Secret

• Implements: ISecret

This class encapsulates and extends the ROS resource type ALIYUN::KMS::Secret.

Initializers

import com.aliyun.ros.cdk.kms.Secret;
Secret.Builder.create(Construct scope, java.lang.String id, java.lang.Boolean enableResourcePropertyConstraint)
    .secretData(java.lang.String)
    .secretData(IResolvable)
    .secretName(java.lang.String)
    .secretName(IResolvable)
    .versionId(java.lang.String)
    .versionId(IResolvable)
//  .description(java.lang.String)
//  .description(IResolvable)
//  .dkmsInstanceId(java.lang.String)
//  .dkmsInstanceId(IResolvable)
//  .enableAutomaticRotation(java.lang.Boolean)
//  .enableAutomaticRotation(IResolvable)
//  .encryptionKeyId(java.lang.String)
//  .encryptionKeyId(IResolvable)
//  .extendedConfig(IResolvable)
//  .extendedConfig(java.util.Map<java.lang.String, java.lang.Object>)
//  .forceDeleteWithoutRecovery(java.lang.Boolean)
//  .forceDeleteWithoutRecovery(IResolvable)
//  .policy(IResolvable)
//  .policy(java.util.Map<java.lang.String, java.lang.Object>)
//  .recoveryWindowInDays(java.lang.Number)
//  .recoveryWindowInDays(IResolvable)
//  .rotationInterval(java.lang.String)
//  .rotationInterval(IResolvable)
//  .secretDataType(java.lang.String)
//  .secretDataType(IResolvable)
//  .secretType(java.lang.String)
//  .secretType(IResolvable)
//  .tags(java.util.List<TagsProperty>)
//  .versionStages(IResolvable)
//  .versionStages(java.util.List<java.lang.String)
//  .versionStages(IResolvable>)
    .build();

scope^Required

• Type: com.aliyun.ros.cdk.core.Construct

id^Required

• Type: java.lang.String

enableResourcePropertyConstraint^Optional

• Type: java.lang.Boolean

secretData^Required

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Property secretData: The value of the secret.

The value can be up to 30,720 bytes (30 KB) in length. KMS encrypts the secret value with the specified key and stores the encrypted value in the initial version.

• If SecretType is set to Generic, you can specify a custom secret value.
• If SecretType is set to Rds, the secret value must be in the following format: {"Accounts":[{"AccountName":"","AccountPassword":""}]}. In the format, AccountName specifies the username of the account for the RDS instance and AccountPassword specifies the password of the account.
• If SecretType is set to Redis, set this parameter to $Auto.
• If SecretType is set to RAMCredentials, the secret value must be in the following format: {"AccessKeys":[{"AccessKeyId":"","AccessKeySecret":""}]}. In the format, AccessKeyId specifies the AccessKey ID and AccessKeySecret specifies the AccessKey secret. You must specify all AccessKey pairs of the RAM user.
• If SecretType is set to PolarDB, set this parameter to $Auto.
• If SecretType is set to ECS, the secret value must be in one of the following formats:
• If SecretSubType in the ExtendedConfig parameter is set to Password: {"UserName":"","Password": ""}. In the format, UserName specifies the username used to log on to the ECS instance and Password specifies the password used to log on to the ECS instance.
• If SecretSubType in the ExtendedConfig parameter is set to SSHKey: {"UserName":"","PublicKey": "", "PrivateKey": ""}. In the format, PublicKey specifies the SSH-formatted public key used to log on to the ECS instance and PrivateKey specifies the private key used to log on to the ECS instance.

secretName^Required

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Property secretName: The name of the secret.

The name must be unique in the same region. The name can be up to 192 characters in length and can contain letters, digits, underscores (_), forward slashes (/), plus signs (+), equal signs (=), periods (.), hyphens (-), and at signs (@). The following limits apply to secret names for different types of secrets:

• If SecretType is set to Generic, Rds, or Redis, the name cannot start with acs\/.
• If SecretType is set to RAMCredentials, set this parameter to the fixed value $Auto. In this case, KMS automatically generates a secret name that starts with acs\/ram\/user\/ and contains the display name of the RAM user.
• If SecretType is set to ECS, the name must start with acs\/ecs\/.

versionId^Required

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Property versionId: The version number of the initial version.

The version number must be unique within the secret. The version number can be up to 64 characters in length.

description^Optional

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Property description: The description of the secret.

dkmsInstanceId^Optional

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Property dkmsInstanceId: The ID of the dedicated KMS instance.

enableAutomaticRotation^Optional

• Type: java.lang.Boolean OR com.aliyun.ros.cdk.core.IResolvable

Property enableAutomaticRotation: Specifies whether to enable automatic rotation.

Valid values:

• true: enables automatic rotation.
• false (default): disables automatic rotation.

This parameter is valid only if SecretType is set to Rds, PolarDB, Redis, RAMCredentials, or ECS. If SecretType is set to Generic, automatic rotation is not supported. You can call the PutSecretValue operation to manually rotate the secret.

encryptionKeyId^Optional

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Property encryptionKeyId: The ID of the key used to encrypt the secret value.

