Key Management Service:SetSecretPolicy

The name or Alibaba Cloud Resource Name (ARN) of the secret.

The name of the secret policy. The value can only be `default`.

The content of the secret policy. The value must be in the JSON format. The value can be up to 32,768 bytes in length.

A secret policy contains the following elements:

• Version: The version of the secret policy. The value can only be 1.

• Statement: The statement of the secret policy. Each secret policy can contain one or more statements.

The following code shows the format of a secret policy:

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "Enable RAM User Permissions",
            "Effect": "Allow",
            "Principal": {
              "RAM": ["acs:ram::12345678****:*"]
            },
            "Action": [
                "kms:*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

The following section describes the elements in a statement:

• Sid: Optional. The custom identifier of the statement. The value can be up to 128 characters in length and can contain uppercase letters (A-Z), lowercase letters (a-z), digits (0-9), and special characters, including underscores (_), forward slashes (/), equal signs (=), plus signs (+), periods (.), at signs (@), and hyphens (-).

• Effect: Required. Specifies whether to allow or deny the permissions in the statement. Valid values: Allow and Deny.

• Principal: Required. The principal that is authorized to access the secret. You can set this parameter to the current Alibaba Cloud account (the account to which the secret belongs), a RAM user or RAM role of the current Alibaba Cloud account, or a RAM user or RAM role of another Alibaba Cloud account.

• Action: Required. The API operations that are allowed or denied. The value must start with `kms:`. For a list of supported operations, see Secret policy overview. If you specify an operation that is not in the list, the operation does not take effect.

• Resource: Required. The value can only be `*`, which indicates the current KMS secret.

• Condition: Optional. The conditions for the authorization to take effect. You can use conditions to evaluate the context of an API request to determine whether a policy statement is applicable. The format is "Condition": {"condition operator": {"condition key": "condition value"}}. For more information, see Secret policy overview.