ALIYUN::KMS::Secret
Updated at:
The ALIYUN::KMS::Secret type creates a secret and stores the secret value in the initial version.
Syntax
{
"Type": "ALIYUN::KMS::Secret",
"Properties": {
"VersionId": String,
"SecretName": String,
"Description": String,
"SecretDataType": String,
"SecretData": String,
"VersionStages": List,
"EncryptionKeyId": String,
"RecoveryWindowInDays": Integer,
"ForceDeleteWithoutRecovery": Boolean,
"SecretType": String,
"EnableAutomaticRotation": Boolean,
"RotationInterval": String,
"ExtendedConfig": Map,
"DKMSInstanceId": String,
"Policy": Map,
"Tags": List
}
}Properties
Property | Type | Required | Editable | Description | Constraints |
SecretData | String | Yes | Yes | The secret value for the newly created secret. Secrets Manager encrypts it and stores it in the initial version. | None. |
SecretName | String | Yes | No | The name of the secret. | None. |
VersionId | String | Yes | Yes | The version number of the initial version. | The version number is unique within the secret. |
Description | String | No | Yes | The description of the secret. | None. |
DKMSInstanceId | String | No | No | The instance ID of Dedicated KMS. | None. |
EnableAutomaticRotation | Boolean | No | No | Specifies whether to enable automatic secret rotation. | Valid values:
|
EncryptionKeyId | String | No | No | The identifier of the KMS master key used to encrypt and protect the secret value. | If you do not specify this property, Secrets Manager uses a system-created key to encrypt and protect the secret data. Note The KMS master key must be a symmetric key. |
ExtendedConfig | Map | No | No | The extended configuration of the secret. | None. |
ForceDeleteWithoutRecovery | Boolean | No | Yes | Specifies whether to force delete the secret without allowing recovery. | Valid values:
|
Policy | Map | No | No | The key policy. | The value is in JSON format and can be up to 32,768 bytes in length. For more information about key policies, see Key policy overview. If you do not specify this property, the default secret policy is used. A key policy includes:
The key policy format is: |
RecoveryWindowInDays | Integer | No | Yes | Deletes the secret in a recoverable manner and specifies the recovery window. | Default value: 30. Unit: days. |
RotationInterval | String | No | No | The interval for automatic secret rotation. | The format is Note This property is returned when automatic rotation is enabled. |
SecretDataType | String | No | No | The type of the secret value. | Valid values:
|
SecretType | String | No | No | The type of the secret. | Valid values:
|
Tags | List | No | Yes | Tags. | A maximum of 20 tags can be added. For more information, see Tags properties. |
VersionStages | List | No | Yes | The status labels of the version. | Default label: ACSCurrent. A maximum of seven labels can be specified. |
Tags syntax
"Tags": [
{
"Key": String,
"Value": String
}
]Tags properties
Property | Type | Required | Editable | Description | Constraints |
Key | String | Yes | No | The tag key. | The tag key is 1 to 128 characters in length. It cannot start with |
Value | String | No | No | The tag value. | The tag value is 0 to 128 characters in length. It cannot start with |
Return values
Fn::GetAtt
SecretName: The name of the secret.
Arn: The Alibaba Cloud Resource Name (ARN).
Examples
Scenario 1: Create a generic KMS secret
# Scenario 1: Create a simple generic KMS secret to store sensitive configuration information.
# Create a simple KMS generic secret for storing sensitive configuration
ROSTemplateFormatVersion: '2015-09-01'
Description:
zh-cn: Create a simple generic KMS secret to store sensitive configuration information.
en: Create a simple KMS generic secret for storing sensitive configuration.
Parameters:
SecretName:
Type: String
Label:
zh-cn: Secret name
en: Secret Name
Description:
zh-cn: The name of the secret.
en: The name of the secret.
Default: my-app-secret
SecretData:
Type: String
Label:
zh-cn: Secret value
en: Secret Data
Description:
zh-cn: The plaintext content of the secret. Secrets Manager encrypts it and stores it in the initial version.
en: The plaintext content of the secret. Secrets Manager encrypts it and stores it in the initial version.