The key and the secret must be in the same KMS instance. The key must be a symmetric key.

extendedConfig^Optional

• Type: com.aliyun.ros.cdk.core.IResolvable OR java.util.Map

Property extendedConfig: The extended configuration of the secret.

This parameter specifies the properties of the secret of a specific type. The value can be up to 1,024 characters in length.

• If SecretType is set to Generic, this parameter is ignored.
• If SecretType is set to Rds, you must specify the following parameters in ExtendedConfig:
• SecretSubType (Required): The subtype of the secret. Valid values:
• SingleUser: Secrets Manager manages the RDS secret in single-account mode. When the secret is rotated, the password of the specified account is reset to a new random password.
• DoubleUsers: Secrets Manager manages the RDS secret in double-account mode. ACSCurrent and ACSPrevious point to one of the accounts. When the secret is rotated, the password of the account pointed to by ACSPrevious is reset to a new random password. Then, Secrets Manager swaps the accounts that ACSCurrent and ACSPrevious point to.
• DBInstanceId (Required): The ID of the RDS instance to which the account belongs.
• CustomData (Optional): The custom data. The value is a key-value pair in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). Example: {"Key1": "v1", "fds":"fdsf"}. The default value is {}.
• If SecretType is set to Redis, you must specify the following parameters in ExtendedConfig:
• SecretSubType (Required): The subtype of the secret. Valid values:
• DoubleUsers: Secrets Manager manages the Redis secret in double-account mode. ACSCurrent and ACSPrevious point to one of the accounts. When the secret is rotated, the password of the account pointed to by ACSPrevious is reset to a new random password. Then, Secrets Manager swaps the accounts that ACSCurrent and ACSPrevious point to.
• AccountName (Required): The database username.
• CloneAccountName (Required): The database username, which is the value of AccountName with the _clone suffix.
• AccountPrivilege (Required): The permissions to access the database.
• InstanceId (Required): The ID of the Redis instance.
• RegionId (Required): The ID of the region where the Redis instance resides.
• CustomData (Optional): The custom data. The value is a key-value pair in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). Example: {"Key1": "v1", "fds":"fdsf"}. The default value is {}.
• If SecretType is set to RAMCredentials, you must specify the following parameters in ExtendedConfig:
• SecretSubType (Required): The subtype of the secret. The value is RamUserAccessKey.
• UserName (Required): The name of the RAM user.
• CustomData (Optional): The custom data. The value is a key-value pair in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). The default value is {}.
• If SecretType is set to ECS, you must specify the following parameters in ExtendedConfig:
• SecretSubType (Required): The subtype of the secret. Valid values:
• Password: an ECS password.
• SSHKey: an ECS SSH key pair.
• RegionId (Required): The ID of the region where the ECS instance resides.
• InstanceId (Required): The ID of the ECS instance.
• CustomData (Optional): The custom data. The value is a key-value pair in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). The default value is {}.
• If SecretType is set to PolarDB, you must specify the following parameters in ExtendedConfig:
• SecretSubType (Required): The fixed value is DoubleUsers.
• RegionId (Required): The region.
• DBClusterId (Required): The ID of the PolarDB instance.
• DBType (Required): MySQL or PostgreSQL.
• AccountName (Required): The account name.
• CloneAccountName: The value is AccountName_clone.
• AccountType: Only Normal is supported.
• AccountPrivilege: This parameter is available only for MySQL.
• DBName: This parameter is available only for MySQL.
• CustomData (Optional): The custom data. The value is a key-value pair in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). Example: {"Key1": "v1", "fds":"fdsf"}. The default value is {}.

If SecretType is set to Rds, Redis, PolarDB, RAMCredentials, or ECS, you must configure this parameter.

forceDeleteWithoutRecovery^Optional

• Type: java.lang.Boolean OR com.aliyun.ros.cdk.core.IResolvable

Property forceDeleteWithoutRecovery: Specifies whether to forcibly delete the secret.

If this parameter is set to true, the secret cannot be recovered. Valid values: true false (default value)

policy^Optional

• Type: com.aliyun.ros.cdk.core.IResolvable OR java.util.Map

Property policy: The specific content of the credential policy in JSON format.

Maximum length is 32768 bytes. If this parameter is not specified, the default credential policy is used. The policy content includes:

• Version: The version of the policy. Currently, only version 1 is supported.

• Statement: A list of statements, each containing:

• Sid (optional): A custom statement identifier. Up to 128 characters, including letters, digits, and _/+=.@-.

• Effect (required): Whether the statement allows or denies permissions. Valid values: Allow, Deny.
• Principal (required): The entity to which the permissions are granted. Can be the current Alibaba Cloud account, RAM users or roles under the current or other accounts.
• Action (required): The API actions allowed or denied. Must start with "kms:". For valid actions, see - Resource (required): Must be "*", representing this KMS secret.
• Condition (optional): Conditions that limit when the policy is effective. Format: "Condition": {"condition operator": {"condition key": "condition value"}}. See documentation for details.

