<YOUR_PASSWORD_ENV_VARIABLE>","clientKeyFile":"<your ClientKey file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]. With this method, you also need to configure the content of the ClientKey's Credential Password (ClientKeyPassword) in an environment variable. You can customize the variable name. After configuration, replace <YOUR_PASSWORD_ENV_VARIABLE> with the variable name. For example, on a Linux operating system: export cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromEnvVariable":"passwordFromEnvVariable","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  • Method 2: Retrieve the ClientKey password from a file

    The downloaded ClientKey Credential Password (ClientKeyPassword) file is named clientKey_****_Password.txt by default. You can change the file name, but you must replace <your Client Key file path> in the value of cache_client_dkms_config_info with the new file path.

    Parameter

    Parameter value

    cache_client_dkms_config_info

    The parameter value format is: [{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromFilePath":"< your password file path >","clientKeyFile":"<your Client Key file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]. For example, on a Linux operating system: export cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromFilePath":"C:\RamSecretPlugin\src\main\resources\clientKeyPassword.txt","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  Description of each configuration item:

  Configuration Item	Parameter descriptions	Description
  Region ID	The region ID where the KMS instance is located.	For specific region IDs, see Regions and zones.
  Endpoint	The domain name of the KMS instance. The format is {instance ID}.kms.aliyuncs.com.	Go to the Instances page. On the instance details page, the Instance VPC Endpoint is the endpoint.
  clientKeyFile	The absolute or relative path of the ClientKey file in JSON format.	The ClientKey file contains the Application Access Secret (ClientKeyContent), which is downloaded when a ClientKey is created in an application access point (AAP). The default file name is ClientKey_******.json. Credential password: The Credential Password (ClientKeyPassword) that is downloaded when you create the ClientKey in AAP. By default, this password is in the ClientKey_******_password.txt file. Important The ClientKey file and the credential password have a one-to-one correspondence. You can only obtain them when you create the ClientKey. If you did not save them during creation, you must create a new ClientKey in the AAP. For more information, see Create an application access point.
  passwordFromFilePath or passwordFromEnvVariable	passwordFromFilePath: The absolute or relative path to the file that contains the credential password. passwordFromEnvVariable: The value is the name of an environment variable that contains the credential password.
  Ignore SSL certificates	Specifies whether to ignore the validity check of the KMS instance SSL certificate. KMS instances have built-in SSL certificates and use the SSL/TLS protocol for authentication and encrypted communication. The valid values are: true: Ignores the validity check. Note If the value is set to true, you do not need to configure caFilePath. false: Performs the validity check.	In a production environment, you must set this parameter to false.
  caFilePath	The absolute or relative path of the KMS instance CA certificate file. The KMS instance CA certificate is used to check the validity of the KMS instance SSL certificate. For example, it checks whether the SSL certificate was issued by the corresponding CA, is within its validity period, and corresponds to the domain name of the KMS instance (endpoint).	Go to the Instances page. On the instance details page, click Download in the Instance CA Certificate section.

  secretsmanager.properties configuration file

  The configuration file must be named secretsmanager.properties.

  The configuration parameter is cache_client_dkms_config_info. cache_client_dkms_config_info uses a JSON array format. You can configure multiple KMS instances to achieve higher service availability and disaster recovery.

  • Method 1: Retrieve the ClientKey password from an environment variable

    The configuration file content is:

    cache_client_dkms_config_info=[{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromEnvVariable":"<YOUR_PASSWORD_ENV_VARIABLE>","clientKeyFile":"<your ClientKey file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]

    With this method, you also need to configure an environment variable with a custom name for the Credential Password (ClientKeyPassword). After configuration, replace <YOUR_PASSWORD_ENV_VARIABLE> with the variable name. For example:

    cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromEnvVariable":"passwordFromEnvVariable","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  • Method 2: Retrieve the ClientKey password from a file

    By default, the downloaded file for the ClientKey Credential Password (ClientKeyPassword) is named clientKey_****_Password.txt. If you change the file name, you must replace <your Client Key file path> in the cache_client_dkms_config_info value with the new file path.

