Creating a Secrets Manager instance in the UI

To create an instance of Secrets Manager from the IBM Cloud console, complete the following steps.

1. In the console, go to the Secrets Manager offering details page.

2. In the Create tab, select the region that represents the geographic area where you want provision your instance.

3. Review and select a pricing plan.

   You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation.

4. Provide a name for your instance.

5. Select a resource group.

6. Optional: Add tags to help you to organize the instance in your account.

7. Determine an option for enabling customer-managed encryption for your instance.

   You can enhance the security of your secrets at rest by integrating with a key management service. For more information about customer-managed encryption, check out Protecting your sensitive data in Secrets Manager.

   You can also use the Key Management Services All-Inclusive module for streamlined key management. Explore Terraform IBM Modules for more.

8. Determine an option for connecting to Secrets Manager. By default instances of Secrets Manager are created with only a private endpoint.

   Select either private-only or public-and-private. For more information about setting up your account to support the private connectivity option, see Enabling VRF and service endpoints.

9. Click Create to create an instance of Secrets Manager in the account, region, and resource group that you selected.

   To update your service plan after you create an instance, see Updating your service plan.

Creating a Secrets Manager instance from the CLI

To create an instance of Secrets Manager by using the IBM Cloud CLI, complete the following steps.

1. Log in to IBM Cloud through the IBM Cloud CLI.

   ibmcloud login
   

   If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.

2. Select the account, region, and resource group where you want to create a Secrets Manager service instance.

   ibmcloud target -r REGION_NAME -g RESOURCE_GROUP_NAME
   

3. Create an instance of Secrets Manager within that account and resource group.

   ibmcloud resource service-instance-create INSTANCE_NAME secrets-manager PLAN REGION_NAME [OPTIONS]
   

   Description of the information that is required to provision the Secrets Manager service using CLI

   Variable	Description
   Instance name (instance_name)	A unique alias for your service instance.
   Region (region)	The region the instance should be provisioned in. Supported regions.
   Pricing plan (plan)	The pricing plan that you want to use. Usetrial,standard or dedicated.
   Endpoints (options)	Optional. By default instances of Secrets Manager are created with only a private endpoint (private-only). If you need to provision an instance of Secrets Manager that uses also a public endpoint, append the --service-endpoints public-and-private option to your command.
   Encryption (options)	To provision an instance of Secrets Manager that uses customer-managed encryption, append -p '{"kms_key": "<root_key_crn>"}'. Replace <root_key_crn> with the CRN value for the root key that you want to integrate.

   You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation.

   To update your service plan after you create an instance, see Updating your service plan.

For more information on the different available plans, see Feature overview.

Creating a Secrets Manager instance from API

To create an instance of Secrets Manager from API, complete the following steps.

For additional programming languages support, see the Resource Controller API Docs.

1. Obtain an IBM Cloud IAM access token.

2. Run a curl command to provision an instance of Secrets Manager.

   curl -X POST https://resource-controller.cloud.ibm.com/v2/resource_instances -H "Authorization: Bearer <IAM token>" -H 'Content-Type: application/json' -d '{
      "name": "<instance_name>",
      "target": "<region>",
      "resource_group": "<resource_group_id>",
      "resource_plan_id": "<plan>",
      "parameters": {"service-endpoints": "public-and-private","kms_key": "<root_key_crn>"}
   }'
   

   Description of the information that is required to provision the Secrets Manager service using API

   Variable	Description
   Instance name (name)	A unique alias for your service instance.
   Target (region)	The region the instance should be provisioned in. Supported regions.
   Pricing plan (plan)	The pricing plan that you want to use, provided as a plan ID. Use 869c191a-3c2a-4faf-98be-18d48f95ba1f for trial, 7713c3a8-3be8-4a9a-81bb-ee822fcaac3d for standard or dedicated.
   Endpoints	By default instances of Secrets Manager are created with only a private endpoint. If you need to provision an instance of Secrets Manager that uses also a public endpoint, add "service-endpoints":"public-and-private" to parameters.
   Encryption	To provision an instance of Secrets Manager that uses customer-managed encryption, keep the kms_key parameter, and replace <root_key_crn> with the CRN value for the root key that you want to integrate.

   You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation.

   To update your service plan after you create an instance, see Updating your service plan.

For more information on the different available plans, see Feature overview.

Creating a Secrets Manager instance using Terraform

To create an instance of Secrets Manager using Terraform, include the following parameters in your ibm_resource_instance resource for Secrets Manager.

• service: secrets-manager
• plan: either Standard, Trial or dedicated. Learn more about the service plans
• service_endpoints: Either private or public-and-private. If not included, default is private Include the following inside parameters for further customization.
• kms_key: Root key CRN from Key Protect. If not included, default is root key that is managed by Secrets Manager

An example resource would look like the following.

resource "ibm_resource_instance" "sm_instance" {
  name              = "demo-sm-instance"
  service           = "secrets-manager"
  plan              = "standard"
  location          = "us-south"
  service_endpoints = "public-and-private"
}

You can also use the IBM Cloud® Secrets Manager to provision and configure Secrets Manager instances as code. For more information about Terraform IBM Modules, see About Terraform IBM Modules.

For more information on the different available plans, see Feature overview.