Exemple de code pour obtenir la valeur d'un secret - Key Management Service

Utilisez le SDK Alibaba Cloud pour appeler l'opération API GetSecretValue et récupérer la valeur d'un secret via une passerelle partagée ou dédiée. Ces deux types de passerelles ne diffèrent que par l'initialisation du client ; le code de la requête et la gestion des exceptions restent identiques.

Choisissez une passerelle

	Passerelle partagée	Passerelle dédiée
Cas d'utilisation	Charges de travail générales accédant à KMS via le réseau public ou un VPC	Charges de travail nécessitant une instance KMS dédiée avec un niveau d'isolation renforcé
Format de l'endpoint	Réseau public : `kms.<REGION_ID>.aliyuncs.com` / VPC : `kms-vpc.<REGION_ID>.aliyuncs.com`	`<KMS_INSTANCE_ID>.cryptoservice.kms.aliyuncs.com`
Certificat CA	Non requis	SDK V2.0 : requis / SDK V1.0 : non pris en charge — définissez `HTTPSInsecure` sur `true` via `client.SetHTTPSInsecure(true)`

Prérequis

Avant de commencer, assurez-vous de disposer des éléments suivants :

Un compte Alibaba Cloud avec un secret créé dans KMS
Les variables d'environnement ALIBABA_CLOUD_ACCESS_KEY_ID et ALIBABA_CLOUD_ACCESS_KEY_SECRET configurées

Important

Le stockage des paires AccessKey dans le code source expose vos identifiants à des fuites. Utilisez des jetons Security Token Service (STS) pour vos environnements de production.

Obtenez la valeur d'un secret via une passerelle partagée

Exemple complet

package com.aliyun.sample;

import com.aliyun.tea.*;

public class Sample {

    /**
     * Use your AccessKey ID and AccessKey Secret to initialize the client.
     * @return Client
     * @throws Exception
     */
    public static com.aliyun.kms20160120.Client createClient() throws Exception {
        // If the project code is leaked, the AccessKey pair may be leaked and resources in your account become insecure. The following code is for reference only.
        // We recommend that you use Security Token Service (STS) tokens, which provide higher security. For more information about authentication methods, see https://www.alibabacloud.com/help/en/sdk/developer-reference/v2-manage-access-credentials.
        com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
                // Required. Make sure that the ALIBABA_CLOUD_ACCESS_KEY_ID environment variable is configured in the code runtime environment.
                .setAccessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"))
                // Required. Make sure that the ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variable is configured in the code runtime environment.
                .setAccessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"));
        // For more information about endpoints, see https://api.alibabacloud.com/product/Kms.
        config.endpoint = "kms.ap-southeast-1.aliyuncs.com";
        return new com.aliyun.kms20160120.Client(config);
    }

    public static void main(String[] args_) throws Exception {
        java.util.List<String> args = java.util.Arrays.asList(args_);
        com.aliyun.kms20160120.Client client = Sample.createClient();
        com.aliyun.kms20160120.models.GetSecretValueRequest getSecretValueRequest = new com.aliyun.kms20160120.models.GetSecretValueRequest()
                .setSecretName("test****");
        com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
        try {
            // If you copy and run the sample code, write your own code to display the response of the API operation if necessary.
            client.getSecretValueWithOptions(getSecretValueRequest, runtime);
        } catch (TeaException error) {
            // Handle exceptions with caution based on your actual business scenario and do not ignore exceptions in your project. The error messages displayed in this example are for reference only.
            // Print error messages
            System.out.println(error.getMessage());
            // Provide the URL that is used for troubleshooting.
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            TeaException error = new TeaException(_error.getMessage(), _error);
            // Handle exceptions with caution based on your actual business scenario and do not ignore exceptions in your project. The error messages displayed in this example are for reference only.
            // Print error messages
            System.out.println(error.getMessage());
            // Provide the URL that is used for troubleshooting.
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        }
    }
}

Analyse de l'exemple

Initialisez le client

Définissez l'endpoint sur l'adresse de la passerelle partagée correspondant à votre région. L'exemple utilise l'endpoint du réseau public de Singapour (ap-southeast-1).

com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
        .setAccessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"))
        .setAccessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"));
// For more information about endpoints, see https://api.alibabacloud.com/product/Kms.
config.endpoint = "kms.ap-southeast-1.aliyuncs.com";

Appelez GetSecretValue

Remplacez test**** par votre véritable SecretName.

com.aliyun.kms20160120.models.GetSecretValueRequest getSecretValueRequest = new com.aliyun.kms20160120.models.GetSecretValueRequest()
        .setSecretName("test****");
com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
try {
    client.getSecretValueWithOptions(getSecretValueRequest, runtime);
} catch (TeaException error) {
    System.out.println(error.getMessage());
    System.out.println(error.getData().get("Recommend"));
    com.aliyun.teautil.Common.assertAsString(error.message);
} catch (Exception _error) {
    TeaException error = new TeaException(_error.getMessage(), _error);
    System.out.println(error.getMessage());
    System.out.println(error.getData().get("Recommend"));
    com.aliyun.teautil.Common.assertAsString(error.message);
}

Remarque

La réponse contient la valeur du secret ainsi que ses métadonnées. Pour la liste complète des champs de réponse, consultez l'opération API GetSecretValue.

