Key Management Service:CreateSecret

The operation that you want to perform. Set the value to CreateSecret.

The secret name.

The name can be up to 192 characters in length, and can contain letters, digits, underscores (_), forward slashes (/), plus signs (+), equal signs (=), periods (.), hyphens (-), and at signs (@). The following list describes the name requirements for different types of secrets:

• If SecretType is set to Generic or Rds, the name cannot start with acs/.
• If SecretType is set to RAMCredentials, set the value to $Auto. In this case, KMS automatically generates a secret name that starts with acs/ram/user/. The name includes the display name of a required Resource Access Management (RAM) user.
• If SecretType is set to ECS, the name must start with acs/ecs/.

The initial version number. The version number is unique within the secret.

The version number can be up to 64 characters in length.

The ID of the key that is used to encrypt the secret value.

The secret value. The value can be up to 30,720 bytes in length, which is equivalent to 30 KB in size. KMS uses the specified key to encrypt the secret value and then stores the secret value in the initial version.

• If SecretType is set to Generic, you can configure a custom secret value.
• If SecretType is set to Rds, the secret value is in the {"Accounts":[{"AccountName":"","AccountPassword":""}]} format. AccountName indicates the username of the account that is used to connect to the ApsaraDB RDS instance, and AccountPassword indicates the password of the account.
• If SecretType is set to Redis, the secret value is in the {"Accounts":[{"AccountName":"","AccountPassword":""}]} format. AccountName indicates the username of the account that is used to connect to the ApsaraDB for Redis instance, and AccountPassword indicates the password of the account.
• If SecretType is set to RAMCredentials, the secret value is in the {"AccessKeys":[{"AccessKeyId":"","AccessKeySecret":""}]} format. AccessKeyId indicates the AccessKey ID of the RAM user and AccessKeySecret indicates the AccessKey secret of the RAM user. You must specify all the AccessKey pairs of the RAM user.
• If SecretType is set to ECS, the secret value must be in one the following formats:
  • {"UserName":"","Password": ""}: This format is used when the value of SecretSubType is set to Password. UserName indicates the username that is used to log on to the ECS instance, and Password indicates the password that is used to log on to the ECS instance.
  • {"UserName":"","PublicKey": "", "PrivateKey": ""}: This format is used when the value of SecretSubType is set to SSHKey. PublicKey indicates the SSH public key that is used to log on to the ECS instance, and PrivateKey specifies the SSH private key that is used to log on to the ECS instance.

The type of the secret value. Valid values:

• text (default)
• binary

The description of the secret.

The tags of the secret. A tag consists of a key-value pair.

A tag key or a tag value can be up to 128 characters in length and can contain letters, digits, forward slashes (/), backslashes (\), underscores (_), hyphens (-), periods (.), plus signs (+), equal sign (=), colons (:), and at signs (@).

• A tag key cannot start with aliyun or acs:.
• You can configure up to 20 key-value pairs for each secret.

The type of the secret. Valid values:

• Generic (default): generic secret.
• Generic: ApsaraDB RDS secret
• Redis: ApsaraDB for Redis secret
• RAMCredentials: RAM secret
• ECS: ECS secret

The extended configuration of the secret. This parameter specifies the properties of the secret of the specific type. The value can be up to 1,024 characters in length.

