This topic describes how to rotate credentials for an ApsaraDB for RDS data source at runtime in a Spring application. This solution uses Key Management Service (KMS) and Nacos to securely store, dynamically update, and seamlessly switch encrypted database credentials. This process ensures your application's security and stability during credential changes.
Solution overview
If your Java application uses the Spring Boot or Spring Cloud framework with databases like MySQL, SQL Server, PostgreSQL, or MariaDB, we recommend implementing runtime data source credential rotation to improve your security posture. The following figure shows the solution architecture.
This solution uses KMS to host and encrypt database credentials, Nacos for dynamic configuration management, and Druid to manage database connections. This solution provides the following features:
-
Centralized and encrypted data source configuration: Centrally manage database connection information and use encryption to secure configuration data during storage and transmission.
-
Fully managed credentials with dual-layer access control: Database credentials are fully managed by the system and use a dual-layer authentication mechanism to enhance access security.
-
Automated runtime credential rotation and leak remediation in seconds: Automatically rotate database credentials at runtime based on a defined policy and remediate leaks in seconds to minimize security risks.
-
Zero-downtime account switching: Dynamically switch database access accounts without interrupting your business. This process ensures high availability and maintenance flexibility.
-
Application-side tuning for database performance parameters: Flexibly adjust key performance parameters, such as connection pool size and timeout settings, to improve system stability and responsiveness.
-
Exception protection for invalid parameters: Validate and protect critical parameters to prevent misconfigurations from causing service interruptions, ensuring safe and controlled changes.
Prerequisites
-
Activate ApsaraDB for RDS and create an instance.
-
Activate Key Management Service (KMS), create a dedicated KMS instance, and create a key.
-
Activate Microservices Engine (MSE) and create an Enterprise Edition instance.
Create a KMS secret
-
Go to the Secrets page of the KMS console and select Database Credential.
-
Select an Instance ID and click .
-
In the Create Database Credential panel, select a Database Type for the RDS Credential. Enter a Secret Name and select the associated RDS Instance.
-
Select Dual-account hosting, enter a Custom Account name, Select Databases, and Specify Permissions.
In the Set the secret value section, select the Create Account tab.
-
Select an Encryption Key, set the Rotation Period, and then click OK.
KMS automatically creates a database access account and a strong password for the secret.
Create a data source
The data source feature is built on the Nacos configuration center, where data source configurations are stored in an encrypted format.
-
Go to the Instances page of the MSE Nacos console and select a region in the top menu bar.
-
Click the name of the target Enterprise Edition instance. In the left-side navigation pane, choose Data Source Management.
If the instance is not bound to a KMS key, follow the prompts in the pop-up window to bind a key.
-
On the Data Source Management page, select the target namespace, and then click Create Data Source.
-
In the Create Data Source panel, configure the parameters for the data source. For more information about the parameters, see Create a data source.
The Create Data Source panel includes the following settings: Data Source Name, Description, Data Source Type (for example, spring-datasource or spring-redis), Subtype (for example, druid), Database Type (for example, rds), Database Instance Endpoint, Database Engine Type (for example, MySQL), Database Port (for example,
3306), Database Name, Database Address Parameters, Initial Connections (for example,20), Minimum Connections (for example,20), Maximum Connections (for example,100), Maximum Wait Time (for example,5000), and Associated KMS Secret.
-
Click OK. In the Confirm Create Data Source dialog box, click OK again to submit the data source.
Credential rotation
Credential rotation for the data source is managed by KMS. Two rotation methods are available:
-
Scheduled rotation: When you create a secret, you can set a rotation period for automatic rotation.
-
On-demand rotation: If a credential is leaked or needs to be rotated immediately for other reasons, you can trigger an immediate rotation from the KMS console.
When a KMS secret is rotated, either on a schedule or on demand, KMS notifies MSE Nacos to update the encrypted data source configuration. Nacos then pushes the update to the application in real time, which updates the username and password. Druid gracefully replaces online connections to prevent business disruption.