    The configuration file content is:

    cache_client_dkms_config_info=[{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromFilePath":"< your password file path >","clientKeyFile":"<your Client Key file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]

    For example:

    cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromFilePath":"C:\RamSecretPlugin\src\main\resources\clientKeyPassword.txt","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  Description of each configuration item:

  Configuration Item	Parameter descriptions	Description
  Region ID	The region ID where the KMS instance is located.	For specific region IDs, see Regions and zones.
  Endpoint	The domain name of the KMS instance. The format is {instance ID}.kms.aliyuncs.com.	Go to the Instances page. On the instance details page, the Instance VPC Endpoint is the endpoint.
  clientKeyFile	The absolute or relative path of the ClientKey file in JSON format.	The ClientKey file contains the Application Access Secret (ClientKeyContent), which is downloaded when a ClientKey is created in an application access point (AAP). The default file name is ClientKey_******.json. Credential password: The Credential Password (ClientKeyPassword) that is downloaded when you create the ClientKey in AAP. By default, this password is in the ClientKey_******_password.txt file. Important The ClientKey file and the credential password have a one-to-one correspondence. You can only obtain them when you create the ClientKey. If you did not save them during creation, you must create a new ClientKey in the AAP. For more information, see Create an application access point.
  passwordFromFilePath or passwordFromEnvVariable	passwordFromFilePath: The absolute or relative path to the file that contains the credential password. passwordFromEnvVariable: The value is the name of an environment variable that contains the credential password.
  Ignore SSL certificates	Specifies whether to ignore the validity check of the KMS instance SSL certificate. KMS instances have built-in SSL certificates and use the SSL/TLS protocol for authentication and encrypted communication. The valid values are: true: Ignores the validity check. Note If the value is set to true, you do not need to configure caFilePath. false: Performs the validity check.	In a production environment, you must set this parameter to false.
  caFilePath	The absolute or relative path of the KMS instance CA certificate file. The KMS instance CA certificate is used to check the validity of the KMS instance SSL certificate. For example, it checks whether the SSL certificate was issued by the corresponding CA, is within its validity period, and corresponds to the domain name of the KMS instance (endpoint).	Go to the Instances page. On the instance details page, click Download in the Instance CA Certificate section.

  The following sample code shows how to retrieve a credential value. Replace #secretName# with your credential name.

  from alibaba_cloud_secretsmanager_client.secret_manager_cache_client_builder import SecretManagerCacheClientBuilder
  
  if __name__ == '__main__':
      # Build the secret client.
      secret_cache_client = SecretManagerCacheClientBuilder.new_client()
      # Use the built client to get the credential information.
      secret_info = secret_cache_client.get_secret_info("#secretName#")
      print(secret_info.__dict__)

• Method 2: Initialize the client by specifying parameters (accessKey, accessSecret, regionId)

  This method applies only to scenarios where AccessKey is used for authentication.

  Note

  The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. We recommend that you do not save the AccessKey ID and AccessKey Secret in your project code. Otherwise, the AccessKey pair may be leaked and the security of all the resources that belong to your account may be compromised.

  In this example, the AccessKey pair is saved in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to implement identity authentication.

  • For more information about how to configure authentication information, see Manage access credentials.

  • The method that is used to configure environment variables varies based on the operating system. For more information, see Configure environment variables in Linux, macOS, and Windows.

  The following sample code shows how to retrieve a credential value. Replace #regionId# with the actual region ID and #secretName# with your credential name.

  import os
  
  from alibaba_cloud_secretsmanager_client.secret_manager_cache_client_builder import SecretManagerCacheClientBuilder
  from alibaba_cloud_secretsmanager_client.service.default_secret_manager_client_builder import DefaultSecretManagerClientBuilder
  
  if __name__ == '__main__':
      secret_cache_client = SecretManagerCacheClientBuilder.new_cache_client_builder(DefaultSecretManagerClientBuilder.standard() \
          .with_access_key(os.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"), os.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")) \
          .with_region("#regionId#").build()) \
      .build();
      secret_info = secret_cache_client.get_secret_info("#secretName#")
      print(secret_info.__dict__)

Go

The sample code for retrieving a credential value varies depending on the client initialization method. You can choose one of the following methods.

• Method 1: Initialize the client using system environment variables or a secretsmanager.properties configuration file

  You can use either environment variables or a secretsmanager.properties configuration file.

