Key Management Service:Integrate ECS secrets in Bastionhost

Feature overview

You can save ECS account passwords or SSH key pairs as ECS secrets in KMS. On the Bastionhost side, you only need to import the ECS secrets. You do not need to manually enter ECS account passwords or SSH key pairs. When Bastionhost connects to an ECS instance, it retrieves the secret value from KMS in real time for authentication.

KMS supports automatic periodic rotation of ECS secrets. Because Bastionhost retrieves the secret value of the ACSCurrent version from KMS in real time, rotation does not affect remote connections from Bastionhost to ECS instances. For more information about secret versions, see Secret versions. The following flowchart shows the workflow of using ECS secrets in Bastionhost to remotely connect to ECS instances.

1. A secret administrator creates an ECS secret in KMS.

2. A Bastionhost administrator configures the import of ECS secrets from KMS into Bastionhost.

3. An O&M engineer initiates a remote connection to the ECS instance.

4. Bastionhost calls the ListSecrets and GetSecretValue operations to retrieve the ECS secret value from KMS in real time.

5. Bastionhost uses the ECS secret value to log on to the ECS instance.

Usage notes

• Only Bastionhost Basic Edition and Bastionhost Enterprise Dual-Engine Edition V3.2.40 and later support ECS secret integration.

• If you delete an ECS secret in KMS, Bastionhost cannot retrieve the secret value and remote connections to the ECS instance will fail.

Prerequisites

• You have imported ECS assets into Bastionhost. For more information, see Import ECS instances of your account.

• If you use a RAM user to manage ECS secrets and Bastionhost, make sure that the Alibaba Cloud account has granted the AliyunKMSSecretAdminAccess permission (permissions to manage KMS secrets) and the AliyunYundunBastionHostFullAccess permission (permissions to manage Bastionhost) to the RAM user. For more information, see Manage RAM user permissions.

Procedure

1. Create an ECS secret in KMS. For more information, see Step 1: Create an ECS secret.

   1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resources > Secrets.

   2. Click the ECS Secrets tab, select the Instance ID, and then click Create ECS Secret. After you configure the parameters, click OK.

      Parameter	Description
      Secret Name	A custom credential name. Must be unique within the current region.
      Managed Instance	Select an ECS instance under your Alibaba Cloud account.
      Managed User	Enter the username of an existing user on the ECS instance, such as root (Linux) or Administrator (Windows).
      Initial Secret Value	The credential value must be up to 30,720 bytes (30 KB) in length. Password: The logon password of the user on the ECS instance. Key pair: The SSH key pair used to log on to the ECS instance. Obtain an SSH key pair Use an SSH key pair created in ECS Private key: After creating an SSH key pair in ECS, the private key is automatically downloaded to your local computer as key-pair-name.pem. Public key: For more information, see the documentation on viewing SSH public keys. Generate an SSH key pair locally Generate and save both the private and public keys. For example, use the ssh-keygen command to generate a 3072-bit RSA key pair: ssh-keygen -t RSA -b 3072 -m PEM -f ~/.ssh/sshKey_demo -N "" The following files are generated: ~/.ssh/sshKey_demo: stores the private key. ~/.ssh/sshKey_demo.pub: stores the public key. Note The credential value must be correctly configured. If the credential value is incorrect, the password or key pair retrieved from KMS cannot be used to log on to the ECS instance until the credential is first rotated.
      CMK	Select the symmetric key used to encrypt the credential value. The key and the credential must belong to the same KMS instance. Important The key and the credential must belong to the same KMS instance, and the key must be a symmetric key. For more information about the symmetric keys supported by KMS, see Key types and specifications. If a RAM user or RAM role is used, it must have permissions to perform the GenerateDataKey operation using the encryption master key.
      Tags	Add tags to the credential for classification. Each tag consists of a key-value pair. Note Format of a tag key and a tag value: A tag key or a tag value can be up to 128 characters in length and can contain letters, digits, forward slashes (/), backslashes (\), underscores (_), hyphens (-), periods (.), plus signs (+), equal signs (=), colons (:), at signs (@), and spaces. A tag key cannot start with aliyun or acs:. Each credential supports up to 20 tag key-value pairs.
      Automatic Rotation	Select whether to enable automatic rotation. When enabled, KMS periodically updates the credential value to reduce the risk of credential leaks.
      Rotation Period	Set this parameter only when automatic rotation is enabled. Valid values: 1 hour to 365 days. Specifies the rotation interval. KMS periodically updates the credential value based on this setting.
      Description	An optional description of the credential for identification and management.
      Advanced Settings > Policy Settings	Set the access policy for the credential to control which RAM users or roles can read or modify it. You can select the default policy first and modify it later as needed.

      Note

      When you create the secret, the system automatically creates the AliyunServiceRoleForKMSSecretsManagerForECS service-linked role and attaches the AliyunServiceRolePolicyForKMSSecretsManagerForECS policy. KMS uses this role to manage ECS secrets and perform rotation of passwords and public/private key pairs. You can log on to the RAM console to view the details of the service-linked role and policy. For more information, see View a RAM role and View policy details.

2. Import the ECS secret into Bastionhost.

   After the import, when you remotely connect to the ECS instance from Bastionhost, Bastionhost automatically retrieves the secret value from KMS for logon.

   1. Log on to the Bastionhost system. For more information, see Log on to the system.

   2. In the navigation pane on the left, choose Assets > Hosts.

   3. On the Hosts page, find the target host and click Import KMS Secret in the Actions column.

   4. In the Import KMS Secret dialog box, select the secrets to import and click Import.

      After the secrets are imported, you can click the host name on the Hosts page. On the Host Account tab, you can view and manage the imported KMS secrets.

What to do next

1. Authorize Bastionhost users to manage the ECS instance. For more information, see Authorize assets and asset accounts for a user.

2. Use Bastionhost to perform O&M on the ECS instance. For more information, see O&M overview.