Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
BedrockMission!

Learn more

View all

Sign in to view all badges

SOLVED

AEM as a Cloud service - Crypto support

bartek__w
Level 2
Level 2

Hi,

 

I am investigating ways of working for new AEM as a Cloud Service. One of the common features used in AEM projects was Crypo support that allowed to encrypt any secret as password, API key and keep it in the repository in OSGI config. Usually we shared one crypto key pair for our test envs and then used another keys on stg/prod. Encrypting was done manually on the instance.

 

Could you please help me and explain how it should be done in AEM as a Cloud ? I can see that local development did not change much but how this should be handled for environments hosted by Adobe (dev/stg/prod) ? In the documentation I see that cloudsetup takes care of automatically reusing the environment-specific CryptoKey but what is the correct way to encrypt given secret? As I see there is no access to /system/console anymore so I do not see a way to do that.

 

Thanks for your help,

Cheers

 
AEM cloud manager cloud service crypto osgi
1 Accepted Solution
jbrar
Correct answer by
Employee
Employee

I would recommend logging a support ticket in this case. The support team can reach out to Adobe Engineering for detailed explanation

View solution in original post

4 Replies
krishna_chaita2
Level 3
Level 3

@bartek__w 

 

if we configure the crypto keys for the local environment as per the procedure documented in below article that will be enough. It will be taken care of automatically, once your application deployed to the Cloud environment.

If you already validated this procedure and not working,  reach out Adobe support through case.

 

Crypto key configuration Procedure

https://experienceleague.adobe.com/docs/experience-manager-cloud-service/implementing/developing/aem...

 

Adobe AEM Support Help document.

https://helpx.adobe.com/enterprise/admin-guide.html/enterprise/using/support-for-experience-cloud.ug...

 

Thanks

K Chaitanya

bartek__w
Level 2
Level 2

Hi @krishna_chaita2, thanks for the answer but I am still not sure how this should be handled on AEM as a Cloud environment. 

 

I can configure the key locally and then encrypt secrets using /system/console/crypto on my local instance and resuse this key pair on all development instances that we create manually but how that is related to the key that is used for encryption on AEM as a cloud service dev/stage/prod (I do not see option to use /system/console/crypto to get actual encrypted value).

 

What steps should be taken to encrypt some API key for prod and put the encrypted value inside the OSGI config that will be later deployed via Cloud manager ? Should it be encrypted separately for author and publish ?

 

jbrar
Correct answer by
Employee
Employee

I would recommend logging a support ticket in this case. The support team can reach out to Adobe Engineering for detailed explanation

View solution in original post

bartek__w
Level 2
Level 2

I found another documentation that states that on envs managed via Cloud Manager a special env-related variables can be used for secrets and regular configurations like.

 

{
"connection.timeout": 1000,
"api-key": "$[secret:server-api-key]",
"url": "$[env:server-url]"
}

 

So I far as I understand this is a way to go. On local/on prem envs used for develpmnet a shared crypto key could be used to keep all secrets safe.