  Environment variables

  • Method 1: Retrieve the ClientKey password from an environment variable

    Parameter

    Parameter value

    cache_client_dkms_config_info

    The parameter value format is [{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromEnvVariable":"<YOUR_PASSWORD_ENV_VARIABLE>","clientKeyFile":"<your ClientKey file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]. With this method, you also need to configure the content of the ClientKey's Credential Password (ClientKeyPassword) in an environment variable. You can customize the variable name. After configuration, replace <YOUR_PASSWORD_ENV_VARIABLE> with the variable name. For example, on a Linux operating system: export cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromEnvVariable":"passwordFromEnvVariable","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  • Method 2: Retrieve the ClientKey password from a file

    The downloaded ClientKey Credential Password (ClientKeyPassword) file is named clientKey_****_Password.txt by default. You can change the file name, but you must replace <your Client Key file path> in the value of cache_client_dkms_config_info with the new file path.

    Parameter

    Parameter value

    cache_client_dkms_config_info

    The parameter value format is: [{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromFilePath":"< your password file path >","clientKeyFile":"<your Client Key file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]. For example, on a Linux operating system: export cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromFilePath":"C:\RamSecretPlugin\src\main\resources\clientKeyPassword.txt","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  Description of each configuration item:

  Configuration Item	Parameter descriptions	Description
  Region ID	The region ID where the KMS instance is located.	For specific region IDs, see Regions and zones.
  Endpoint	The domain name of the KMS instance. The format is {instance ID}.kms.aliyuncs.com.	Go to the Instances page. On the instance details page, the Instance VPC Endpoint is the endpoint.
  clientKeyFile	The absolute or relative path of the ClientKey file in JSON format.	The ClientKey file contains the Application Access Secret (ClientKeyContent), which is downloaded when a ClientKey is created in an application access point (AAP). The default file name is ClientKey_******.json. Credential password: The Credential Password (ClientKeyPassword) that is downloaded when you create the ClientKey in AAP. By default, this password is in the ClientKey_******_password.txt file. Important The ClientKey file and the credential password have a one-to-one correspondence. You can only obtain them when you create the ClientKey. If you did not save them during creation, you must create a new ClientKey in the AAP. For more information, see Create an application access point.
  passwordFromFilePath or passwordFromEnvVariable	passwordFromFilePath: The absolute or relative path to the file that contains the credential password. passwordFromEnvVariable: The value is the name of an environment variable that contains the credential password.
  Ignore SSL certificates	Specifies whether to ignore the validity check of the KMS instance SSL certificate. KMS instances have built-in SSL certificates and use the SSL/TLS protocol for authentication and encrypted communication. The valid values are: true: Ignores the validity check. Note If the value is set to true, you do not need to configure caFilePath. false: Performs the validity check.	In a production environment, you must set this parameter to false.
  caFilePath	The absolute or relative path of the KMS instance CA certificate file. The KMS instance CA certificate is used to check the validity of the KMS instance SSL certificate. For example, it checks whether the SSL certificate was issued by the corresponding CA, is within its validity period, and corresponds to the domain name of the KMS instance (endpoint).	Go to the Instances page. On the instance details page, click Download in the Instance CA Certificate section.

  secretsmanager.properties configuration file

  The configuration file must be named secretsmanager.properties.

  The configuration parameter is cache_client_dkms_config_info. cache_client_dkms_config_info uses a JSON array format. You can configure multiple KMS instances to achieve higher service availability and disaster recovery.

  • Method 1: Retrieve the ClientKey password from an environment variable

    The configuration file content is:

    cache_client_dkms_config_info=[{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromEnvVariable":"<YOUR_PASSWORD_ENV_VARIABLE>","clientKeyFile":"<your ClientKey file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]

    With this method, you also need to configure an environment variable with a custom name for the Credential Password (ClientKeyPassword). After configuration, replace <YOUR_PASSWORD_ENV_VARIABLE> with the variable name. For example:

    cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromEnvVariable":"passwordFromEnvVariable","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  • Method 2: Retrieve the ClientKey password from a file

    By default, the downloaded file for the ClientKey Credential Password (ClientKeyPassword) is named clientKey_****_Password.txt. If you change the file name, you must replace <your Client Key file path> in the cache_client_dkms_config_info value with the new file path.

