Rotating IAM Secrets Using FunctionGraph

Scenario

This section describes how to rotate IAM secrets through KMS using a FunctionGraph template.

Constraints

• Only IAM member accounts can be rotated. IAM master accounts cannot be rotated.
• The IAM member account to be rotated must have at least one group of secrets.
• CSMS is available in the region.

Procedure

Create an agency.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Management & Governance > Identity and Access Management.
4. In the navigation pane one the left, choose Agencies. Click Create Agency in the upper right corner.
5. Configure the parameters, as shown in the following figure. Table 1 lists the parameters.
   Figure 1 Creating an agency
   

   Table 1 Parameters for creating an agency

   Parameter	Description
   Agency Name	Enter a custom agency name, for example, test.
   Agency Type	Select Cloud service.
   Cloud Service	Choose FunctionGraph.
   Validity Period	Set this parameter based on the actual scenario. If the function needs to be executed for a long time, choose Unlimited.
   Description	Set this parameter as needed.

6. Click Next.
7. Select Security Administrator, CSMS FullAccess, and KMS CMKFullAccess, as shown in the following figure.
   Figure 2 Assigning permissions
   

8. Click Next and choose an authorization scope, as shown in the following figure.
   Figure 3 Authorization scope
   

9. Click OK.

Create a function template and a function.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Compute > FunctionGraph.
4. Click Create Function in the upper right corner.
5. Click Select template. In the Service area, click DEW, locate rotate-iam-credentials in the below, and click Configure in the upper right corner of the box, as shown in the following figure.
   Figure 4 Creating a function
   

6. Configure the parameters, which are described in Table 2.
   Figure 5 Basic function information
   

   Table 2 Basic parameters

   Parameter	Description
   Region	Select the region where the function is to be deployed.
   Project	Select the project where the function is to be deployed.
   Function Name	Enter a custom function name.
   Agency	Select an agency.
   Enterprise Project	If you have enabled enterprise projects, select one for you to add a function to it. If you have not enabled an enterprise project, this parameter will be unavailable. Skip this step.

7. Configure the environment variables, which are described in Table 3.
   Figure 6 Environment variables
   

   Table 3 Environment variables

   Parameter	Description
   region	Project, for example, if the region is CN North-Beijing4, the project name should be cn-north-4. NOTE: To obtain the project, hover the mouse over the username, and choose My Credentials from the drop-down list. The projects are displayed.
   user_id	Enter the ID of the IAM user to be rotated. NOTE: To obtain the IAM user ID, hover the mouse over the username, and choose My Credentials from the drop-down list. The ID is displayed.
   project_id	Enter the project ID. NOTE: To obtain the IAM user ID, hover the mouse over the username, and choose My Credentials from the drop-down list. The IDs of the projects are displayed.
   secret_name	Enter the name of the secret to be created, which cannot be the same as an existing secret name.

8. Configure trigger variables, which are described in Table 4.
   Figure 7 Trigger variables
   

   Table 4 Trigger variables

   Parameter	Description
   Timer Name	Custom
   Rule	Configured as required
   Enable Trigger	Configured as required

9. Click Create Function.

Debug.

For details about debugging a function workflow, see Online Debugging.

View the secret.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click . Choose Security & Compliance > Data Encryption Workshop.
4. In the navigation pane, choose Cloud Secret Management Service.
5. Query the specified secret in Step 7. Click it to view the details. The current valid secret, historical secrets, and other information are displayed.
   Figure 8 Secret details
   

6. Locate the latest version of the secret, click View Secret in the Operation column to check the AK/SK.