NoEcho: true
Default: my-secret-password-123
VersionId:
Type: String
Label:
zh-cn: Version number
en: Version ID
Description:
zh-cn: The version number of the initial version. It is unique within the secret.
en: The version number of the initial secret version. Unique within the secret.
Default: v1
Resources:
Secret:
Type: ALIYUN::KMS::Secret
Properties:
SecretName:
Ref: SecretName
SecretData:
Ref: SecretData
VersionId:
Ref: VersionId
Outputs:
SecretName:
Description:
zh-cn: The name of the secret.
en: Secret name.
Label:
zh-cn: Secret name
en: Secret Name
Value:
Fn::GetAtt:
- Secret
- SecretName
Arn:
Description:
zh-cn: The Alibaba Cloud Resource Name (ARN) of the secret.
en: The Alibaba Cloud Resource Name (ARN) of the secret.
Label:
zh-cn: Secret ARN
en: Secret ARN
Value:
Fn::GetAtt:
- Secret
- Arn
Metadata:
ALIYUN::ROS::Interface:
ParameterGroups:
- Parameters:
- SecretName
- SecretData
- VersionId{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": {
"zh-cn": "Create a simple generic KMS secret to store sensitive configuration information.",
"en": "Create a simple KMS generic secret for storing sensitive configuration."
},
"Parameters": {
"SecretName": {
"Type": "String",
"Label": {
"zh-cn": "Secret name",
"en": "Secret Name"
},
"Description": {
"zh-cn": "The name of the secret.",
"en": "The name of the secret."
},
"Default": "my-app-secret"
},
"SecretData": {
"Type": "String",
"Label": {
"zh-cn": "Secret value",
"en": "Secret Data"
},
"Description": {
"zh-cn": "The plaintext content of the secret. Secrets Manager encrypts it and stores it in the initial version.",
"en": "The plaintext content of the secret. Secrets Manager encrypts it and stores it in the initial version."
},
"NoEcho": true,
"Default": "my-secret-password-123"
},
"VersionId": {
"Type": "String",
"Label": {
"zh-cn": "Version number",
"en": "Version ID"
},
"Description": {
"zh-cn": "The version number of the initial version. It is unique within the secret.",
"en": "The version number of the initial secret version. Unique within the secret."
},
"Default": "v1"
}
},
"Resources": {
"Secret": {
"Type": "ALIYUN::KMS::Secret",
"Properties": {
"SecretName": {
"Ref": "SecretName"
},
"SecretData": {
"Ref": "SecretData"
},
"VersionId": {
"Ref": "VersionId"
}
}
}
},
"Outputs": {
"SecretName": {
"Description": {
"zh-cn": "The name of the secret.",
"en": "Secret name."
},
"Label": {
"zh-cn": "Secret name",
"en": "Secret Name"
},
"Value": {
"Fn::GetAtt": [
"Secret",
"SecretName"
]
}
},
"Arn": {
"Description": {
"zh-cn": "The Alibaba Cloud Resource Name (ARN) of the secret.",
"en": "The Alibaba Cloud Resource Name (ARN) of the secret."
},
"Label": {
"zh-cn": "Secret ARN",
"en": "Secret ARN"
},
"Value": {
"Fn::GetAtt": [
"Secret",
"Arn"
]
}
}
},
"Metadata": {
"ALIYUN::ROS::Interface": {
"ParameterGroups": [
{
"Parameters": [
"SecretName",
"SecretData",
"VersionId"
]
}
]
}
}
}Scenario 2: Create a KMS custom key (CMK) to encrypt a secret and configure automatic rotation, a recovery window, and tags
# Scenario 2: Create a KMS custom key (CMK) to encrypt a secret and configure automatic rotation, a recovery window, and tags.
# Create a KMS customer master key (CMK) to encrypt a secret with automatic rotation, recovery window and tags
ROSTemplateFormatVersion: '2015-09-01'
Description:
zh-cn: Create a KMS custom key (CMK), use it to encrypt a secret, and configure automatic rotation, a recovery window, and tags for custom encryption and lifecycle management of the secret.
en: Create a KMS customer master key (CMK), use it to encrypt a secret with automatic rotation, recovery window and tags for custom encryption and lifecycle management of the secret.