Credential rotation is fully managed by KMS. If you change the password of a managed account directly in the ApsaraDB for RDS console, by calling an OpenAPI operation, or by using a high-privilege database account, the change is not pushed to your application in real time.
Application access
On the data source details page, click Application Access to view the integration steps for each data source.
For parameter configurations, use the actual settings shown in the Application Access section of the console. The parameters for each step in the console are dynamically adapted and linked to the target instance and data source.
Step 1: Upgrade versions
-
Upgrade Spring Cloud to version 2023.0.3.3 or later.
-
Upgrade Druid to version 1.2.27 or later.
<!-- Druid connection pool, including Spring Starter and the Druid core version -->
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid-spring-boot-3-starter</artifactId>
<version>1.2.27</version>
</dependency>
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>1.2.27</version>
</dependency>
<dependency>
<groupId>com.alibaba.cloud</groupId>
<artifactId>spring-cloud-starter-alibaba-nacos-config</artifactId>
<version>2023.0.3.3</version>
</dependency>
<!-- Commercial KMS encryption and decryption plugin -->
<dependency>
<groupId>com.alibaba.nacos</groupId>
<artifactId>nacos-client-mse-extension</artifactId>
<version>1.0.5</version>
</dependency> Step 2: Modify the configuration
-
Modify
application.propertiesto enable dynamic data source rotation and specify the Nacos configuration for the corresponding data source.
# Import the data source configuration into Spring to initialize the data source.
spring.config.import[0]=optional:nacos:cipher-kms-aes-256-proxy-spring-{resourceName}.properties?group=nacos-datasource
# Specify the Nacos address. The public endpoint is used by default. Change it as needed.
spring.cloud.nacos.config.server-addr={nacos-server-endpoint}
# Specify the namespace ID.
spring.cloud.nacos.config.namespace={namespaceID}
# Specify the KMS region ID.
spring.cloud.nacos.config.kms_region_id={instanceRegion}
# Enable Druid data source management and specify the dataId for the rotation configuration.
spring.nacos.config.proxy.druid.enabled=true
spring.nacos.config.proxy.druid.data-id={dataID}Step 3: Set the access credential
Because the encrypted data source configuration must be decrypted in memory at runtime, you must configure an access credential with the necessary decryption permissions.
Access credential without an AccessKey (Recommended)
If your application runs on Alibaba Cloud ECS or ACK, we recommend using a credential without an AccessKey. Set the following JVM parameter:
-
Using an ECS RAM role:
-Dspring.cloud.nacos.config.ramRoleName=${ramRoleName} -
Using an OIDC role ARN:
-Dspring.cloud.nacos.config.alibabaCloudRoleSessionName=${sessionName}
Traditional AccessKey/SecretKey
Set the following JVM parameters:
-Dspring.cloud.nacos.config.accessKey=${accessKey}
-Dspring.cloud.nacos.config.secretKey=${secretKey}Replace ${accessKey} and ${secretKey} with your actual AccessKey and SecretKey.
Regardless of the access credential type you choose, you must grant the necessary permissions to the corresponding account or role. The credential must have KMS decryption permissions so that the application can decrypt the configuration into plaintext in memory.
Go to the instance details page, and navigate to . For the authorization scope, select Permissions to decrypt data that is encrypted by using KMS and follow the instructions to complete the authorization. For more information about credential types, see Configure client access credentials.
FAQ
1. When are old credentials invalidated?
When KMS rotates a secret, it notifies MSE to update the credential. KMS keeps two versions of the credential active. The credential from two versions ago is invalidated. In the future, this feature will integrate with the session management of specific data sources. An old credential will be invalidated only when no active connections are using it, further improving stability.
2. How to detect exception protection triggers?
When the exception protection mechanism is triggered in the application's connection pool, it reports a push failure to Nacos. You can detect this event by searching the config.log file for the notify-error keyword. Future versions of Nacos will report the client listener's callback status. This will allow you to directly view failed client callbacks in the listener query feature.