Key Management Service:Usar uma função RAM de instância para acessar o KMS

Alibaba Cloud SDK V2.0

package com.aliyun.sample;

import com.aliyun.tea.*;

public class Sample {

    public static com.aliyun.kms20160120.Client createClient() throws Exception {
        com.aliyun.credentials.models.Config credentialConfig = new com.aliyun.credentials.models.Config();
        // Set the credential type.
        credentialConfig.type = "ecs_ram_role";
        // Optional. To reduce API calls, specify the instance RAM role name. If this parameter is omitted, the role name is retrieved automatically.
        credentialConfig.roleName = "<your-ecsRamRoleName>";
        com.aliyun.credentials.Client credentialClient = new com.aliyun.credentials.Client(credentialConfig);

        com.aliyun.teaopenapi.models.Config kmsClientConfig = new com.aliyun.teaopenapi.models.Config()
        // Set the KMS endpoint. Example: kms.cn-hangzhou.aliyuncs.com
        .setEndpoint( "kms.cn-hangzhou.aliyuncs.com").
                setCredential(credentialClient);
        return new com.aliyun.kms20160120.Client(kmsClientConfig);

    }

    public static void main(String[] args_) throws Exception {
        java.util.List<String> args = java.util.Arrays.asList(args_);
        com.aliyun.kms20160120.Client client = Sample.createClient();
        com.aliyun.kms20160120.models.ListKeysRequest listKeysRequest = new com.aliyun.kms20160120.models.ListKeysRequest();
        com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
        try {
            client.listKeysWithOptions(listKeysRequest, runtime);
        } catch (TeaException error) {
            System.out.println(error.getMessage());
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            _error.printStackTrace();
        }        
    }
}

Corpo da aba

Secrets Manager Client

Para mais informações, consulte Secrets Manager Client.

1. Configure os seguintes parâmetros no arquivo secretsmanager.properties ou como variáveis de ambiente do sistema.

   Parâmetro	Valor
   credentials_type	Defina como ecs_ram_role.
   credentials_role_session_name	Um nome personalizado para a sessão da função, usado para auditoria.
   cache_client_region_id	O formato é [{"regionId":"<your region id>"}]. Substitua <your region id> pelo seu ID de região real.

2. Compile o cliente para recuperar o valor do segredo.

   import com.aliyuncs.kms.secretsmanager.client.v2.SecretCacheClient;
   import com.aliyuncs.kms.secretsmanager.client.v2.SecretCacheClientBuilder;
   import com.aliyuncs.kms.secretsmanager.client.v2.exception.CacheSecretException;
   import com.aliyuncs.kms.secretsmanager.client.v2.model.SecretInfo;
   
   public class CacheClientEnvironmentSample {
   
       public static void main(String[] args) {
           try {
               SecretCacheClient client = SecretCacheClientBuilder.newClient();
               SecretInfo secretInfo = client.getSecretInfo("#secretName#");
               System.out.println(secretInfo);
           } catch (CacheSecretException e) {
               e.printStackTrace();
           }
       }
   }

Secrets Manager JDBC Client

Esta seção usa uma conexão de banco de dados MySQL via JDBC como exemplo. Para mais informações, consulte Secrets Manager JDBC Client.

1. No código da aplicação do seu projeto, adicione um arquivo de configuração chamado secretsmanager.properties.

   ## Type of access credentials
   credentials_type=ecs_ram_role
   ## Name of the ECS RAM role
   credentials_role_name=#credentials_role_name#
   ## Region of the associated KMS instance
   cache_client_region_id=[{"regionId":"#regionId#"}]
   ## Custom refresh interval. Unit: milliseconds. Default: 6 hours. Minimum: 5 minutes.
   refresh_secret_ttl=21600000

2. Conecte-se ao banco de dados MySQL via JDBC.

   import java.sql.Connection;
   import java.sql.DriverManager;
   import java.sql.SQLException;
   
   public class SecretManagerJDBCSample {
       public static void main(String[] args) throws Exception {
           // Load the Alibaba Cloud Secrets Manager JDBC driver com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver
           Class.forName("com.aliyun.kms.secretsmanager.MysqlSecretsManagerSimpleDriver");
           Connection connect = null;
           try {
               connect = DriverManager.getConnection("secrets-manager:mysql://<YOUR-MYSQL-IP>:<YOUR-MYSQL-PORT>/<YOUR-DATABASE-NAME>", "#your-mysql-secret-name#","");
           } catch(SQLException e) {
               e.printStackTrace();
           }
       }
   }

Plug-in de segredo do RAM

Para mais informações, consulte RAM secret plug-in.

