Note:

Migrate Secrets from AWS Secrets Manager to Oracle Cloud Infrastructure Secrets in Vault

Introduction

Benefits when migrating secrets from Amazon Web Services (AWS) to Oracle Cloud Infrastructure (OCI):

Supported Secret Types in OCI Vault

Objectives

Prerequisites

Migrate Secrets from AWS to OCI

  1. Retrieve and view AWS secrets. To migrate secrets from AWS, first ensure you have a list of the secrets to be transferred. In this example, we are migrating two secrets: awssecret4 and awssecret5.

    Edit button

    The following screenshot shows the secrets in AWS Secrets Manager before migration.

    Edit button

    Edit button

  2. Create a vault and encryption key in OCI. To set up an OCI Vault and key for encrypting secrets, see Creating a Master Encryption Key.

    Edit button

    Edit button

  3. Use Python script to migrate secrets. Download and save the following Python script as aws_to_oci_secret_migration.py. The script automates the process of retrieving AWS secrets and storing them in OCI Vault.

    Note: Replace placeholders like your_aws_secret1, your_aws_region, your_oci_vault_id and so on, with your actual values. The prefix specified will be used to create the secrets in the vault, helping to isolate the creation of secrets using the script.

    Script:

    import boto3  # AWS SDK to interact with AWS services
import oci  # OCI SDK to interact with Oracle Cloud
import base64  # To handle base64 encoding
from botocore.exceptions import ClientError  # For handling errors with AWS

# AWS configuration
AWS_SECRET_NAMES = ["your_aws_secret1", "your_aws_secret2"]  # List of AWS secrets to migrate
AWS_REGION = "your_aws_region"  # AWS region where the secrets are stored

# OCI configuration
VAULT_ID = "your_oci_vault_id"  # OCI Vault ID
COMPARTMENT_ID = "your_oci_compartment_id"  # OCI Compartment ID
KEY_ID = "your_oci_key_id"  # OCI Key ID
OCI_SECRET_NAME_PREFIX = "your_prefix"  # Prefix for the secret names in OCI Vault

def get_aws_secret(secret_name):
    """Retrieve the secret value from AWS Secrets Manager."""
    session = boto3.session.Session()  # Create a session with AWS
    client = session.client(service_name='secretsmanager', region_name=AWS_REGION)  # Create a Secrets Manager client

    try:
        # Get the secret value
        get_secret_value_response = client.get_secret_value(SecretId=secret_name)
        secret = get_secret_value_response['SecretString']  # This is the actual secret data
        return secret
    except ClientError as e:
        print(f"Error retrieving secret from AWS: {e}")  # In case something goes wrong
        return None

def create_oci_secret(secret_content, secret_name):
    """Create a new secret in OCI Vault."""
    config = oci.config.from_file()  # This loads your OCI configuration from ~/.oci/config
    vaults_client = oci.vault.VaultsClient(config)  # Use the VaultsClient to create a secret in OCI Vault

    # Encode secret content to Base64 format
    secret_content_base64 = base64.b64encode(secret_content.encode('utf-8')).decode('utf-8')  # Proper base64 encoding

    try:
        # Creating a new secret in OCI Vault
        create_secret_response = vaults_client.create_secret(
            create_secret_details=oci.vault.models.CreateSecretDetails(
                vault_id=VAULT_ID,
                compartment_id=COMPARTMENT_ID,
                secret_name=secret_name,
                key_id=KEY_ID,
                secret_content=oci.vault.models.Base64SecretContentDetails(
                    content=secret_content_base64,  # Base64 encoded content
                    content_type="BASE64"  # Specifying the content type as BASE64
                ),
                description="Migrated from AWS Secrets Manager"  # A brief description
            )
        )
        print(f"Secret '{secret_name}' successfully created in OCI Vault.")
    except oci.exceptions.ServiceError as e:
        print(f"Error creating secret in OCI Vault: {e}")  # If something goes wrong

def main():
    # Step 1: Retrieve and migrate secrets from AWS Secrets Manager
    for aws_secret_name in AWS_SECRET_NAMES:
        aws_secret_content = get_aws_secret(aws_secret_name)

        if aws_secret_content:
            # Generate OCI secret name based on AWS secret name
            oci_secret_name = f"{OCI_SECRET_NAME_PREFIX}_{aws_secret_name}"
            # Step 2: Create the secret in OCI Vault
            create_oci_secret(aws_secret_content, oci_secret_name)

if __name__ == "__main__":
    main()

  4. Once the script is saved, run it with the following command.

    python3 aws_to_oci_secret_migration.py

    Edit button

  5. After successfully running the script, you can verify the newly created secrets in the OCI Vault.

    Edit button

    Edit button

Next Steps

Migrating secrets from AWS to OCI can help streamline your operations, especially if you are leveraging OCI for the rest of your cloud infrastructure. By using Python automation, you can efficiently transfer secrets, ensuring they are securely stored and compliant with OCI’s encryption standards.

Acknowledgments

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.