Managing secret versions
Secret version control enables you to:
- Create a new version.
- Get information about a version.
- Create a version based on another version.
- Roll back to a version.
- Schedule version deletion.
Creating a new version
- In the management console
, select the folder the secret belongs to. - In the list of services, select Lockbox.
- Click the name of the secret you need.
- Under Versions, click Add version.
- Add the following parameters:
- (Optional) Description: Version description.
- Key: Non-secret name that identifies a value.
- Value: Explicitly represented secret data.
You can create multiple key-value pairs per version.
- Click Add version.
If you don't have Terraform, install it and configure the Yandex Cloud provider.
-
In the configuration file, describe the parameters of the resources you want to create:
terraform { required_providers { yandex = { source = "yandex-cloud/yandex" } } required_version = ">= 0.13" } provider "yandex" { zone = "ru-central1-a" } resource "yandex_lockbox_secret_version" "my_version" { secret_id = "<secret_ID>" entries { key = "<secret_1_key>" text_value = "<secret_1_value>" } entries { key = "<secret_2_key>" text_value = "secret_2_value>" } }
Where:
secret_id
: ID of the secret you are creating a version for. This is a required parameter.entries
: Section with secret parameters. For each secret, create a separateentries
section. It may contain the following parameters:key
: Secret key, which is a non-secret name that identifies a value. This is a required parameter.text_value
: Explicitly represented secret data. This is a required parameter.
You can learn more about the parameters of the
yandex_lockbox_secret_version
resource in Terraform in the provider documentation . -
Create resources:
-
In the terminal, change to the folder where you edited the configuration file.
-
Make sure the configuration file is correct using the command:
terraform validate
If the configuration is correct, the following message is returned:
Success! The configuration is valid.
-
Run the command:
terraform plan
The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contains errors, Terraform will point them out.
-
Apply the configuration changes:
terraform apply
-
Confirm the changes: type
yes
in the terminal and press Enter.
-
This creates a new version of the specified secret. You can check the new version and its configuration using the management console
yc lockbox secret list-versions <secret_ID>
To create a new secret version, use the addVersion REST API method for the Secret resource or the SecretService/AddVersion gRPC API call.
Getting information about a version
- In the management console
, select the folder the secret belongs to. - In the list of services, select Lockbox.
- Click the name of the secret you need.
- Under Versions, you will see a list of all secret versions with information about them.
- Click a version to see the details about its key-value pairs.
To get information about a version, use the listVersions REST API method for the Secret resource or the SecretService/ListVersions gRPC API call.
Creating a version based on another version
- In the management console
, select the folder the secret belongs to. - In the list of services, select Lockbox.
- Click the name of the secret you need.
- Under Versions, click
next to the appropriate version. - Select Create a new version from this one.
- Edit or add the following parameters:
- (Optional) Description: Version description.
- Key: Non-secret name that identifies a value.
- Value: Explicitly represented secret data.
You can create multiple key-value pairs per version.
- Click Add version.
To create a version based on another version, use the addVersion REST API method for the Secret resource or the SecretService/AddVersion gRPC API call.
Changing the current version
- In the management console
, select the folder the secret belongs to. - In the list of services, select Lockbox.
- Click the name of the secret you need.
- Under Versions, click
next to the appropriate version. - Select Set as current version.
- Click Set as current version.
To change the current version, use the addVersion REST API method for the Secret resource or the SecretService/AddVersion gRPC API call and specify the required version.
Scheduling version destruction
- In the management console
, select the folder the secret belongs to. - In the list of services, select Lockbox.
- Click the name of the secret you need.
- Under Versions, click
next to the appropriate version. - Select Schedule destruction.
- Enter the destruction pending period.
- Click Schedule.
If you do not have the Yandex Cloud command line interface yet, install and initialize it.
The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name
or --folder-id
parameter.
-
View a description of the CLI command to schedule version destruction:
yc lockbox secret schedule-version-destruction --help
-
Schedule a version for destruction by specifying the secret name, version ID, and the destruction pending period. For example, 1 week:
168h
:yc lockbox secret schedule-version-destruction <secret_name> \ --version-id <version_ID> \ --pending-period 168h
Result:
id: e6qor8pe3ju7******** secret_id: e6qkkp3k29jf******** created_at: "2023-11-08T13:14:34.676Z" destroy_at: "2023-11-15T17:06:28.795Z" status: SCHEDULED_FOR_DESTRUCTION payload_entry_keys: - secret-key
To schedule a version deletion, use the scheduleVersionDestruction REST API method for the Secret resource or the SecretService/ScheduleVersionDestruction gRPC API call.