Alibaba Cloud KMS Secret Management

This Skill provides core functionality for Alibaba Cloud Key Management Service (KMS) secret management, supporting CRUD operations on secrets.

Scenario Description

KMS Secret Management service is used to securely store, manage, and access sensitive information, such as:

• - Database connection credentials
• API keys
• OAuth tokens
• Certificate private keys
• Other sensitive data requiring secure storage

Architecture: Alibaba Cloud KMS Service + Secret Management (Secrets Manager)

CODEBLOCK0

Environment Setup

Dependency: Aliyun CLI. If command not found error occurs, refer to references/cli-installation-guide.md for installation.

Timeout Configuration

Set appropriate timeouts for CLI commands to avoid hanging:

CODEBLOCK1

Or use command-line flags:
CODEBLOCK2

Recommended timeout values:

• - Connection timeout: 30 seconds
• Read timeout: 30 seconds

Security Rules

• - Prohibited: Reading, printing, or displaying AK/SK values
• Prohibited: Requiring users to directly input AK/SK in conversation
• Sensitive Data Masking: Secret values returned by GetSecretValue are masked by default (e.g., ***), only output in plaintext when user explicitly requests

RAM Permission Requirements

Ensure the executing user has the following KMS permissions. For detailed policies, see references/ram-policies.md.

Minimum Permissions (Read-Only):
CODEBLOCK3

Full Permissions (Read-Write):

kms:CreateSecret, kms:DeleteSecret, kms:UpdateSecret, kms:DescribeSecret, 
kms:ListSecrets, kms:GetSecretValue, kms:PutSecretValue, kms:ListSecretVersionIds,
kms:UpdateSecretVersionStage, kms:UpdateSecretRotationPolicy, kms:RotateSecret,
kms:RestoreSecret, kms:SetSecretPolicy, kms:GetSecretPolicy,
kms:ListKmsInstances, kms:ListKeys, kms:CreateKey

Core Workflows

1. Create Secret

Creating a secret requires obtaining the KMS instance ID and encryption key ID first, then executing the creation.

CODEBLOCK5

2. List Secrets

CODEBLOCK6

3. Get Secret Value

Security Policy:

• - If user does NOT explicitly request the secret value: Only provide the CLI command or Python code script. DO NOT execute.
• If user explicitly requests to get/retrieve/show the secret value: Provide the command/script first, then execute after user confirms.

CLI Command:
CODEBLOCK7

Python SDK Example:
CODEBLOCK8

Note:

• - Only execute the retrieval after user explicitly confirms
• The secret value contains sensitive information that should be handled with care
• Always remind user to execute in a secure environment (private terminal, no screen sharing, no logging)

4. Delete Secret

Pre-check before deletion (Safety Requirement):

Before force deleting a secret, always verify its existence and check if it's still in use:

CODEBLOCK9

If DescribeSecret returns error (secret not found):

• - Stop and inform user: "Secret does not exist, no deletion needed"

If DescribeSecret succeeds:

• - Review the secret metadata
• Confirm with user before proceeding with force deletion

CODEBLOCK10

Idempotency: If Forbidden.ResourceNotFound error is returned, it means the secret does not exist, treat as deletion successful and continue with subsequent operations.

5. Update Secret Value

CODEBLOCK11

6. Describe Secret

CODEBLOCK12

7. List Secret Versions

CODEBLOCK13

8. Configure Rotation Policy

CODEBLOCK14

9. Restore Deleted Secret

CODEBLOCK15

Idempotency: If Rejected.ResourceInUse error is returned, it means the secret has been restored or was not deleted, treat as restore successful and continue with subsequent operations.

Advanced Features

For managed credentials and other advanced features, see references/managed-credentials.md.

Reference Links