It’s no secret that every developer should be aware of the need to protect sensitive information such as passwords and API keys when building and deploying applications in the cloud.  One of the steps that you should always take to protect these sensitive items is to make sure they are stored in an encrypted manner and are only able to be decrypted by the function or application that uses them. Today we make that task much easier with the launch of Secrets as part of our current Key Management offering on the Oracle Cloud. In this post, I’ll show you how to get started creating your first secret.

Here is a general overview of the steps we’ll take in this post:

Let’s jump right into it!

In order to work with secrets, you’ll need a user that is in a group that has the following policies:

You’ll also need to apply the following service level policies:

The next step is to create a vault if you don’t have one already created. From the burger menu, select ’Security’ -> ‘Key Management’. On the vault list page, click ‘Create Vault’.

In the ‘Create Vault’ dialog, name your vault. If necessary, check ‘Make It A Virtual Private Vault’ (click ‘Learn more’ if you need to understand more about virtual private. Vaults).  Next, click create.

Your vault will initially be in a ‘Creating’ state.

As soon as it is ‘Active’ you can view the vault details.

Now we’ll need to create a Key that will be used to encrypt our secrets. On the vault details page, click ‘Keys’ in the sidebar menu and then click ‘Create Key’.

In the ‘Create Key’ dialog, name your key and choose the key shape algorithm and length.

Once your key is in an ‘Active’ state, move on to creating your secret(s).

Next, click ’Secrets’ in the sidebar and click ‘Create Secret’.

Name your secret, enter a description, and choose the encryption key. At this point, you have two choices. You can enter your key as plain text and have the console base64 encode it for you, or you can choose base64 and enter an encoded value for your secret. For this demo, choose ‘Plain Text’ and enter ‘hunter2’ as the secret contents.

If you prefer working with the CLI, you can also create your secrets via the OCI CLI.  You’ll need the OCID of your vault, key and compartment to do so. Here’s an example of creating a secret in a vault encrypted by my demo-key containing the base64 encoded string “hunter2”:

Once your secret has been created, copy the OCID of the secret and keep it handy for later.

Now let’s create a serverless application and function that will retrieve our password.

Note! This could be a regular microservice using Java or any language that the OCI SDK supports.

Create the serverless application:

Next, create the function. If you’re new to serverless functions on the Oracle Cloud, check out the following videos:

Create your function:

Set the secret OCID into the configuration:

We’ll need to use the OCI SDK, so add the following dependencies:

If you’re using anything above Java 8, don’t forget the following dependency.

Finally, create the handleRequest() method that is invoked when our function is called. We’ll return the decoded and decrypted fake password here for demo purposes, but certainly you’d never do this in a real application, right?  RIGHT??

Deploy the function.

Summary