- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
-
User Guide
- Key Management Service
- Cloud Secret Management Service
- Key Pair Service
- Dedicated HSM
- Tag Management
- Auditing Logs
- Sharing
- Permission Control
-
Best Practices
- Key Management Service
- Cloud Secret Management Service
- General
-
API Reference
- Before You Start
- Calling APIs
- API Overview
-
APIs
-
Key Management APIs
- Key Lifecycle Management
- DEK Management
- Small-Size Data Encryption and Decryption
- Signature and Verification
- Key Tag Management
- Key API Version Query
- Querying Key API Versions
- Key Import Management
- Querying Keys
- Key Grant Management
- Key Rotation Management
- Dedicated Keystore Management
- Signature Verification
- Key Pair Management APIs
- Secret Management APIs
-
Key Management APIs
- Historical APIs
- Application Examples
- Permissions Policies and Supported Actions
- Appendix
- SDK Reference
-
FAQs
-
KMS Related
- What Is Key Management Service?
- What Is a Customer Master Key?
- What Is a Default Key?
- What Are the Differences Between a Custom Key and a Default Key?
- What Is a Data Encryption Key?
- Why Cannot I Delete a CMK Immediately?
- Which Cloud Services Can Use KMS for Encryption?
- How Do Huawei Cloud Services Use KMS to Encrypt Data?
- What Are the Benefits of Envelope Encryption?
- Is There a Limit on the Number of Custom Keys That I Can Create on KMS?
- Can I Export a CMK from KMS?
- Can I Decrypt My Data if I Permanently Delete My Custom Key?
- How Do I Use the Online Tool to Encrypt or Decrypt Small Volumes of Data?
- Can I Update CMKs Created by KMS-Generated Key Materials?
- When Should I Use a CMK Created with Imported Key Materials?
- What Should I Do When I Accidentally Delete Key Materials?
- How Are Default Keys Generated?
- What Should I Do If I Do Not Have the Permissions to Perform Operations on KMS?
- Why Can't I Wrap Asymmetric Keys by Using -id-aes256-wrap-pad in OpenSSL?
- Key Algorithms Supported by KMS
- What Should I Do If KMS Failed to Be Requested and Error Code 401 Is Displayed?
- What Is the Relationship Between the Ciphertext and Plaintext Returned by the encrypt-data API?
- How Does KMS Protect My Keys?
- How Do I Use an Asymmetric Key to Verify the Signature Result of a Public Key Pair?
- Does an Imported Key Support Rotation?
- Does KMS Support Offline Data Encryption and Decryption?
- How Do I Convert an Original EC Private Key into a Private Key in PKCS8 Format?
- CSMS Related
-
KPS Related
- How Do I Create a Key Pair?
- What Are a Private Key Pair and an Account Key Pair?
- How Do I Handle an Import Failure of a Key Pair Created Using PuTTYgen?
- What Should I Do When I Fail to Import a Key Pair Using Internet Explorer 9?
- How Do I Log In to a Linux ECS with a Private Key?
- How Do I Use a Private Key to Obtain the Password to Log In to a Windows ECS?
- How Do I Handle the Failure in Binding a Key Pair?
- How Do I Handle the Failure in Replacing a Key Pair?
- How Do I Handle the Failure in Resetting a Key Pair?
- How Do I Handle the Failure in Unbinding a Key Pair?
- Do I Need to Restart Servers After Replacing Its Key Pair?
- How Do I Enable the Password Login Mode for an ECS?
- How Do I Handle the Failure in Logging In to ECS After Unbinding the Key Pair?
- What Should I Do If My Private Key Is Lost?
- How Do I Convert the Format of a Private Key File?
- Can I Change the Key Pair of a Server?
- Can a Key Pair Be Shared by Multiple Users?
- How Do I Obtain the Public or Private Key File of a Key Pair?
- What Can I Do If an Error Is Reported When an Account Key Is Created or Upgraded for the First Time?
- Will the Account Key Pair Quota Be Occupied After a Private Key Pair Is Upgraded to an Account Key Pair?
- Why Is the Private Key Pair Invisible After It Is Upgraded to an Account Key Pair When Logging in as a Federated User?
-
Dedicated HSM Related
- What Is Dedicated HSM?
- How Does Dedicated HSM Ensure the Security for Key Generation?
- Do Equipment Room Personnel Has the Super Administrator Role to Steal Information by Using a Privileged UKey?
