Using Secret Manager

Available in VPC

To create and manage secrets in Secret Manager, configure console access permissions first. For details about permissions, see Secret Manager permissions management and the Sub Account user guide.

Secret Manager interface

The Secret Manager interface includes the following components:

Create a secret

To create a secret:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Secret Manager > Secret.
2. In (1) Enter basic secret information, select the secret name and protection key.
3. In (2) Set rotation, choose whether to enable automatic rotation and select the rotation interval and trigger. The rotation interval and trigger are required only when automatic rotation is enabled. If there is no trigger, create a Cloud Functions trigger. For details about creating a trigger, see Cloud Functions - Secret Manager type trigger.
4. Configure the secret in Enter secret value. A secret has key-value properties and is configured in the JSON format. (A secret supports up to 100 key-value pairs, and the maximum secret value size is 10,000 bytes.) Set at least 1 rotation target. For details about rotation targets, see Secret rotation.
5. Review Final confirmation and complete secret creation.

# JSON format example
{
    "cdbUser" : "test",
    "cdbPassword" : "test123",
    "cdbHost" : "db-c89**-**.cdb.ntruss.com",
    "cdbPort" : "3306",
    "cdbDatabase" : "test_db"
}

View secret information

Check the secret list and secret type.

1. In the VPC environment of the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Secret Manager > Secret.
2. When the secret list appears, check the type and name of the secret, or click the secret to see the details.
   
   • Secret name: The unique name of the secret.
   • Status: The status of the secret. For more information, see Manage secret status.
   • Secret ID: The unique identifier of the secret. Used to identify the secret in API calls.
   • Protection key (key tag): The encryption key that protects the secret. It is managed in Key Management Service for encryption and decryption.
     • Default key (Secret Manager Default Key): A key managed directly by Secret Manager for each user. This key is also managed through Key Management Service, but you cannot view or manage it directly.
     • User-managed key (User Managed Key): A key you create and manage directly in Key Management Service. See User-managed key in Key Management Service concepts.
   • Creation date: When the secret was created.
   • Description: Additional information and a description of the secret.

Secret value

A secret contains a password used as a credential. This is called the secret value. Secret values are hidden by default to minimize unintended exposure. To view and edit secret values:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Secret Manager > Secret.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. Click the Secret value tab.
4. Secret values are not displayed by default. To check the secret value, click See secret value.
5. After editing the secret value, click Save to apply your changes.

Secret chain

Secret Manager manages rotated secret values through internal states called stages, based on their rotation history. As rotation progresses, secret values are retained in chronological order. This sequence is called a secret chain.

The ACTIVE stage contains the secret value currently in use. The immediately preceding value is retained in the PREVIOUS stage, and the value before that is retained in the SUSPENDED stage. When a new rotation starts, the newly generated secret value is added to the PENDING stage until rotation completes. This process is called chain shifting.

As shown in the secret chain transition diagram above, PENDING remains empty after rotation completes successfully. Normally, only the ACTIVE stage is used; however, PENDING or PREVIOUS stages may have to be applied depending on the progress of the rotation action. If a secret retrieval call during rotation returns a chain that includes PENDING, you can troubleshoot by retrying values in the order ACTIVE -> PENDING.

View usage logs

All access actions to secrets are saved in Cloud Log Analytics as logs. To view secret usage history:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Secret Manager > Secret.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. Click the Check logs tab.
4. Enter a search period or keyword to search logs.

Manage secret status

Secret status

Secret Manager manages secrets in a series of statuses, from their creation to deletion. The following diagram shows the sequence of secret states, known as the secret lifecycle.

The secret lifecycle includes these states: Initial creation, available, temporarily suspended, rotation in progress, pending deletion, and final deletion. Each status of a secret is described as follows:

• Creation
  When a secret is created, it receives a unique identifier. Its value is encrypted with the designated protection key and saved in encrypted storage. Once creation is complete, the secret automatically becomes available.