• If SecretType is set to Generic, you do not need to configure this parameter.
• If SecretType is set to Rds, you must configure the following fields in the ExtendedConfig parameter:
  • SecretSubType: required. The subtype of the secret. Valid values:
    • SingleUser: KMS manages the ApsaraDB RDS secret in single-account mode. When the secret is rotated, the password of the specified account is reset to a new random password.
    • DoubleUsers: KMS manages the ApsaraDB RDS secret in dual-account mode. One account is referenced by the ACSCurrent version, and the other account is referenced by the ACSPrevious version. When the secret is rotated, the password of the account referenced by the ACSPrevious version is reset to a new random password. Then, KMS switches the referenced accounts between the ACSCurrent and ACSPrevious versions.
  • DBInstanceId: required. The ApsaraDB RDS instance to which the ApsaraDB RDS account belongs.
  • CustomData: optional. The custom data. The value is a collection of key-value pairs in the JSON format. Up to 10 key-value pairs can be specified. Separate multiple key-value pairs with commas (,). Example: {"Key1": "v1", "fds":"fdsf"}. The default value is a pair of empty braces ({}).
• If SecretType is set to Redis, you must configure the following fields in the ExtendedConfig parameter:
  • SecretSubType: required. The subtype of the secret. Valid values:
    • DoubleUsers: KMS manages the ApsaraDB for Redis secret in dual-account mode. One account is referenced by the ACSCurrent version, and the other account is referenced by the ACSPrevious version. When the secret is rotated, the password of the account referenced by the ACSPrevious version is reset to a new random password. Then, KMS switches the referenced accounts between the ACSCurrent and ACSPrevious versions.
  • AccountName: required. The username of the account that is used to log on to the ApsaraDB for Redis database.
  • CloneAccountName: required. The username of the account used to log on to the ApsaraDB for Redis database, which is the value of AccountName appended with the _clone suffix.
  • AccountPrivilege: required. The permissions to access the ApsaraDB for Redis database.
  • InstanceId: required. The ID of the ApsaraDB for Redis instance.
  • RegionId: required. The ID of the region where the ApsaraDB for Redis instance resides.
  • CustomData: optional. The custom data. The value is a collection of key-value pairs in the JSON format. Up to 10 key-value pairs can be specified. Separate multiple key-value pairs with commas (,). Example: {"Key1": "v1", "fds":"fdsf"}. The default value is a pair of empty braces ({}).
• If SecretType is set to RAMCredentials, you must configure the following fields in the ExtendedConfig parameter:
  • SecretSubType: required. The subtype of the secret. Set the value to RamUserAccessKey.
  • UserName: required. The name of the RAM user.
  • CustomData: optional. The custom data. The value is a collection of key-value pairs in the JSON format. Up to 10 key-value pairs can be specified. Separate multiple key-value pairs with commas (,). The default value is a pair of empty braces ({}).
• If SecretType is set to ECS, you must configure the following fields in the ExtendedConfig parameter:
  • SecretSubType: required. The subtype of the secret. Valid values:
    • Password: the password that is used to log on to the ECS instance.
    • SSHKey: the SSH public key and private key that are used to log on to the ECS instance.
  • RegionId: required. The ID of the region in which the ECS instance resides.
  • InstanceId: required. The ID of the ECS instance.
  • CustomData: optional. The custom data. The value is a collection of key-value pairs in the JSON format. Up to 10 key-value pairs can be specified. Separate multiple key-value pairs with commas (,). The default value is a pair of empty braces ({}).

Specifies whether to enable automatic rotation. Valid values:

• true
• false (default)

The interval for automatic rotation. Valid values: 6 hours to 8,760 hours (365 days).

The value is in the integer[unit] format. integer indicates the length of time. unit: indicates the time unit.

The unit can be d (day), h (hour), m (minute), or s (second). For example, both 7d and 604800s indicate a seven-day interval.

The ID of the KMS instance.

The content of the secret policy. The value is in the JSON format. The value can be up to 32,768 bytes in length.

For more information about secret policies, see Overview. If you do not specify this parameter, the default secret policy is used.

A secret policy contains the following content:

• Version: the version of the secret policy. Set the value to 1.
• Statement: the statement of the secret policy. Each secret policy contains one or more statements.

Example:

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "Enable RAM User Permissions",
            "Effect": "Allow",
            "Principal": {
              "RAM": ["acs:ram::123456789012:root"]
            },
            "Action": [
                "kms:*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Statement description:

• Sid: optional. The statement identifier of a custom statement. The value can be up to 128 characters in length and can contain letters, digits, and the following special characters: _ / + = . @ -
• Effect: required. Specifies whether the permissions in a policy statement are allowed or denied. Valid values: Allow and Deny.
• Principal: required. The authorization principal of the policy. The following principals are supported: the current Alibaba Cloud account to which the secret belongs, RAM users and RAM roles of the current Alibaba Cloud account, and RAM users and RAM roles of other Alibaba Cloud accounts.
• Action: required. The API operation that you want to allow or deny. The value must start with kms:. For more information about the API operation scope, see Overview. If you specify an API operation outside the scope, the API operation does not take effect.
• Resource: required. Set the value to an asterisk (*), which specifies the current secret.
• Condition: optional. The conditions that are required for a policy to take effect. Conditions allow you to evaluate the context of an API request to determine whether a policy statement applies. Format: "Condition": {"condition operator": {"condition key": "condition value"}}. For more information, see Overview.

The ID of the request, which is used to locate and troubleshoot issues.

Indicates whether automatic rotation is enabled. Valid values:

• Enabled: indicates that automatic rotation is enabled.
• Disabled: indicates that automatic rotation is disabled.
• Invalid: indicates that the status of automatic rotation is abnormal. In this case, Secrets Manager cannot automatically rotate the secret.

The secret name.

The version number of the secret.

The time when the next rotation is performed.

The type of the secret. Valid values:

• Generic: generic secret
• Generic: ApsaraDB RDS secret
• Redis: ApsaraDB for Redis secret
• RAMCredentials: RAM secret
• ECS: ECS secret

The interval for automatic rotation.

The value is in the integer[unit] format. integer indicates the length of time. unit: indicates the time unit. The unit field has a fixed value of s. For example, if automatic rotation is performed at an interval of 7 days, set RotationInterval to 604800s.

The Alibaba Cloud Resource Name (ARN) of the secret.

The extended configuration of the secret.

The ID of the KMS instance.