Secret

• Implements: ISecret

This class encapsulates and extends the ROS resource type ALIYUN::KMS::Secret.

Initializers

import ros_cdk_kms
ros_cdk_kms.Secret(
  scope: Construct,
  id: str,
  secret_data: typing.Union[str, IResolvable],
  secret_name: typing.Union[str, IResolvable],
  version_id: typing.Union[str, IResolvable],
  description: typing.Union[str, IResolvable] = None,
  dkms_instance_id: typing.Union[str, IResolvable] = None,
  enable_automatic_rotation: typing.Union[bool, IResolvable] = None,
  encryption_key_id: typing.Union[str, IResolvable] = None,
  extended_config: typing.Union[IResolvable, typing.Mapping[typing.Any]] = None,
  force_delete_without_recovery: typing.Union[bool, IResolvable] = None,
  policy: typing.Union[IResolvable, typing.Mapping[typing.Any]] = None,
  recovery_window_in_days: typing.Union[typing.Union[int, float], IResolvable] = None,
  rotation_interval: typing.Union[str, IResolvable] = None,
  secret_data_type: typing.Union[str, IResolvable] = None,
  secret_type: typing.Union[str, IResolvable] = None,
  tags: typing.List[TagsProperty] = None,
  version_stages: typing.Union[IResolvable, typing.List[typing.Union[str, IResolvable]]] = None,
  enable_resource_property_constraint: bool = None
)

scope^Required

• Type: ros_cdk_core.Construct

id^Required

• Type: str

secret_data^Required

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretData: The value of the secret.

The value can be up to 30,720 bytes (30 KB) in length. KMS encrypts the secret value with the specified key and stores the encrypted value in the initial version.

• If SecretType is set to Generic, you can specify a custom secret value.
• If SecretType is set to Rds, the secret value must be in the following format: {"Accounts":[{"AccountName":"","AccountPassword":""}]}. In the format, AccountName specifies the username of the account for the RDS instance and AccountPassword specifies the password of the account.
• If SecretType is set to Redis, set this parameter to $Auto.
• If SecretType is set to RAMCredentials, the secret value must be in the following format: {"AccessKeys":[{"AccessKeyId":"","AccessKeySecret":""}]}. In the format, AccessKeyId specifies the AccessKey ID and AccessKeySecret specifies the AccessKey secret. You must specify all AccessKey pairs of the RAM user.
• If SecretType is set to PolarDB, set this parameter to $Auto.
• If SecretType is set to ECS, the secret value must be in one of the following formats:
• If SecretSubType in the ExtendedConfig parameter is set to Password: {"UserName":"","Password": ""}. In the format, UserName specifies the username used to log on to the ECS instance and Password specifies the password used to log on to the ECS instance.
• If SecretSubType in the ExtendedConfig parameter is set to SSHKey: {"UserName":"","PublicKey": "", "PrivateKey": ""}. In the format, PublicKey specifies the SSH-formatted public key used to log on to the ECS instance and PrivateKey specifies the private key used to log on to the ECS instance.

secret_name^Required

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretName: The name of the secret.

The name must be unique in the same region. The name can be up to 192 characters in length and can contain letters, digits, underscores (_), forward slashes (/), plus signs (+), equal signs (=), periods (.), hyphens (-), and at signs (@). The following limits apply to secret names for different types of secrets:

• If SecretType is set to Generic, Rds, or Redis, the name cannot start with acs\/.
• If SecretType is set to RAMCredentials, set this parameter to the fixed value $Auto. In this case, KMS automatically generates a secret name that starts with acs\/ram\/user\/ and contains the display name of the RAM user.
• If SecretType is set to ECS, the name must start with acs\/ecs\/.

version_id^Required

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property versionId: The version number of the initial version.

The version number must be unique within the secret. The version number can be up to 64 characters in length.

description^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property description: The description of the secret.

dkms_instance_id^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property dkmsInstanceId: The ID of the dedicated KMS instance.

enable_automatic_rotation^Optional

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property enableAutomaticRotation: Specifies whether to enable automatic rotation.

Valid values:

• true: enables automatic rotation.
• false (default): disables automatic rotation.

This parameter is valid only if SecretType is set to Rds, PolarDB, Redis, RAMCredentials, or ECS. If SecretType is set to Generic, automatic rotation is not supported. You can call the PutSecretValue operation to manually rotate the secret.

encryption_key_id^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property encryptionKeyId: The ID of the key used to encrypt the secret value.

The key and the secret must be in the same KMS instance. The key must be a symmetric key.

extended_config^Optional

• Type: typing.Union[ros_cdk_core.IResolvable, typing.Mapping[typing.Any]]

Property extendedConfig: The extended configuration of the secret.

This parameter specifies the properties of the secret of a specific type. The value can be up to 1,024 characters in length.

