Help Center> Data Encryption Workshop> Best Practices> Secret Management> Using CSMS to Change Hard-coded Database Account Passwords
Updated on 2022-11-18 GMT+08:00

Using CSMS to Change Hard-coded Database Account Passwords

Generally, the secrets used for access are embedded in applications. To update a secret, you need to create a new secret and spend time updating your applications. If you have multiple applications using the same secret, you have to update all of them, or the applications you forgot to update will be unable to use the secret for login.

An easy-to-use, effective, and secure secret management tool will be helpful.

Cloud Secret Management Service (CSMS) has the following advantages:

  • You can host your secrets instead of using hardcoded secrets, improving the security of data and assets.
  • Your services are not affected when you manually rotate secrets.
  • Secure SDK access allows you to dynamically call your secrets.
  • You can store many types of secrets. You can store service accounts, passwords, and database information, including but not limited to database names, IP addresses, and port numbers.

Logging In to a Database Using Secrets

You can create a secret and log in to your database by calling the secret via an API.

Ensure your account has the KMS Administrator or KMS CMKFullAccess permission. For details, see DEW Permissions Management.

Figure 1 Secret-based login process

The process is as follows:

  1. Create a secret on the console or via an API to store database information (such as the database address, port, and password).
  2. Use an application to access the database. CSMS will query the secret created in 1.
  3. CSMS retrieves and decrypts the secret ciphertext and securely returns the information stored in the secret to the application through the secret management API.
  4. The application obtains the decrypted plaintext secret and uses it to access the database.

Secret Creation and Query APIs

You can call the following APIs to create secrets, save their content, and query secret information.



Creating a Secret

This API is used to create a secret and store the secret value in the initial secret version.

Querying a Secret

This API is used to query a secret.

Creating and Querying Secrets via APIs

  1. Prepare basic authentication information.
    • ACCESS_KEY: access key of the Huawei Cloud account
    • SECRET_ACCESS_KEY: secret access key of the Huawei Cloud account
    • PROJECT_ID: project ID of a Huawei Cloud site. For details, see Project.
    • CSMS_ENDPOINT: endpoint for accessing CSMS. For details, see Endpoints.
  2. Create and query secret information.

    Secret name: secretName

    Secret value: secretString

    Secret version value: LATEST_SECRET

    Secret version: versionId

import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.csms.v1.CsmsClient;
import com.huaweicloud.sdk.csms.v1.model.CreateSecretRequest;
import com.huaweicloud.sdk.csms.v1.model.CreateSecretRequestBody;
import com.huaweicloud.sdk.csms.v1.model.CreateSecretResponse;
import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionRequest;
import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionResponse;

public class CsmsCreateSecretExample {
     * Basic authentication information:
     * - ACCESS_KEY: access key of the HUAWEI CLOUD account
     * - SECRET_ACCESS_KEY: secret access key of the Huawei Cloud account
     * - PROJECT_ID: Huawei Cloud project ID. For details, see
* - CSMS_ENDPOINT: endpoint address for accessing CSMS. For details, see
    private static final String ACCESS_KEY = "<AccessKey>";
    private static final String SECRET_ACCESS_KEY = "<SecretAccessKey>";
    private static final String PROJECT_ID = "<ProjectID>";
    private static final String CSMS_ENDPOINT = "<CsmsEndpoint>";

    //Version ID used to query the latest secret version details
    private static final String LATEST_SECRET = "latest";

    public static void main(String[] args) {
        String secretName = args[0];
        String secretString = args[1];

        //Create a secret.
        createSecret(secretName, secretString);

        //Query the content of the new secret based on the secret version latest or v1.
        ShowSecretVersionResponse latestVersion = showSecretVersion(secretName, LATEST_SECRET);
        ShowSecretVersionResponse firstVersion = showSecretVersion(secretName, "v1");

        assert latestVersion.equals(firstVersion);
        assert latestVersion.getVersion().getSecretString().equalsIgnoreCase(secretString);

     * Create a secret.
     * @param secretName
     * @param secretString
    private static void createSecret(String secretName, String secretString) {
        CreateSecretRequest secret = new CreateSecretRequest().withBody(
                new CreateSecretRequestBody().withName(secretName).withSecretString(secretString));

        CsmsClient csmsClient = getCsmsClient();

        CreateSecretResponse createdSecret = csmsClient.createSecret(secret);

        System.out.printf("Created secret success, secret detail:%s", createdSecret);
     * Query secret version details based on the secret version ID.
     * @param secretName
     * @param versionId
     * @return
    private static ShowSecretVersionResponse showSecretVersion(String secretName, String versionId) {
        ShowSecretVersionRequest showSecretVersionRequest = new ShowSecretVersionRequest().withSecretName(secretName)

        CsmsClient csmsClient = getCsmsClient();

        ShowSecretVersionResponse version = csmsClient.showSecretVersion(showSecretVersionRequest);

        System.out.printf("Query secret success. version id:%s", version.getVersion().getVersionMetadata().getId());

        return version;

     * Obtain the CSMS client.
     * @return
    private static CsmsClient getCsmsClient() {
        BasicCredentials auth = new BasicCredentials()

        return CsmsClient.newBuilder().withCredential(auth).withEndpoint(CSMS_ENDPOINT).build();

Obtaining the Database Account and Password Through an Application

  1. Obtain the dependency statement of the CSMS SDK.


  2. Establish a database connection and obtain the account and password.
    import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionRequest;
    import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionResponse;
    import java.sql.Connection;
    import java.sql.DriverManager;
    import java.sql.SQLException;
     //Obtain the specified database account and password based on the secret information.
        public static Connection getMySQLConnectionBySecret(String secretName, String jdbcUrl) throws ClassNotFoundException, SQLException{
            ShowSecretVersionResponse latestVersionValue = getCsmsClient().showSecretVersion(new ShowSecretVersionRequest().withSecretName(secretName).withVersionId("latest"));
            String secretString = latestVersionValue.getVersion().getSecretString();
            JsonObject jsonObject = new Gson().fromJson(secretString, JsonObject.class);
            return DriverManager.getConnection(jdbcUrl, jsonObject.get("username").getAsString(), jsonObject.get("password").getAsString());