Parameters:
CommonName:
Type: String
Label:
zh-cn: Resource name prefix
en: Resource Name Prefix
Description:
zh-cn: The common prefix for all resource names.
en: Unified name prefix for all resources.
Default: kms-demo
SecretData:
Type: String
Label:
zh-cn: Secret value
en: Secret Data
Description:
zh-cn: The plaintext content of the secret. Structured data in JSON format is supported.
en: The plaintext content of the secret. Supports structured data in JSON format.
NoEcho: true
Default: '{"username":"app_admin","password":"P@ssw0rd123"}'
RotationInterval:
Type: String
Label:
zh-cn: Rotation interval
en: Rotation Interval
Description:
zh-cn: The automatic secret rotation interval in the `integer[unit]` format. For example, seven days is 604800s.
en: The automatic rotation period in the format integer[unit], e.g. 604800s for 7 days.
Default: 604800s
RecoveryWindowInDays:
Type: Number
Label:
zh-cn: Recovery window (days)
en: Recovery Window (Days)
Description:
zh-cn: The recovery window in days when you delete the secret in a recoverable manner.
en: The recovery window in days when deleting the secret in a recoverable manner.
Default: 30
MinValue: 1
MaxValue: 366
Resources:
KmsKey:
Type: ALIYUN::KMS::Key
Properties:
Description:
Fn::Sub: Encryption key for ${CommonName} secrets
KeySpec: Aliyun_AES_256
KeyUsage: ENCRYPT/DECRYPT
Enable: true
EnableAutomaticRotation: true
RotationInterval: 365d
PendingWindowInDays: 30
Tags:
- Key: Purpose
Value: SecretEncryption
- Key: CreatedBy
Value: ROS
Secret:
Type: ALIYUN::KMS::Secret
DependsOn: KmsKey
Properties:
SecretName:
Fn::Sub: ${CommonName}-app-credential
SecretData:
Ref: SecretData
SecretDataType: text
VersionId: v1
VersionStages:
- ACSCurrent
EncryptionKeyId:
Fn::GetAtt:
- KmsKey
- KeyId
Description: Application credential encrypted by custom CMK
EnableAutomaticRotation: true
RotationInterval:
Ref: RotationInterval
RecoveryWindowInDays:
Ref: RecoveryWindowInDays
ForceDeleteWithoutRecovery: false
SecretType: Generic
Tags:
- Key: Environment
Value: Production
- Key: ManagedBy
Value: ROS
Outputs:
KeyId:
Description:
zh-cn: KMS key ID.
en: KMS key ID.
Label:
zh-cn: Key ID
en: Key ID
Value:
Fn::GetAtt:
- KmsKey
- KeyId
SecretName:
Description:
zh-cn: The name of the secret.
en: Secret name.
Label:
zh-cn: Secret name
en: Secret Name
Value:
Fn::GetAtt:
- Secret
- SecretName
SecretArn:
Description:
zh-cn: The Alibaba Cloud Resource Name (ARN) of the secret.
en: The ARN of the secret.
Label:
zh-cn: Secret ARN
en: Secret ARN
Value:
Fn::GetAtt:
- Secret
- Arn
Metadata:
ALIYUN::ROS::Interface:
ParameterGroups:
- Parameters:
- CommonName
- SecretData
- Parameters:
- RotationInterval
- RecoveryWindowInDays{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": {
"zh-cn": "Create a KMS custom key (CMK), use it to encrypt a secret, and configure automatic rotation, a recovery window, and tags for custom encryption and lifecycle management of the secret.",
"en": "Create a KMS customer master key (CMK), use it to encrypt a secret with automatic rotation, recovery window and tags for custom encryption and lifecycle management of the secret."
},
"Parameters": {
"CommonName": {
"Type": "String",
"Label": {
"zh-cn": "Resource name prefix",
"en": "Resource Name Prefix"
},
"Description": {
"zh-cn": "The common prefix for all resource names.",
"en": "Unified name prefix for all resources."
