Specific Alibaba Cloud services integrate with KMS to retrieve secret values by name, keeping sensitive credentials under centralized, systematic management and reducing the risk of leaks from manual handling.
Background
Secrets Manager prevents sensitive information leaks caused by hardcoding credentials in code. You store sensitive data—database passwords, server passwords, SSH key pairs, or access keys—as secrets in KMS, then reference them by name in your applications. At runtime, applications dynamically retrieve secret values from KMS. KMS manages secrets throughout their lifecycle and ensures that only authorized users and services can access them.
How integration works
You manage secrets centrally in KMS and configure secret names in Alibaba Cloud services. After you grant relevant permissions, the services can view secret metadata and retrieve secret values from KMS. Operators use secrets without seeing secret details—meeting the principle of accessible but invisible and reducing the risk of leaks.
Alibaba Cloud services retrieve secrets from KMS in real time. You can audit secret usage in ActionTrail.
Supported Alibaba Cloud services
|
Service name |
Description |
References |
|
Container Service for Kubernetes (ACK) |
Install the ack-secret-manager plug-in in ACK and configure secret names. The plug-in periodically reads the latest secret values from KMS and caches them in the Kubernetes cluster as native Kubernetes Secrets. This prevents sensitive data from being transmitted or leaked during application development and construction. |
|
|
Bastionhost |
Store the account password or SSH key pair of an ECS instance as an ECS secret in KMS, then import the secret in Bastionhost. When Bastionhost connects to the instance, it retrieves the ECS secret value from KMS—no manual password or key entry required. You can perform immediate rotation or configure automatic rotation for ECS secrets in KMS to meet security and compliance requirements. |
|
|
Data Management (DMS) |
Store ApsaraDB RDS account passwords as ApsaraDB RDS secrets in KMS, then configure and import the secrets in DMS. When DMS connects to an ApsaraDB RDS database, it automatically retrieves the associated secret from KMS—no manual password entry required. You can configure immediate or automatic rotation for ApsaraDB RDS secrets in KMS to meet security and compliance requirements. |