I am investigating ways of working for new AEM as a Cloud Service. One of the common features used in AEM projects was Crypo support that allowed to encrypt any secret as password, API key and keep it in the repository in OSGI config. Usually we shared one crypto key pair for our test envs and then used another keys on stg/prod. Encrypting was done manually on the instance.
Could you please help me and explain how it should be done in AEM as a Cloud ? I can see that local development did not change much but how this should be handled for environments hosted by Adobe (dev/stg/prod) ? In the documentation I see that cloudsetup takes care of automatically reusing the environment-specific CryptoKeybut what is the correct way to encrypt given secret? As I see there is no access to /system/console anymore so I do not see a way to do that.
Hi @krishna_chaita2, thanks for the answer but I am still not sure how this should be handled on AEM as a Cloud environment.
I can configure the key locally and then encrypt secrets using /system/console/crypto on my local instance and resuse this key pair on all development instances that we create manually but how that is related to the key that is used for encryption on AEM as a cloud service dev/stage/prod (I do not see option to use /system/console/crypto to get actual encrypted value).
What steps should be taken to encrypt some API key for prod and put the encrypted value inside the OSGI config that will be later deployed via Cloud manager ? Should it be encrypted separately for author and publish ?
if we configure the crypto keys for the local environment as per the procedure documented in below article that will be enough. It will be taken care of automatically, once your application deployed to the Cloud environment.
If you already validated this procedure and not working, reach out Adobe support through case.