- What HSMs Are Used for Dedicated HSM?
- What APIs Does Dedicated HSM Support?
- How Do I Enable Public Access to a Dedicated HSM Instance?
- Pricing
-
General
- What Functions Does DEW Provide?
- What Cryptography Algorithms Does DEW Use?
- In Which Regions Are DEW Services Available?
- What Is a Quota?
- What Is the Resource Allocation Mechanism of DEW?
- What Are Regions and AZs?
- Can DEW Be Shared Across Accounts?
- How Do I Access the Functions of DEW?
- Why Do DEW Pemissions Fail to Take Effect Immediately?
-
KMS Related
- Videos
-
More Documents
- User Guide (ME-Abu Dhabi Region)
- User Guide (Paris and Amsterdam Regions)
-
User Guide (Kuala Lumpur Region)
- Service Overview
-
User Guide
- Key Management Service
- Cloud Secret Management Service
- Auditing Logs
- Permission Control
-
FAQs
-
KMS Related
- What Is Key Management Service?
- What Is a Customer Master Key?
- What Is a Default Key?
- What Are the Differences Between a Custom Key and a Default Key?
- What Is a Data Encryption Key?
- Why Cannot I Delete a CMK Immediately?
- Which Cloud Services Can Use KMS for Encryption?
- How Do Cloud Services Use KMS to Encrypt Data?
- What Are the Benefits of Envelope Encryption?
- Is There a Limit on the Number of Custom Keys That I Can Create on KMS?
- Can I Export a CMK from KMS?
- Can I Decrypt My Data if I Permanently Delete My Custom Key?
- How Do I Use the Online Tool to Encrypt or Decrypt Small Volumes of Data?
- Can I Update CMKs Created by KMS-Generated Key Materials?
- When Should I Use a CMK Created with Imported Key Materials?
- What Types of Keys Can I Import?
- What Should I Do When I Accidentally Delete Key Materials?
- How Are Default Keys Generated?
- What Should I Do If I Do Not Have the Permissions to Perform Operations on KMS?
- Why Can't I Wrap Asymmetric Keys by Using -id-aes256-wrap-pad in OpenSSL?
- Key Algorithms Supported by KMS
- What Should I Do If KMS Failed to Be Requested and Error Code 401 Is Displayed?
- What Is the Relationship Between the Ciphertext and Plaintext Returned by the encrypt-data API?
- How Does KMS Protect My Keys?
- Credential Related
-
KMS Related
- Change History
-
API Reference (ME-Abu Dhabi Region)
- Before You Start
- Calling APIs
- API Overview
-
APIs
- Creating a CMK
- Enabling a CMK
- Disabling a CMK
- Scheduling the Deletion of a CMK
- Canceling the Scheduled Deletion of a CMK
- Querying the List of CMKs
- Querying the Information About a CMK
- Creating a Random Number
- Creating a DEK
- Creating a Plaintext-Free DEK
- Encrypting a DEK
- Decrypting a DEK
- Querying the Number of Instances
- Querying the Quota of a User
- Changing the Alias of a CMK
- Changing the Description of a CMK
- Encrypting Data
- Decrypting Data
- Obtaining CMK Import Parameters
- Importing CMK Material
- Deleting CMK Material
- Querying CMK Instances
- Querying CMK Tags
- Querying Project Tags
- Adding or Deleting CMK Tags in Batches
- Adding a CMK Tag
- Deleting a CMK Tag
- Permissions Policies and Supported Actions
- Appendix
- Change History
-
API Reference (Paris and Amsterdam Regions)
- Before You Start
- Calling APIs
- API Overview
-
APIs
- Creating a CMK
- Enabling a CMK
- Disabling a CMK
- Scheduling the Deletion of a CMK
- Canceling the Scheduled Deletion of a CMK
- Querying the List of CMKs
- Querying the Information About a CMK
- Creating a Random Number
- Creating a DEK
- Creating a Plaintext-Free DEK
- Encrypting a DEK
- Decrypting a DEK
- Querying the Number of Instances
- Querying the Quota of a User
- Changing the Alias of a CMK
- Changing the Description of a CMK
- Creating a Grant
- Revoking a Grant
- Retiring a Grant
- Querying Grants on a CMK
- Querying Grants That Can Be Retired
- Encrypting Data
- Decrypting Data
- Obtaining CMK Import Parameters
- Importing CMK Material
- Deleting CMK Material
- Enabling Rotation for a CMK
- Changing the Rotation Interval for a CMK
