Using CSMS to Change Hard-coded Database Account Passwords

Logging In to a Database Using Secrets

You can create a secret and log in to your database by calling the secret via an API.

Ensure your account has the KMS Administrator or KMS CMKFullAccess permission. For details, see DEW Permissions Management.

Figure 1 Secret-based login process

The process is as follows:

1. Create a secret on the console or via an API to store database information (such as the database address, port, and password).
2. Use an application to access the database. CSMS will query the secret created in 1.
3. CSMS retrieves and decrypts the secret ciphertext and securely returns the information stored in the secret to the application through the secret management API.
4. The application obtains the decrypted plaintext secret and uses it to access the database.

Secret Creation and Query APIs

You can call the following APIs to create secrets, save their content, and query secret information.

Creating and Querying Secrets via APIs

1. Prepare basic authentication information.
   • ACCESS_KEY: access key of the Huawei ID
   • SECRET_ACCESS_KEY: secret access key of the Huawei ID
   • PROJECT_ID: project ID of a Huawei Cloud site. For details, see Project.
   • CSMS_ENDPOINT: endpoint for accessing CSMS. For details, see Endpoints.
   • There will be security risks if the AK/SK used for authentication is directly written into code. Encrypt the AK/SK in the configuration file or environment variables for storage.
   • In this example, the AK/SK stored in the environment variables are used for identity authentication. Configure the environment variables HUAWEICLOUD_SDK_AK and HUAWEICLOUD_SDK_SK in the local environment first.
2. Create and query secret information.

   Secret name: secretName

   Secret value: secretString

   Secret version value: LATEST_SECRET

   Secret version: versionId

import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.csms.v1.CsmsClient;
import com.huaweicloud.sdk.csms.v1.model.CreateSecretRequest;
import com.huaweicloud.sdk.csms.v1.model.CreateSecretRequestBody;
import com.huaweicloud.sdk.csms.v1.model.CreateSecretResponse;
import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionRequest;
import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionResponse;

public class CsmsCreateSecretExample {
    /**
     * Basic authentication information:
     * - ACCESS_KEY: access key of the Huawei ID
     * - SECRET_ACCESS_KEY: secret access key of the Huawei ID
     * - PROJECT_ID: Huawei Cloud project ID. For details, see https://support.huaweicloud.com/intl/en-us/productdesc-iam/iam_01_0023.html
* - CSMS_ENDPOINT: endpoint address for accessing CSMS. For details, see https://support.huaweicloud.com/intl/en-us/api-dew/dew_02_0052.html.
     * - There will be security risks if the AK/SK used for authentication is directly written into code. Encrypt the AK/SK in the configuration file or environment variables for storage.
     * - In this example, the AK/SK stored in the environment variables are used for identity authentication. Configure the environment variables HUAWEICLOUD_SDK_AK and HUAWEICLOUD_SDK_SK in the local environment first.
     */
    private static final String ACCESS_KEY = System.getenv("HUAWEICLOUD_SDK_AK");
    private static final String SECRET_ACCESS_KEY = System.getenv("HUAWEICLOUD_SDK_SK");
    private static final String PROJECT_ID = "<ProjectID>";
    private static final String CSMS_ENDPOINT = "<CsmsEndpoint>";

    //Version ID used to query the latest secret version details
    private static final String LATEST_SECRET = "latest";

    public static void main(String[] args) {
        String secretName = args[0];
        String secretString = args[1];

        //Create a secret.
        createSecret(secretName, secretString);

        //Query the content of the new secret based on the secret version latest or v1.
        ShowSecretVersionResponse latestVersion = showSecretVersion(secretName, LATEST_SECRET);
        ShowSecretVersionResponse firstVersion = showSecretVersion(secretName, "v1");

        assert latestVersion.equals(firstVersion);
        assert latestVersion.getVersion().getSecretString().equalsIgnoreCase(secretString);
    }

    /**
     * Create a secret.
     * @param secretName
     * @param secretString
     */
    private static void createSecret(String secretName, String secretString) {
        CreateSecretRequest secret = new CreateSecretRequest().withBody(
                new CreateSecretRequestBody().withName(secretName).withSecretString(secretString));

        CsmsClient csmsClient = getCsmsClient();

        CreateSecretResponse createdSecret = csmsClient.createSecret(secret);

        System.out.printf("Created secret success, secret detail:%s", createdSecret);
    }
    /**
     * Query secret version details based on the secret version ID.
     * @param secretName
     * @param versionId
     * @return
     */
    private static ShowSecretVersionResponse showSecretVersion(String secretName, String versionId) {
        ShowSecretVersionRequest showSecretVersionRequest = new ShowSecretVersionRequest().withSecretName(secretName)
                .withVersionId(versionId);

        CsmsClient csmsClient = getCsmsClient();

        ShowSecretVersionResponse version = csmsClient.showSecretVersion(showSecretVersionRequest);

        System.out.printf("Query secret success. version id:%s", version.getVersion().getVersionMetadata().getId());

        return version;
    }

    /**
     * Obtain the CSMS client.
     * @return
     */
    private static CsmsClient getCsmsClient() {
        BasicCredentials auth = new BasicCredentials()
                .withAk(ACCESS_KEY)
                .withSk(SECRET_ACCESS_KEY)
                .withProjectId(PROJECT_ID);

        return CsmsClient.newBuilder().withCredential(auth).withEndpoint(CSMS_ENDPOINT).build();
    }
}

Obtaining the Database Account and Password Through an Application

1. Obtain the dependency statement of the CSMS SDK.

   Example:

   <dependency>
               <groupId>mysql</groupId>
               <artifactId>mysql-connector-java</artifactId>
               <version>XXX</version>
           </dependency>
           <dependency>
               <groupId>com.google.code.gson</groupId>
               <artifactId>gson</artifactId>
               <version>2.8.9</version>
           </dependency>
           <dependency>
               <groupId>com.huaweicloud.sdk</groupId>
               <artifactId>huaweicloud-sdk-csms</artifactId>
               <version>3.0.79</version>
           </dependency>

2. Establish a database connection and obtain the account and password.
   Example:

   import com.google.gson.Gson;
   import com.google.gson.JsonObject;
   import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionRequest;
   import com.huaweicloud.sdk.csms.v1.model.ShowSecretVersionResponse;
   
   import java.sql.Connection;
   import java.sql.DriverManager;
   import java.sql.SQLException;
   
    //Obtain the specified database account and password based on the secret information.
       public static Connection getMySQLConnectionBySecret(String secretName, String jdbcUrl) throws ClassNotFoundException, SQLException{
           Class.forName(MYSQL_JDBC_DRIVER);
           ShowSecretVersionResponse latestVersionValue = getCsmsClient().showSecretVersion(new ShowSecretVersionRequest().withSecretName(secretName).withVersionId("latest"));
           String secretString = latestVersionValue.getVersion().getSecretString();
           JsonObject jsonObject = new Gson().fromJson(secretString, JsonObject.class);
           return DriverManager.getConnection(jdbcUrl, jsonObject.get("username").getAsString(), jsonObject.get("password").getAsString());
       }