Secret

• Implements: ISecret

This class encapsulates and extends the ROS resource type ALIYUN::KMS::Secret.

Initializers

import ros_cdk_kms
ros_cdk_kms.Secret(
  scope: Construct,
  id: str,
  secret_data: typing.Union[str, IResolvable],
  secret_name: typing.Union[str, IResolvable],
  version_id: typing.Union[str, IResolvable],
  description: typing.Union[str, IResolvable] = None,
  dkms_instance_id: typing.Union[str, IResolvable] = None,
  enable_automatic_rotation: typing.Union[bool, IResolvable] = None,
  encryption_key_id: typing.Union[str, IResolvable] = None,
  extended_config: typing.Union[IResolvable, typing.Mapping[typing.Any]] = None,
  force_delete_without_recovery: typing.Union[bool, IResolvable] = None,
  policy: typing.Union[IResolvable, typing.Mapping[typing.Any]] = None,
  recovery_window_in_days: typing.Union[typing.Union[int, float], IResolvable] = None,
  rotation_interval: typing.Union[str, IResolvable] = None,
  secret_data_type: typing.Union[str, IResolvable] = None,
  secret_type: typing.Union[str, IResolvable] = None,
  tags: typing.List[TagsProperty] = None,
  version_stages: typing.Union[IResolvable, typing.List[typing.Union[str, IResolvable]]] = None,
  enable_resource_property_constraint: bool = None
)

scope^Required

• Type: ros_cdk_core.Construct

id^Required

• Type: str

secret_data^Required

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretData: The value of the secret that you want to create.

Secrets Manager encrypts the secret value and stores it in the initial version.

secret_name^Required

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretName: The name of the secret.

version_id^Required

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property versionId: The version number of the initial version.

Version numbers are unique in each secret object.

description^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property description: The description of the secret.

dkms_instance_id^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property dkmsInstanceId: The ID of the dedicated KMS instance.

enable_automatic_rotation^Optional

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property enableAutomaticRotation: Specifies whether to enable automatic rotation.

Valid values: true: specifies to enable automatic rotation. false: specifies to disable automatic rotation. This is the default value.

encryption_key_id^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property encryptionKeyId: The ID of the KMS CMK that is used to encrypt the secret value.

If you do not specify this parameter, Secrets Manager automatically creates an encryption key to encrypt the secret. Note The KMS CMK must be a symmetric key.

extended_config^Optional

• Type: typing.Union[ros_cdk_core.IResolvable, typing.Mapping[typing.Any]]

Property extendedConfig: The extended configuration of the secret.

This parameter specifies the properties of the secret of the specific type.

force_delete_without_recovery^Optional

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property forceDeleteWithoutRecovery: Specifies whether to forcibly delete the secret.

If this parameter is set to true, the secret cannot be recovered. Valid values: true false (default value)

policy^Optional

• Type: typing.Union[ros_cdk_core.IResolvable, typing.Mapping[typing.Any]]

Property policy: The specific content of the credential policy in JSON format.

Maximum length is 32768 bytes. If this parameter is not specified, the default credential policy is used. The policy content includes:

• Version: The version of the policy. Currently, only version 1 is supported.

• Statement: A list of statements, each containing:

• Sid (optional): A custom statement identifier. Up to 128 characters, including letters, digits, and _/+=.@-.

• Effect (required): Whether the statement allows or denies permissions. Valid values: Allow, Deny.
• Principal (required): The entity to which the permissions are granted. Can be the current Alibaba Cloud account, RAM users or roles under the current or other accounts.
• Action (required): The API actions allowed or denied. Must start with "kms:". For valid actions, see - Resource (required): Must be "*", representing this KMS secret.
• Condition (optional): Conditions that limit when the policy is effective. Format: "Condition": {"condition operator": {"condition key": "condition value"}}. See documentation for details.

After granting permissions to RAM users or roles under another Alibaba Cloud account, you must also use RAM to authorize that user or role to use this secret.

recovery_window_in_days^Optional

• Type: typing.Union[typing.Union[int, float], ros_cdk_core.IResolvable]

Property recoveryWindowInDays: Specifies the recovery period of the secret if you do not forcibly delete it.

