Field | | Description | |
Basic Settings | Secret name | | The unique identifier of the secret. It cannot be duplicated within the same region and cannot be modified after creation. Filling Rule: Required. The length must be 1–128 bytes. Only letters, digits, hyphens (-), and underscores (_) are allowed. The first character must be a letter or digit. |
| Secret type | | Select the database type for which you need to create a database secret. Currently supported: Relational databases: MySQL secrets, TDSQL_C_MySQL secrets, PostgreSQL secrets, SQL Server secrets; Enterprise distributed databases: TDSQL_MySQL secrets NoSQL databases: Redis secrets, MongoDB secrets. |
| Description | | The secret description is used to provide supplementary information about the secret, such as its purpose. Filling Rule: Optional. The maximum size supported is 2048 bytes. |
Database Account Settings | Bound instance | | Select the TencentDB instance for which you need to host the secret. Only the purchased database instances in the current region are displayed. Filling Rule: Required. If the list is empty, refer to Prerequisites to create a database instance first. |
| Username. | | SSM automatically creates an administrator account in the database. The generated username is the username prefix + suffix. During each rotation, two different usernames are swapped. Rule: This field is required. The value must be 1-8 bytes in length, consist of letters, digits, or underscores (_), and start with an uppercase or lowercase letter. |
| Server | | Specify the IP addresses or hosts that are allowed to access the database. This configuration is available only when the secret type is MySQL, PostgreSQL, or TDSQL_MySQL. Rule: You can enter % to represent any host. Multiple hosts can be entered simultaneously and separated by delimiters (such as spaces, line breaks, ; , |). |
| Permission configuration. | | The list of permissions granted to the database instances associated with SSM. |
Configure rotation | Rotation status | | After rotation is enabled, SSM will periodically update the password of the database account. Note: Risk Warning: Do not cache the account passwords from secrets in your business code or any third-party SDKs (which have built-in connection pools). Otherwise, database connection failures may occur. It is recommended to refer to Database Credentials Application to proactively mitigate these risks. |
| Rotation cycle | | Set the cycle interval to 30–365 days. |
| Next rotation Start | | Set the next rotation start time as required. |
Other Settings | Tag | | Used for scenarios such as tag-based authorization, resource classification, and quick filtering. Filling Rule: Optional. |
| EncryptiMode | KMS Key | A KMS hardware key, generated and stored by a third-party compliant and certified hardware security module (HSM), remains within the HSM hardware throughout its entire lifecycle, cannot be exported from the hardware carrier, and is a hardware-level secure encryption key. |
| | Software key. | A key generated and stored by the system's built-in standard encryption algorithm, without an independent hardware security carrier. The full lifecycle management of the key is implemented at the software layer and does not rely on KMS key capabilities. |
| Dedicated KMS | | When you have purchased a dedicated Key Management System (KMS), you can select the dedicated KMS capability to encrypt credentials. |
| Encryption key. | | If you select KMS key as the encryption method, it indicates that you have enabled the Key Management System. You can create an encryption key using either of the following two methods: Select the cloud product master key that is created by default in the KMS console as the encryption key, and store it in encrypted form using the envelope encryption scheme. Create a user key in the KMS console and use it as a custom encryption key for the encrypted storage of credentials. |
Esta página foi útil?
Você também pode entrar em contato com a Equipe de vendas ou Enviar um tíquete em caso de ajuda.
comentários