Functions

Unified Secret Management

CSMS provides secret lifecycle management, including creating, viewing, deleting, backing up, and restoring secrets.

Applications and business systems have a large number of secrets and are difficult to manage.

CSMS can store, retrieve, and use secrets in a unified manner throughout their lifecycles.

Perform the following operations to manage secrets using CSMS:

1. Collect secrets.
2. Upload the secrets to CSMS.
3. Configure fine-grained access and usage permissions for each secret by using IAM.

Secure Secret Retrieval

Many applications store plaintext secrets, such as passwords, tokens, certificates, SSH keys, and API keys, in their configuration files to be used for authentication when they access databases or other services. Plaintext and hardcoded secrets are prone to breach and incur security risks.

CSMS allows users to dynamically query secrets via APIs instead of hardcoding the secrets, greatly reducing breach risks.

Perform the following operations to manage secrets using CSMS:

When an application reads its configurations, it calls CSMS APIs to retrieve secrets. Neither hardcoded nor plaintext secrets are required.

Rotating Secrets and Keys

Secrets need to be periodically updated to enhance security. To rotate a secret, you need to update the secret in all the applications and configurations using it, which is time-consuming, error-prone, and may cause service interruption.

CSMS enables convenient multi-version secret management. Applications can call CSMS APIs or SDKs to securely update secrets without making mistakes.

Perform the following operations to manage secrets using CSMS:

1. An administrator adds a secret version on the CSMS console or via APIs to and update the secret.
2. Applications call CSMS APIs or SDKs to obtain the latest or a specified version of the secret, and perform full or grayscale update.
3. Repeat operations in 1 and 2 for periodic secret rotation.
4. Enable rotation for encryption keys to improve storage security.

Secret Version Management

You can create a new version of a secret to encrypt and keep a new secret value. By default, the latest secret version is in the SYSCURRENT state. The previous version is in the SYSPREVIOUS state.

Secret Tag Management

Tags are used to identify secrets. You can add tags to secrets to classify and track secrets and summarize their usage by tag.

Secret Event Notification

After you subscribe to an associated event for a secret object, if the event is enabled and a basic event is triggered on the secret object, an event notification is sent to the notification topic specified by the event through Simple Message Notification (SMN), or the cloud service is notified through the event subscription created in Event Grid. Basic event types include new secret version creation, secret version expiration, secret deletion, and secret rotation. After configuring event notification, you can use event-driven managed functions in FunctionGraph to automatically rotate secrets.

Perform the following operations to manage secrets using CSMS:

1. The administrator adds an event on the CSMS event notification console or by calling the API.

2. When creating or updating a secret, you need to associate the event object required for subscription.

3. You will receive an event notification when the secret status changes. You can configure functions in FunctionGraph to automatically update or rotate secrets.