Database Secret Rotation without Wallet Function

Permissions

Running a function requires certain IAM policies.

For the Database Secret Rotation without Wallet function, you have to create a dynamic group and configure an IAM policy to allow the Secret Rotation Service to invoke the function. To set the proper policies, perform the following steps:

• Create a dynamic group with the rule:

  resource.type='vaultsecret'

  This rule includes all vault secrets in the dynamic group. You can limit which vault secret is included in the dynamic group by using a more restrictive rule. For example:

  resource.id='<secret-id>'

• Configure an IAM policy that enables the resources included in the dynamic group to invoke functions. For example:

  Allow dynamic-group <vs-dynamic-group-name> to manage functions-family in tenancy

  Note
  
  Replace <vs-dynamic-group-name> with the name of the dynamic group that you created for the vault secret.

In addition, if you selected the Do not create a dynamic group and IAM policy option when creating the function, you must define the dynamic group and the IAM policy yourself to enable the function to manage secrets. To set the proper policies, perform the following steps:

• Create a dynamic group with the rule:

  resource.type='fnfunc'

  This rule includes all functions in the dynamic group. You can limit which function is included in the dynamic group by using a more restrictive rule. For example:

  resource.id='<function-ocid>'

• Configure an IAM policy using the dynamic group:

  Allow dynamic-group <dynamic-group-name> to manage secret-family in tenancy

  You can limit which vault secrets the function can manage by using a more restrictive policy. For example:

  Allow dynamic-group <dynamic-group-name> to manage secret-family in compartment <compartment-name> where target.secret.id = "<secret-ocid>"

Invoking This Function

The function created using this PBF would be invoked by the Secret Service to rotate the secret.

1. Create a function using this PBF and copy the function ID.
2. 1. Open the navigation menu, select Identity & Security, and then select Vault.
   2. Under List scope, select a compartment that contains the secrets that you have created in a vault.
   3. From the list of secrets, select a secret name that you require to rotate using this PBF, or create a new secret.

      • To create a new secret, see Create a secret.
      • To update an existing secret, see Update a secret.
3. Select Target system type as Function for rotations.
4. Add the function ID copied from step 1 as the Target system ID.
5. Ensure that the secret follows these requirements:
   • The first version of the secret must be manually created. Select Manual Secret Generation with the secret content in the following JSON format:

     {
      "username": "<required: username>",
      "password": "<required: password>",
      "connectionString": "<required: DB connection string>"
     }

   • The password has to be the same password that is set for the database to be rotated.
   • After successful creation of the secret, Automatic Secret Generation has to be enabled so that subsequent secret versions can be auto-generated by the Secret Service.
   • Edit the newly created secret, enable Automatic Secret Generation, and provide the secret content in the following JSON format:

     {
      "username": "<required: username>",
      "password": "%GENERATED_PASSPHRASE%",
      "connectionString": "<required: DB connection string>"
     }
     

   • In Automatic Secret Generation, password is given as %GENERATED_PASSPHRASE% so that the Secret Service can auto-generate the password in this field.
   • Username and password must establish a connection with the database using the format: jdbc:oracle:thin:@<connectionString>?user=<username>&password=<example-password>
   • Ensure to use TLS connection.
     Note
     
     This function isn't compatible with MTLS connection.

Troubleshooting

For example, a log entry for the Database Secret Rotation without Wallet pre-built function looks similar to the following:

"PBF | Database Secret Rotation without Wallet | INFO | 2024-01-31T18:06:50.809Z | Fetching details from Events JSON"