},
"Default": "kms-demo"
},
"SecretData": {
"Type": "String",
"Label": {
"zh-cn": "Secret value",
"en": "Secret Data"
},
"Description": {
"zh-cn": "The plaintext content of the secret. Structured data in JSON format is supported.",
"en": "The plaintext content of the secret. Supports structured data in JSON format."
},
"NoEcho": true,
"Default": "{\"username\":\"app_admin\",\"password\":\"P@ssw0rd123\"}"
},
"RotationInterval": {
"Type": "String",
"Label": {
"zh-cn": "Rotation interval",
"en": "Rotation Interval"
},
"Description": {
"zh-cn": "The automatic secret rotation interval in the `integer[unit]` format. For example, seven days is 604800s.",
"en": "The automatic rotation period in the format integer[unit], e.g. 604800s for 7 days."
},
"Default": "604800s"
},
"RecoveryWindowInDays": {
"Type": "Number",
"Label": {
"zh-cn": "Recovery window (days)",
"en": "Recovery Window (Days)"
},
"Description": {
"zh-cn": "The recovery window in days when you delete the secret in a recoverable manner.",
"en": "The recovery window in days when deleting the secret in a recoverable manner."
},
"Default": 30,
"MinValue": 1,
"MaxValue": 366
}
},
"Resources": {
"KmsKey": {
"Type": "ALIYUN::KMS::Key",
"Properties": {
"Description": {
"Fn::Sub": "Encryption key for ${CommonName} secrets"
},
"KeySpec": "Aliyun_AES_256",
"KeyUsage": "ENCRYPT/DECRYPT",
"Enable": true,
"EnableAutomaticRotation": true,
"RotationInterval": "365d",
"PendingWindowInDays": 30,
"Tags": [
{
"Key": "Purpose",
"Value": "SecretEncryption"
},
{
"Key": "CreatedBy",
"Value": "ROS"
}
]
}
},
"Secret": {
"Type": "ALIYUN::KMS::Secret",
"DependsOn": "KmsKey",
"Properties": {
"SecretName": {
"Fn::Sub": "${CommonName}-app-credential"
},
"SecretData": {
"Ref": "SecretData"
},
"SecretDataType": "text",
"VersionId": "v1",
"VersionStages": [
"ACSCurrent"
],
"EncryptionKeyId": {
"Fn::GetAtt": [
"KmsKey",
"KeyId"
]
},
"Description": "Application credential encrypted by custom CMK",
"EnableAutomaticRotation": true,
"RotationInterval": {
"Ref": "RotationInterval"
},
"RecoveryWindowInDays": {
"Ref": "RecoveryWindowInDays"
},
"ForceDeleteWithoutRecovery": false,
"SecretType": "Generic",
"Tags": [
{
"Key": "Environment",
"Value": "Production"
},
{
"Key": "ManagedBy",
"Value": "ROS"
}
]
}
}
},
"Outputs": {
"KeyId": {
"Description": {
"zh-cn": "KMS key ID.",
"en": "KMS key ID."
},
"Label": {
"zh-cn": "Key ID",
"en": "Key ID"
},
"Value": {
"Fn::GetAtt": [
"KmsKey",
"KeyId"
]
}
},
"SecretName": {
"Description": {
"zh-cn": "The name of the secret.",
"en": "Secret name."
},
"Label": {
"zh-cn": "Secret name",
"en": "Secret Name"
},
"Value": {
"Fn::GetAtt": [
"Secret",
"SecretName"
]
}
},
"SecretArn": {
"Description": {
"zh-cn": "The Alibaba Cloud Resource Name (ARN) of the secret.",
"en": "The ARN of the secret."
},
"Label": {
"zh-cn": "Secret ARN",
"en": "Secret ARN"
},
"Value": {
"Fn::GetAtt": [
"Secret",
"Arn"
]
}
}
},
"Metadata": {
"ALIYUN::ROS::Interface": {
"ParameterGroups": [
{
"Parameters": [
"CommonName",
"SecretData"
]
},
{
"Parameters": [
"RotationInterval",
"RecoveryWindowInDays"
]
}
]
}
}
}Scenario 3: Create a complete application secret management solution (KMS key, multiple business secrets, and a RAM read-only access role) for centralized encrypted storage of sensitive information and least privilege access control
# Scenario 3: Create a complete application secret management solution (KMS key, multiple business secrets, and a RAM read-only access role) for centralized encrypted storage of sensitive information and least privilege access control.