• If SecretType is set to Generic, this parameter is ignored.
• If SecretType is set to Rds, you must specify the following parameters in ExtendedConfig:
• SecretSubType (Required): The subtype of the secret. Valid values:
• SingleUser: Secrets Manager manages the RDS secret in single-account mode. When the secret is rotated, the password of the specified account is reset to a new random password.
• DoubleUsers: Secrets Manager manages the RDS secret in double-account mode. ACSCurrent and ACSPrevious point to one of the accounts. When the secret is rotated, the password of the account pointed to by ACSPrevious is reset to a new random password. Then, Secrets Manager swaps the accounts that ACSCurrent and ACSPrevious point to.
• DBInstanceId (Required): The ID of the RDS instance to which the account belongs.
• CustomData (Optional): The custom data. The value is a key-value pair in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). Example: {"Key1": "v1", "fds":"fdsf"}. The default value is {}.
• If SecretType is set to Redis, you must specify the following parameters in ExtendedConfig:
• SecretSubType (Required): The subtype of the secret. Valid values:
• DoubleUsers: Secrets Manager manages the Redis secret in double-account mode. ACSCurrent and ACSPrevious point to one of the accounts. When the secret is rotated, the password of the account pointed to by ACSPrevious is reset to a new random password. Then, Secrets Manager swaps the accounts that ACSCurrent and ACSPrevious point to.
• AccountName (Required): The database username.
• CloneAccountName (Required): The database username, which is the value of AccountName with the _clone suffix.
• AccountPrivilege (Required): The permissions to access the database.
• InstanceId (Required): The ID of the Redis instance.
• RegionId (Required): The ID of the region where the Redis instance resides.
• CustomData (Optional): The custom data. The value is a key-value pair in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). Example: {"Key1": "v1", "fds":"fdsf"}. The default value is {}.
• If SecretType is set to RAMCredentials, you must specify the following parameters in ExtendedConfig:
• SecretSubType (Required): The subtype of the secret. The value is RamUserAccessKey.
• UserName (Required): The name of the RAM user.
• CustomData (Optional): The custom data. The value is a key-value pair in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). The default value is {}.
• If SecretType is set to ECS, you must specify the following parameters in ExtendedConfig:
• SecretSubType (Required): The subtype of the secret. Valid values:
• Password: an ECS password.
• SSHKey: an ECS SSH key pair.
• RegionId (Required): The ID of the region where the ECS instance resides.
• InstanceId (Required): The ID of the ECS instance.
• CustomData (Optional): The custom data. The value is a key-value pair in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). The default value is {}.
• If SecretType is set to PolarDB, you must specify the following parameters in ExtendedConfig:
• SecretSubType (Required): The fixed value is DoubleUsers.
• RegionId (Required): The region.
• DBClusterId (Required): The ID of the PolarDB instance.
• DBType (Required): MySQL or PostgreSQL.
• AccountName (Required): The account name.
• CloneAccountName: The value is AccountName_clone.
• AccountType: Only Normal is supported.
• AccountPrivilege: This parameter is available only for MySQL.
• DBName: This parameter is available only for MySQL.
• CustomData (Optional): The custom data. The value is a key-value pair in the JSON format. You can specify up to 10 key-value pairs. Separate multiple key-value pairs with commas (,). Example: {"Key1": "v1", "fds":"fdsf"}. The default value is {}.

If SecretType is set to Rds, Redis, PolarDB, RAMCredentials, or ECS, you must configure this parameter.

force_delete_without_recovery^Optional

• Type: typing.Union[bool, ros_cdk_core.IResolvable]

Property forceDeleteWithoutRecovery: Specifies whether to forcibly delete the secret.

If this parameter is set to true, the secret cannot be recovered. Valid values: true false (default value)

policy^Optional

• Type: typing.Union[ros_cdk_core.IResolvable, typing.Mapping[typing.Any]]

Property policy: The specific content of the credential policy in JSON format.

Maximum length is 32768 bytes. If this parameter is not specified, the default credential policy is used. The policy content includes:

• Version: The version of the policy. Currently, only version 1 is supported.

• Statement: A list of statements, each containing:

• Sid (optional): A custom statement identifier. Up to 128 characters, including letters, digits, and _/+=.@-.

• Effect (required): Whether the statement allows or denies permissions. Valid values: Allow, Deny.
• Principal (required): The entity to which the permissions are granted. Can be the current Alibaba Cloud account, RAM users or roles under the current or other accounts.
• Action (required): The API actions allowed or denied. Must start with "kms:". For valid actions, see - Resource (required): Must be "*", representing this KMS secret.
• Condition (optional): Conditions that limit when the policy is effective. Format: "Condition": {"condition operator": {"condition key": "condition value"}}. See documentation for details.

