Secrets Manager

• 1: Overview
• 2: How-to guides
• 2.1: Secret Retrieval API Reference
• 3: Release Note

1 - Overview

Service Overview

Secrets Manager is a service that encrypts customers’ sensitive information as Secrets (secure data) and stores and manages it safely. Remove hard-coded sensitive information from the application source code and retrieve it by invoking Secrets stored securely in a Key-Value format. A secret is encrypted with a user‑managed key in conjunction with the Key Management Service and stored securely.

Service Architecture Diagram

Provided features

Secrets Manager provides the following features.

• Secret creation/deletion: Secrets Manager can create, delete, and manage Secrets. * The user stores security (sensitive) information in key/value format in the generated Secret.
• Secret lookup: You can retrieve Secret values based on custom policies and permission settings.
• Label-based version control: When a Secret is modified, you can set a label on the version, which is a snapshot of the uniquely generated data, allowing you to manage Secrets more efficiently.

Component

Secret

It stores sensitive (critical) information as a logical unit, encrypting security information values in Key/Value format with a KMS key.

• A Secret is an object created through the creation of a Secrets Manager product service in the Samsung Cloud Platform Console.

Version

It is a snapshot of unique data that is newly created each time a Secret is modified (the unit that stores the actual value of the Secret).

Label

It is a label or tag attached to a specific version of a Secret (a pointer for referencing a specific version).

Constraints

The limitations of the Secrets Manager service are as follows. Before use, be sure to review the following constraints and incorporate them into your service usage plan.

Preliminary Service

Secrets Manager has no prerequisite services.

2 - How-to guides

Users can create the service by entering the required information for the Secrets Manager service through the Samsung Cloud Platform Console and selecting detailed options.

Create Secrets Manager

You can create and use Secrets Manager in the Samsung Cloud Platform Console.

To create a Secrets Manager, follow these steps.

1. Click the All Services > Security > Secrets Manager menu. 1. Go to the Service Home page of Secrets Manager.

2. On the Service Home page, click the Create Secrets Manager button. 2. Navigate to the Create Secrets Manager page.

3. Create Secrets Manager page, enter the information required to create the service and input additional details.

   • Enter or select the required information in the Service Information Input area.

     Category	required status	Detailed description
     Secret name	Required	Enter the secret name
     type	Required	Select the type to manage encrypted with Secret from the list.
     Key/Value input	Required	Enter a pair of Key/Value for Secret information Click the Add button to add up to 10 entries Click the X icon to delete the entry
     encryption key	Essential	Select the KMS key from the list to encrypt the Secret Select a key created in the KMS service from the list. Or click +Create New to create a KMS key Only KMS keys for encryption/decryption can be selected. The selectable encryption/decryption KMS key types are encryption/decryption (AES-256), encryption/decryption and signing/verification (RSA-2048), and encryption/decryption (ARIA) – three types. When entering Key/Value, input must be within 64 KB; registration is not allowed if the size exceeds this limit. For detailed information on creating KMS keys, see KMS 키 생성하기 for reference
     Public access control	Required	Enter public access allowed IP After entering the IP address, click the Add button to register up to 10 entries Click the Delete All button to remove all IP entries from the list You can register the 0.0.0.0/24 - 0.0.0.0/32 range, but it may be insecure
     Private access control	Selection	Use After selecting, select the resource to allow private access Click the Add button to add an access‑allowed resource If the setting is not enabled, access is allowed for all subnet resources in the same region
     Explanation	Selection	Enter description for Secrets Manager

     Table. Secrets Manager service information input items
   • Enter or select the required information in the Additional Information Input area.

     Category	required status	Detailed description
     tag	Selection	Add Tag Up to 50 per resource can be added After clicking the Add Tag button, input or select Key, Value values

     Table. Secrets Manager additional information input fields

4. Summary Check the detailed information and estimated charges generated in the panel, and click the Create button.

   • Once creation is complete, verify the created resource on the Secrets Manager list page.

Check Secrets Manager detailed information

Secrets Manager can view and edit the complete list of resources and detailed information. Secrets Manager Details page consists of Details, Versions, Tags, Activity History tabs.

To view detailed information about Secrets Manager, follow these steps.

1. All Services > Security > Secrets Manager Click the menu. 1. Go to the Service Home page of Secrets Manager.
2. On the Service Home page, click the Secrets Manager menu. 2. Go to the Secrets Manager List page.
3. On the Secrets Manager List page, click the resource to view its details. 3. Go to the Secrets Manager Details page.
   • Secrets Manager Details At the top of the page, status information and descriptions of additional features are displayed.

     Category	Detailed description
     status	Display the status of Secrets Manager Active: available/enabled To be terminated: scheduled for deletion
     Service termination	Cancel Service button

     Table. Secrets Manager status information and additional features

Detailed Information

Secrets Manager list page allows you to view detailed information of the selected resource and edit the information if necessary.