- Disabling Rotation for a CMK
- Querying the Rotation Status of a CMK
- Appendix
- Change History
-
API Reference (Kuala Lumpur Region)
- Before You Start
- Calling APIs
- API Overview
-
APIs
- Creating a CMK
- Enabling a CMK
- Disabling a CMK
- Scheduling the Deletion of a CMK
- Canceling the Scheduled Deletion of a CMK
- Querying the List of CMKs
- Querying the Information About a CMK
- Creating a Random Number
- Creating a DEK
- Creating a Plaintext-Free DEK
- Encrypting a DEK
- Decrypting a DEK
- Querying the Number of Instances
- Querying the Quota of a User
- Changing the Alias of a CMK
- Changing the Description of a CMK
- Creating a Grant
- Revoking a Grant
- Retiring a Grant
- Querying Grants on a CMK
- Querying Grants That Can Be Retired
- Encrypting Data
- Decrypting Data
- Obtaining CMK Import Parameters
- Importing CMK Material
- Deleting CMK Material
- Enabling Rotation for a CMK
- Changing the Rotation Interval for a CMK
- Disabling Rotation for a CMK
- Querying the Rotation Status of a CMK
- Appendix
- Change History
- General Reference
Copied.
Using CSMS to Change Hard-coded Database Account Passwords
Generally, the secrets used for access are embedded in applications. To update a secret, you need to create a new secret and spend time updating your applications. If you have multiple applications using the same secret, you have to update all of them, or the applications you forgot to update will be unable to use the secret for login.
An easy-to-use, effective, and secure secret management tool will be helpful.
Cloud Secret Management Service (CSMS) has the following advantages:
- You can host your secrets instead of using hardcoded secrets, improving the security of data and assets.
- Your services are not affected when you manually rotate secrets.
- Secure SDK access allows you to dynamically call your secrets.
- You can store many types of secrets. You can store service accounts, passwords, and database information, including but not limited to database names, IP addresses, and port numbers.
Logging In to a Database Using Secrets
You can create a secret and log in to your database by calling the secret via an API.
Ensure your account has the KMS Administrator or KMS CMKFullAccess permission. For details, see DEW Permissions Management.

The process is as follows:
- Create a secret on the console or via an API to store database information (such as the database address, port, and password).
- Use an application to access the database. CSMS will query the secret created in 1.
- CSMS retrieves and decrypts the secret ciphertext and securely returns the information stored in the secret to the application through the secret management API.
- The application obtains the decrypted plaintext secret and uses it to access the database.
Secret Creation and Query APIs
You can call the following APIs to create secrets, save their content, and query secret information.
API |
Description |
---|---|
This API is used to create a secret and store the secret value in the initial secret version. |
|
This API is used to query a secret. |
Creating and Querying Secrets via APIs
- Prepare basic authentication information.
- ACCESS_KEY: Access key of the Huawei account
- SECRET_ACCESS_KEY: Secret access key of the Huawei account
- PROJECT_ID: project ID of a Huawei Cloud site. For details, see Project.
- CSMS_ENDPOINT: endpoint for accessing CSMS. For details, see Endpoints.
- There will be security risks if the AK/SK used for authentication is directly written into code. Encrypt the AK/SK in the configuration file or environment variables for storage.
- In this example, the AK/SK stored in the environment variables are used for identity authentication. Configure the environment variables HUAWEICLOUD_SDK_AK and HUAWEICLOUD_SDK_SK in the local environment first.
- Create and query secret information.