# Create a complete application credential management solution (KMS key + multiple secrets + RAM read-only role) for unified encrypted storage with least-privilege access control
ROSTemplateFormatVersion: '2015-09-01'
Description:
zh-cn: Create a complete application secret management solution that includes a KMS custom key, multiple business secrets (application configuration, database account, and API key), and a RAM read-only access role for centralized encrypted storage of sensitive information and least privilege access control.
en: Create a complete application credential management solution including a KMS custom key, multiple business secrets (app config, database account, API key), and a RAM read-only access role, achieving unified encrypted storage of sensitive information with least-privilege access control.
Parameters:
CommonName:
Type: String
Label:
zh-cn: Resource name prefix
en: Resource Name Prefix
Description:
zh-cn: The common prefix for all resource names.
en: Unified name prefix for all resources.
Default: secret-center
DbUsername:
Type: String
Label:
zh-cn: Database username
en: Database Username
Description:
zh-cn: The username of the database account.
en: The database account username.
Default: db_admin
DbPassword:
Type: String
Label:
zh-cn: Database password
en: Database Password
Description:
zh-cn: The password of the database account.
en: The database account password.
NoEcho: true
ApiKeyValue:
Type: String
Label:
zh-cn: Third-party API key
en: Third-party API Key
Description:
zh-cn: The API key of a third-party service.
en: The API key of a third-party service.
NoEcho: true
RotationInterval:
Type: String
Label:
zh-cn: Rotation interval
en: Rotation Interval
Description:
zh-cn: The automatic secret rotation interval in the `integer[unit]` format.
en: The automatic rotation period in the format integer[unit].
Default: 2592000s
Resources:
KmsKey:
Type: ALIYUN::KMS::Key
Properties:
Description:
Fn::Sub: Central encryption key for ${CommonName}
KeySpec: Aliyun_AES_256
KeyUsage: ENCRYPT/DECRYPT
Enable: true
EnableAutomaticRotation: true
RotationInterval: 365d
PendingWindowInDays: 30
DeletionProtection: false
Tags:
- Key: Purpose
Value: CentralSecretEncryption
- Key: CreatedBy
Value: ROS
AppConfigSecret:
Type: ALIYUN::KMS::Secret
DependsOn: KmsKey
Properties:
SecretName:
Fn::Sub: ${CommonName}-app-config
SecretData:
Fn::Sub: '{"env":"production","log_level":"info","feature_flags":{"new_ui":true,"beta_api":false}}'
SecretDataType: text
VersionId: v1
VersionStages:
- ACSCurrent
EncryptionKeyId:
Fn::GetAtt:
- KmsKey
- KeyId
Description: Application runtime configuration
EnableAutomaticRotation: false
RecoveryWindowInDays: 30
SecretType: Generic
Tags:
- Key: SecretCategory
Value: AppConfig
- Key: Environment
Value: Production
DbCredentialSecret:
Type: ALIYUN::KMS::Secret
DependsOn: KmsKey
Properties:
SecretName:
Fn::Sub: ${CommonName}-db-credential
SecretData:
Fn::Sub:
- '{"username":"${User}","password":"${Pass}"}'
- User:
Ref: DbUsername
Pass:
Ref: DbPassword
SecretDataType: text
VersionId: v1
VersionStages:
- ACSCurrent
EncryptionKeyId:
Fn::GetAtt:
- KmsKey
- KeyId
Description: Database account credential
EnableAutomaticRotation: true
RotationInterval:
Ref: RotationInterval
RecoveryWindowInDays: 30
SecretType: Generic
Tags:
- Key: SecretCategory
Value: Database
- Key: Environment