Version

Secrets Manager list page allows you to use labels to track the version of the selected Secret.

Tag

Secrets Manager list page allows you to view the tag information of the selected resource, and to add, modify, or delete it.

Job History

Secrets Manager list page lets you view the operation history of the selected resource.

Terminate Secrets Manager

You can cancel Secrets Manager that you are not using.

To cancel Secrets Manager, follow the steps below.

1. All Services > Security > Secrets Manager Click the menu. 1. Go to the Service Home page of Secrets Manager.
2. On the Service Home page, click the Secrets Manager menu. 2. Go to the Secrets Manager List page.
3. On the Secrets Manager List page, click the resource to view its details. 3. Go to the Secrets Manager Details page.
4. On the Secrets Manager Details page, click the Cancel Service button. 4. Service Cancellation popup will be opened.
5. Service Cancellation in the popup window, enter the cancellation waiting period, and click the Confirm button.
   • The termination waiting period can be entered within a range of 7 to 30 days.
6. After termination is complete, check on the Secrets Manager List page whether the resource has been terminated.

2.1 - Secret Retrieval API Reference

This user guide explains how to use and invoke the Public/Private endpoints of Secrets Manager.

Pre-configuration for Endpoint Calls

Describes the prerequisite configuration items required when calling the Secrets Manager endpoint.

Register Outbound Rule for Security Group

To call the endpoint, you need to register an outbound rule in the security group.

To register an Outbound Rule for a Security Group, follow the steps below.

1. Click the All Services > Security > Secrets Manager menu. You will be taken to the Service Home page of Secrets Manager.
2. On the Service Home page, click the Secrets Manager menu. You will be taken to the Secrets Manager List page.
3. On the Secrets Manager List page, click the resource whose details you want to view. You will be taken to the Secrets Manager Details page.
4. On the Secrets Manager Details page, check the URL information.
   • You can copy the public/private URL information from the URL field.
5. Use the nslookup command to verify the IP to register in the Security Group.

nslookup <호출할 endpoint url>

6. From Security Group > Security Group List, select the Security Group of the VM for which you want to set access control. Then navigate to the Security Group Details page.
7. In the Security Group Details > Rules tab, click the Add Rule button. When the Add Rule window appears, enter the information below to add a rule.

   Item	Detailed description
   Target input method	CIDR selection
   Target address	Enter the IP address retrieved by nslookup
   type	Select Destination Port/Type then enter protocol information Select TCP among the protocols, and enter 443 in the TCP Destination Port
   direction	Outbound rule Select
   Explanation	Enter the invocation rules for Secrets Manager public/private endpoints

   Table. Input items for adding Security Group rules
8. Security Group rules Verify that the rule you entered in the list has been added.

Register access control for Secrets Manager

You can register public/private access controls for Secrets Manager.

To configure the access control items of Secrets Manager, follow these steps.

1. Click the All Services > Security > Secrets Manager menu. You will be taken to the Service Home page of Secrets Manager.
2. On the Service Home page, click the Secrets Manager menu. You will be taken to the Secrets Manager list page.
3. On the Secrets Manager List page, click the resource to view detailed information. You will be taken to the Secrets Manager Details page.
4. On the Secrets Manager Details page, click the edit icon of Public Access Control to add an allowed IP for Public Endpoint access.
   • Public Access Control Edit Popup window, enter the IP and click the Add button. When the addition is complete, click the Confirm button.
   • For security, we recommend adding a single IP, and you can register up to 10.
   • You can register the 0.0.0.0/24 – 0.0.0.0/32 range, but be careful as it may be insecure.
5. On the Secrets Manager Details page, click the edit icon of Private Access Control to add a VM that allows Private Endpoint access.
   • Private Access Control Edit Popup window, select the resource to allow access and click the Add button. When addition is complete, click the Confirm button.
   • If you do not enable the setting, you can access all subnet resources in the same region.

Calling Secrets Manager API

Describes how to call the Secrets Manager API.

Check the URL information of Secrets Manager

On the All Services > Security > Secrets Manager > Secrets Manager Details page, check the URL information.

• You can copy the public/private URL information from the URL field.

Secrets Manager Retrieval API

get /v1/secret

Description

Secret value lookup

Parameters

Responses

Example HTTP request

Request path

/v1/secret?secretId={secretId}

Request header

"AccessKey = 341g54421b5d67a1gf2b30f1a5415e75",
"SecretKey = 87d5eec6-998h-4933-e865-fd837495je28"

Example HTTP response

Response 200

{
  "status": "success",
  "data": {
    "key": "value"
  },
  "timestamp": "2026-01-20T09:21:18.92730172"
}

3 - Release Note

Secrets Manager