Key Management Service:Secrets Manager Client

Step 1: Create a RAM role and configure permissions

Step 2: Set environment variables or configuration file

The SDK supports the following two methods to obtain access credentials:

• Environment variables: Configuration methods vary by operating system. For more information, see .

  Warning

  Do not modify the parameter names. Otherwise, the SDK cannot recognize them.

• Configuration file: The default configuration file is secretsmanager.properties (the file name cannot be changed).To ensure your application loads the configuration file correctly, place it in the appropriate configuration directory. Common configuration directories for different languages include:

  • Java: Place the configuration file in the src/main/resources directory so it is automatically included in the classpath during compilation.

  • Go: Place the configuration file in the project root directory or a dedicated config directory, then load it through code.

  • Python: Place the configuration file in the project directory or a specific config directory, and use an appropriate method (such as os.path or pkg_resources) to load it.

• If you use a custom configuration file, you must specify the file path (#customConfigFileName#) during client initialization.

Step 1: Create an AccessKey and configure permissions

Step 2: Set environment variables or configuration file

The SDK supports the following two methods to obtain access credentials:

• Environment variables: Configuration methods vary by operating system. For more information, see .

  Warning

  Do not modify the parameter names. Otherwise, the SDK cannot recognize them.

• Configuration file: The default configuration file is secretsmanager.properties (the file name cannot be changed).To ensure your application loads the configuration file correctly, place it in the appropriate configuration directory. Common configuration directories for different languages include:

  • Java: Place the configuration file in the src/main/resources directory so it is automatically included in the classpath during compilation.

  • Go: Place the configuration file in the project root directory or a dedicated config directory, then load it through code.

  • Python: Place the configuration file in the project directory or a specific config directory, and use an appropriate method (such as os.path or pkg_resources) to load it.

• If you use a custom configuration file, you must specify the file path (#customConfigFileName#) during client initialization.

Step 1: Create an OIDC role ARN and configure permissions

Step 2: Set environment variables or configuration file

The SDK supports the following two methods to obtain access credentials:

• Environment variables: Configuration methods vary by operating system. For more information, see .

  Warning

  Do not modify the parameter names. Otherwise, the SDK cannot recognize them.

• Configuration file: The default configuration file is secretsmanager.properties (the file name cannot be changed).To ensure your application loads the configuration file correctly, place it in the appropriate configuration directory. Common configuration directories for different languages include:

  • Java: Place the configuration file in the src/main/resources directory so it is automatically included in the classpath during compilation.

  • Go: Place the configuration file in the project root directory or a dedicated config directory, then load it through code.

  • Python: Place the configuration file in the project directory or a specific config directory, and use an appropriate method (such as os.path or pkg_resources) to load it.

• If you use a custom configuration file, you must specify the file path (#customConfigFileName#) during client initialization.

Step 1: Create a RAM role ARN and configure permissions

Step 2: Set environment variables or configuration file

The SDK supports the following two methods to obtain access credentials:

• Environment variables: Configuration methods vary by operating system. For more information, see .

  Warning

  Do not modify the parameter names. Otherwise, the SDK cannot recognize them.

• Configuration file: The default configuration file is secretsmanager.properties (the file name cannot be changed).To ensure your application loads the configuration file correctly, place it in the appropriate configuration directory. Common configuration directories for different languages include:

  • Java: Place the configuration file in the src/main/resources directory so it is automatically included in the classpath during compilation.

  • Go: Place the configuration file in the project root directory or a dedicated config directory, then load it through code.

  • Python: Place the configuration file in the project directory or a specific config directory, and use an appropriate method (such as os.path or pkg_resources) to load it.

• If you use a custom configuration file, you must specify the file path (#customConfigFileName#) during client initialization.

Parameters of cache_client_dkms_config_info

Use default configuration

The SDK automatically reads credential information from the secretsmanager.properties file or environment variables.

import com.aliyuncs.kms.secretsmanager.client.V2.0.SecretCacheClient;
import com.aliyuncs.kms.secretsmanager.client.V2.0.SecretCacheClientBuilder;
import com.aliyuncs.kms.secretsmanager.client.V2.0.exception.CacheSecretException;
import com.aliyuncs.kms.secretsmanager.client.V2.0.model.SecretInfo;

public class CacheClientEnvironmentSample {

    public static void main(String[] args) {
        try {
            SecretCacheClient client = SecretCacheClientBuilder.newClient();
            SecretInfo secretInfo = client.getSecretInfo("#secretName#");
            System.out.println(secretInfo);
        } catch (CacheSecretException e) {
            e.printStackTrace();
        }
    }
}
          

Use custom configuration file

Use this approach when the configuration file does not use the default file name or path. Specify the configuration file path (#customConfigFileName#).

import com.aliyuncs.kms.secretsmanager.client.V2.0.SecretCacheClient;
import com.aliyuncs.kms.secretsmanager.client.V2.0.SecretCacheClientBuilder;
import com.aliyuncs.kms.secretsmanager.client.V2.0.exception.CacheSecretException;
import com.aliyuncs.kms.secretsmanager.client.V2.0.model.SecretInfo;
import com.aliyuncs.kms.secretsmanager.client.V2.0.service.BaseSecretManagerClientBuilder;

public class CacheClientCustomConfigFileSample {

    public static void main(String[] args) {
        try {
            SecretCacheClient client = SecretCacheClientBuilder.newCacheClientBuilder(
                    BaseSecretManagerClientBuilder.standard()
                        .withCustomConfigFile("#customConfigFileName#")
                        .build())
                    .build();
            SecretInfo secretInfo = client.getSecretInfo("#secretName#");
            System.out.println(secretInfo);
        } catch (CacheSecretException e) {
            System.out.println("CacheSecretException: " + e.getMessage());
        }
    }
}
          

Use hard-coded credentials

This approach allows you to pass the AccessKey and region information directly during client initialization, without writing the AccessKey to the configuration file or environment variables.

import com.aliyuncs.kms.secretsmanager.client.V2.0.SecretCacheClient;
import com.aliyuncs.kms.secretsmanager.client.V2.0.SecretCacheClientBuilder;
import com.aliyuncs.kms.secretsmanager.client.V2.0.exception.CacheSecretException;
import com.aliyuncs.kms.secretsmanager.client.V2.0.model.RegionInfo;
import com.aliyuncs.kms.secretsmanager.client.V2.0.service.BaseSecretManagerClientBuilder;
import com.aliyuncs.kms.secretsmanager.client.V2.0.utils.CredentialsProviderUtils;

public class CacheClientWithCaCertificateSample {
    public static void main(String[] args) {
        try {
            // Create a RegionInfo with the CA certificate path
            RegionInfo regionInfo = new RegionInfo();
            regionInfo.setRegionId("#regionId#");
            // Dedicated gateway endpoint. Omit if using shared gateway.
            regionInfo.setEndpoint("<your_kms_instance_id>.cryptoservice.kms.aliyuncs.com");

            SecretCacheClient client = SecretCacheClientBuilder.newCacheClientBuilder(
                    BaseSecretManagerClientBuilder.standard()
                            .withCredentialsProvider(CredentialsProviderUtils.withAccessKey(
                                    System.getenv("#accessKeyId#"),
                                    System.getenv("#accessKeySecret#")))
                            .addRegion(regionInfo)
                            .build())
                    .build();
            SecretInfo secretInfo = client.getSecretInfo("#secretName#");
        } catch (CacheSecretException e) {
            e.printStackTrace();
        }
    }
}
          

Use Alibaba Cloud Default credential provider chain

The Default credential provider chain is a fallback strategy. It searches for credentials in a predefined order until credentials are found. If all methods fail, authentication fails and credentials cannot be obtained.

import com.aliyuncs.kms.secretsmanager.client.V2.0.SecretCacheClient;
import com.aliyuncs.kms.secretsmanager.client.V2.0.SecretCacheClientBuilder;
import com.aliyuncs.kms.secretsmanager.client.V2.0.exception.CacheSecretException;
import com.aliyuncs.kms.secretsmanager.client.V2.0.model.SecretInfo;
import com.aliyuncs.kms.secretsmanager.client.V2.0.service.BaseSecretManagerClientBuilder;

public class CacheClientDefaultCredentialChainSample {

    public static void main(String[] args) {
        try {
            SecretCacheClient client = SecretCacheClientBuilder.newCacheClientBuilder(
                    BaseSecretManagerClientBuilder.standard()
                        .withRegion("#regionId#")
                        .build())
                    .build();
            SecretInfo secretInfo = client.getSecretInfo("#secretName#");
            System.out.println(secretInfo);
        } catch (CacheSecretException e) {
            e.printStackTrace();
        }
    }
}
          

