Access secrets from multi-cloud workloads

Step 3: Application access

After you create an access point, the console provides two access guides: SDK integration and KMS Agent integration.

1. Log on to the Key Management Service console. In the left-side navigation pane, choose Application Access > Multi-Cloud Access (Public Preview).

2. On the resource list page, find the target resource. In the Actions column, click Access Guide and complete the access by following the instructions in the access guide panel. The following two access methods are supported:

   • SDK Integration: The workload directly accesses KMS secrets through Go SDK integration without managing an AccessKey pair. Two configuration methods are supported: inline configuration and configuration file.

   • Agent Access: Access KMS secret resources through request forwarding by KMS Agent. The Agent automatically completes AAP identity authentication and token refresh without managing an AccessKey pair. This method is suitable for non-intrusive integration in multiple languages.

   SDK integration

   The following two configuration methods are supported:

   • Inline Configuration: Build the IDaaSClientConfig object directly in Go code and enter fields such as ClientId and InstanceId. This method is suitable for scenarios that require programmatic configuration.

   • Configuration File: When the workload starts, the SDK automatically obtains the local identity credential (OIDC Token / PKCS7 signature / Instance Identity), completes identity authentication through the AAP, and then accesses KMS secret resources without managing an AccessKey pair.

   Inline configuration

   1. Install the dependencies:

      go mod init demo
      go get -u github.com/aliyun/alibabacloud-secretsmanager-client-go-v2

   2. Write the code. This topic uses an AWS EC2 instance as an example.

      Important

      • Replace <SecretName> with the actual secret name.

      • For other configurations such as <ClientId>, <InstanceId>, <IssuerEndpoint>, <TokenEndpoint>, and the application access point ARN, the system automatically fills them in based on the authentication information generated in Step 2: Create an access point. Keep the defaults unless you have special requirements.

      package main
      
      import (
          "fmt"
          "github.com/aliyun/alibabacloud-secretsmanager-client-go-v2/sdk"
          "github.com/aliyun/alibabacloud-secretsmanager-client-go-v2/sdk/service"
          idaasconfig "github.com/cloud-idaas/idaas-go-core-sdk/config"
      )
      
      func main() {
          cfg := &idaasconfig.IDaaSClientConfig{
              ClientId:       "app_nj2x5w****l3lkihnbi",
              InstanceId:     "idaas_jzeao****rn5xkyratw4",
              IssuerEndpoint: "https://fd***acn.aliyunidaas.com/api/v2/iauths_system/oauth2",
              TokenEndpoint:  "https://fd***acn.aliyunidaas.com/api/v2/iauths_system/oauth2/token",
              Scope:          "urn:alibabacloud:kms|kms:default",
              AuthnConfiguration: &idaasconfig.IdentityAuthenticationConfiguration{
                  AuthnMethod:                        "PKCS7",
                  IdentityType:                       "CLIENT",
                  ApplicationFederatedCredentialName: "shared--o6vd27c2",
                  ClientDeployEnvironment:            "AWS_EC2",
              },
          }
          client, err := sdk.NewSecretCacheClientBuilder(
              service.NewDefaultSecretManagerClientBuilder().Standard().
                  WithAwsEc2PKCS7(
                      cfg,                     // IDaaS client configuration object
                      "acs:kms:cn-hangzhou:119*****18460:applicationaccesspoint/shared--o6vd27c2", // Application access point ARN
                  ).
                  WithRegion("cn-hangzhou"). // Region of the target KMS service
                  Build(),
          ).Build()
          if err != nil {
              panic(err)
          }
      
          secretInfo, err := client.GetSecretInfo("<SecretName>") // Secret name
          if err != nil {
              panic(err)
          }
      
          fmt.Printf("SecretValue: %s\n", secretInfo.SecretValue)
      }

   3. Run the code. Expected output: SecretValue: xxxxxxxx.

      go mod tidy
      go build -o demo main.go
      ./demo

   Configuration file

   1. Download and save the identity file:

      1. On the Configuration File tab, click Download Identity File.

      2. Save the downloaded file as idaasconfig.json and place it in the workload environment, so that the SDK can load it through the configuration file path and complete KMS identity authentication.

         Important

         Do not modify the content of the identity file. Otherwise, the identity file becomes unavailable.