After granting permissions to RAM users or roles under another Alibaba Cloud account, you must also use RAM to authorize that user or role to use this secret.

recoveryWindowInDays^Optional

• Type: java.lang.Number OR com.aliyun.ros.cdk.core.IResolvable

Property recoveryWindowInDays: Specifies the recovery period of the secret if you do not forcibly delete it.

Default value: 30

rotationInterval^Optional

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Property rotationInterval: The interval for automatic rotation.

The value is in the range of 6 hours to 8,760 hours (365 days).
The value is in the integer[unit] format. integer indicates the interval. unit indicates the unit of time.
Valid values for unit: d (day), h (hour), m (minute), and s (second). For example, both 7d and 604,800s indicate a rotation interval of 7 days.

You must specify this parameter if you set EnableAutomaticRotation to true. You do not need to specify this parameter if you set EnableAutomaticRotation to false.

secretDataType^Optional

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Property secretDataType: The type of the secret value.

Valid values:

• text (default): The secret value is a text string.
• binary: The secret value is a binary string.

If SecretType is set to Rds, Redis, PolarDB, RAMCredentials, or ECS, SecretDataType must be set to text.

secretType^Optional

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Property secretType: The type of the secret.

Valid values:

• Generic (default): a generic secret.
• Rds: an RDS secret.
• Redis: a Redis secret.
• RAMCredentials: a RAM secret.
• ECS: an ECS secret.
• PolarDB: a PolarDB secret.

tags^Optional

• Type: java.util.List<TagsProperty>

Property tags: Tags to attach to secret.

Max support 20 tags to add during create secret. Each tag with two properties Key and Value, and Key is required.

versionStages^Optional

• Type: com.aliyun.ros.cdk.core.IResolvable OR java.util.List

Property versionStages: The stage labels that mark the secret version.

ACSCurrent will be marked as DefaultIf you do not specify it, Secrets Manager marks it with "ACSCurrent".

Methods

toString

public java.lang.String toString()

Returns a string representation of this construct.

synthesize

public void synthesize(ISynthesisSession session)

Allows this construct to emit artifacts into the cloud assembly during synthesis.

This method is usually implemented by framework-level constructs such as Stack and Asset as they participate in synthesizing the cloud assembly.

session^Required

• Type: com.aliyun.ros.cdk.core.ISynthesisSession

The synthesis session.

addCondition

public void addCondition(RosCondition condition)

condition^Required

• Type: com.aliyun.ros.cdk.core.RosCondition

addCount

public void addCount(java.lang.Number OR IResolvable count)

count^Required

• Type: java.lang.Number OR com.aliyun.ros.cdk.core.IResolvable

addDependency

public void addDependency(Resource resource)

resource^Required

• Type: com.aliyun.ros.cdk.core.Resource

addResourceDesc

public void addResourceDesc(java.lang.String desc)

desc^Required

• Type: java.lang.String

applyRemovalPolicy

public void applyRemovalPolicy(RemovalPolicy policy)

policy^Required

• Type: com.aliyun.ros.cdk.core.RemovalPolicy

fetchCondition

public RosCondition fetchCondition()

fetchDependency

public java.util.List<java.lang.String> fetchDependency()

fetchResourceDesc

public java.lang.String fetchResourceDesc()

getAtt

public IResolvable getAtt(java.lang.String name)

name^Required

• Type: java.lang.String

setMetadata

public void setMetadata(java.lang.String key, java.lang.Object value)

key^Required

• Type: java.lang.String

value^Required

• Type: java.lang.Object

Static Functions

isConstruct

import com.aliyun.ros.cdk.kms.Secret;
Secret.isConstruct(java.lang.Object x)

Return whether the given object is a Construct.

x^Required

• Type: java.lang.Object

Properties

node^Required

public ConstructNode getNode();

• Type: com.aliyun.ros.cdk.core.ConstructNode

The construct tree node associated with this construct.

env^Required

public IResourceEnvironment getEnv();

• Type: com.aliyun.ros.cdk.core.IResourceEnvironment

The environment this resource belongs to.

For resources that are created and managed by the CDK (generally, those created by creating new class instances like Role, Bucket, etc.), this is always the same as the environment of the stack they belong to; however, for imported resources (those obtained from static methods like fromRoleArn, fromBucketName, etc.), that might be different than the stack they were imported into.

ref^Required

public java.lang.String getRef();

• Type: java.lang.String

stack^Required

public Stack getStack();

• Type: com.aliyun.ros.cdk.core.Stack

The stack in which this resource is defined.

resource^Optional

public RosResource getResource();

• Type: com.aliyun.ros.cdk.core.RosResource

attrArn^Required

public java.lang.Object getAttrArn();

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Attribute Arn: The Alibaba Cloud Resource Name (ARN).

attrSecretName^Required

public java.lang.Object getAttrSecretName();

• Type: java.lang.String OR com.aliyun.ros.cdk.core.IResolvable

Attribute SecretName: The name of the secret.

props^Required

public SecretProps getProps();

• Type: SecretProps