1. Adicione o arquivo de configuração managed_credentials_providers.properties ao código de execução do seu projeto.

   credentials_type=ecs_ram_role
   ## Name of the ECS RAM role
   credentials_role_name=#credentials_role_name#
   ## Region of the associated KMS instance
   cache_client_region_id=[{"regionId":"#regionId#"}]

2. Obtenha um cliente do Alibaba Cloud SDK for Java e chame os services de nuvem.

   O exemplo a seguir mostra como chamar a operação DescribeInstanceStatus do ECS:

   Nota

   Antes de executar o código de exemplo, adicione a dependência aliyun-java-sdk-ecs ao seu arquivo pom.xml.

   import com.aliyuncs.IAcsClient;
   import com.aliyuncs.ecs.model.v20140526.DescribeInstanceStatusRequest;
   import com.aliyuncs.ecs.model.v20140526.DescribeInstanceStatusResponse;
   import com.aliyun.kms.secretsmanager.plugin.sdkcore.ProxyAcsClient;
   import com.aliyuncs.exceptions.ClientException;
   import com.aliyuncs.exceptions.ServerException;
   
   public class AliyunSdkProviderSample {
       public static void main(String[]args) {
           String secretName="******";
           /*
             If the application cannot read the default configuration file (managed_credentials_providers.properties) from the classpath or an executable JAR file, or if you need to use a custom configuration file name, you can call the following code to specify a custom configuration file. The file is read in the following order:
             1. If "your-config-name" is an absolute path, the file is read from that path.
             2. If "your-config-name" is only a file name, the file is read from the classpath first, and then from the executable JAR file.
           */
           //ConfigLoader.setConfigName("your-config-name");
           
           // 1. Obtain an IAcsClient by using aliyun-java-sdk-managed-credentials-provider.
           IAcsClient client = null;
           try {
               client = new ProxyAcsClient("<the regionId of ECS>", secretName);
           } catch (ClientException e) {
                e.printStackTrace();
            }
           // 2. Call an ECS API operation to implement your business logic.
           DescribeInstanceStatusRequest request = new DescribeInstanceStatusRequest();
           DescribeInstanceStatusResponse response;
           try {
                response = client.getAcsResponse(request);
           } catch (ServerException e) {
                e.printStackTrace();
            } catch (ClientException e) {
                e.printStackTrace();
            }
           // 3. Shut down the client to release resources used by the plug-in.
           client.shutdown();
       }
   }

Alibaba Cloud SDK V1.0 (Não Recomendado)

package com.aliyuncs.kms.examples;

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.IAcsClient;
import com.aliyuncs.auth.AlibabaCloudCredentialsProvider;
import com.aliyuncs.auth.InstanceProfileCredentialsProvider;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.exceptions.ServerException;
import com.aliyuncs.kms.model.v20160120.*;
import com.aliyuncs.profile.DefaultProfile;

public class RamRoleTest {
    public static void main(final String[] args) throws Exception {
        String regionId = "<region-id>";
        DefaultProfile profile = DefaultProfile.getProfile(regionId);

        // Set the RAM role. This topic uses EcsRamRoleTest as an example.
        String roleName = "EcsRamRoleTest"; 

        // Create the credentials provider for the instance RAM role.
        AlibabaCloudCredentialsProvider provider = new InstanceProfileCredentialsProvider(roleName);

        IAcsClient client = new DefaultAcsClient(profile, provider);

        ListKeysRequest request = new ListKeysRequest();
      
        try {
            ListKeysResponse response = client.getAcsResponse(request);
            System.out.println(new Gson().toJson(response));
        } catch (ServerException e) {
            e.printStackTrace();
        } catch (ClientException e) {
            System.out.println("ErrCode:" + e.getErrCode());
            System.out.println("ErrMsg:" + e.getErrMsg());
            System.out.println("RequestId:" + e.getRequestId());
        }

    }
}