After granting permissions to RAM users or roles under another Alibaba Cloud account, you must also use RAM to authorize that user or role to use this secret.

recovery_window_in_days^Optional

• Type: typing.Union[typing.Union[int, float], ros_cdk_core.IResolvable]

Property recoveryWindowInDays: Specifies the recovery period of the secret if you do not forcibly delete it.

Default value: 30

rotation_interval^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property rotationInterval: The interval for automatic rotation.

The value is in the range of 6 hours to 8,760 hours (365 days).
The value is in the integer[unit] format. integer indicates the interval. unit indicates the unit of time.
Valid values for unit: d (day), h (hour), m (minute), and s (second). For example, both 7d and 604,800s indicate a rotation interval of 7 days.

You must specify this parameter if you set EnableAutomaticRotation to true. You do not need to specify this parameter if you set EnableAutomaticRotation to false.

secret_data_type^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretDataType: The type of the secret value.

Valid values:

• text (default): The secret value is a text string.
• binary: The secret value is a binary string.

If SecretType is set to Rds, Redis, PolarDB, RAMCredentials, or ECS, SecretDataType must be set to text.

secret_type^Optional

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Property secretType: The type of the secret.

Valid values:

• Generic (default): a generic secret.
• Rds: an RDS secret.
• Redis: a Redis secret.
• RAMCredentials: a RAM secret.
• ECS: an ECS secret.
• PolarDB: a PolarDB secret.

tags^Optional

• Type: typing.List[TagsProperty]

Property tags: Tags to attach to secret.

Max support 20 tags to add during create secret. Each tag with two properties Key and Value, and Key is required.

version_stages^Optional

• Type: typing.Union[ros_cdk_core.IResolvable, typing.List[typing.Union[str, ros_cdk_core.IResolvable]]]

Property versionStages: The stage labels that mark the secret version.

ACSCurrent will be marked as DefaultIf you do not specify it, Secrets Manager marks it with "ACSCurrent".

enable_resource_property_constraint^Optional

• Type: bool

Methods

to_string

def to_string() -> str

Returns a string representation of this construct.

synthesize

def synthesize(
  session: ISynthesisSession
) -> None

Allows this construct to emit artifacts into the cloud assembly during synthesis.

This method is usually implemented by framework-level constructs such as Stack and Asset as they participate in synthesizing the cloud assembly.

session^Required

• Type: ros_cdk_core.ISynthesisSession

The synthesis session.

add_condition

def add_condition(
  condition: RosCondition
) -> None

condition^Required

• Type: ros_cdk_core.RosCondition

add_count

def add_count(
  count: typing.Union[typing.Union[int, float], IResolvable]
) -> None

count^Required

• Type: typing.Union[typing.Union[int, float], ros_cdk_core.IResolvable]

add_dependency

def add_dependency(
  resource: Resource
) -> None

resource^Required

• Type: ros_cdk_core.Resource

add_resource_desc

def add_resource_desc(
  desc: str
) -> None

desc^Required

• Type: str

apply_removal_policy

def apply_removal_policy(
  policy: RemovalPolicy
) -> None

policy^Required

• Type: ros_cdk_core.RemovalPolicy

fetch_condition

def fetch_condition() -> RosCondition

fetch_dependency

def fetch_dependency() -> typing.List[str]

fetch_resource_desc

def fetch_resource_desc() -> str

get_att

def get_att(
  name: str
) -> IResolvable

name^Required

• Type: str

set_metadata

def set_metadata(
  key: str,
  value: typing.Any
) -> None

key^Required

• Type: str

value^Required

• Type: typing.Any

Static Functions

is_construct

import ros_cdk_kms
ros_cdk_kms.Secret.is_construct(
  x: typing.Any
)

Return whether the given object is a Construct.

x^Required

• Type: typing.Any

Properties

node^Required

node: ConstructNode

• Type: ros_cdk_core.ConstructNode

The construct tree node associated with this construct.

env^Required

env: IResourceEnvironment

• Type: ros_cdk_core.IResourceEnvironment

The environment this resource belongs to.

For resources that are created and managed by the CDK (generally, those created by creating new class instances like Role, Bucket, etc.), this is always the same as the environment of the stack they belong to; however, for imported resources (those obtained from static methods like fromRoleArn, fromBucketName, etc.), that might be different than the stack they were imported into.

ref^Required

ref: str

• Type: str

stack^Required

stack: Stack

• Type: ros_cdk_core.Stack

The stack in which this resource is defined.

resource^Optional

resource: RosResource

• Type: ros_cdk_core.RosResource

attr_arn^Required

attr_arn: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Attribute Arn: The Alibaba Cloud Resource Name (ARN).

attr_secret_name^Required

attr_secret_name: typing.Union[str, IResolvable]

• Type: typing.Union[str, ros_cdk_core.IResolvable]

Attribute SecretName: The name of the secret.

props^Required

props: SecretProps

• Type: SecretProps