Secrets in Code

You can use the Secret object in your JSON code when you do not want to expose confidential information in the source—for example, the Password field in a connection profile. The value of the secret is obtained from a vault and is resolved during deployment.

You can save secrets in the following vault types:

• Control-M Vault: A secure collection of secrets, defined as name and value pairs, that you manage through Control-M Automation API. For information about managing such secrets, see Secrets Configuration.

  For information about the syntax to reference secrets of this type, see Control-M Vault Secrets.

• External Vault: A secure repository of sensitive information managed by the software vendor of your choice.

  For more information about setting up an integration with an external vault, see Vault Integrations for Secret Management and the linked integration setup page for the relevant third-party vault vendor.

  You can use secrets from your external vaults in password-type fields in

  • Centralized connection profiles of the following types:

    • File Transfer Connection Profiles

    • Application Integrator Connection Profiles

    • Control-M Integrations Connection Profiles

    • Database Management Connection Profiles

  • Run as User Configuration

  For information about the syntax to reference secrets of this type, see External Vault Secrets.

Control-M Vault Secrets

The following syntax is used to reference a secret stored in a Control-M vault:

"<parameter>" :  {"Secret": "<secret name>"}

{
    "Type": "ConnectionProfile:Hadoop",
    "Hive": {
        "Host": "hiveServer",
        "Principal": "a@bc",
        "Port": "1024",
        "User": "emuser",
        "Password": {"Secret": "hive_dev_secret"}
    }
}

For information about managing secrets of this type, see Secrets Configuration.

External Vault Secrets

The following examples show the syntax of references to secrets stored in an external, third-party vault. You can use these secrets in password-type fields in several types of centralized connection profiles—File Transfer connection profiles,connection profiles for plug-ins developed in Control-M Application Integrator (including Control-M Integrations developed by BMC), or database connection profiles. Secrets from an external vault are supported only in centralized connection profiles.

As of Server 9.0.22.100, you can use secrets also in Run as User Configuration.

Examples are available for references to secrets in the following types of supported vaults:

• CyberArk Secrets

• HashiCorp Secrets

• Azure Secrets

CyberArk Secrets

The following example shows an Application Integrator connection profile with two types of CyberArk secrets.

 {
    "NEW-CCP": {
        "Type": "ConnectionProfile:ApplicationIntegrator:AI ainew",
        "Description": "",
        "Centralized": true,
        "AI-RunAs-Pass": {
            "Secret": {
                "Type": "Secret:CyberArkVault:Basic",
                "AppID": "finance",
                "Safe": "financeDept",
                "Folder": "Root",
                "Object": "oracleSalaryService",
                "Reason": "I need it to export salaries for VP"
            }
        },
        "AI-Run As": "",
        "AI-mysecret": {
            "Secret": {
                "Type": "Secret:CyberArkVault:QueryBased",
                "AppID": "finance",
                "Query": "Safe=finDep;title=Sr;Department=IT",
                "Reason": "I need to build a report on salaries from IT"
            }
        }
    }
}

The following table lists the parameters of a CyberArk secret, which enable Control-M Automation API to locate and retrieve the secret from the external vault.

property1=value1;property2=value2;property3=value3

HashiCorp Secrets

The following example shows an Application Integrator connection profile with a HashiCorp secret.

 {
    "NEW-CCP": {
        "Type": "ConnectionProfile:ApplicationIntegrator:AI ainew",
        "Description": "",
        "Centralized": true,
        "AI-RunAs-Pass": {
            "Secret": {
                "Type": "Secret:HashiCorp:Vault",
                "SecretURL": "v1/kv/data/onecm/emuser",
                "Key": "emuser",
                "Application": "finance"
            }
        },
        "AI-Run As": ""
    }
}

The following table lists the parameters of a HashiCorp secret, which enable Control-M Automation API to locate and retrieve the secret from the external vault.

Azure Secrets

The following example shows an Application Integrator connection profile with an Azure secret.

 {
    "NEW-CCP": {
        "Type": "ConnectionProfile:ApplicationIntegrator:AI ainew",
        "Description": "",
        "Centralized": true,
        "AI-RunAs-Pass": {
            "Secret": {
                "Type": "Secret:Azure:KeyVault",
                "VaultName": "finance",
                "SecretName": "emuser",
                "Application": "oracle"
            }
        },
        "AI-Run As": ""
    }
}

The following table lists the parameters of an Azure secret, which enable Control-M Automation API to locate and retrieve the secret from the external vault.