Value: Production
ApiKeySecret:
Type: ALIYUN::KMS::Secret
DependsOn: KmsKey
Properties:
SecretName:
Fn::Sub: ${CommonName}-api-key
SecretData:
Fn::Sub:
- '{"api_key":"${ApiKey}","provider":"third-party-service"}'
- ApiKey:
Ref: ApiKeyValue
SecretDataType: text
VersionId: v1
VersionStages:
- ACSCurrent
EncryptionKeyId:
Fn::GetAtt:
- KmsKey
- KeyId
Description: Third-party API key credential
EnableAutomaticRotation: true
RotationInterval:
Ref: RotationInterval
RecoveryWindowInDays: 30
SecretType: Generic
Tags:
- Key: SecretCategory
Value: ApiKey
- Key: Environment
Value: Production
SecretReaderRole:
Type: ALIYUN::RAM::Role
Properties:
RoleName:
Fn::Sub: ${CommonName}-secret-reader
Description: Read-only role for accessing business secrets
AssumeRolePolicyDocument:
Version: '1'
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service:
- ecs.aliyuncs.com
Policies:
- PolicyName: SecretReadOnlyAccess
PolicyDocument:
Version: '1'
Statement:
- Action:
- kms:GetSecretValue
- kms:DescribeSecret
- kms:ListSecrets
- kms:ListSecretVersionIds
Resource:
- Fn::GetAtt:
- AppConfigSecret
- Arn
- Fn::GetAtt:
- DbCredentialSecret
- Arn
- Fn::GetAtt:
- ApiKeySecret
- Arn
Effect: Allow
- Action:
- kms:Decrypt
Resource:
- Fn::Sub: acs:kms:${ALIYUN::Region}:${ALIYUN::TenantId}:key/*
Effect: Allow
Condition:
StringEquals:
kms:EncryptionContextKey:
- secret
Outputs:
KeyId:
Description:
zh-cn: KMS key ID.
en: KMS key ID.
Label:
zh-cn: Key ID
en: Key ID
Value:
Fn::GetAtt:
- KmsKey
- KeyId
AppConfigSecretArn:
Description:
zh-cn: Application configuration secret ARN.
en: App config secret ARN.
Label:
zh-cn: Application configuration secret ARN
en: App Config Secret ARN
Value:
Fn::GetAtt:
- AppConfigSecret
- Arn
DbCredentialSecretArn:
Description:
zh-cn: Database secret ARN.
en: Database credential secret ARN.
Label:
zh-cn: Database secret ARN
en: DB Credential Secret ARN
Value:
Fn::GetAtt:
- DbCredentialSecret
- Arn
ApiKeySecretArn:
Description:
zh-cn: API key secret ARN.
en: API key secret ARN.
Label:
zh-cn: API key secret ARN
en: API Key Secret ARN
Value:
Fn::GetAtt:
- ApiKeySecret
- Arn
SecretReaderRoleArn:
Description:
zh-cn: Read-only access role ARN for secrets.
en: Secret reader role ARN.
Label:
zh-cn: Read-only role ARN
en: Secret Reader Role ARN
Value:
Fn::GetAtt:
- SecretReaderRole
- Arn
Metadata:
ALIYUN::ROS::Interface:
ParameterGroups:
- Parameters:
- CommonName
- RotationInterval
- Parameters:
- DbUsername
- DbPassword
- ApiKeyValue{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": {
"zh-cn": "Create a complete application secret management solution that includes a KMS custom key, multiple business secrets (application configuration, database account, and API key), and a RAM read-only access role for centralized encrypted storage of sensitive information and least privilege access control.",
"en": "Create a complete application credential management solution including a KMS custom key, multiple business secrets (app config, database account, API key), and a RAM read-only access role, achieving unified encrypted storage of sensitive information with least-privilege access control."
},
"Parameters": {
"CommonName": {
"Type": "String",
"Label": {
"zh-cn": "Resource name prefix",
"en": "Resource Name Prefix"
},
"Description": {
"zh-cn": "The common prefix for all resource names.",
"en": "Unified name prefix for all resources."
