Creating a Secret for Data Storage Rotation

Applications and business systems have a large number of secrets and are difficult to manage. Cloud Secret Management Service (CSMS) can store, retrieve, and use secrets in a unified manner throughout their lifecycles.

Procedure

This section uses a shared secret and a rotated secret as examples to describe how to create a secret and rotate data. The following figure shows the process.

Figure 1 Creating a key for cloud service encryption

Procedure	Description
Preparations	Register a Huawei ID, enable Huawei Cloud services, top up the account, and grant CSMS permissions to the account.
Creating a Shared Secret Creating a Rotated Secret	Create a secret and choose the secret type.
Data Rotation	After the secret is created, you can configure FunctionGraph to complete data rotation within the secret.

Preparations

Before creating a secret, register a Huawei Cloud account and enable Huawei Cloud services. For details, see Signing up for a Huawei ID and Enabling Huawei Cloud Services and Real-Name Authentication.
If you have enabled Huawei Cloud services and completed real-name authentication, skip this step.
Before purchasing an instance, ensure that your account balance is sufficient. For details, see Top-Up and Repayment.
You have created an encryption key on KMS.
- The default key is csms/default.
- Select the custom keys created on KMS. For details, see Creating a Key.
Before using a rotated secret, you need to create a database instance and database account.
- For details about how to create an RDS instance, see Buying an RDS for MySQL DB Instance.
- For details about how to create a GaussDB instance, see Buying a GaussDB Instance.

Log in to the management console. Click on the left and choose Security & Compliance > Data Encryption Workshop.
In the navigation pane on the left, choose Cloud Secret Management Service > Secrets. On the displayed page, click Create Secret in the upper left corner.
Configure the parameters as follows:
- Type: Select Shared secret.
  The created secret can be used only in the current region. To use it in other regions, switch to the target region and create a secret. For details about regions of secret management, see Function Overview.
- KMS Encryption Key: Choose the default key or a created key from the list.
- Set other parameters as needed.
Click OK. In the secret list, you can view the created secrets, which are in the Enabled state by default.

Log in to the management console. Click on the left and choose Security & Compliance > Data Encryption Workshop.
In the navigation pane on the left, choose Cloud Secret Management Service > Secrets. On the displayed page, click Create Secret in the upper left corner.
Configure the parameters as follows:
- Type: Select Rotated secret and choose an RDS secret or GaussDB(for MySQL) secret.
  The created secret can be used only in the current region. To use it in other regions, switch to the target region and create a secret. For details about regions of secret management, see Function Overview.
- KMS Encryption Key: Choose the default key or a created key from the list.
- Secret Value: Choose the created database account and enter the password.
- Set other parameters as needed.
Click Next. On the displayed page, enable automatic rotation and set the rotation period as required.
Under Rotation function, click Create one, enter the function name, select I understand the risks, and click Next.
Click OK. In the secret list, you can view the created secrets, which are in the Enabled state by default.