Use default configuration

The SDK automatically reads credential information from the secretsmanager.properties file or environment variables.

from alibabacloud_secretsmanager_client_V2.0.secret_manager_cache_client_builder import SecretManagerCacheClientBuilder

if __name__ == '__main__':
    secret_cache_client = SecretManagerCacheClientBuilder.new_client()
    secret_info = secret_cache_client.get_secret_info("#secretName#")
    print(secret_info.__dict__)
          

Use custom configuration file

Use this approach when the configuration file does not use the default file name or path.

from alibabacloud_secretsmanager_client_V2.0.secret_manager_cache_client_builder import SecretManagerCacheClientBuilder
from alibabacloud_secretsmanager_client_V2.0.service.default_secret_manager_client_builder import DefaultSecretManagerClientBuilder

if __name__ == '__main__':
    secret_cache_client = SecretManagerCacheClientBuilder.new_cache_client_builder(
        DefaultSecretManagerClientBuilder.standard()
            .with_custom_config_file("#customConfigFileName#")
            .build()
    ).build()
    secret_info = secret_cache_client.get_secret_info("#secretName#")
    print(secret_info.__dict__)
          

Use hard-coded credentials

This approach passes the AccessKey and region information directly during client initialization.

import os

from alibabacloud_secretsmanager_client_V2.0.secret_manager_cache_client_builder import SecretManagerCacheClientBuilder
from alibabacloud_secretsmanager_client_V2.0.service.default_secret_manager_client_builder import \
    DefaultSecretManagerClientBuilder
from alibabacloud_secretsmanager_client_V2.0.model.region_info import RegionInfo

if __name__ == '__main__':
    # Create a RegionInfo with the CA certificate path
    region_info = RegionInfo(
        region_id="#regionId#",
        endpoint="#kmsInstanceEndpoint#",  # Dedicated gateway endpoint. Omit if using shared gateway.
    )
    secret_cache_client = SecretManagerCacheClientBuilder.new_cache_client_builder(
        DefaultSecretManagerClientBuilder.standard()
            .with_access_key(
                os.getenv("#accessKeyId#"),
                os.getenv("#accessKeySecret#")
            )
            .add_region_info(region_info)
            .build()
    ).build()
    # ... use the client
          

Use Alibaba Cloud Default credential provider chain

from alibabacloud_secretsmanager_client_V2.0.secret_manager_cache_client_builder import SecretManagerCacheClientBuilder
from alibabacloud_secretsmanager_client_V2.0.service.default_secret_manager_client_builder import DefaultSecretManagerClientBuilder

if __name__ == '__main__':
    secret_cache_client = SecretManagerCacheClientBuilder.new_cache_client_builder(
        DefaultSecretManagerClientBuilder.standard()
            .with_region("#regionId#")
            .build()
    ).build()
    secret_info = secret_cache_client.get_secret_info("#secretName#")
    print(secret_info.__dict__)
          

Use default configuration

package main

import "github.com/aliyun/alibabacloud-secretsmanager-client-go-V2.0/sdk"

func main() {
    client, err := sdk.NewClient()
    if err != nil {
        // Handle exceptions
        panic(err)
    }
    secretInfo, err := client.GetSecretInfo("#secretName#")
    if err != nil {
        // Handle exceptions
        panic(err)
    }
}
          

Use custom configuration file

package main

import (
    "github.com/aliyun/alibabacloud-secretsmanager-client-go-V2.0/sdk"
    "github.com/aliyun/alibabacloud-secretsmanager-client-go-V2.0/sdk/service"
)

func main() {
    client, err := sdk.NewSecretCacheClientBuilder(
            service.NewDefaultSecretManagerClientBuilder().Standard().
                WithCustomConfigFile("#customConfigFileName#").Build()).Build()
    if err != nil {
        // Handle exceptions
        panic(err)
    }
    secretInfo, err := client.GetSecretInfo("#secretName#")
    if err != nil {
        // Handle exceptions
        panic(err)
    }
}
          

Use hard-coded credentials

package main

import (
    "github.com/aliyun/alibabacloud-secretsmanager-client-go-V2.0/sdk"
    "github.com/aliyun/alibabacloud-secretsmanager-client-go-V2.0/sdk/models"
    "github.com/aliyun/alibabacloud-secretsmanager-client-go-V2.0/sdk/service"
    "os"
)

func main() {
    regionInfo := &models.RegionInfo{
        RegionId: "#regionId#",
        // Dedicated gateway endpoint. Omit if using shared gateway.
        Endpoint: "<kmsInstanceId>.cryptoservice.kms.aliyuncs.com",
    }

    client, err := sdk.NewSecretCacheClientBuilder(
        service.NewDefaultSecretManagerClientBuilder().
            Standard().
            WithAccessKey(os.Getenv("#accessKeyId#"), os.Getenv("#accessKeySecret#")).
            AddRegionInfo(regionInfo).
            Build()).Build()
    if err != nil {
        // Handle exceptions
        panic(err)
    }
    secretInfo, err := client.GetSecretInfo("#secretName#")
    if err != nil {
        // Handle exceptions
        panic(err)
    }
}
          

Use Alibaba Cloud Default credential provider chain

package main

import (
    "github.com/aliyun/alibabacloud-secretsmanager-client-go-V2.0/sdk"
    "github.com/aliyun/alibabacloud-secretsmanager-client-go-V2.0/sdk/service"
)

func main() {
    client, err := sdk.NewSecretCacheClientBuilder(
            service.NewDefaultSecretManagerClientBuilder().Standard().
                WithRegion("#regionId#").Build()).Build()
    if err != nil {
        // Handle exceptions
        panic(err)
    }
    secretInfo, err := client.GetSecretInfo("#secretName#")
    if err != nil {
        // Handle exceptions
        panic(err)
    }
}
          

Use default configuration

The SDK automatically reads credential information from the secretsmanager.properties file or environment variables.

import { SecretCacheClientBuilder } from 'alibabacloud-secretsmanager-client-v2';

async function example() {
  try {
    // Build client via environment variables or default configuration
    const client = await SecretCacheClientBuilder.newClient();
    const secretInfo = await client.getSecretInfo('#secretName#');
    console.log(secretInfo);
  } catch (error) {
    console.error('Error:', error);
  }
}

example();

Use custom configuration file

Use this approach when the configuration file does not use the default file name or path. Specify the configuration file path.

import {
  SecretCacheClientBuilder,
  BaseSecretManagerClientBuilder,
  CredentialsProviderUtils
} from 'alibabacloud-secretsmanager-client-v2';

async function example() {
  try {
    const client = await SecretCacheClientBuilder.newCacheClientBuilder(
      BaseSecretManagerClientBuilder.standard().withCustomConfigFile('#customConfigFileName#').build()
    ).build();

    const secretInfo = await client.getSecretInfo('#secretName#');
    console.log(secretInfo);
  } catch (error) {
    console.error('Error:', error);
  }
}

example();

Use hard-coded credentials

This approach passes the AccessKey and region information directly during client initialization.

import {
  SecretCacheClientBuilder,
  BaseSecretManagerClientBuilder,
  CredentialsProviderUtils,
  RegionInfo
} from 'alibabacloud-secretsmanager-client-v2';

async function example() {
  try {
    // Create RegionInfo with CA certificate path
    const regionInfo = new RegionInfo();
    regionInfo.setRegionId('#regionId#');
    regionInfo.setEndpoint('#kmsInstanceEndpoint#'); // Specify KMS instance address
    
    const client = await SecretCacheClientBuilder.newCacheClientBuilder(
        BaseSecretManagerClientBuilder.standard()
          .withCredentialsProvider(
            CredentialsProviderUtils.withAccessKey(
              process.env['#accessKeyId#'],
              process.env['#accessKeySecret#']
            )
        )
        .addRegionInfo(regionInfo) // Use RegionInfo with CA certificate path
        .build()
    ).build();

    const secretInfo = await client.getSecretInfo('#secretName#');
    console.log(secretInfo);
  } catch (error) {
    console.error('Error:', error);
  }
}

example();

Use Alibaba Cloud Default credential provider chain

import {
  SecretCacheClientBuilder,
  BaseSecretManagerClientBuilder,
  CredentialsProviderUtils
} from 'alibabacloud-secretsmanager-client-v2';

async function example() {
  try {
    const client = await SecretCacheClientBuilder.newCacheClientBuilder(
      BaseSecretManagerClientBuilder.standard()
        .withCredentialsProvider(CredentialsProviderUtils.withDefaultCredential())
        .withRegion('#regionId#')
        .build()
    ).build();

    const secretInfo = await client.getSecretInfo('#secretName#');
    console.log(secretInfo);
  } catch (error) {
    console.error('Error:', error);
  }
}

example();