AEM as a Cloud service - Crypto support | Community
Skip to main content
B
bartek__w
Level 2
May 3, 2021
Solved

AEM as a Cloud service - Crypto support

  • May 3, 2021
  • 5 replies
  • 5770 views

Hi,

 

I am investigating ways of working for new AEM as a Cloud Service. One of the common features used in AEM projects was Crypo support that allowed to encrypt any secret as password, API key and keep it in the repository in OSGI config. Usually we shared one crypto key pair for our test envs and then used another keys on stg/prod. Encrypting was done manually on the instance.

 

Could you please help me and explain how it should be done in AEM as a Cloud ? I can see that local development did not change much but how this should be handled for environments hosted by Adobe (dev/stg/prod) ? In the documentation I see that cloudsetup takes care of automatically reusing the environment-specific CryptoKey but what is the correct way to encrypt given secret? As I see there is no access to /system/console anymore so I do not see a way to do that.

 

Thanks for your help,

Cheers

 
This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by user05162

I would recommend logging a support ticket in this case. The support team can reach out to Adobe Engineering for detailed explanation

5 replies

K
krishna_chaita2
Level 3
May 4, 2021

@bartek__w 

 

if we configure the crypto keys for the local environment as per the procedure documented in below article that will be enough. It will be taken care of automatically, once your application deployed to the Cloud environment.

If you already validated this procedure and not working,  reach out Adobe support through case.

 

Crypto key configuration Procedure

https://experienceleague.adobe.com/docs/experience-manager-cloud-service/implementing/developing/aem-as-a-cloud-service-sdk.html?lang=en#developing

 

Adobe AEM Support Help document.

https://helpx.adobe.com/enterprise/admin-guide.html/enterprise/using/support-for-experience-cloud.ug.html

 

Thanks

K Chaitanya

    B
    bartek__wAuthor
    Level 2
    May 4, 2021

    Hi @krishna_chaita2, thanks for the answer but I am still not sure how this should be handled on AEM as a Cloud environment. 

     

    I can configure the key locally and then encrypt secrets using /system/console/crypto on my local instance and resuse this key pair on all development instances that we create manually but how that is related to the key that is used for encryption on AEM as a cloud service dev/stage/prod (I do not see option to use /system/console/crypto to get actual encrypted value).

     

    What steps should be taken to encrypt some API key for prod and put the encrypted value inside the OSGI config that will be later deployed via Cloud manager ? Should it be encrypted separately for author and publish ?

     

      U
      Adobe Employee
      user05162Adobe EmployeeAccepted solution
      Adobe Employee
      May 4, 2021

      I would recommend logging a support ticket in this case. The support team can reach out to Adobe Engineering for detailed explanation

        B
        bartek__wAuthor
        Level 2
        May 6, 2021

        I found another documentation that states that on envs managed via Cloud Manager a special env-related variables can be used for secrets and regular configurations like.

         

        { "connection.timeout": 1000, "api-key": "$[secret:server-api-key]", "url": "$[env:server-url]" }

         

        So I far as I understand this is a way to go. On local/on prem envs used for develpmnet a shared crypto key could be used to keep all secrets safe. 

          S
          sdouglasmcSonova
          November 10, 2021

          ^^ is the way.

          T
          tushr2187
          April 8, 2022

          Do we have any official reply from Adobe team on this topic?

          @kautuk_sahni 

          Terms & ConditionsAccessibility statement

          Loading footer...