Key Management Service:Quickstart: Create and manage secrets

Set up your environment

1. Install the Java Development Kit (JDK)

Download and install JDK 8 or later. Verify the installation:

java -version

2. Add the SDK dependency

Add the following Maven dependency to your project. Make sure to use Alibaba Cloud SDK V2.0.

<dependency>
  <groupId>com.aliyun</groupId>
  <artifactId>kms20160120</artifactId>
  <version>1.2.3</version>
</dependency>

3. Create access credentials

This example uses AccessKey pairs for authentication. For other authentication methods, see Manage access credentials.

Create an AccessKey pair for a RAM user in the RAM console. See Create an AccessKey pair.

Grant the RAM user the required permissions by attaching the AliyunKMSSecretUserAccess and AliyunKMSCryptoUserAccess system policies. See Grant permissions to a RAM user.

KMS supports two types of access control:

• Identity-based policies: Attach policies to RAM identities to define what they can do. See Use RAM to implement access control.

• Resource-based policies: Attach policies directly to KMS resources (keys and secrets) to define who can access them. See Key policies and Secret policies.

4. Download the instance CA certificate

1. On the Instances page, click the Software key management or Hardware key management tab and select your instance.

2. Click the instance ID or Details in the Actions column.

3. On the instance details page, click Download next to Instance CA certificate.

Save the certificate file. It is named PrivateKmsCA_kst-******.pem by default.

5. Record the VPC endpoint

On the instance details page, copy the Virtual Private Cloud (VPC) endpoint of your instance.

Retrieve the secret value

The following example initializes the SDK client and calls GetSecretValue. The example uses the VPC endpoint and CA certificate to connect to your KMS instance.

Set the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables before running the code.

package com.aliyun.sample;

import com.aliyun.tea.*;

public class Sample {

    /**
     * Initialize the KMS client.
     *
     * endpoint: The VPC endpoint of your KMS instance.
     *           Example: kst-hzz65f176a0ogplgq****.cryptoservice.kms.aliyuncs.com
     * ca:       The content of the CA certificate downloaded from the instance details page.
     */
    public static com.aliyun.kms20160120.Client createClient() throws Exception {
        com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
                // Read credentials from environment variables
                .setAccessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"))
                .setAccessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"));
        config.endpoint = "<VPC endpoint of the instance>";
        config.ca = "<CA certificate of the instance>";
        return new com.aliyun.kms20160120.Client(config);
    }

    public static void main(String[] args_) throws Exception {
        com.aliyun.kms20160120.Client client = Sample.createClient();

        com.aliyun.kms20160120.models.GetSecretValueRequest request =
                new com.aliyun.kms20160120.models.GetSecretValueRequest()
                        .setSecretName("<SecretName>");

        com.aliyun.teautil.models.RuntimeOptions runtime =
                new com.aliyun.teautil.models.RuntimeOptions();

        try {
            client.getSecretValueWithOptions(request, runtime);
        } catch (TeaException error) {
            System.out.println(error.getMessage());
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            TeaException error = new TeaException(_error.getMessage(), _error);
            System.out.println(error.getMessage());
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        }
    }
}

Replace the following placeholders before running: