Overview of default secrets

Step 1: Confirm the cloud product has created the secret

Trigger the secret creation from within the cloud product — for example, by creating a key in AI Gateway or API Gateway. The cloud product assumes a RAM role to create the secret in KMS automatically.

Step 2: Grant access permissions

Grant a RAM user or RAM role permission to read the secret. Two policy types are available.

Identity-based policy — attach to a RAM user or RAM role. Supported in both free and paid modes.

The following sample policy grants read access to all default secrets created by Alibaba Cloud Model Studio (product code: mcp):

{
  "Version": "1",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "kms:List*",
      "kms:Describe*",
      "kms:GetSecretValue"
    ],
    "Resource": "acs:kms:${region}:${account}:secret/mcp!*"
  }]
}

If the secret uses a customer managed key (paid mode), the identity must also have kms:Decrypt permission on the encryption key. The following complete policy grants both secret access and key decryption:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:List*",
        "kms:Describe*",
        "kms:GetSecretValue"
      ],
      "Resource": "acs:kms:${region}:${account}:secret/mcp!*"
    },
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "acs:kms:${region}:${account}:key/${key-id}"
    }
  ]
}

Secret policy (paid mode only) — attach directly to the secret resource. Use this for cross-account authorization.

The following sample policy allows the RAM user key_ramuser3 from another Alibaba Cloud account (190325303126****) to retrieve the secret value:

{
  "Version": "1",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "kms:List*",
      "kms:Describe*",
      "kms:GetSecretValue"
    ],
    "Principal": {
      "RAM": [
        "acs:ram::190325303126****:user/key_ramuser3"
      ]
    },
    "Resource": [
      "acs:kms:cn-hangzhou:123456789012****:secret/ai-gateway!secret-name"
    ]
  }]
}

For more information on policy configuration, see Grant permissions.

Step 3: Retrieve the secret

Retrieve the secret value using any of the following methods:

• RAM role (for cloud products): Grant the cloud product's RAM role permission to call the secret. The product retrieves the secret automatically.

• Alibaba Cloud SDK: Call GetSecretValue through the Alibaba Cloud SDK.

• Secrets Manager Client: Integrate the secret client into your application for automatic caching and rotation-aware retrieval.

• KMS Agent: Use the KMS Agent as a sidecar to retrieve secrets without SDK integration.

Free default secrets are accessible only through a shared gateway. Paid default secrets are accessible through either a shared or dedicated gateway.