},
"Default": "secret-center"
},
"DbUsername": {
"Type": "String",
"Label": {
"zh-cn": "Database username",
"en": "Database Username"
},
"Description": {
"zh-cn": "The username of the database account.",
"en": "The database account username."
},
"Default": "db_admin"
},
"DbPassword": {
"Type": "String",
"Label": {
"zh-cn": "Database password",
"en": "Database Password"
},
"Description": {
"zh-cn": "The password of the database account.",
"en": "The database account password."
},
"NoEcho": true
},
"ApiKeyValue": {
"Type": "String",
"Label": {
"zh-cn": "Third-party API key",
"en": "Third-party API Key"
},
"Description": {
"zh-cn": "The API key of a third-party service.",
"en": "The API key of a third-party service."
},
"NoEcho": true
},
"RotationInterval": {
"Type": "String",
"Label": {
"zh-cn": "Rotation interval",
"en": "Rotation Interval"
},
"Description": {
"zh-cn": "The automatic secret rotation interval in the `integer[unit]` format.",
"en": "The automatic rotation period in the format integer[unit]."
},
"Default": "2592000s"
}
},
"Resources": {
"KmsKey": {
"Type": "ALIYUN::KMS::Key",
"Properties": {
"Description": {
"Fn::Sub": "Central encryption key for ${CommonName}"
},
"KeySpec": "Aliyun_AES_256",
"KeyUsage": "ENCRYPT/DECRYPT",
"Enable": true,
"EnableAutomaticRotation": true,
"RotationInterval": "365d",
"PendingWindowInDays": 30,
"DeletionProtection": false,
"Tags": [
{
"Key": "Purpose",
"Value": "CentralSecretEncryption"
},
{
"Key": "CreatedBy",
"Value": "ROS"
}
]
}
},
"AppConfigSecret": {
"Type": "ALIYUN::KMS::Secret",
"DependsOn": "KmsKey",
"Properties": {
"SecretName": {
"Fn::Sub": "${CommonName}-app-config"
},
"SecretData": {
"Fn::Sub": "{\"env\":\"production\",\"log_level\":\"info\",\"feature_flags\":{\"new_ui\":true,\"beta_api\":false}}"
},
"SecretDataType": "text",
"VersionId": "v1",
"VersionStages": [
"ACSCurrent"
],
"EncryptionKeyId": {
"Fn::GetAtt": [
"KmsKey",
"KeyId"
]
},
"Description": "Application runtime configuration",
"EnableAutomaticRotation": false,
"RecoveryWindowInDays": 30,
"SecretType": "Generic",
"Tags": [
{
"Key": "SecretCategory",
"Value": "AppConfig"
},
{
"Key": "Environment",
"Value": "Production"
}
]
}
},
"DbCredentialSecret": {
"Type": "ALIYUN::KMS::Secret",
"DependsOn": "KmsKey",
"Properties": {
"SecretName": {
"Fn::Sub": "${CommonName}-db-credential"
},
"SecretData": {
"Fn::Sub": [
"{\"username\":\"${User}\",\"password\":\"${Pass}\"}",
{
"User": {
"Ref": "DbUsername"
},
"Pass": {
"Ref": "DbPassword"
}
}
]
},
"SecretDataType": "text",
"VersionId": "v1",
"VersionStages": [
"ACSCurrent"
],
"EncryptionKeyId": {
"Fn::GetAtt": [
"KmsKey",
"KeyId"
]
},
"Description": "Database account credential",
"EnableAutomaticRotation": true,
"RotationInterval": {
"Ref": "RotationInterval"
},
"RecoveryWindowInDays": 30,
"SecretType": "Generic",
"Tags": [
{
"Key": "SecretCategory",
"Value": "Database"
},
{
"Key": "Environment",
"Value": "Production"
}
]
}
},
"ApiKeySecret": {
"Type": "ALIYUN::KMS::Secret",
"DependsOn": "KmsKey",
"Properties": {
