AliCloud secrets engine (API)
This is the API documentation for the Vault AliCloud secrets engine. For general information about the usage and operation of the AliCloud secrets engine, please see the Vault AliCloud documentation.
This documentation assumes the AliCloud secrets engine is enabled at the /alicloud
path
in Vault. Since it is possible to enable secrets engines at any location, please
update your API calls accordingly.
Config management
This endpoint configures the root RAM credentials to communicate with AliCloud. AliCloud will use credentials in the following order:
- Environment variables
- A static credential configuration set at this endpoint
- Instance metadata (recommended)
To use instance metadata, leave the static credential configuration unset.
At present, this endpoint does not confirm that the provided AliCloud credentials are valid AliCloud credentials with proper permissions.
Please see the Vault AliCloud documentation for the policies that should be attached to the access key you provide.
Method | Path |
---|---|
POST | /alicloud/config |
GET | /alicloud/config |
Parameters
access_key
(string, required) - The ID of an access key with appropriate policies.secret_key
(string, required) - The secret for that key.
Sample post request
Sample post payload
Sample get response data
Role management
The role
endpoint configures how Vault will generate credentials for users of each role.
Parameters
name
(string, required) – Specifies the name of the role to generate credentials against. This is part of the request URL.remote_policies
(string, optional) - The names and types of a pre-existing policies to be applied to the generate access token. Example: "name:AliyunOSSReadOnlyAccess,type:System".inline_policies
(string, optional) - The policy document JSON to be generated and attached to the access token.role_arn
(string, optional) - The ARN of a role that will be assumed to obtain STS credentials. See Vault AliCloud documentation regarding trusted actors.ttl
(int, optional) - The duration in seconds after which the issued token should expire. Defaults to 0, in which case the value will fallback to the system/mount defaults.max_ttl
(int, optional) - The maximum allowed lifetime of tokens issued using this role.
Method | Path |
---|---|
GET | /alicloud/role |
POST | /alicloud/role/:role_name |
GET | /alicloud/role/:role_name |
DELETE | /alicloud/role/:role_name |
Sample post request
Sample post payload using policies
Sample get role response using policies
Sample post payload using Assume-Role
Sample get role response using Assume-Role
Sample list roles response
Performing a LIST
on the /alicloud/roles
endpoint will list the names of all the roles Vault contains.
Generate RAM credentials
This endpoint generates dynamic RAM credentials based on the named role. This role must be created before queried.
Method | Path |
---|---|
GET | /alicloud/creds/:name |
Parameters
name
(string, required) – Specifies the name of the role to generate credentials against. This is part of the request URL.
Sample request
Sample response for roles using policies
Sample response for roles using Assume-Role