• Available
  The secret is operating normally and can be viewed or rotated. You can suspend it temporarily or request to delete it.

• Temporarily suspended
  Use of the secret is temporarily suspended. You cannot change the protection key or view or edit the secret value. In this status, automatic rotation, which requires viewing and editing secret values, is not available either.

• Deletion requested
  Deletion has been requested. The secret is permanently deleted after a 7-day grace period. To delete the secret immediately without a grace period, click Delete immediately. As with a temporarily suspended secret, you cannot change the protection key, view or edit the secret value, or run automatic rotation. You can cancel the deletion request until the secret is permanently deleted. Canceling the request places the secret in the temporarily suspended state.

• Final deletion
  The secret has been permanently deleted. This is a logical state defined by Secret Manager. At the time of deletion, all related information, including the secret value, is deleted and cannot be recovered.

Change secret status

To change the status of a secret:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Secret Manager > Secret.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. Click Suspend using to change the status of an available secret.
4. Click Resume using to change the status of a temporarily suspended secret.

Change the protection key

Secret values are encrypted and protected by designated protection keys. All protection keys are managed in Key Management Service. To change the secret protection key:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Secret Manager > Secret.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. Under Protection key, click Edit.
4. When the available keys are listed, select the key you want to use and click Edit.
5. If you select a user-managed key, delegate permission to use the key for encryption and decryption to Secret Manager.
6. If you need a new key, click Create Key Management Service key and create it in the Key Management Service console.

Secret rotation

To keep secrets secure, rotate them regularly. Secret Manager cannot change your secrets arbitrarily, so rotation is handled by actions you define. When the secret rotation is executed, it renews the property value of the secret set as the Rotation target by default. You can also change other values, but it is not recommended for smooth operation. It is generally recommended to designate only confidential values (such as passwords) that require renewal as the rotation targets. Also, Cloud Functions triggers must be registered to execute the rotation action. For details about creating a secret rotation trigger, see Cloud Functions - Secret Manager type trigger.

For details about the secret rotation process and action definitions, see Secret rotation.

Configure secret rotation

To configure secret rotation:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Secret Manager > Secret.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. You can execute the rotation action periodically by enabling Automatic rotation in the rotation information section. (A trigger must be registered to enable automatic rotation.)
4. When the automatic rotation is enabled, the automatic rotation cycle is set to 90 days by default. To change the rotation interval, click Edit for Automatic rotation cycle.
5. To change the mapped trigger, click Edit for Trigger. However, you cannot change trigger mapping while rotation is in progress.
6. In the Progress status item, the previous rotation execution information is displayed.

Execute secret rotation

Secrets with automatic rotation enabled are rotated automatically. You can also rotate them manually at any time.

To run secret rotation:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Secret Manager > Secret.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. In the Rotation information section, click Execute rotation to run the trigger.

Retry, cancel, and roll back secret rotation

Whether the secret rotation process is completed is determined depending on the secret rotation process strategy. If the final Complete Rotation notification is not received, the rotation action is considered to have failed.

The secret rotation statuses and their features are as follows:

• Normal: You can run the next rotation when the status is Normal. After rotation completes, the secret is updated to the new value, and the former ACTIVE value moves to PREVIOUS. Use Rollback to restore the previously used secret value from PREVIOUS to ACTIVE.
• Rotation in progress: A rotation event has triggered execution, but completion has not yet been reported.
• Rotation failed: If rotation does not complete successfully, the status changes to Rotation failed. You can then select Retry or Cancel action.

Delete a secret

To permanently delete a secret:

1. In the VPC environment of the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Secret Manager > Secret.
2. When the list of secrets appears, click the secret you want to see and check its details.
3. Click Deletion request to request a secret deletion.
4. Enter the secret name and confirm the deletion of the secret.
5. A secret is permanently deleted 7 days after deletion is requested. To delete it immediately without a grace period, click Delete now.