Default value: 30

rotation_interval^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property rotationInterval: The interval for automatic rotation.

Valid values: 6 hours to 8,760 hours (365 days). The value is in the integer[unit] format. The unit can be d (day), h (hour), m (minute), or s (second). For example, both 7d and 604800s indicate a seven-day interval.

secret_data_type^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretDataType: The type of the secret value.

Valid values: text (default value) binary

secret_type^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretType: The type of the secret.

Valid values: Generic: specifies a generic secret. Rds: specifies a managed ApsaraDB RDS secret. RAMCredentials: specifies a managed RAM secret. ECS: specifies a managed ECS secret.

tags^Optional

• Type: typing.List[TagsProperty]

Property tags: Tags to attach to secret.

Max support 20 tags to add during create secret. Each tag with two properties Key and Value, and Key is required.

version_stages^Optional

• Type: typing.Union[ros_cdk_core.IResolvable, typing.List[typing.Union[str, ros_cdk_core.IResolvable]]]

Property versionStages: The stage labels that mark the secret version.

ACSCurrent will be marked as DefaultIf you do not specify it, Secrets Manager marks it with "ACSCurrent".

enable_resource_property_constraint^Optional

• Type: bool

Methods

to_string

def to_string() -> str

Returns a string representation of this construct.

synthesize

def synthesize(
  session: ISynthesisSession
) -> None

Allows this construct to emit artifacts into the cloud assembly during synthesis.

This method is usually implemented by framework-level constructs such as Stack and Asset as they participate in synthesizing the cloud assembly.

session^Required

• Type: ros_cdk_core.ISynthesisSession

The synthesis session.

add_condition

def add_condition(
  condition: RosCondition
) -> None

condition^Required

• Type: ros_cdk_core.RosCondition

add_count

def add_count(
  count: typing.Union[typing.Union[int, float], IResolvable]
) -> None

count^Required

• Type: typing.Union[typing.Union[int, float], ros_cdk_core.IResolvable]

add_dependency

def add_dependency(
  resource: Resource
) -> None

resource^Required

• Type: ros_cdk_core.Resource

add_resource_desc

def add_resource_desc(
  desc: str
) -> None

desc^Required

• Type: str

apply_removal_policy

def apply_removal_policy(
  policy: RemovalPolicy
) -> None

policy^Required

• Type: ros_cdk_core.RemovalPolicy

fetch_condition

def fetch_condition() -> RosCondition

fetch_dependency

def fetch_dependency() -> typing.List[str]

fetch_resource_desc

def fetch_resource_desc() -> str

get_att

def get_att(
  name: str
) -> IResolvable

name^Required

• Type: str

set_metadata

def set_metadata(
  key: str,
  value: typing.Any
) -> None

key^Required

• Type: str

value^Required

• Type: typing.Any

Static Functions

is_construct

import ros_cdk_kms
ros_cdk_kms.Secret.is_construct(
  x: typing.Any
)

Return whether the given object is a Construct.

x^Required

• Type: typing.Any

Properties

node^Required

node: ConstructNode

• Type: ros_cdk_core.ConstructNode

The construct tree node associated with this construct.

env^Required

env: IResourceEnvironment

• Type: ros_cdk_core.IResourceEnvironment

The environment this resource belongs to.

For resources that are created and managed by the CDK (generally, those created by creating new class instances like Role, Bucket, etc.), this is always the same as the environment of the stack they belong to; however, for imported resources (those obtained from static methods like fromRoleArn, fromBucketName, etc.), that might be different than the stack they were imported into.

ref^Required

ref: str

• Type: str

stack^Required

stack: Stack

• Type: ros_cdk_core.Stack

The stack in which this resource is defined.

resource^Optional

resource: RosResource

• Type: ros_cdk_core.RosResource

attr_arn^Required

attr_arn: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Attribute Arn: The Alibaba Cloud Resource Name (ARN).

attr_secret_name^Required

attr_secret_name: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Attribute SecretName: The name of the secret.

props^Required

props: SecretProps

• Type: SecretProps