Using CSMS to Change Hard-coded Database Account Passwords

Logging In to a Database Using Secrets

You can create a secret and log in to your database by calling the secret via an API.

Ensure your account has the KMS Administrator or KMS CMKFullAccess permission. For details, see DEW Permissions Management.

Figure 1 Secret-based login process

The process is as follows:

1. Create a secret on the console or via an API to store database information (such as the database address, port, and password).
2. Use an application to access the database. CSMS will query the secret created in 1.
3. CSMS retrieves and decrypts the secret ciphertext and securely returns the information stored in the secret to the application through the secret management API.
4. The application obtains the decrypted plaintext secret and uses it to access the database.

Secret Creation and Query APIs

You can call the following APIs to create secrets, save their content, and query secret information.

Creating and Querying Secrets via APIs

1. Prepare basic authentication information.
   • ACCESS_KEY: access key of the Huawei Cloud account
   • SECRET_ACCESS_KEY: secret access key of the Huawei Cloud account
   • PROJECT_ID: project ID of a Huawei Cloud site. For details, see Project.
   • CSMS_ENDPOINT: endpoint for accessing CSMS. For details, see Endpoints.
2. Create and query secret information.

   Secret name: secretName

   Secret value: secretString

   Secret version value: LATEST_SECRET

   Secret version: versionId

import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.csms.v1.CsmsClient;
import com.huaweicloud.sdk.csms.v1.model.CreateSecretRequest;
import com.huaweicloud.sdk.csms.v1.model.CreateSecretRequestBody;
import com.huaweicloud.sdk.csms.v1.model.CreateSecretResponse;
import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionRequest;
import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionResponse;

public class CsmsCreateSecretExample {
    /**
     * Basic authentication information:
     * - ACCESS_KEY: access key of the HUAWEI CLOUD account
     * - SECRET_ACCESS_KEY: secret access key of the Huawei Cloud account
     * - PROJECT_ID: Huawei Cloud project ID. For details, see https://support.huaweicloud.com/intl/en-us/productdesc-iam/iam_01_0023.html
* - CSMS_ENDPOINT: endpoint address for accessing CSMS. For details, see https://support.huaweicloud.com/intl/en-us/api-dew/dew_02_0052.html.
     */
    private static final String ACCESS_KEY = "<AccessKey>";
    private static final String SECRET_ACCESS_KEY = "<SecretAccessKey>";
    private static final String PROJECT_ID = "<ProjectID>";
    private static final String CSMS_ENDPOINT = "<CsmsEndpoint>";

    //Version ID used to query the latest secret version details
    private static final String LATEST_SECRET = "latest";

    public static void main(String[] args) {
        String secretName = args[0];
        String secretString = args[1];

        //Create a secret.
        createSecret(secretName, secretString);

        //Query the content of the new secret based on the secret version latest or v1.
        ShowSecretVersionResponse latestVersion = showSecretVersion(secretName, LATEST_SECRET);
        ShowSecretVersionResponse firstVersion = showSecretVersion(secretName, "v1");

        assert latestVersion.equals(firstVersion);
        assert latestVersion.getVersion().getSecretString().equalsIgnoreCase(secretString);
    }

    /**
     * Create a secret.
     * @param secretName
     * @param secretString
     */
    private static void createSecret(String secretName, String secretString) {
        CreateSecretRequest secret = new CreateSecretRequest().withBody(
                new CreateSecretRequestBody().withName(secretName).withSecretString(secretString));

        CsmsClient csmsClient = getCsmsClient();

        CreateSecretResponse createdSecret = csmsClient.createSecret(secret);

        System.out.printf("Created secret success, secret detail:%s", createdSecret);
    }
    /**
     * Query secret version details based on the secret version ID.
     * @param secretName
     * @param versionId
     * @return
     */
    private static ShowSecretVersionResponse showSecretVersion(String secretName, String versionId) {
        ShowSecretVersionRequest showSecretVersionRequest = new ShowSecretVersionRequest().withSecretName(secretName)
                .withVersionId(versionId);

        CsmsClient csmsClient = getCsmsClient();

        ShowSecretVersionResponse version = csmsClient.showSecretVersion(showSecretVersionRequest);

        System.out.printf("Query secret success. version id:%s", version.getVersion().getVersionMetadata().getId());

        return version;
    }

    /**
     * Obtain the CSMS client.
     * @return
     */
    private static CsmsClient getCsmsClient() {
        BasicCredentials auth = new BasicCredentials()
                .withAk(ACCESS_KEY)
                .withSk(SECRET_ACCESS_KEY)
                .withProjectId(PROJECT_ID);

        return CsmsClient.newBuilder().withCredential(auth).withEndpoint(CSMS_ENDPOINT).build();
    }
}

Obtaining the Database Account and Password Through an Application

1. Obtain the dependency statement of the CSMS SDK.

   Example:

   <dependency>
               <groupId>mysql</groupId>
               <artifactId>mysql-connector-java</artifactId>
               <version>XXX</version>
           </dependency>
           <dependency>
               <groupId>com.google.code.gson</groupId>
               <artifactId>gson</artifactId>
               <version>2.8.9</version>
           </dependency>
           <dependency>
               <groupId>com.huaweicloud.sdk</groupId>
               <artifactId>huaweicloud-sdk-csms</artifactId>
               <version>3.0.79</version>
           </dependency>

2. Establish a database connection and obtain the account and password.
   Example:

   import com.google.gson.Gson;
   import com.google.gson.JsonObject;
   import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionRequest;
   import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionResponse;
   
   import java.sql.Connection;
   import java.sql.DriverManager;
   import java.sql.SQLException;
   
    //Obtain the specified database account and password based on the secret information.
       public static Connection getMySQLConnectionBySecret(String secretName, String jdbcUrl) throws ClassNotFoundException, SQLException{
           Class.forName(MYSQL_JDBC_DRIVER);
           ShowSecretVersionResponse latestVersionValue = getCsmsClient().showSecretVersion(new ShowSecretVersionRequest().withSecretName(secretName).withVersionId("latest"));
           String secretString = latestVersionValue.getVersion().getSecretString();
           JsonObject jsonObject = new Gson().fromJson(secretString, JsonObject.class);
           return DriverManager.getConnection(jdbcUrl, jsonObject.get("username").getAsString(), jsonObject.get("password").getAsString());
       }