Key Management Service:Secret JDBC client

Scenario 1: Use shared gateways to retrieve secret values

Available networks are the Internet and virtual private clouds (VPCs). The following Resource Access Management (RAM)-based authentication methods are supported: RAM roles of Elastic Compute Service (ECS) instances, RamRoleArn, Security Token Service (STS) tokens, and AccessKey pairs. For more information, see Manage access credentials.

Scenario 2: Use dedicated gateways to retrieve secret values (not recommended)

Available networks are KMS VPCs, and available access credentials are client keys.

• Method 1: Quick creation

  Suitable for quick testing and development scenarios. This method uses a default permission policy that cannot be modified. Your application will have access to all keys and secrets in the specified KMS instance.

• Method 2: Standard creation

  Use this method to configure fine-grained access permissions for resources.

Connect to a database by using JDBC

• ApsaraDB RDS for MySQL

  Note

  Replace #your-mysql-secret-name#, <your-mysql-ip>, <your-mysql-port>, and <your-database-name> in the sample code with the actual secret name, server IP address of the database, server port number of the database, and name of the database.

  import java.sql.Connection;
  import java.sql.DriverManager;
  import java.sql.SQLException;
  
  public class SecretManagerJDBCSample {
      public static void main(String[] args) throws Exception {
          // Load the secret JDBC client.
          Class.forName("com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver");
          Connection connect = null;
          try {
              connect = DriverManager.getConnection("secrets-manager:mysql://<your-mysql-ip>:<your-mysql-port>/<your-database-name>", "#your-mysql-secret-name#","");
          } catch(SQLException e) {
              e.printStackTrace();
          }
      }
  }

• ApsaraDB RDS for SQL Server

  Note

  Replace #your-sqlserver-secret-name#, <your-sqlserver-ip>, <your-sqlserver-port>, and <your-database-name> in the sample code with the actual secret name, server IP address of the database, server port number of the database, and name of the database.

  import java.sql.Connection;
  import java.sql.DriverManager;
  import java.sql.SQLException;
  
  public class SecretManagerJDBCSqlServerSample {
  
      public static void main(String[] args) throws Exception{
          // Load the secret JDBC client.
          Class.forName("com.aliyun.kms.secretsmanager.MssqlSecretsManagerSimpleDriver");
          Connection connect = null;
          try {
              connect = DriverManager.getConnection("secrets-manager:sqlserver://<your-sqlserver-ip>:<your-sqlserver-port>;databaseName=<your-database-name>", "#your-sqlserver-secret-name#", "");
          }  catch (SQLException e) {
              e.printStackTrace();
          }
      }
  }

• ApsaraDB RDS for PostgreSQL

  Note

  Replace #your-postgresql-secret-name#, <your-postgresql-ip>, <your-postgresql-port>, and <your-database-name> in the sample code with the actual secret name, server IP address of the database, server port number of the database, and name of the database.

  import java.sql.Connection;
  import java.sql.DriverManager;
  import java.sql.SQLException;
  
  public class SecretManagerJDBCPostgreSQLSample {
      public static void main(String[] args) throws Exception {
          // Load the secret JDBC client.
          Class.forName("com.aliyun.kms.secretsmanager.PostgreSQLSecretManagerSimpleDriver");
          Connection connect = null;
          try {
              connect = DriverManager.getConnection("secrets-manager:postgresql://<your-postgresql-ip>:<your-postgresql-port>/<your-database-name>", "#your-postgresql-secret-name#", "");
          } catch (SQLException e) {
              e.printStackTrace();
          }
      }
  }

• ApsaraDB RDS for MariaDB

  Note

  Replace #your-mariadb-secret-name#, <your-mariadb-ip>, <your-mariadb-port>, and <your-database-name> in the sample code with the actual secret name, server IP address of the database, server port number of the database, and name of the database.

  import java.sql.Connection;
  import java.sql.DriverManager;
  import java.sql.SQLException;
  
  public class SecretManagerJDBCMarialDBSample {
  
  	public static void main(String[] args) throws Exception{
  		// Load the secret JDBC client.
  		Class.forName("com.aliyun.kms.secretsmanager.MariaDBSecretManagerSimpleDriver");
  		Connection connect = null;
  		try {
  			connect = DriverManager.getConnection("secrets-manager:mariadb://<your-mariadb-ip>:<your-mariadb-port>/<your-database-name>", "#your-mariadb-secret-name#", "");
  		}  catch (SQLException e) {
  			e.printStackTrace();
  		}
  	}
  }

Connect to a database by using a connection pool

Configure c3p0.user, c3p0.driverClass, and c3p0.jdbcUrl in the c3p0 c3p0.properties configuration file. c3p0.user specifies the name of the secret. c3p0.driverClass specifies the name of the secret JDBC driver class. The value of c3p0.jdbcUrl must start with secrets-manager.

