Updated on 2024-08-30 GMT+08:00

Rotating IAM Secrets Using FunctionGraph

Scenario

This section describes how to rotate IAM secrets through KMS using a FunctionGraph template.

Constraints

  • Only IAM member accounts can be rotated. IAM master accounts cannot be rotated.
  • The IAM member account to be rotated must have at least one group of secrets.
  • CSMS is available in the region.

Procedure

Create an agency.

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Click in the upper left corner of the page and choose Management & Governance > Identity and Access Management.
  4. In the navigation pane one the left, choose Agencies. Click Create Agency in the upper right corner.
  5. Configure the parameters, as shown in the following figure. Table 1 lists the parameters.

    Figure 1 Creating an agency
    Table 1 Parameters for creating an agency

    Parameter

    Description

    Agency Name

    Enter a custom agency name, for example, test.

    Agency Type

    Select Cloud service.

    Cloud Service

    Choose FunctionGraph.

    Validity Period

    Set this parameter based on the actual scenario. If the function needs to be executed for a long time, choose Unlimited.

    Description

    Set this parameter as needed.

  6. Click Next.
  7. Select Security Administrator, CSMS FullAccess, and KMS CMKFullAccess, as shown in the following figure.

    Figure 2 Assigning permissions

  8. Click Next and choose an authorization scope, as shown in the following figure.

    Figure 3 Authorization scope

  9. Click OK.

Create a function template and a function.

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Click in the upper left corner of the page and choose Compute > FunctionGraph.
  4. Click Create Function in the upper right corner.
  5. Click Select template. In the Service area, click DEW, locate rotate-iam-credentials in the below, and click Configure in the upper right corner of the box, as shown in the following figure.

    Figure 4 Creating a function

  6. Configure the parameters, which are described in Table 2.

    Figure 5 Basic function information
    Table 2 Basic parameters

    Parameter

    Description

    Region

    Select the region where the function is to be deployed.

    Project

    Select the project where the function is to be deployed.

    Function Name

    Enter a custom function name.

    Agency

    Select an agency.

    Enterprise Project

    If you have enabled enterprise projects, select one for you to add a function to it.

    If you have not enabled an enterprise project, this parameter will be unavailable. Skip this step.

  7. Configure the environment variables, which are described in Table 3.

    Figure 6 Environment variables
    Table 3 Environment variables

    Parameter

    Description

    region

    Project, for example, if the region is CN North-Beijing4, the project name should be cn-north-4.

    NOTE:

    To obtain the project, hover the mouse over the username, and choose My Credentials from the drop-down list. The projects are displayed.

    user_id

    Enter the ID of the IAM user to be rotated.

    NOTE:

    To obtain the IAM user ID, hover the mouse over the username, and choose My Credentials from the drop-down list. The ID is displayed.

    project_id

    Enter the project ID.

    NOTE:

    To obtain the IAM user ID, hover the mouse over the username, and choose My Credentials from the drop-down list. The IDs of the projects are displayed.

    secret_name

    Enter the name of the secret to be created, which cannot be the same as an existing secret name.

  8. Configure trigger variables, which are described in Table 4.

    Figure 7 Trigger variables
    Table 4 Trigger variables

    Parameter

    Description

    Timer Name

    Custom

    Rule

    Configured as required

    Enable Trigger

    Configured as required

  9. Click Create Function.

Debug.

For details about debugging a function workflow, see Online Debugging.

View the secret.

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Click . Choose Security & Compliance > Data Encryption Workshop.
  4. In the navigation pane, choose Cloud Secret Management Service.
  5. Query the specified secret in Step 7. Click it to view the details. The current valid secret, historical secrets, and other information are displayed.

    Figure 8 Secret details

  6. Locate the latest version of the secret, click View Secret in the Operation column to check the AK/SK.