   2. Install the dependencies:

      go mod init demo
      go get -u github.com/aliyun/alibabacloud-secretsmanager-client-go-v2

   3. Write the code. This topic uses an AWS EC2 instance as an example.

      Note

      Replace <IdaasConfigPath> with the actual save path of the downloaded identity file, and <SecretName> with the actual secret name.

      package main
      
      import (
          "fmt"
          "github.com/aliyun/alibabacloud-secretsmanager-client-go-v2/sdk"
          "github.com/aliyun/alibabacloud-secretsmanager-client-go-v2/sdk/service"
      )
      
      func main() {
          client, err := sdk.NewSecretCacheClientBuilder(
              service.NewDefaultSecretManagerClientBuilder().Standard().
                  WithAwsEc2PKCS7Path(
                      "<IdaasConfigPath>", // Path of the identity file
                      "acs:kms:cn-hangzhou:119*****18460:applicationaccesspoint/shared--o6vd27c2", // Application access point ARN
                  ).
                  WithRegion("cn-hangzhou"). // Region of the target KMS service
                  Build(),
          ).Build()
          if err != nil {
              panic(err)
          }
      
          secretInfo, err := client.GetSecretInfo("<SecretName>") // Secret name
          if err != nil {
              panic(err)
          }
      
          fmt.Printf("SecretValue: %s\n", secretInfo.SecretValue)
      }

   4. Run the code. Expected output: SecretValue: xxxxxxxx.

      go mod tidy
      go build -o demo main.go
      ./demo

   Agent integration

   1. Select the deployment environment for KMS Agent: Linux or Windows.

   2. Download and save the identity file:

      1. On the Linux or Windows tab, click Download Identity File.

      2. Save the downloaded file as idaasconfig.json and place it in the workload environment, so that the SDK can load it through the configuration file path and complete KMS identity authentication.

         Important

         Do not modify the content of the identity file. Otherwise, the identity file becomes unavailable.

   3. Get the secret:

      Linux

      1. Install KMS Agent

         mkdir -p /home/ec2-user/kms && cd /home/ec2-user/kms
         
         # Download the installation script
         # amd64
         curl -fsSL -o install_alibabacloud_kms_agent "https://alibabacloud-kms-agent-cn.oss-cn-hangzhou.aliyuncs.com/1.3.0/install_alibabacloud_kms_agent"
         # arm64
         #curl -fsSL -o install_alibabacloud_kms_agent "https://alibabacloud-kms-agent-cn.oss-cn-hangzhou.aliyuncs.com/1.3.0/install_alibabacloud_kms_agent_arm64"

         chmod +x install_alibabacloud_kms_agent
         
         # Run the installation (replace the parameters with the actual values)
         sudo ./install_alibabacloud_kms_agent --install \
           --AuthMethod AwsEc2PKCS7 \
           --AapArn "acs:kms:cn-hangzhou:119*****18460:applicationaccesspoint/shared--o6vd27c2" \
           --IdaasConfigPath "<IdaasConfigPath>"  # Path of the identity file
         
         # --Endpoint is optional. You can specify the instance domain name. The public domain name is used by default.
         

      2. Verify the KMS Agent installation

         curl http://127.0.0.1:2025/ping
         # Expected: healthy

      3. Get Secret: Before you run the following command, replace <SecretName> with the secret name.

         TOKEN=$(sudo cat /var/run/kmstoken)
         curl -H "X-KMS-Token: $TOKEN" \
           "http://127.0.0.1:2025/secretsmanager/get?secretId=<SecretName>"  # Secret name

      4. Uninstall (optional): If KMS Agent is no longer needed, you can uninstall it with the following command.

         sudo ./install_alibabacloud_kms_agent --uninstall

      Windows

      1. Download Executable File

         curl.exe -fsSL -o install_alibabacloud_kms_agent.exe "https://alibabacloud-kms-agent-cn.oss-cn-hangzhou.aliyuncs.com/1.3.0/install_alibabacloud_kms_agent.exe"

      2. Install KMS Agent: Before you run the following command, replace <IdaasConfigPath> with the path of the downloaded identity file.

         # Run the installation in PowerShell as an administrator
         .\install_alibabacloud_kms_agent.exe --install `
           --AuthMethod AwsEc2PKCS7 `
           --AapArn "acs:kms:cn-hangzhou:119*****18460:applicationaccesspoint/shared--o6vd27c2" `
           --IdaasConfigPath "<IdaasConfigPath>"  # Path of the identity file
         
         # --Endpoint is optional. You can specify the instance domain name. The public domain name is used by default.

      3. Verify the KMS Agent installation

         curl.exe http://127.0.0.1:2025/ping
         # Expected: healthy

      4. Get Secret: Before you run the following command, replace <SecretName> with the secret name.

         $TOKEN = Get-Content $env:ProgramData\AlibabaCloud\KMSAgent\token
         curl.exe -H "X-KMS-Token: $TOKEN" `
           "http://127.0.0.1:2025/secretsmanager/get?secretId=<SecretName>"  # Secret name

      5. Uninstall (optional): If KMS Agent is no longer needed, you can uninstall it with the following command.

         .\install_alibabacloud_kms_agent.exe --uninstall

More information

• Overview of AAPs introduces the authentication and authorization model of AAP, as well as the applicable scenarios of each authentication method.

• For the AccessKey-free access methods of Alibaba Cloud ECS instances and ACK clusters, see Quick access from ECS and Quick access from ACK.

• To choose an integration method such as SDK, secret SDK, or KMS Agent, see Integrate KMS with self-managed applications.