Vaults Manager¶
Use dataikuapi.DSSClient.get_vaults_manager() to obtain a vaults manager
handle. Vault administration requires DSS administrator privileges.
The manager can create definitions for AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager. Authentication settings are represented by provider-specific configuration objects. For example:
from dataikuapi.secretsmanager import (
AWSIAMRoleAuthConfig,
DSSVaultCacheSettings,
)
vaults_manager = client.get_vaults_manager()
vault = vaults_manager.create_aws_secrets_manager_vault(
id="production-aws-vault",
region_or_endpoint="eu-west-1",
auth_config=AWSIAMRoleAuthConfig(
role_arn="arn:aws:iam::123456789012:role/dss-secrets",
),
allowed_remote_secret_identifier_regex="^dss-production-.*",
cache_settings=DSSVaultCacheSettings(max_caching_minutes=5),
)
Use dataikuapi.secretsmanager.secretsmanager.DSSSecretsManager.create_vault_secret()
to create a DSS secret backed by the configured vault:
secrets_manager = client.get_secrets_manager()
secret = secrets_manager.create_vault_secret(
identifier="snowflake-password",
vault_id=vault.id,
remote_secret_identifier="dss-production-snowflake",
)