Obtenez la valeur d'un secret via une passerelle dédiée

Exemple complet

package com.aliyun.sample;

import com.aliyun.tea.*;

public class Sample {

    /**
     * Use your AccessKey ID and AccessKey Secret to initialize the client.
     * @return Client
     * @throws Exception
     */
    public static com.aliyun.kms20160120.Client createClient() throws Exception {
        // If the project code is leaked, the AccessKey pair may be leaked and resources in your account become insecure. The following code is for reference only.
        // We recommend that you use Security Token Service (STS) tokens, which provide higher security. For more information about authentication methods, see https://www.alibabacloud.com/help/en/sdk/developer-reference/v2-manage-access-credentials.
        com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
                // Required. Make sure that the ALIBABA_CLOUD_ACCESS_KEY_ID environment variable is configured in the code runtime environment.
                .setAccessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"))
                // Required. Make sure that the ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variable is configured in the code runtime environment.
                .setAccessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"));
        // Dedicated gateway endpoint
        config.endpoint = "kst-hzz65f176a0ogplgq****.cryptoservice.kms.aliyuncs.com";
        // KMS instance CA certificate
        config.ca = "-----BEGIN CERTIFICATE-----MIIDuzCCAqOgAwIBAgIJALTKwWAjvbMiMA0GCS****";
        return new com.aliyun.kms20160120.Client(config);
    }

    public static void main(String[] args_) throws Exception {
        java.util.List<String> args = java.util.Arrays.asList(args_);
        com.aliyun.kms20160120.Client client = Sample.createClient();
        com.aliyun.kms20160120.models.GetSecretValueRequest getSecretValueRequest = new com.aliyun.kms20160120.models.GetSecretValueRequest()
                .setSecretName("test****");
        com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
        try {
            // If you copy and run the sample code, write your own code to display the response of the API operation if necessary.
            client.getSecretValueWithOptions(getSecretValueRequest, runtime);
        } catch (TeaException error) {
            // Handle exceptions with caution based on your actual business scenario and do not ignore exceptions in your project. The error messages displayed in this example are for reference only.
            // Print error messages
            System.out.println(error.getMessage());
            // Provide the URL that is used for troubleshooting.
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            TeaException error = new TeaException(_error.getMessage(), _error);
            // Handle exceptions with caution based on your actual business scenario and do not ignore exceptions in your project. The error messages displayed in this example are for reference only.
            // Print error messages
            System.out.println(error.getMessage());
            // Provide the URL that is used for troubleshooting.
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        }
    }
}

Analyse de l'exemple

Initialisez le client

La passerelle dédiée nécessite deux champs supplémentaires : l'endpoint de l'instance KMS et le certificat CA.

// Dedicated gateway endpoint
config.endpoint = "kst-hzz65f176a0ogplgq****.cryptoservice.kms.aliyuncs.com";
// KMS instance CA certificate
config.ca = "-----BEGIN CERTIFICATE-----MIIDuzCCAqOgAwIBAgIJALTKwWAjvbMiMA0GCS****";

Remplacez kst-hzz65f176a0ogplgq**** par l'ID de votre instance KMS, et remplacez la valeur du certificat CA par celui téléchargé depuis votre instance KMS.

Remarque

Le SDK V1.0 ne prend pas en charge les certificats CA. Définissez plutôt HTTPSInsecure sur true : client.SetHTTPSInsecure(true).

Appelez GetSecretValue

Le code de la requête et la gestion des exceptions sont identiques à ceux de l'exemple avec la passerelle partagée. Remplacez test**** par votre véritable SecretName.

com.aliyun.kms20160120.models.GetSecretValueRequest getSecretValueRequest = new com.aliyun.kms20160120.models.GetSecretValueRequest()
        .setSecretName("test****");
com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
try {
    client.getSecretValueWithOptions(getSecretValueRequest, runtime);
} catch (TeaException error) {
    System.out.println(error.getMessage());
    System.out.println(error.getData().get("Recommend"));
    com.aliyun.teautil.Common.assertAsString(error.message);
} catch (Exception _error) {
    TeaException error = new TeaException(_error.getMessage(), _error);
    System.out.println(error.getMessage());
    System.out.println(error.getData().get("Recommend"));
    com.aliyun.teautil.Common.assertAsString(error.message);
}