"SecretName": {
"Fn::Sub": "${CommonName}-api-key"
},
"SecretData": {
"Fn::Sub": [
"{\"api_key\":\"${ApiKey}\",\"provider\":\"third-party-service\"}",
{
"ApiKey": {
"Ref": "ApiKeyValue"
}
}
]
},
"SecretDataType": "text",
"VersionId": "v1",
"VersionStages": [
"ACSCurrent"
],
"EncryptionKeyId": {
"Fn::GetAtt": [
"KmsKey",
"KeyId"
]
},
"Description": "Third-party API key credential",
"EnableAutomaticRotation": true,
"RotationInterval": {
"Ref": "RotationInterval"
},
"RecoveryWindowInDays": 30,
"SecretType": "Generic",
"Tags": [
{
"Key": "SecretCategory",
"Value": "ApiKey"
},
{
"Key": "Environment",
"Value": "Production"
}
]
}
},
"SecretReaderRole": {
"Type": "ALIYUN::RAM::Role",
"Properties": {
"RoleName": {
"Fn::Sub": "${CommonName}-secret-reader"
},
"Description": "Read-only role for accessing business secrets",
"AssumeRolePolicyDocument": {
"Version": "1",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": [
"ecs.aliyuncs.com"
]
}
}
]
},
"Policies": [
{
"PolicyName": "SecretReadOnlyAccess",
"PolicyDocument": {
"Version": "1",
"Statement": [
{
"Action": [
"kms:GetSecretValue",
"kms:DescribeSecret",
"kms:ListSecrets",
"kms:ListSecretVersionIds"
],
"Resource": [
{
"Fn::GetAtt": [
"AppConfigSecret",
"Arn"
]
},
{
"Fn::GetAtt": [
"DbCredentialSecret",
"Arn"
]
},
{
"Fn::GetAtt": [
"ApiKeySecret",
"Arn"
]
}
],
"Effect": "Allow"
},
{
"Action": [
"kms:Decrypt"
],
"Resource": [
{
"Fn::Sub": "acs:kms:${ALIYUN::Region}:${ALIYUN::TenantId}:key/*"
}
],
"Effect": "Allow",
"Condition": {
"StringEquals": {
"kms:EncryptionContextKey": [
"secret"
]
}
}
}
]
}
}
]
}
}
},
"Outputs": {
"KeyId": {
"Description": {
"zh-cn": "KMS key ID.",
"en": "KMS key ID."
},
"Label": {
"zh-cn": "Key ID",
"en": "Key ID"
},
"Value": {
"Fn::GetAtt": [
"KmsKey",
"KeyId"
]
}
},
"AppConfigSecretArn": {
"Description": {
"zh-cn": "Application configuration secret ARN.",
"en": "App config secret ARN."
},
"Label": {
"zh-cn": "Application configuration secret ARN",
"en": "App Config Secret ARN"
},
"Value": {
"Fn::GetAtt": [
"AppConfigSecret",
"Arn"
]
}
},
"DbCredentialSecretArn": {
"Description": {
"zh-cn": "Database secret ARN.",
"en": "Database credential secret ARN."
},
"Label": {
"zh-cn": "Database secret ARN",
"en": "DB Credential Secret ARN"
},
"Value": {
"Fn::GetAtt": [
"DbCredentialSecret",
"Arn"
]
}
},
"ApiKeySecretArn": {
"Description": {
"zh-cn": "API key secret ARN.",
"en": "API key secret ARN."
},
"Label": {
"zh-cn": "API key secret ARN",
"en": "API Key Secret ARN"
},
"Value": {
"Fn::GetAtt": [
"ApiKeySecret",
"Arn"
]
}
},
"SecretReaderRoleArn": {
"Description": {
"zh-cn": "Read-only access role ARN for secrets.",
"en": "Secret reader role ARN."
},
"Label": {
"zh-cn": "Read-only role ARN",
"en": "Secret Reader Role ARN"
},
"Value": {
"Fn::GetAtt": [
"SecretReaderRole",
"Arn"
]
}
}
},
"Metadata": {
"ALIYUN::ROS::Interface": {
"ParameterGroups": [
{
"Parameters": [
"CommonName",
"RotationInterval"
]
},
{
"Parameters": [
"DbUsername",
"DbPassword",
"ApiKeyValue"
]
}
]
}
}
}Is this page helpful?