注意：

将密钥从 AWS Secrets Manager 迁移到 VaultOracle Cloud Infrastructure Secrets in Vault 中的 Oracle Cloud Infrastructure Secrets

简介

将密钥从 Amazon Web Services (AWS) 迁移到 Oracle Cloud Infrastructure (OCI) 时的优势：

OCI Vault 中支持的密钥类型

目标

先决条件

将密钥从 AWS 迁移到 OCI

  1. 检索和查看 AWS 密钥。要从 AWS 迁移密钥，请首先确保您具有要传输的密钥列表。在本示例中，我们将迁移两个密钥：awssecret4 和 awssecret5。

    “编辑”按钮

    以下屏幕截图显示了迁移前 AWS Secrets Manager 中的机密。

    “编辑”按钮

    “编辑”按钮

  2. 在 OCI 中创建 Vault 和加密密钥。要设置 OCI Vault 和密钥以加密密钥，请参见 Creating a Master Encryption Key 。

    “编辑”按钮

    “编辑”按钮

  3. 使用 Python 脚本迁移密钥。下载以下 Python 脚本并将其另存为 aws_to_oci_secret_migration.py。该脚本自动执行检索 AWS 密钥并将其存储在 OCI Vault 中的过程。

    注意：将 your_aws_secret1、your_aws_region、your_oci_vault_id 等占位符替换为实际值。指定的前缀将用于在 Vault 中创建密钥，有助于使用脚本隔离密钥创建。

    脚本：

    import boto3  # AWS SDK to interact with AWS services
import oci  # OCI SDK to interact with Oracle Cloud
import base64  # To handle base64 encoding
from botocore.exceptions import ClientError  # For handling errors with AWS

# AWS configuration
AWS_SECRET_NAMES = ["your_aws_secret1", "your_aws_secret2"]  # List of AWS secrets to migrate
AWS_REGION = "your_aws_region"  # AWS region where the secrets are stored

# OCI configuration
VAULT_ID = "your_oci_vault_id"  # OCI Vault ID
COMPARTMENT_ID = "your_oci_compartment_id"  # OCI Compartment ID
KEY_ID = "your_oci_key_id"  # OCI Key ID
OCI_SECRET_NAME_PREFIX = "your_prefix"  # Prefix for the secret names in OCI Vault

def get_aws_secret(secret_name):
    """Retrieve the secret value from AWS Secrets Manager."""
    session = boto3.session.Session()  # Create a session with AWS
    client = session.client(service_name='secretsmanager', region_name=AWS_REGION)  # Create a Secrets Manager client

    try:
        # Get the secret value
        get_secret_value_response = client.get_secret_value(SecretId=secret_name)
        secret = get_secret_value_response['SecretString']  # This is the actual secret data
        return secret
    except ClientError as e:
        print(f"Error retrieving secret from AWS: {e}")  # In case something goes wrong
        return None

def create_oci_secret(secret_content, secret_name):
    """Create a new secret in OCI Vault."""
    config = oci.config.from_file()  # This loads your OCI configuration from ~/.oci/config
    vaults_client = oci.vault.VaultsClient(config)  # Use the VaultsClient to create a secret in OCI Vault

    # Encode secret content to Base64 format
    secret_content_base64 = base64.b64encode(secret_content.encode('utf-8')).decode('utf-8')  # Proper base64 encoding

    try:
        # Creating a new secret in OCI Vault
        create_secret_response = vaults_client.create_secret(
            create_secret_details=oci.vault.models.CreateSecretDetails(
                vault_id=VAULT_ID,
                compartment_id=COMPARTMENT_ID,
                secret_name=secret_name,
                key_id=KEY_ID,
                secret_content=oci.vault.models.Base64SecretContentDetails(
                    content=secret_content_base64,  # Base64 encoded content
                    content_type="BASE64"  # Specifying the content type as BASE64
                ),
                description="Migrated from AWS Secrets Manager"  # A brief description
            )
        )
        print(f"Secret '{secret_name}' successfully created in OCI Vault.")
    except oci.exceptions.ServiceError as e:
        print(f"Error creating secret in OCI Vault: {e}")  # If something goes wrong

def main():
    # Step 1: Retrieve and migrate secrets from AWS Secrets Manager
    for aws_secret_name in AWS_SECRET_NAMES:
        aws_secret_content = get_aws_secret(aws_secret_name)

        if aws_secret_content:
            # Generate OCI secret name based on AWS secret name
            oci_secret_name = f"{OCI_SECRET_NAME_PREFIX}_{aws_secret_name}"
            # Step 2: Create the secret in OCI Vault
            create_oci_secret(aws_secret_content, oci_secret_name)

if __name__ == "__main__":
    main()

  4. 保存脚本后，使用以下命令运行该脚本。

    python3 aws_to_oci_secret_migration.py

    “编辑”按钮

  5. 成功运行脚本后，您可以在 OCI Vault 中验证新创建的密钥。

    “编辑”按钮

    “编辑”按钮

后续步骤

将密钥从 AWS 迁移到 OCI 可帮助您简化运营，尤其是当您将 OCI 用于其他云基础设施时。通过使用 Python 自动化，您可以高效传输密钥，确保密钥安全存储并符合 OCI 的加密标准。

确认

更多学习资源

浏览 docs.oracle.com/learn 上的其他实验室，或者访问 Oracle Learning YouTube 渠道上的更多免费学习内容。此外，请访问 education.oracle.com/learning-explorer 成为 Oracle Learning Explorer。

有关产品文档，请访问 Oracle 帮助中心。