Key Management Service:Utiliser un rôle RAM d'instance pour accéder à KMS

Alibaba Cloud SDK V2.0

package com.aliyun.sample;

import com.aliyun.tea.*;

public class Sample {

    public static com.aliyun.kms20160120.Client createClient() throws Exception {
        com.aliyun.credentials.models.Config credentialConfig = new com.aliyun.credentials.models.Config();
        // Set the credential type.
        credentialConfig.type = "ecs_ram_role";
        // Optional. To reduce API calls, specify the instance RAM role name. If this parameter is omitted, the role name is retrieved automatically.
        credentialConfig.roleName = "<your-ecsRamRoleName>";
        com.aliyun.credentials.Client credentialClient = new com.aliyun.credentials.Client(credentialConfig);

        com.aliyun.teaopenapi.models.Config kmsClientConfig = new com.aliyun.teaopenapi.models.Config()
        // Set the KMS endpoint. Example: kms.cn-hangzhou.aliyuncs.com
        .setEndpoint( "kms.cn-hangzhou.aliyuncs.com").
                setCredential(credentialClient);
        return new com.aliyun.kms20160120.Client(kmsClientConfig);

    }

    public static void main(String[] args_) throws Exception {
        java.util.List<String> args = java.util.Arrays.asList(args_);
        com.aliyun.kms20160120.Client client = Sample.createClient();
        com.aliyun.kms20160120.models.ListKeysRequest listKeysRequest = new com.aliyun.kms20160120.models.ListKeysRequest();
        com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
        try {
            client.listKeysWithOptions(listKeysRequest, runtime);
        } catch (TeaException error) {
            System.out.println(error.getMessage());
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            _error.printStackTrace();
        }        
    }
}

Corps de l'onglet

Secrets Manager Client

Pour plus d'informations, consultez la section Secrets Manager Client.

1. Configurez les paramètres suivants dans le fichier secretsmanager.properties ou en tant que variables d'environnement système.

   Paramètre	Valeur
   credentials_type	Définissez sur ecs_ram_role.
   credentials_role_session_name	Nom personnalisé pour la session de rôle, utilisé à des fins d'audit.
   cache_client_region_id	Le format est [{"regionId":"<votre ID de région>"}]. Remplacez <your region id> par votre ID de région réel.

2. Générez le client pour récupérer la valeur du secret.

   import com.aliyuncs.kms.secretsmanager.client.v2.SecretCacheClient;
   import com.aliyuncs.kms.secretsmanager.client.v2.SecretCacheClientBuilder;
   import com.aliyuncs.kms.secretsmanager.client.v2.exception.CacheSecretException;
   import com.aliyuncs.kms.secretsmanager.client.v2.model.SecretInfo;
   
   public class CacheClientEnvironmentSample {
   
       public static void main(String[] args) {
           try {
               SecretCacheClient client = SecretCacheClientBuilder.newClient();
               SecretInfo secretInfo = client.getSecretInfo("#secretName#");
               System.out.println(secretInfo);
           } catch (CacheSecretException e) {
               e.printStackTrace();
           }
       }
   }

Secrets Manager JDBC Client

Cette section utilise une connexion de base de données MySQL via JDBC à titre d'exemple. Pour plus d'informations, consultez la section Secrets Manager JDBC Client.

1. Dans le code applicatif de votre projet, ajoutez un fichier de configuration nommé secretsmanager.properties.

   ## Type of access credentials
   credentials_type=ecs_ram_role
   ## Name of the ECS RAM role
   credentials_role_name=#credentials_role_name#
   ## Region of the associated KMS instance
   cache_client_region_id=[{"regionId":"#regionId#"}]
   ## Custom refresh interval. Unit: milliseconds. Default: 6 hours. Minimum: 5 minutes.
   refresh_secret_ttl=21600000

2. Connectez-vous à la base de données MySQL via JDBC.

   import java.sql.Connection;
   import java.sql.DriverManager;
   import java.sql.SQLException;
   
   public class SecretManagerJDBCSample {
       public static void main(String[] args) throws Exception {
           // Load the Alibaba Cloud Secrets Manager JDBC driver com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver
           Class.forName("com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver");
           Connection connect = null;
           try {
               connect = DriverManager.getConnection("secrets-manager:mysql://<YOUR-MYSQL-IP>:<YOUR-MYSQL-PORT>/<YOUR-DATABASE-NAME>", "#your-mysql-secret-name#","");
           } catch(SQLException e) {
               e.printStackTrace();
           }
       }
   }

RAM secret plug-in

Pour plus d'informations, consultez la section RAM secret plug-in.

