AmazonSecrets Component
Properties Methods Events Configuration Settings Errors
The AmazonSecrets component provides an easy-to-use interface for Amazon's Secrets Manager service.
Syntax
cloudkeys.Amazonsecrets
Remarks
The AmazonSecrets component makes it easy to work with the Amazon Secrets Manager service in a secure manner using TLS. Amazon Secrets Manager allows you to securely store secrets (e.g., passwords, symmetric keys, etc.) in the cloud so that the aren't persisted locally. This component helps you to create, manage, and access those secrets.
To begin, register for an AWS account and obtain an AccessKey and SecretKey to use for authentication.
Resource Terminology
A secret in Amazon Secrets Manager is a container for one or more secret versions, which is where secret data is actually stored. Each secret version can have between zero and 20 staging labels attached to it at any given time.
A staging label is a simple string that can be used instead of a version Id to refer to a particular secret version when retrieving secret data. A staging label can only be attached to one version of a secret at any given time. The server ensures that there is always exactly one version of a secret with the special staging label AWSCURRENT, but otherwise you are free to apply any staging labels to any secret versions you choose.
Secret versions that do not have any staging labels attached to them are considered deprecated, and the server may delete them at any time without warning. Deprecated secret versions are not shown in a secret's version list unless explicitly asked for.
Using the Component
The CreateSecret method will create a new secret with an initial secret version that holds the specified secret data. To change a secret's data, create a new version of it using the CreateVersion method.
To retrieve a secret's data, call the GetSecret method, and specify the specific version (either by Id or using a staging label) whose data should be retrieved. If no particular version is specified, the version with the AWSCURRENT staging label is used.
Secrets that will no longer be used can be deleted using the DeleteSecret method, either immediately or after a waiting period. If a secret is scheduled for deletion later, then during said waiting period the deletion can be canceled using CancelDeletion.
// Creates a new secret with the textual data "Test123" named MySecret.
// The initial secret version will have only the "AWSCURRENT" staging label.
amazonsecrets.SecretString = "Test123";
amazonsecrets.CreateSecret("MySecret", "A description of my secret.");
// Creates a new secret version with the textual data "Cats456" and
// attaches the staging labels "AWSCURRENT" (which gets moved from the previous version)
// and "best-version" to it.
amazonsecrets.SecretString = "Cats456";
amazonsecrets.CreateVersion("MySecret", "AWSCURRENT,best-version");
// Downloads the latest secret version's data to a local file.
amazonsecrets.LocalFile = "C:\temp\secret.txt";
amazonsecrets.GetSecret("MySecret", "", "");
// Schedules the secret, and all its versions, for deletion after 10 days.
amazonsecrets.DeleteSecret("MySecret", 10);
// Cancels the scheduled deletion.
amazonsecrets.CancelDeletion("MySecret");
To list secrets, use the ListSecrets method. To list a secret's versions, use the ListVersions method.
// If there are many secrets to list, there may be multiple pages of results. This will
// cause all pages of results to be accumulated into the Secrets collection property.
do {
amazonsecrets.ListSecrets();
} while (!string.IsNullOrEmpty(amazonsecrets.SecretMarker));
// A similar thing applies to secret versions as well.
do {
amazonsecrets.ListVersions("MySecret");
} while (!string.IsNullOrEmpty(amazonsecrets.VersionMarker));
The component also supports other functionality, including:
- Adding, removing, and moving staging labels between secret versions using MoveStagingLabel.
- Retrieval of information for a single secret with GetSecretInfo.
- Random password generation using GenRandomPassword.
- And more!
Property List
The following is the full list of the properties of the component with short descriptions. Click on the links for further details.
AccessKey | The access key to use for authentication. |
Firewall | A set of properties related to firewall access. |
Idle | The current status of the component. |
LocalFile | The local file to write data to, or whose data should be sent. |
LocalHost | The name of the local host or user-assigned IP interface through which connections are initiated or accepted. |
OtherHeaders | Other headers as determined by the user (optional). |
Overwrite | Whether the local file should be overwritten if necessary. |
ParsedHeaders | Collection of headers returned from the last request. |
Proxy | A set of properties related to proxy access. |
QueryParams | Additional query parameters to be included in the request. |
Region | The region that the component will make requests against. |
SecretData | The binary secret data that was retrieved or that should be sent. |
SecretKey | The secret key to use for authentication. |
SecretMarker | A marker indicating what page of secrets to return next. |
Secrets | A collection of secrets. |
SecretString | The textual secret data that was retrieved or that should be sent. |
SSLAcceptServerCert | Instructs the component to unconditionally accept the server certificate that matches the supplied certificate. |
SSLCert | The certificate to be used during SSL negotiation. |
SSLServerCert | The server certificate for the last established connection. |
Timeout | A timeout for the component. |
VersionMarker | A marker indicating what page of secret versions to return next. |
Versions | A collection of secret versions. |
Method List
The following is the full list of the methods of the component with short descriptions. Click on the links for further details.
AddQueryParam | Adds a query parameter to the QueryParams properties. |
CancelDeletion | Cancels the deletion of a secret. |
Config | Sets or retrieves a configuration setting. |
CreateSecret | Creates a new secret. |
CreateVersion | Creates a new secret version. |
DeleteSecret | Deletes a secret and all of its versions. |
DoEvents | Processes events from the internal message queue. |
GenRandomPassword | Returns a server-generated random password that complies with the given criteria. |
GetSecret | Retrieves a secret version's data. |
GetSecretInfo | Gets information about a secret. |
ListSecrets | Lists secrets in the current account and region. |
ListVersions | List the secret versions for the specified secret. |
MoveStagingLabel | Adds, removes, or moves a staging label. |
Reset | Resets the component to its initial state. |
SendCustomRequest | Sends a custom request to the server. |
SetInputStream | Sets the stream whose data should be sent. |
SetOutputStream | Sets the stream to which received data should be written. |
UpdateSecret | Updates a secret's information. |
Event List
The following is the full list of the events fired by the component with short descriptions. Click on the links for further details.
EndTransfer | Fired when a document finishes transferring. |
Error | Information about errors during data delivery. |
Header | Fired every time a header line comes in. |
Log | Fires once for each log message. |
SecretList | Fires once for each secret when listing secrets. |
SSLServerAuthentication | Fired after the server presents its certificate to the client. |
SSLStatus | Shows the progress of the secure connection. |
StartTransfer | Fired when a document starts transferring (after the headers). |
Transfer | Fired while a document transfers (delivers document). |
VersionList | Fires once for each secret version when listing secret versions. |
Configuration Settings
The following is a list of configuration settings for the component with short descriptions. Click on the links for further details.
AccumulatePages | Whether the component should accumulate subsequent pages of results when listing them. |
AlwaysParseVersions | Whether to parse version information when listing secrets. |
AWSProfile | The name of the AWS CLI profile that the component should use to obtain authentication and region information. |
AWSProfileDir | The location of the AWS CLI credentials and config files. |
CloseInputStreamAfterProcessing | Whether the specified input stream should be closed after data is read from it. |
CloseOutputStreamAfterProcessing | Whether the specified output stream should be closed after data is written to it. |
IncludeDeleted | Whether to include secrets scheduled for deletion when listing secrets. |
IncludeDeprecated | Whether to include deprecated version when listing versions. |
KMSKeyId | The Id of the Amazon KMS CMK that should be used to encrypt a secret. |
MaxSecrets | The maximum number of results to return when listing secrets. |
PreferBinary | Whether the component should treat secret data as binary or textual in ambiguous situations. |
RawRequest | Returns the data that was sent to the server. |
RawResponse | Returns the data that was received from the server. |
SessionToken | The session token to send in the request when using temporary credentials. |
UseEC2RoleCredentials | If set to true, authenticate requests with credentials obtained from the IAM role attached to the EC2 instance. |
UseFIPSEndpoint | Whether to use the FIPs endpoint to communicate with the server. |
XChildCount | The number of child elements of the current element. |
XChildName[i] | The name of the child element. |
XChildXText[i] | The inner text of the child element. |
XElement | The name of the current element. |
XParent | The parent of the current element. |
XPath | Provides a way to point to a specific element in the returned XML or JSON response. |
XSubTree | A snapshot of the current element in the document. |
XText | The text of the current element. |
AcceptEncoding | Used to tell the server which types of content encodings the client supports. |
AllowHTTPCompression | This property enables HTTP compression for receiving data. |
AllowHTTPFallback | Whether HTTP/2 connections are permitted to fallback to HTTP/1.1. |
AllowNTLMFallback | Whether to allow fallback from Negotiate to NTLM when authenticating. |
Append | Whether to append data to LocalFile. |
Authorization | The Authorization string to be sent to the server. |
BytesTransferred | Contains the number of bytes transferred in the response data. |
ChunkSize | Specifies the chunk size in bytes when using chunked encoding. |
CompressHTTPRequest | Set to true to compress the body of a PUT or POST request. |
EncodeURL | If set to true the URL will be encoded by the component. |
FollowRedirects | Determines what happens when the server issues a redirect. |
GetOn302Redirect | If set to true the component will perform a GET on the new location. |
HTTP2HeadersWithoutIndexing | HTTP2 headers that should not update the dynamic header table with incremental indexing. |
HTTPVersion | The version of HTTP used by the component. |
IfModifiedSince | A date determining the maximum age of the desired document. |
KeepAlive | Determines whether the HTTP connection is closed after completion of the request. |
KerberosSPN | The Service Principal Name for the Kerberos Domain Controller. |
LogLevel | The level of detail that is logged. |
MaxHeaders | Instructs component to save the amount of headers specified that are returned by the server after a Header event has been fired. |
