Managing public endpoint access for Secrets Manager

You can enable or disable the public internet endpoint of your Secrets Manager instance at any time. When the public endpoint is disabled, your instance is accessible only through the private network endpoint. You can re-enable the public endpoint whenever needed.

Before you begin

Before you get started, make sure that you meet the following requirements:

  • You must have the Administrator, Editor, or Operator platform role on the Secrets Manager instance.
  • The instance must exist. Endpoint access can be changed on existing instances only.

Disabling the public endpoint

When the public endpoint is disabled, your instance is accessible only through the private network endpoint:

Disabling the public endpoints by using the console

Use the IBM Cloud console to disable the public endpoint for your instance.

  1. In the IBM Cloud console, navigate to the Resource list and select your Secrets Manager instance.
  2. Locate the endpoint controls based on your plan:
    • For the Trial and Standard plans: From the Resource list, open an instance and click Endpoints from the navigation menu. The private endpoint and public endpoint access controls are displayed. For more information on navigating your instance, see Getting started with Secrets Manager.
    • For the Vault Dedicated plan: Click Overview and go to the Endpoints section. For more information on navigating your instance dashboard, see Setting up your Vault Dedicated instance.
  3. In the Public endpoint access section, click Disable public endpoint.
  4. Wait for the operation to complete. A confirmation message is displayed when the public endpoint is successfully disabled.

After the operation completes, the public endpoint URL is no longer accessible. Your instance can still be reached through the private endpoint.

Disabling the public endpoint by using the CLI

Run the following command, replacing <INSTANCE_NAME_OR_ID> with the name or ID of your Secrets Manager instance.

ibmcloud resource service-instance-update <INSTANCE_NAME_OR_ID> \
  --service-endpoints private-only

You can update both the pricing plan and endpoint access in a single CLI command by passing the -p or --plan-id option alongside --service-endpoints. For more information on plan options, see Secrets Manager plans and features.

The update is asynchronous. To check the status of the operation, run:

ibmcloud resource service-instance <INSTANCE_NAME_OR_ID>

The State field shows active for all instances after provisioning and does not indicate whether the update is complete. Check the Last Operation section instead.

While the update is in progress, the output looks similar to:

...
State:                  active
Last Operation:
                        Status    update in progress
                        Message   Configuring endpoint and plan 66%

When the operation is complete, the Last Operation status changes to update succeeded:

...
State:                  active
Last Operation:
                        Status    update succeeded
                        Message   Configuring endpoint and plan

Disabling the public endpoints by using the API

Send a PATCH request to the Resource Controller API.

curl -X PATCH \
  "https://resource-controller.cloud.ibm.com/v2/resource_instances/<INSTANCE_ID>" \
  -H "Authorization: Bearer <IAM_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "parameters": {
      "service-endpoints": "private-only"
    }
  }'

You can also include resource_plan_id in the request body to update your pricing plan and endpoint access simultaneously.

Enabling the public endpoint

You can re-enable the public endpoint at any time to restore public internet access to your Secrets Manager instance.

Enabling the public endpoints by using the console

Use the IBM Cloud console to enable the public endpoint for your instance.

  1. In the IBM Cloud console, navigate to the Resource list and select your Secrets Manager instance.
  2. Locate the endpoint controls based on your plan:
    • For the Trial and Standard plans: From the Resource list, open an instance and click Endpoints from the navigation menu. For more information on navigating your instance, see Getting started with Secrets Manager.
    • For the Vault Dedicated plan: Click Overview and go to the Endpoints section. For more information on navigating your instance dashboard, see Setting up your Vault Dedicated instance.
  3. In the Public endpoint access section, click Enable public endpoint.
  4. Wait for the operation to complete. A confirmation message is displayed when the public endpoint is successfully enabled.

After you enable a public endpoint, DNS changes can take up to 30 minutes to propagate. During this time, attempts to access the endpoint might fail with a host resolution error, which resolves automatically once propagation is complete.

Enabling the public endpoints by using the CLI

Run the following command, replacing <INSTANCE_NAME_OR_ID> with the name or ID of your Secrets Manager instance.

ibmcloud resource service-instance-update <INSTANCE_NAME_OR_ID> \
  --service-endpoints public-and-private

After you enable a public endpoint, DNS changes can take up to 30 minutes to propagate. During this time, attempts to access the endpoint might fail with a host resolution error, which resolves automatically once propagation is complete.

Enabling the public endpoints by using the API

Send a PATCH request to the Resource Controller API.

curl -X PATCH \
  "https://resource-controller.cloud.ibm.com/v2/resource_instances/<INSTANCE_ID>" \
  -H "Authorization: Bearer <IAM_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "parameters": {
      "service-endpoints": "public-and-private"
    }
  }'

After you enable a public endpoint, DNS changes can take up to 30 minutes to propagate. During this time, attempts to access the endpoint might fail with a host resolution error, which resolves automatically once propagation is complete.

Supported endpoint access values

The CLI and API commands for managing endpoint access are uniform across all plans (Trial, Standard, and Vault Dedicated). The following table lists the accepted values for the --service-endpoints parameter and their effect on endpoint access.

Accepted values for --service-endpoints
Value Result
private-only Disables the public endpoint. Private access only.
public-and-private Enables both public and private endpoints.

The private endpoint is always active and cannot be disabled.

Connecting to a private-only instance

When the public endpoint is disabled, you must connect to your instance through the IBM Cloud private network. For detailed instructions on how to set up private connectivity for your instance, see the following topics:

What to expect

When you update the public endpoint configuration of your instance, keep in mind the following behaviors:

  • The operation is asynchronous and typically completes within a few minutes.
  • While the operation is in progress, the instance remains available through its existing endpoints.
  • Existing secrets and configurations are not affected by changing the endpoint access.
  • Activity Tracker records an event every time the public endpoint is enabled or disabled.

Known limitations

Review the following limitations before managing public endpoint access for your instance.

Private Certificate Engine: AIA URLs in issued certificates

When you configure the Private Certificate Engine, Secrets Manager embeds Authority Information Access (AIA) URLs directly into every leaf certificate it issues. These URLs point to the locations where clients can download the CA chain and Certificate Revocation Lists (CRLs) to validate and check the revocation status of certificates.

If your instance was originally provisioned with the public endpoint enabled, the AIA URLs embedded in already-issued certificates reference the public endpoint. If you later disable the public endpoint, those URLs become unreachable, which can cause:

  • Certificate path validation failures in clients that strictly follow AIA extensions.
  • CRL and OCSP check to fail, which might result in revocation-checking errors, depending on the client's policy (fail-open versus fail-closed).

To avoid these issues, follow these recommendations:

  • If you plan to disable the public endpoint, configure the Private Certificate Engine with AIA URLs that reference the private endpoint before issuing any certificates.
  • Certificates issued before the AIA configuration is updated to use the private endpoint URL must be reissued.
  • Clients that do not strictly enforce CRL or OCSP validation are not affected.

Event notification URL fields

Event notifications sent by Secrets Manager include two URL fields: source_instance_api_private_url and source_instance_api_public_url.

Event notification URL fields
Field Description
source_instance_api_private_url The private endpoint URL of the instance.
source_instance_api_public_url Intended to be the public endpoint URL; however, this field currently always returns the private endpoint URL regardless of whether the public endpoint is enabled or disabled.

Due to a known limitation, the source_instance_api_public_url field is always present in event notification payloads. If your instance has the public endpoint that is disabled, do not rely on this field to reach your instance; use source_instance_api_private_url instead.

Next steps