1. Ajoutez le fichier de configuration managed_credentials_providers.properties au code d'exécution de votre projet.

   credentials_type=ecs_ram_role
   ## Name of the ECS RAM role
   credentials_role_name=#credentials_role_name#
   ## Region of the associated KMS instance
   cache_client_region_id=[{"regionId":"#regionId#"}]

2. Obtenez un client Alibaba Cloud SDK for Java et appelez les services cloud.

   L'exemple suivant montre comment appeler l'opération DescribeInstanceStatus d'ECS :

   Remarque

   Avant d'exécuter l'exemple de code, ajoutez la dépendance aliyun-java-sdk-ecs à votre fichier pom.xml.

   import com.aliyuncs.IAcsClient;
   import com.aliyuncs.ecs.model.v20140526.DescribeInstanceStatusRequest;
   import com.aliyuncs.ecs.model.v20140526.DescribeInstanceStatusResponse;
   import com.aliyun.kms.secretsmanager.plugin.sdkcore.ProxyAcsClient;
   import com.aliyuncs.exceptions.ClientException;
   import com.aliyuncs.exceptions.ServerException;
   
   public class AliyunSdkProviderSample {
       public static void main(String[]args) {
           String secretName="******";
           /*
             If the application cannot read the default configuration file (managed_credentials_providers.properties) from the classpath or an executable JAR file, or if you need to use a custom configuration file name, you can call the following code to specify a custom configuration file. The file is read in the following order:
             1. If "your-config-name" is an absolute path, the file is read from that path.
             2. If "your-config-name" is only a file name, the file is read from the classpath first, and then from the executable JAR file.
           */
           //ConfigLoader.setConfigName("your-config-name");
           
           // 1. Obtain an IAcsClient by using aliyun-java-sdk-managed-credentials-provider.
           IAcsClient client = null;
           try {
               client = new ProxyAcsClient("<the regionId of ECS>", secretName);
           } catch (ClientException e) {
                e.printStackTrace();
            }
           // 2. Call an ECS API operation to implement your business logic.
           DescribeInstanceStatusRequest request = new DescribeInstanceStatusRequest();
           DescribeInstanceStatusResponse response;
           try {
                response = client.getAcsResponse(request);
           } catch (ServerException e) {
                e.printStackTrace();
            } catch (ClientException e) {
                e.printStackTrace();
            }
           // 3. Shut down the client to release resources used by the plug-in.
           client.shutdown();
       }
   }

Alibaba Cloud SDK V1.0 (Not Recommended)

package com.aliyuncs.kms.examples;

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.IAcsClient;
import com.aliyuncs.auth.AlibabaCloudCredentialsProvider;
import com.aliyuncs.auth.InstanceProfileCredentialsProvider;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.exceptions.ServerException;
import com.aliyuncs.kms.model.v20160120.*;
import com.aliyuncs.profile.DefaultProfile;

public class RamRoleTest {
    public static void main(final String[] args) throws Exception {
        String regionId = "<region-id>";
        DefaultProfile profile = DefaultProfile.getProfile(regionId);

        // Set the RAM role. This topic uses EcsRamRoleTest as an example.
        String roleName = "EcsRamRoleTest"; 

        // Create the credentials provider for the instance RAM role.
        AlibabaCloudCredentialsProvider provider = new InstanceProfileCredentialsProvider(roleName);

        IAcsClient client = new DefaultAcsClient(profile, provider);

        ListKeysRequest request = new ListKeysRequest();
      
        try {
            ListKeysResponse response = client.getAcsResponse(request);
            System.out.println(new Gson().toJson(response));
        } catch (ServerException e) {
            e.printStackTrace();
        } catch (ClientException e) {
            System.out.println("ErrCode:" + e.getErrCode());
            System.out.println("ErrMsg:" + e.getErrMsg());
            System.out.println("RequestId:" + e.getRequestId());
        }

    }
}