    The configuration file content is:

    cache_client_dkms_config_info=[{"regionId":"<your dkms regionId >","endpoint":"<your dkms endpoint>","passwordFromFilePath":"< your password file path >","clientKeyFile":"<your Client Key file path>","ignoreSslCerts":false,"caFilePath":"<your CA certificate file path>"}]

    For example:

    cache_client_dkms_config_info=[{"regionId":"cn-hangzhou","endpoint":"kst-hzz634e67d126u9p9****.cryptoservice.kms.aliyuncs.com","passwordFromFilePath":"C:\RamSecretPlugin\src\main\resources\clientKeyPassword.txt","clientKeyFile":"C:\RamSecretPlugin\src\main\resources\clientKey_KAAP.json","ignoreSslCerts":false,"caFilePath":"C:\RamSecretPlugin\src\main\resources\PrivateKmsCA_kst-hzz634e67d126u9p9****.pem"}]

  Description of each configuration item:

  Configuration Item	Parameter descriptions	Description
  Region ID	The region ID where the KMS instance is located.	For specific region IDs, see Regions and zones.
  Endpoint	The domain name of the KMS instance. The format is {instance ID}.kms.aliyuncs.com.	Go to the Instances page. On the instance details page, the Instance VPC Endpoint is the endpoint.
  clientKeyFile	The absolute or relative path of the ClientKey file in JSON format.	The ClientKey file contains the Application Access Secret (ClientKeyContent), which is downloaded when a ClientKey is created in an application access point (AAP). The default file name is ClientKey_******.json. Credential password: The Credential Password (ClientKeyPassword) that is downloaded when you create the ClientKey in AAP. By default, this password is in the ClientKey_******_password.txt file. Important The ClientKey file and the credential password have a one-to-one correspondence. You can only obtain them when you create the ClientKey. If you did not save them during creation, you must create a new ClientKey in the AAP. For more information, see Create an application access point.
  passwordFromFilePath or passwordFromEnvVariable	passwordFromFilePath: The absolute or relative path to the file that contains the credential password. passwordFromEnvVariable: The value is the name of an environment variable that contains the credential password.
  Ignore SSL certificates	Specifies whether to ignore the validity check of the KMS instance SSL certificate. KMS instances have built-in SSL certificates and use the SSL/TLS protocol for authentication and encrypted communication. The valid values are: true: Ignores the validity check. Note If the value is set to true, you do not need to configure caFilePath. false: Performs the validity check.	In a production environment, you must set this parameter to false.
  caFilePath	The absolute or relative path of the KMS instance CA certificate file. The KMS instance CA certificate is used to check the validity of the KMS instance SSL certificate. For example, it checks whether the SSL certificate was issued by the corresponding CA, is within its validity period, and corresponds to the domain name of the KMS instance (endpoint).	Go to the Instances page. On the instance details page, click Download in the Instance CA Certificate section.

  The following sample code shows how to retrieve a credential value. Replace #secretName# with your credential name.

  package main
  
  import (
      "fmt"
      "github.com/aliyun/aliyun-secretsmanager-client-go/sdk"
  )
  func main() { 
     // Build the secret client.
      client, err := sdk.NewClient()
      if err != nil {
          // Handle exceptions
          panic(err)
      }
     // Use the built client to get the credential information.
      secretInfo, err := client.GetSecretInfo("#secretName#")
      if err != nil {
          // Handle exceptions
          panic(err)
      }
      fmt.Printf("SecretValue:%s\n",secretInfo.SecretValue)
  }

• Initialize the client by specifying parameters (accessKey, accessSecret, regionId)

  This method applies only to scenarios where AccessKey is used for authentication.

  Note

  The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using the AccessKey pair to perform operations is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. We recommend that you do not save the AccessKey ID and AccessKey Secret in your project code. Otherwise, the AccessKey pair may be leaked and the security of all the resources that belong to your account may be compromised.

  In this example, the AccessKey pair is saved in ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables to implement identity authentication.

  • For more information about how to configure authentication information, see Manage access credentials.

  • The method that is used to configure environment variables varies based on the operating system. For more information, see Configure environment variables in Linux, macOS, and Windows.

  The following sample code shows how to retrieve a credential value. Replace #regionId# with the actual region ID and #secretName# with your credential name.

  package main
  
  import (
  	"github.com/aliyun/aliyun-secretsmanager-client-go/sdk/service"
  	"github.com/aliyun/aliyun-secretsmanager-client-go/sdk"
  	"os"
  )
  
  func main() {
  	client, err := sdk.NewSecretCacheClientBuilder(service.NewDefaultSecretManagerClientBuilder().Standard().WithAccessKey(os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"), os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")).WithRegion("#regionId#").Build()).Build()
  	if err != nil {
  		// Handle exceptions
  		panic(err)
  	}
  	secretInfo, err := client.GetSecretInfo("#secretName#")
  	if err != nil {
  		// Handle exceptions
  		panic(err)
  	}
  }