Secret value: secretString
Secret version value: LATEST_SECRET
Secret version: versionId
import com.huaweicloud.sdk.core.auth.BasicCredentials; import com.huaweicloud.sdk.csms.v1.CsmsClient; import com.huaweicloud.sdk.csms.v1.model.CreateSecretRequest; import com.huaweicloud.sdk.csms.v1.model.CreateSecretRequestBody; import com.huaweicloud.sdk.csms.v1.model.CreateSecretResponse; import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionRequest; import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionResponse; public class CsmsCreateSecretExample { /** * Basic authentication information: * - ACCESS_KEY: Access key of the Huawei account * - SECRET_ACCESS_KEY: Secret access key of the Huawei account * - PROJECT_ID: Huawei Cloud project ID. For details, see https://support.huaweicloud.com/intl/en-us/productdesc-iam/iam_01_0023.html * - CSMS_ENDPOINT: endpoint address for accessing CSMS. For details, see https://support.huaweicloud.com/intl/en-us/api-dew/dew_02_0052.html. * - There will be security risks if the AK/SK used for authentication is directly written into code. Encrypt the AK/SK in the configuration file or environment variables for storage. * - In this example, the AK/SK stored in the environment variables are used for identity authentication. Configure the environment variables HUAWEICLOUD_SDK_AK and HUAWEICLOUD_SDK_SK in the local environment first. */ private static final String ACCESS_KEY = System.getenv("HUAWEICLOUD_SDK_AK"); private static final String SECRET_ACCESS_KEY = System.getenv("HUAWEICLOUD_SDK_SK"); private static final String PROJECT_ID = "<ProjectID>"; private static final String CSMS_ENDPOINT = "<CsmsEndpoint>"; //Version ID used to query the latest secret version details private static final String LATEST_SECRET = "latest"; public static void main(String[] args) { String secretName = args[0]; String secretString = args[1]; //Create a secret. createSecret(secretName, secretString); //Query the content of the new secret based on the secret version latest or v1. ShowSecretVersionResponse latestVersion = showSecretVersion(secretName, LATEST_SECRET); ShowSecretVersionResponse firstVersion = showSecretVersion(secretName, "v1"); assert latestVersion.equals(firstVersion); assert latestVersion.getVersion().getSecretString().equalsIgnoreCase(secretString); } /** * Create a secret. * @param secretName * @param secretString */ private static void createSecret(String secretName, String secretString) { CreateSecretRequest secret = new CreateSecretRequest().withBody( new CreateSecretRequestBody().withName(secretName).withSecretString(secretString)); CsmsClient csmsClient = getCsmsClient(); CreateSecretResponse createdSecret = csmsClient.createSecret(secret); System.out.printf("Created secret success, secret detail:%s", createdSecret); } /** * Query secret version details based on the secret version ID. * @param secretName * @param versionId * @return */ private static ShowSecretVersionResponse showSecretVersion(String secretName, String versionId) { ShowSecretVersionRequest showSecretVersionRequest = new ShowSecretVersionRequest().withSecretName(secretName) .withVersionId(versionId); CsmsClient csmsClient = getCsmsClient(); ShowSecretVersionResponse version = csmsClient.showSecretVersion(showSecretVersionRequest); System.out.printf("Query secret success. version id:%s", version.getVersion().getVersionMetadata().getId()); return version; } /** * Obtain the CSMS client. * @return */ private static CsmsClient getCsmsClient() { BasicCredentials auth = new BasicCredentials() .withAk(ACCESS_KEY) .withSk(SECRET_ACCESS_KEY) .withProjectId(PROJECT_ID); return CsmsClient.newBuilder().withCredential(auth).withEndpoint(CSMS_ENDPOINT).build(); } }
Obtaining the Database Account Through an Application
- Obtain the dependency statement of the CSMS SDK.
<dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> <version>XXX</version> </dependency> <dependency> <groupId>com.google.code.gson</groupId> <artifactId>gson</artifactId> <version>2.8.9</version> </dependency> <dependency> <groupId>com.huaweicloud.sdk</groupId> <artifactId>huaweicloud-sdk-csms</artifactId> <version>3.0.79</version> </dependency>
- Establish a database connection and obtain the account.
Example:
import com.google.gson.Gson; import com.google.gson.JsonObject; import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionRequest; import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionResponse; import java.sql.Connection; import java.sql.DriverManager; import java.sql.SQLException; // Obtain the specified database account based on the secret information. public static Connection getMySQLConnectionBySecret(String secretName, String jdbcUrl) throws ClassNotFoundException, SQLException{ Class.forName(MYSQL_JDBC_DRIVER); ShowSecretVersionResponse latestVersionValue = getCsmsClient().showSecretVersion(new ShowSecretVersionRequest().withSecretName(secretName).withVersionId("latest")); String secretString = latestVersionValue.getVersion().getSecretString(); JsonObject jsonObject = new Gson().fromJson(secretString, JsonObject.class); return DriverManager.getConnection(jdbcUrl, jsonObject.get("username").getAsString(), jsonObject.get("password").getAsString()); }
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot