Creating a Scheduled Secret Deletion Task
Function
Specify the deletion delay time and create a scheduled task for deleting secrets. You can set the deletion delay time to 7 to 30 days.
Constraints
For a secret in the Scheduled deletion state, its metadata cannot be updated and its secret cannot be checked.
Calling Method
For details, see Calling APIs.
URI
POST /v1/{project_id}/secrets/{secret_name}/scheduled-deleted-tasks/create
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
project_id |
Yes |
String |
Project ID |
secret_name |
Yes |
String |
Secret name |
Request Parameters
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
X-Auth-Token |
Yes |
String |
User token. It can be obtained by calling the IAM API used to obtain a user token. The value of X-Subject-Token in the response header is a token. |
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
recovery_window_in_days |
Yes |
Integer |
Delay in deleting a secret in a scheduled task. Constraint: The value range is 7 to 30 days. Default value: 30 |
Response Parameters
Status code: 200
Parameter |
Type |
Description |
---|---|---|
secret |
Secret object |
Secret object |
Parameter |
Type |
Description |
---|---|---|
id |
String |
Resource identifier of a secret |
name |
String |
Secret name |
state |
String |
Secret status. Its value can be: ENABLED DISABLED PENDING_DELETE FROZEN |
kms_key_id |
String |
ID of the KMS CMK used to encrypt a secret value. |
description |
String |
Description of a secret |
create_time |
Long |
Secret creation time. The value is a timestamp, that is, the total number of seconds on January 1, 1970 to the current time. |
update_time |
Long |
Time when a secret was last updated. The value is a timestamp, that is, the total number of seconds on January 1, 1970 to the current time. |
scheduled_delete_time |
Long |
Time when a secret is scheduled to be deleted. The value is a timestamp, that is, the total number of seconds on January 1, 1970 to the current time. If the secret is not in the deletion plan, the value of this parameter is null. |
secret_type |
String |
Secret type The options are as follows: COMMON: common secret (default) stores sensitive information in the application system. RDS: RDS secrets. RDS secrets are used to store RDS account information. |
auto_rotation |
Boolean |
Automatic rotation The value can be true (enabled) or false (disabled). The default value is false. |
rotation_period |
String |
Rotation period Constraints: 6 hours - 8,760 hours (365 days) Type: Integer[unit]. Integer indicates the time length. unit indicates the time unit, which can be d (day), h (hour), m (minute), or s (second). For example, 1d indicates one day, and 24h also indicates one day. Note: This parameter is mandatory when automatic rotation is enabled. |
rotation_config |
String |
Rotation configuration Constraints: The value contains a maximum of 1,024 characters. If secret_type is set to RDS, set this parameter to {"RDSInstanceId":"","SecretSubType":""}. Note: This parameter is mandatory when secret_type is set to RDS. RDSInstanceId indicates the RDS DB instance ID. SecretSubType indicates the rotation subtype. The value can be SingleUser or MultiUser. SingleUser: The single-user mode is used. The password of a specified account is reset each time the account is rotated. MultiUser: The dual-user mode is used. SYSCURRENT and SYSPREVIOUS reference one of the accounts. During secret rotation, the account password referenced by SYSPREVIOUS is reset to a new random password. Subsequently, secrets exchange SYSCURRENT and SYSPREVIOUS references to the RDS account. |
rotation_time |
Long |
Rotation timestamp |
next_rotation_time |
Long |
Next rotation timestamp |
event_subscriptions |
Array of strings |
List of events subscribed to by secrets. Currently, only one event can be subscribed to. When a basic event contained in an event is triggered, a notification message is sent to the notification topic corresponding to the event. |
enterprise_project_id |
String |
Enterprise project ID |
Status code: 400
Parameter |
Type |
Description |
---|---|---|
error_code |
String |
Error codes |
error_msg |
String |
Error description |
Status code: 401
Parameter |
Type |
Description |
---|---|---|
error_code |
String |
Error codes |
error_msg |
String |
Error description |
Status code: 403
Parameter |
Type |
Description |
---|---|---|
error_code |
String |
Error codes |
error_msg |
String |
Error description |
Status code: 404
Parameter |
Type |
Description |
---|---|---|
error_code |
String |
Error codes |
error_msg |
String |
Error description |
Status code: 500
Parameter |
Type |
Description |
---|---|---|
error_code |
String |
Error codes |
error_msg |
String |
Error description |
Status code: 502
Parameter |
Type |
Description |
---|---|---|
error_code |
String |
Error codes |
error_msg |
String |
Error description |
Status code: 504
Parameter |
Type |
Description |
---|---|---|
error_code |
String |
Error codes |
error_msg |
String |
Error description |
Example Requests
Create a scheduled secret deletion task and delete the secret 15 days later.
{ "recovery_window_in_days" : 15 }
Example Responses
Status code: 200
Request succeeded.
{ "secret" : { "id" : "bb6a3d22-dc93-47ac-b5bd-88df7ad35f1e", "name" : "test", "state" : "ENABLED", "kms_key_id" : "b168fe00ff56492495a7d22974df2d0b", "description" : "description", "create_time" : 1581507580000, "update_time" : 1581507580000, "scheduled_delete_time" : 1581507580000 } }
SDK Sample Code
The SDK sample code is as follows.
Create a scheduled secret deletion task and delete the secret 15 days later.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 |
package com.huaweicloud.sdk.test; import com.huaweicloud.sdk.core.auth.ICredential; import com.huaweicloud.sdk.core.auth.BasicCredentials; import com.huaweicloud.sdk.core.exception.ConnectionException; import com.huaweicloud.sdk.core.exception.RequestTimeoutException; import com.huaweicloud.sdk.core.exception.ServiceResponseException; import com.huaweicloud.sdk.csms.v1.region.CsmsRegion; import com.huaweicloud.sdk.csms.v1.*; import com.huaweicloud.sdk.csms.v1.model.*; public class DeleteSecretForScheduleSolution { public static void main(String[] args) { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment String ak = System.getenv("CLOUD_SDK_AK"); String sk = System.getenv("CLOUD_SDK_SK"); ICredential auth = new BasicCredentials() .withAk(ak) .withSk(sk); CsmsClient client = CsmsClient.newBuilder() .withCredential(auth) .withRegion(CsmsRegion.valueOf("<YOUR REGION>")) .build(); DeleteSecretForScheduleRequest request = new DeleteSecretForScheduleRequest(); DeleteSecretForScheduleRequestBody body = new DeleteSecretForScheduleRequestBody(); body.withRecoveryWindowInDays(15); request.withBody(body); try { DeleteSecretForScheduleResponse response = client.deleteSecretForSchedule(request); System.out.println(response.toString()); } catch (ConnectionException e) { e.printStackTrace(); } catch (RequestTimeoutException e) { e.printStackTrace(); } catch (ServiceResponseException e) { e.printStackTrace(); System.out.println(e.getHttpStatusCode()); System.out.println(e.getRequestId()); System.out.println(e.getErrorCode()); System.out.println(e.getErrorMsg()); } } } |
Create a scheduled secret deletion task and delete the secret 15 days later.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
# coding: utf-8 from huaweicloudsdkcore.auth.credentials import BasicCredentials from huaweicloudsdkcsms.v1.region.csms_region import CsmsRegion from huaweicloudsdkcore.exceptions import exceptions from huaweicloudsdkcsms.v1 import * if __name__ == "__main__": # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak = __import__('os').getenv("CLOUD_SDK_AK") sk = __import__('os').getenv("CLOUD_SDK_SK") credentials = BasicCredentials(ak, sk) \ client = CsmsClient.new_builder() \ .with_credentials(credentials) \ .with_region(CsmsRegion.value_of("<YOUR REGION>")) \ .build() try: request = DeleteSecretForScheduleRequest() request.body = DeleteSecretForScheduleRequestBody( recovery_window_in_days=15 ) response = client.delete_secret_for_schedule(request) print(response) except exceptions.ClientRequestException as e: print(e.status_code) print(e.request_id) print(e.error_code) print(e.error_msg) |
Create a scheduled secret deletion task and delete the secret 15 days later.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
package main import ( "fmt" "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic" csms "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/csms/v1" "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/csms/v1/model" region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/csms/v1/region" ) func main() { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak := os.Getenv("CLOUD_SDK_AK") sk := os.Getenv("CLOUD_SDK_SK") auth := basic.NewCredentialsBuilder(). WithAk(ak). WithSk(sk). Build() client := csms.NewCsmsClient( csms.CsmsClientBuilder(). WithRegion(region.ValueOf("<YOUR REGION>")). WithCredential(auth). Build()) request := &model.DeleteSecretForScheduleRequest{} request.Body = &model.DeleteSecretForScheduleRequestBody{ RecoveryWindowInDays: int32(15), } response, err := client.DeleteSecretForSchedule(request) if err == nil { fmt.Printf("%+v\n", response) } else { fmt.Println(err) } } |
For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.
Status Codes
Status Code |
Description |
---|---|
200 |
Request succeeded. |
400 |
Invalid request parameter. |
401 |
A username and password are required. |
403 |
Authentication failed. |
404 |
The requested resource does not exist or is not found. |
500 |
Internal service error. |
502 |
The request failed to be fulfilled because the server received an invalid response from the upstream server. |
504 |
Gateway timed out. |
Error Codes
See Error Codes.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot