Creating a Custom Credential

Download

Focus Mode

Font Size

Last updated: 2026-09-07 17:51:23

AI-Translated & Reviewed

This document guides you on how to create custom secrets in the SSM console to securely store and manage sensitive information. After a secret is successfully created, you can perform operations on it, such as enabling, disabling, modifying, scheduling deletion, and rotating.
Operation Steps
1. Log in to the SSM console, and click Custom Secrets in the left sidebar.
2. In the upper-left corner of the Custom Secrets page, select the region where you want to create the secret, and then click New.
3. In the Create Secret window, after completing all configurations, click OK to create the secret.
Configuration Item
﻿
Description
Secret Name
﻿
The unique identifier of the secret. It cannot be duplicated within the same region and cannot be modified after creation.
Filling Rule: Required. The length must be 1–128 bytes. Only letters, digits, hyphens (-), and underscores (_) are allowed. The first character must be a letter or digit.
Secret Version
﻿
The version number corresponding to the current secret content, used for secret updates, canary switching, and version rollback.
Filling Rule: Required. The maximum length is 64 bytes. Only letters, digits, hyphens (-), and underscores (_) are allowed. The first character must be a letter or digit.
Secret Content
﻿
The actual sensitive information that needs to be hosted, such as database account passwords, API keys, tokens, SSH keys, and so on.
Filling Rule: Required. The maximum size supported is 64 KB.
Description information.
﻿
Used to provide supplementary information about the secret, such as its purpose, associated system, usage scenarios, maintainer, and so on.
Filling Rule: Optional. The maximum size supported is 2048 bytes.
Tags
﻿
Used for scenarios such as tag-based authorization, resource classification, and quick filtering.
Filling Rule: Optional.
Encryption Method
KMS Key
A KMS hardware key, generated and stored by a third-party compliant and certified hardware security module (HSM), remains within the HSM hardware throughout its entire lifecycle, cannot be exported from the hardware carrier, and is a hardware-level secure encryption key.
﻿
Software key.
A key generated and stored by the system's built-in standard encryption algorithm, without an independent hardware security carrier. The full lifecycle management of the key is implemented at the software layer and does not rely on KMS key capabilities.
Dedicated KMS
﻿
When you have purchased a dedicated Key Management System (KMS), you can select the dedicated KMS capability to encrypt credentials.
Encryption key.
﻿
If you select KMS key as the encryption method, it indicates that you have enabled the Key Management System. You can create an encryption key using either of the following two methods:
Select the cloud product master key that is created by default in the KMS console as the encryption key, and store it in encrypted form using the envelope encryption scheme.
Create a user key in the KMS console and use it as a custom encryption key for the encrypted storage of credentials.
Note:
If you use a KMS key for encryption, you must activate the KMS service in advance. For details, see the KMS Billing Overview.
Encryption Recommendation: For production environments or scenarios with high compliance requirements, it is recommended to use KMS keys for encryption.
﻿

Help and Support

Was this page helpful?

You can also Contact sales or Submit a Ticket for help.

Help us improve! Rate your documentation experience in 5 mins.

Feedback

tencent cloud

Secrets Manager

Creating a Custom Credential

Operation Steps

Help and Support

Configuration Item			Description
Secret Name			The unique identifier of the secret. It cannot be duplicated within the same region and cannot be modified after creation. Filling Rule: Required. The length must be 1–128 bytes. Only letters, digits, hyphens (-), and underscores (_) are allowed. The first character must be a letter or digit.
Secret Version			The version number corresponding to the current secret content, used for secret updates, canary switching, and version rollback. Filling Rule: Required. The maximum length is 64 bytes. Only letters, digits, hyphens (-), and underscores (_) are allowed. The first character must be a letter or digit.
Secret Content			The actual sensitive information that needs to be hosted, such as database account passwords, API keys, tokens, SSH keys, and so on. Filling Rule: Required. The maximum size supported is 64 KB.
Description information.			Used to provide supplementary information about the secret, such as its purpose, associated system, usage scenarios, maintainer, and so on. Filling Rule: Optional. The maximum size supported is 2048 bytes.
Tags			Used for scenarios such as tag-based authorization, resource classification, and quick filtering. Filling Rule: Optional.
Encryption Method	KMS Key	A KMS hardware key, generated and stored by a third-party compliant and certified hardware security module (HSM), remains within the HSM hardware throughout its entire lifecycle, cannot be exported from the hardware carrier, and is a hardware-level secure encryption key.
		Software key.	A key generated and stored by the system's built-in standard encryption algorithm, without an independent hardware security carrier. The full lifecycle management of the key is implemented at the software layer and does not rely on KMS key capabilities.
Dedicated KMS			When you have purchased a dedicated Key Management System (KMS), you can select the dedicated KMS capability to encrypt credentials.
Encryption key.			If you select KMS key as the encryption method, it indicates that you have enabled the Key Management System. You can create an encryption key using either of the following two methods: Select the cloud product master key that is created by default in the KMS console as the encryption key, and store it in encrypted form using the envelope encryption scheme. Create a user key in the KMS console and use it as a custom encryption key for the encrypted storage of credentials.