本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 密钥管理
<a name="secrets-management"></a>

研究与工程工作室使用以下秘密进行维护 AWS Secrets Manager。在创建环境期间，RES 会自动创建密钥。管理员在创建环境时输入的密钥作为参数输入。


| 密钥名称 |  说明  |  已生成的 RES | 管理员已输入 | 
| --- | --- | --- | --- | 
| {{<envname>}}-sso-client-secret | 用于环境的单个 Sign-On OAuth2 客户端密钥 | ✓ |  | 
| {{<envname>}}-vdc-client-secret | VDC ClientSecret | ✓ |  | 
| {{<envname>}}-vdc-client-id | VDC ClientId | ✓ |  | 
| {{<envname>}}-vdc-gateway-certificate-private-key | Self-Signed 域的证书私钥 | ✓ |  | 
| {{<envname>}}-vdc-gateway-certificate-certificate | Self-Signed 域名证书 | ✓ |  | 
| {{<envname>}}-cluster-manager-client-secret | 集群管理器 ClientSecret | ✓ |  | 
| {{<envname>}}-cluster-manager-client-id | 集群管理器 ClientId | ✓ |  | 
| {{<envname>}}-external-private-key | Self-Signed 域的证书私钥 | ✓ |  | 
| {{<envname>}}-external-certificate | Self-Signed 域名证书 | ✓ |  | 
| {{<envname>}}-internal-private-key | Self-Signed 域的证书私钥 | ✓ |  | 
| {{<envname>}}-internal-certificate | Self-Signed 域名证书 | ✓ |  | 
| {{<envname>}}-directoryservice-ServiceAccountUserDN |  ServiceAccount 用户的唯一判别名 (DN) 属性。 | ✓ |  | 

DynamoDB 的`{{<envname>}}-cluster-settings`表中包含以下秘密 ARN 值：


| Key | 来源 | 
| --- | --- | 
| identity-provider.cognito.sso\_client\_secret |  | 
| vdc.dcv\_connection\_gateway.certificate.certificate\_secret\_arn | 堆栈 | 
| vdc.dcv\_connection\_gateway.certificate.private\_key\_secret\_arn | 堆栈 | 
| cluster.load\_balancers.internal\_alb.certificates.private\_key\_secret\_arn | 堆栈 | 
| directoryservice.root\_username\_secret\_arn |  | 
| vdc.client\_secret | 堆栈 | 
| cluster.load\_balancers.external\_alb.certificates.certificate\_secret\_arn | 堆栈 | 
| cluster.load\_balancers.internal\_alb.certificates.certificate\_secret\_arn | 堆栈 | 
| directoryservice.root\_password\_secret\_arn |  | 
| cluster.secretsmanager.kms\_key\_id |  | 
| cluster.load\_balancers.external\_alb.certificates.private\_key\_secret\_arn | 堆栈 | 
| cluster-manager.client\_secret |  |