• ApsaraDB RDS for MySQL

  Note

  Replace #your-mysql-secret-name#, <your-mysql-ip>, <your-mysql-port>, and <your-database-name> in the sample code with the actual secret name, server IP address of the database, server port number of the database, and name of the database.

  c3p0.user=#your-mysql-secret-name#
  c3p0.driverClass=com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver
  c3p0.jdbcUrl=secrets-manager:mysql://<your-mysql-ip>:<your-mysql-port>/<your-database-name>

• ApsaraDB RDS for SQL Server

  Note

  Replace #your-sqlserver-secret-name#, <your-sqlserver-ip>, <your-sqlserver-port>, and <your-database-name> in the sample code with the actual secret name, server IP address of the database, server port number of the database, and name of the database.

  c3p0.user=#your-sqlserver-secret-name#
  c3p0.driverClass=com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver
  c3p0.jdbcUrl=secrets-manager:sqlserver://<your-sqlserver-ip>:<your-sqlserver-port>/<your-database-name>

• ApsaraDB RDS for PostgreSQL

  Note

  Replace #your-postgresql-secret-name#, <your-postgresql-ip>, <your-postgresql-port>, and <your-database-name> in the sample code with the actual secret name, server IP address of the database, server port number of the database, and name of the database.

  c3p0.user=#your-postgresql-secret-name#
  c3p0.driverClass=com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver
  c3p0.jdbcUrl=secrets-manager:postgresql://<your-postgresql-ip>:<your-postgresql-port>/<your-database-name>

• ApsaraDB RDS for MariaDB

  Note

  Replace #your-mariadb-secret-name#, <your-mariadb-ip>, <your-mariadb-port>, and <your-database-name> in the sample code with the actual secret name, server IP address of the database, server port number of the database, and name of the database.

  c3p0.user=#your-mariadb-secret-name#
  c3p0.driverClass=com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver
  c3p0.jdbcUrl=secrets-manager:mariadb://<your-mariadb-ip>:<your-mariadb-port>/<your-database-name>

Connect to a database by using a data source

In this example, c3p0 ComboPooledDataSource and ApsaraDB RDS for MySQL are used. Add the following configuration to the Spring configuration file:

<bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource" >
      <property name="driverClass" value="com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver" />
      <property name="user" value="#your-mysql-secret-name#" />
      <property name="jdbcUrl" value="secrets-manager:mysql://<your-mysql-ip>:<your-mysql-port>/<your-database-name>" />
      <property name="maxPoolSize" value="***" />
      <property name="minPoolSize" value="***" />
      <property name="initialPoolSize" value="***" />
  </bean>
  <bean id="jdbcTemplate" class="org.springframework.jdbc.core.JdbcTemplate" >
      <property name="dataSource" ref="dataSource" />
  </bean>

Connect to a database by using a Druid connection pool

In this example, ApsaraDB RDS for MySQL is used. You must modify the following properties in the configuration file.

• properties configuration file

  username=#your-mysql-secret-name#
  driverClassName=com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver
  url=secrets-manager:mysql://<your-mysql-ip>:<your-mysql-port>/<your-database-name>

• Bean configuration mode

  • Method 1: XML configuration file

    <bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource" init-method="init" destroy-method="close"> 
         <property name="username" value="${your-mysql-secret-name}" />
         <property name="driverClassName" value="com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver" />
         <property name="url" value="secrets-manager:mysql://<your-mysql-ip>:<your-mysql-port>/<your-database-name>" />
    </bean>
    

  • Method 2: Property injection

    Create a driver class to load database connection information in the application.

    @Configuration
    public class DataConfig {
    
        @Value("${your-mysql-secret-name}")
        private String username;
    
        @Value("com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver")
        private String driverClassName;
    
        @Value("secrets-manager:mysql://<your-mysql-ip>:<your-mysql-port>/<your-database-name>")
        private String url;
    
        @Bean(name = "dataSource",initMethod = "init",destroyMethod = "close")
        public DruidDataSource dataSource(){
            DruidDataSource druidDataSource = new DruidDataSource();
            druidDataSource.setUsername(username);
            druidDataSource.setDriverClassName(driverClassName);
            druidDataSource.setUrl(url);
            return druidDataSource;
        }
    }