June 20-22 Announcing HashiConf Europe full schedule: keynotes, sessions, labs & more Register Now
  • Infrastructure
    • terraform
    • packer
  • Networking
    • consul
  • Security
    • vault
    • boundary
  • Applications
    • nomad
    • waypoint
    • vagrant
  • HashiCorp Cloud Platform

    A fully managed platform to automate infrastructure on any cloud with HashiCorp products.

    • consul
    • terraform
    • vault
    • packerbeta
    Visit cloud.hashicorp.com
  • Overview
  • Tutorials
  • Docs
  • API
  • Community
GitHub—Stars on GitHub
Download
    • v0.8.x (latest)
    • v0.7.x
    • v0.6.x
    • v0.5.x
    • v0.4.x
    • v0.3.x
    • v0.2.x
    • v0.1.x
  • What is Boundary?
    • Overview
      • Overview
      • Production
    • Run and Login
    • Connect to Target
    • Overview
    • Non-Dev Environments
    • Systemd Install
    • Postgres Install
    • High Availability Install
    • Reference Architectures
    • Overview
    • API
    • CLI
    • Go SDK
    • Desktop
    • Desktop
    • Overview
    • Service Discovery
      • Overview
        • Overview
        • Assignable Permissions
        • Permission Grant Formats
        • Resource Table
      • Data Encryption
      • Connections/TLS
      • Overview
      • Accounts
      • Auth Methods
      • Credentials
      • Credential Libraries
      • Credential Stores
      • Groups
      • Hosts
      • Host Catalogs
      • Host Sets
      • Managed Groups
      • Scopes
      • Sessions
      • Session Connections
      • Targets
      • Roles
      • Users
      • Overview
      • OIDC Managed Groups
      • Resource Listing
      • Worker Tags
      • Events
    • Overview
    • Building
    • Developing the UI

    • Overview
      • Overview
      • TCP
      • Unix
      • Overview
      • AEAD
      • AWS KMS
      • AliCloud KMS
      • Azure Key Vault
      • GCP Cloud KMS
      • OCI KMS
      • Vault Transit
    • controller
    • worker
      • Overview
      • Common Sink Parameters
      • File Sink
      • Stderr Sink
    • plugins
    • Overview
    • Metrics
    • Health Endpoint
  • Common Workflows
    • Overview
    • Manage Roles
    • Manage Scopes
    • Manage Sessions
    • Manage Targets
    • Manage Users and Groups
    • Workflow SSH Proxy

  • Roadmap
    • Overview
    • v0.8.0
    • v0.7.0
    • v0.6.0
    • v0.5.0
    • v0.4.0
    • v0.3.0
    • v0.2.0
    • v0.1.0
Type '/' to Search

»alicloudkms KMS

The AliCloud KMS configures Boundary to use AliCloud KMS for key management. The AliCloud KMS is activated by one of the following:

  • The presence of a kms "alicloudkms" block in Boundary's configuration file.

»alicloudkms Example

This example shows configuring AliCloud KMS through the Boundary configuration file by providing all the required values:

kms "alicloudkms" {
  purpose    = "root"
  region     = "us-east-1"
  access_key = "0wNEpMMlzy7szvai"
  secret_key = "PupkTg8jdmau1cXxYacgE736PJj4cA"
  kms_key_id = "08c33a6f-4e0a-4a1b-a3fa-7ddfa1d4fb73"
}
kms "alicloudkms" {
  purpose    = "root"
  region     = "us-east-1"
  access_key = "0wNEpMMlzy7szvai"
  secret_key = "PupkTg8jdmau1cXxYacgE736PJj4cA"
  kms_key_id = "08c33a6f-4e0a-4a1b-a3fa-7ddfa1d4fb73"
}

»alicloudkms Parameters

These parameters apply to the kms stanza in the Boundary configuration file:

  • purpose - Purpose of this KMS, acceptable values are: worker-auth, root, recovery, or config.

  • region (string: <required> "us-east-1"): The AliCloud region where the encryption key lives. May also be specified by the ALICLOUD_REGION environment variable.

  • domain (string: "kms.us-east-1.aliyuncs.com"): If set, overrides the endpoint AliCloud would normally use for KMS for a particular region. May also be specified by the ALICLOUD_DOMAIN environment variable.

  • access_key (string: <required>): The AliCloud access key ID to use. May also be specified by the ALICLOUD_ACCESS_KEY environment variable or as part of the AliCloud profile from the AliCloud CLI or instance profile.

  • secret_key (string: <required>): The AliCloud secret access key to use. May also be specified by the ALICLOUD_SECRET_KEY environment variable or as part of the AliCloud profile from the AliCloud CLI or instance profile.

  • kms_key_id (string: <required>): The AliCloud KMS key ID to use for encryption and decryption. May also be specified by the ALICLOUDKMS_WRAPPER_KEY_ID environment variable.

»Authentication

Authentication-related values must be provided, either as environment variables or as configuration parameters.

Note: Although the configuration file allows you to pass in ALICLOUD_ACCESS_KEY and ALICLOUD_SECRET_KEY as part of the 's parameters, it is strongly recommended to set these values via environment variables.

AliCloud authentication values:

* `ALICLOUD_REGION`
* `ALICLOUD_ACCESS_KEY`
* `ALICLOUD_SECRET_KEY`
AliCloud authentication values:

* `ALICLOUD_REGION`
* `ALICLOUD_ACCESS_KEY`
* `ALICLOUD_SECRET_KEY`

Note: The client uses the official AliCloud SDK and will use environment credentials, the specified credentials, or RAM role credentials in that order.

github logoEdit this page
DocsLearnPrivacySecurityPress KitConsent Manager