MaxHTTPCookies | Instructs component to save the amount of cookies specified that are returned by the server when a SetCookie event is fired. |
MaxRedirectAttempts | Limits the number of redirects that are followed in a request. |
NegotiatedHTTPVersion | The negotiated HTTP version. |
OtherHeaders | Other headers as determined by the user (optional). |
ProxyAuthorization | The authorization string to be sent to the proxy server. |
ProxyAuthScheme | The authorization scheme to be used for the proxy. |
ProxyPassword | A password if authentication is to be used for the proxy. |
ProxyPort | Port for the proxy server (default 80). |
ProxyServer | Name or IP address of a proxy server (optional). |
ProxyUser | A user name if authentication is to be used for the proxy. |
SentHeaders | The full set of headers as sent by the client. |
StatusLine | The first line of the last response from the server. |
TransferredData | The contents of the last response from the server. |
TransferredDataLimit | The maximum number of incoming bytes to be stored by the component. |
TransferredHeaders | The full set of headers as received from the server. |
TransferredRequest | The full request as sent by the client. |
UseChunkedEncoding | Enables or Disables HTTP chunked encoding for transfers. |
UseIDNs | Whether to encode hostnames to internationalized domain names. |
UsePlatformDeflate | Whether to use the platform implementation to decompress compressed responses. |
UsePlatformHTTPClient | Whether or not to use the platform HTTP client. |
UserAgent | Information about the user agent (browser). |
CloseStreamAfterTransfer | If true, the component will close the upload or download stream after the transfer. |
ConnectionTimeout | Sets a separate timeout value for establishing a connection. |
FirewallAutoDetect | Tells the component whether or not to automatically detect and use firewall system settings, if available. |
FirewallHost | Name or IP address of firewall (optional). |
FirewallListener | If true, the component binds to a SOCKS firewall as a server (IPPort only). |
FirewallPassword | Password to be used if authentication is to be used when connecting through the firewall. |
FirewallPort | The TCP port for the FirewallHost;. |
FirewallType | Determines the type of firewall to connect through. |
FirewallUser | A user name if authentication is to be used connecting through a firewall. |
KeepAliveInterval | The retry interval, in milliseconds, to be used when a TCP keep-alive packet is sent and no response is received. |
KeepAliveTime | The inactivity time in milliseconds before a TCP keep-alive packet is sent. |
Linger | When set to True, connections are terminated gracefully. |
LingerTime | Time in seconds to have the connection linger. |
LocalHost | The name of the local host through which connections are initiated or accepted. |
LocalPort | The port in the local host where the component binds. |
MaxLineLength | The maximum amount of data to accumulate when no EOL is found. |
MaxTransferRate | The transfer rate limit in bytes per second. |
ProxyExceptionsList | A semicolon separated list of hosts and IPs to bypass when using a proxy. |
TCPKeepAlive | Determines whether or not the keep alive socket option is enabled. |
TcpNoDelay | Whether or not to delay when sending packets. |
UseIPv6 | Whether to use IPv6. |
UseNTLMv2 | Whether to use NTLM V2. |
LogSSLPackets | Controls whether SSL packets are logged when using the internal security API. |
ReuseSSLSession | Determines if the SSL session is reused. |
SSLCACerts | A newline separated list of CA certificate to use during SSL client authentication. |
SSLCheckCRL | Whether to check the Certificate Revocation List for the server certificate. |
SSLCipherStrength | The minimum cipher strength used for bulk encryption. |
SSLContextProtocol | The protocol used when getting an SSLContext instance. |
SSLEnabledCipherSuites | The cipher suite to be used in an SSL negotiation. |
SSLEnabledProtocols | Used to enable/disable the supported security protocols. |
SSLEnableRenegotiation | Whether the renegotiation_info SSL extension is supported. |
SSLIncludeCertChain | Whether the entire certificate chain is included in the SSLServerAuthentication event. |
SSLProvider | The name of the security provider to use. |
SSLServerCACerts | A newline separated list of CA certificate to use during SSL server certificate validation. |
SSLTrustManagerFactoryAlgorithm | The algorithm to be used to create a TrustManager through TrustManagerFactory. |
TLS12SignatureAlgorithms | Defines the allowed TLS 1.2 signature algorithms when UseInternalSecurityAPI is True. |
TLS12SupportedGroups | The supported groups for ECC. |
TLS13KeyShareGroups | The groups for which to pregenerate key shares. |
TLS13SignatureAlgorithms | The allowed certificate signature algorithms. |
TLS13SupportedGroups | The supported groups for (EC)DHE key exchange. |
AbsoluteTimeout | Determines whether timeouts are inactivity timeouts or absolute timeouts. |
FirewallData | Used to send extra data to the firewall. |
InBufferSize | The size in bytes of the incoming queue of the socket. |
OutBufferSize | The size in bytes of the outgoing queue of the socket. |
BuildInfo | Information about the product's build. |
GUIAvailable | Tells the component whether or not a message loop is available for processing events. |
LicenseInfo | Information about the current license. |
UseDaemonThreads | Whether threads created by the component are daemon threads. |
UseInternalSecurityAPI | Tells the component whether or not to use the system security libraries or an internal implementation. |