SecretProps

Properties for defining a Secret.

See https://www.alibabacloud.com/help/ros/developer-reference/aliyun-kms-secret

Initializer

import ros_cdk_kms
ros_cdk_kms.SecretProps(
  secret_data: typing.Union[str, IResolvable],
  secret_name: typing.Union[str, IResolvable],
  version_id: typing.Union[str, IResolvable],
  description: typing.Union[str, IResolvable] = None,
  dkms_instance_id: typing.Union[str, IResolvable] = None,
  enable_automatic_rotation: typing.Union[bool, IResolvable] = None,
  encryption_key_id: typing.Union[str, IResolvable] = None,
  extended_config: typing.Union[IResolvable, typing.Mapping[typing.Any]] = None,
  force_delete_without_recovery: typing.Union[bool, IResolvable] = None,
  policy: typing.Union[IResolvable, typing.Mapping[typing.Any]] = None,
  recovery_window_in_days: typing.Union[typing.Union[int, float], IResolvable] = None,
  rotation_interval: typing.Union[str, IResolvable] = None,
  secret_data_type: typing.Union[str, IResolvable] = None,
  secret_type: typing.Union[str, IResolvable] = None,
  tags: typing.List[TagsProperty] = None,
  version_stages: typing.Union[IResolvable, typing.List[typing.Union[str, IResolvable]]] = None
)

Properties

secret_data^Required

secret_data: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretData: The value of the secret that you want to create.

Secrets Manager encrypts the secret value and stores it in the initial version.

secret_name^Required

secret_name: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretName: The name of the secret.

version_id^Required

version_id: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property versionId: The version number of the initial version.

Version numbers are unique in each secret object.

description^Optional

description: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property description: The description of the secret.

dkms_instance_id^Optional

dkms_instance_id: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property dkmsInstanceId: The ID of the dedicated KMS instance.

enable_automatic_rotation^Optional

enable_automatic_rotation: typing.Union[bool, IResolvable]

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property enableAutomaticRotation: Specifies whether to enable automatic rotation.

Valid values: true: specifies to enable automatic rotation. false: specifies to disable automatic rotation. This is the default value.

encryption_key_id^Optional

encryption_key_id: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property encryptionKeyId: The ID of the KMS CMK that is used to encrypt the secret value.

If you do not specify this parameter, Secrets Manager automatically creates an encryption key to encrypt the secret. Note The KMS CMK must be a symmetric key.

extended_config^Optional

extended_config: typing.Union[IResolvable, typing.Mapping[typing.Any]]

• Type: typing.Union[ros_cdk_core.IResolvable, typing.Mapping[typing.Any]]

Property extendedConfig: The extended configuration of the secret.

This parameter specifies the properties of the secret of the specific type.

force_delete_without_recovery^Optional

force_delete_without_recovery: typing.Union[bool, IResolvable]

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property forceDeleteWithoutRecovery: Specifies whether to forcibly delete the secret.

If this parameter is set to true, the secret cannot be recovered. Valid values: true false (default value)

policy^Optional

policy: typing.Union[IResolvable, typing.Mapping[typing.Any]]

• Type: typing.Union[ros_cdk_core.IResolvable, typing.Mapping[typing.Any]]

Property policy: The specific content of the credential policy in JSON format.

Maximum length is 32768 bytes. If this parameter is not specified, the default credential policy is used. The policy content includes:

• Version: The version of the policy. Currently, only version 1 is supported.

• Statement: A list of statements, each containing:

• Sid (optional): A custom statement identifier. Up to 128 characters, including letters, digits, and _/+=.@-.

• Effect (required): Whether the statement allows or denies permissions. Valid values: Allow, Deny.
• Principal (required): The entity to which the permissions are granted. Can be the current Alibaba Cloud account, RAM users or roles under the current or other accounts.
• Action (required): The API actions allowed or denied. Must start with "kms:". For valid actions, see - Resource (required): Must be "*", representing this KMS secret.
• Condition (optional): Conditions that limit when the policy is effective. Format: "Condition": {"condition operator": {"condition key": "condition value"}}. See documentation for details.

After granting permissions to RAM users or roles under another Alibaba Cloud account, you must also use RAM to authorize that user or role to use this secret.

recovery_window_in_days^Optional

recovery_window_in_days: typing.Union[typing.Union[int, float], IResolvable]

• Type: typing.Union[typing.Union[int, float], ros_cdk_core.IResolvable]

Property recoveryWindowInDays: Specifies the recovery period of the secret if you do not forcibly delete it.

Default value: 30

rotation_interval^Optional

rotation_interval: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property rotationInterval: The interval for automatic rotation.

Valid values: 6 hours to 8,760 hours (365 days). The value is in the integer[unit] format. The unit can be d (day), h (hour), m (minute), or s (second). For example, both 7d and 604800s indicate a seven-day interval.

secret_data_type^Optional

secret_data_type: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretDataType: The type of the secret value.

Valid values: text (default value) binary

secret_type^Optional

secret_type: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretType: The type of the secret.

Valid values: Generic: specifies a generic secret. Rds: specifies a managed ApsaraDB RDS secret. RAMCredentials: specifies a managed RAM secret. ECS: specifies a managed ECS secret.

tags^Optional

tags: typing.List[TagsProperty]

• Type: typing.List[TagsProperty]

Property tags: Tags to attach to secret.

Max support 20 tags to add during create secret. Each tag with two properties Key and Value, and Key is required.

version_stages^Optional

version_stages: typing.Union[IResolvable, typing.List[typing.Union[str, IResolvable]]]

• Type: typing.Union[ros_cdk_core.IResolvable, typing.List[typing.Union[str, ros_cdk_core.IResolvable]]]

Property versionStages: The stage labels that mark the secret version.

ACSCurrent will be marked as DefaultIf you do not specify it, Secrets Manager marks it with "ACSCurrent".