Key Management Service:Integrate DMS with ApsaraDB RDS secrets

How it works

Before you use Data Management (DMS) to perform operations such as data asset management and database development on an ApsaraDB RDS instance, you must first add the RDS instance to DMS. This process requires you to configure the login credentials for the RDS instance in DMS, which allows DMS to remotely connect to the instance.

Instead of manually entering the ApsaraDB RDS account and password in DMS, you can use KMS to store the ApsaraDB RDS account and password as a secret and then configure DMS to use it for logon. When DMS connects to the ApsaraDB RDS database, it retrieves the secret value from KMS in real time. The following workflow describes this process:

1. A secret administrator creates an ApsaraDB RDS secret in KMS.

2. During database registration in DMS, an administrator configures the database to use the secret from KMS.

3. The DMS administrator initiates a request to connect to the ApsaraDB RDS database.

4. DMS calls the KMS ListSecrets and GetSecretValue API operations and retrieves the corresponding RDS secret value from KMS in real time.

5. DMS uses the retrieved secret value to log on to the ApsaraDB RDS database.

Benefits

Integrating DMS with ApsaraDB RDS secrets enhances database security and ensures secure access to database credentials.

• Enhanced security: ApsaraDB RDS secrets are encrypted and stored in KMS. Storing secrets in KMS reduces the exposure of plaintext database accounts and passwords.

• Simplified password management: KMS can automatically rotate ApsaraDB RDS secrets to regularly update database passwords. This reduces security risks associated with long-lived passwords.

  Note

  DMS retrieves the secret value that has the ACSCurrent stage label from KMS in real time. Therefore, enabling automatic rotation does not affect remote connections from DMS to the ApsaraDB RDS database. For more information about rotation, see ApsaraDB RDS secrets and Stage labels.

• Comprehensive auditing: KMS integrates with ActionTrail to record all access requests for ApsaraDB RDS secrets. This facilitates auditing, traceability, and timely detection of unusual activities.

Usage notes

• You must purchase a KMS instance to use this feature. For more information about the billing and selection of a KMS instance, see Billing and Select a KMS instance type.

• KMS supports secrets for the following ApsaraDB RDS instance types:

  • ApsaraDB RDS for MySQL

  • ApsaraDB RDS for MariaDB

  • ApsaraDB RDS for SQL Server (except instances running SQL Server 2017 EE)

  • ApsaraDB RDS for PostgreSQL

• If you use KMS to manage an ApsaraDB RDS secret, we recommend configuring DMS to use that secret for logon instead of manual password entry. This method avoids logon failures caused by manual password updates, as DMS always retrieves the current secret.

• Before you delete an ApsaraDB RDS secret in KMS, make sure that the secret is no longer accessed by DMS. To check access records, see Query the usage records of keys and secrets.

Prerequisites

• You have purchased and enabled a KMS instance. For more information, see Purchase and enable a KMS instance.

• Because you must specify a symmetric key to encrypt an RDS secret, you must first create a symmetric key in a KMS instance. For more information, see Create a key.

Step 1: Create an RDS secret in KMS

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resources > Secrets.

2. On the Secrets page, click Database Secrets, select an Instance ID, and then click Create Secret > Create Single Secret. Complete the configurations and click OK.

   Parameter	Description
   Database Type	Select ApsaraDB RDS Secrets.
   Secret Name	A custom credential name. Must be unique within the current region.
   ApsaraDB RDS Instance	Select an RDS instance under your Alibaba Cloud account.
   Account Management	Manage Dual Accounts (Recommended): Suitable for programmatic database access. KMS manages two accounts with identical permissions to avoid connection interruption during rotation. Click Create Account to configure the account name, select a database, and specify permissions. Note One-click creation and authorization does not immediately create the new account. The account is created after you review and confirm the credential information. For RDS PostgreSQL, you cannot obtain the database name during creation. You must manually set the DBName. Click Import Existing Accounts to select a username and configure the password. Note We recommend that you set the password to the one used when creating the RDS instance user account. If the imported username and password do not match, you can obtain the correct account and password after the first credential rotation. Manage Single Account: Suitable for privileged accounts or manual O&M account hosting scenarios. The current credential version may be temporarily unavailable immediately after password reset. Click Create Account to configure the account name and select the account type. Supports Standard Account and Privileged Account. When you select Standard Account, you must also select a database and specify permissions. Click the Import Existing Accounts tab to select a username and configure the password.
   CMK	Select the symmetric key used to encrypt the credential value. The key and the credential must belong to the same KMS instance. Important The key and the credential must belong to the same KMS instance, and the key must be a symmetric key. For more information about the symmetric keys supported by KMS, see Key types and specifications. If a RAM user or RAM role is used, it must have permissions to perform the GenerateDataKey operation using the encryption master key.
   Tags	Add tags to the credential for classification. Each tag consists of a key-value pair. Note Format of a tag key and a tag value: A tag key or a tag value can be up to 128 characters in length and can contain letters, digits, forward slashes (/), backslashes (\), underscores (_), hyphens (-), periods (.), plus signs (+), equal signs (=), colons (:), at signs (@), and spaces. A tag key cannot start with aliyun or acs:. Each credential supports up to 20 tag key-value pairs.
   Automatic Rotation	Select whether to enable automatic rotation. When enabled, KMS periodically updates the credential value to reduce the risk of credential leaks.
   Rotation Period	Set this parameter only when automatic rotation is enabled. Valid values: 6 hours to 365 days. Specifies the rotation interval. KMS periodically updates the credential value based on this setting.
   Description	An optional description of the credential for identification and management.
   Advanced Settings > Policy Settings	Set the access policy for the credential to control which RAM users or roles can read or modify it. You can select the default policy first and modify it later as needed.

Step 2: Register the RDS database with DMS

1. Log in to DMS 5.0.

2. On the left side of the console homepage, in the Database Instances section, click the Add Instance icon.

   Note

   You can also choose Data Assets > Instances from the top navigation bar and then click New.

3. On the Create Instance page, enter the RDS instance information.

   For Access Mode, select KMS Credential Logon. For information about how to configure other parameters, see Add a cloud database.

Related documentation

• Change the access mode: Switch an existing ApsaraDB RDS database in DMS from password-based logon to KMS secret-based logon. See Edit instance information.

• Manage databases: Create databases, create tables, and query or modify data using the SQL console. See SQL Console quick start.

• Run lock-free DML: Change large volumes of data without locking tables. See Lock-free DML operation.

• Export data: Export table data from the database. See Export data.

• Manage secret rotation: Configure or review rotation settings for your ApsaraDB RDS secret. See Manage and use ApsaraDB RDS secretsand Secret versions.