CLI Reference - Rotated Secrets

This section outlines the CLI commands relevant to Rotated Secrets.

Rotated Secrets enable you to protect the credentials for privileged-user accounts such as an Administrator account on a Windows Server, a root account on a Linux server, or an Admin account on a network device, by resetting its password.

General Flags

--profile, --token: Use a specific profile (located at $HOME/.akeyless/profiles) or a temporary access token

--uid-token: The universal identity token, required only for universal_identity authentication

-h, --help: Display help information

--json[=false]: Set the output format to JSON

--jq-expression: Provide a jQuery expression to filter result output

--no-creds-cleanup[=false]: Do not clean local temporary expired credentials

`create`

akeyless rotated-secret create

Commands to create a Rotated Secret

Subcommands

aws: Creates a new AWS rotated secret item

azure: Creates a new Azure rotated secret item

cassandra: Creates a new Cassandra rotated secret item

custom: Creates a new custom rotated secret item

dockerhub: Creates a new Docker Hub rotated secret item

gcp: Creates a new GCP rotated secret item.

hanadb: Creates a new SAP HANA database rotated secret item

ldap: Creates a new LDAP rotated secret item

mongodb: Creates a new MongoDB rotated secret item

mssql: Creates a new MSSQL rotated secret item

mysql: Creates a new MySQL rotated secret item

oracledb: Creates a new OracleDB rotated secret item

postgresql: Creates a new PostgreSQL rotated secret item

redis: Creates a new Redis rotated secret item

redshift: Creates a new Amazon Redshift rotated secret item

snowflake: Creates a new Snowflake rotated secret item

ssh: Creates a new SSH rotated secret item

windows: Creates a new Windows rotated secret item

`aws`

Creates a new AWS rotated secret item

Usage

akeyless rotated-secret create aws \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>' \
--rotator-type <target/api-key>

Flags

-n, --name: Required, Rotated Secret name

--target-name: Required, the target name to associate

--rotator-type: Required, The rotator type. options: [target/api-key]

--api-id: API ID to rotate (relevant only for rotator-type=api-key)

--api-key: API Key to rotate (relevant only for rotator-type=api-key)

-u, --gateway-url[=http://localhost:8000]: API Gateway URL (Configuration Management port)

-k, --key: The name of a key that is used to encrypt the secret value (if empty, the account default protection key will be used)

--auto-rotate: Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation

--rotation-interval: The number of days to wait between every automatic rotation (1-365), custom rotator interval will be set in minutes

--rotation-hour: The Hour of the rotation in UTC

--rotation-event-in: How many days before auto rotation of the item would you like to be notified. To specify multiple events, use argument multiple times: --rotation-event-in 1 --rotation-event-in 5

--authentication-credentials[=use-user-creds]: The credentials to connect with use-user-creds or use-target-creds

--password-length: The length of the password to be generated

--max-versions: Set the maximum number of versions, limited by the account settings defaults.

--grace-rotation: A boolean flag, when enabled, a graceful mode of rotation will be conducted, where only the older AWS Access Key will be rotated. When there is only one Access Key, a new version will be created - to maintain 2 values at the same time, following AWS best practice.

--grace-rotation-interval: The number of days to wait before deleting the old key (must be bigger than rotation-interval)

--grace-rotation-hour: The number of hours of grace rotation allowed in UTC

--secure-access-enable: Enable/Disable Secure Remote Access, [true/false]

--rotate-after-disconnect[=false]: Rotate the value of the secret after the SRA session ends [true/false]

--secure-access-bastion-issuer: Path to the SSH Certificate Issuer for your Akeyless Bastion

--secure-access-aws-account-id: The AWS account ID

--aws-region[=us-east-2]: AWS region

--secure-access-aws-native-cli: The AWS native CLI

-t, --tag: Add tags attached to this object. To specify multiple tags use the argument multiple times: --tag Tag1 -t Tag2

--delete-protection: Protection from accidental deletion of this item, [true/false]

`azure`

Creates a new Azure rotated secret item

Usage

akeyless rotated-secret create azure \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>' \
--rotator-type <target|api-key|azure-storage-account|password>

Flags

-n, --name: Required, Rotated Secret name

--target-name: Required, the target name to associate

--rotator-type: Required, The rotator type. options: [target/api-key/azure-storage-account/password]

--app-id: ID of the Azure app that holds the secret to be rotated (relevant only for rotator-type=api-key & authentication-credentials=use-target-creds)

--api-id: API ID to rotate (relevant only for rotator-type=api-key)

--api-key: API Key to rotate (relevant only for rotator-type=api-key)

--storage-account-key-name: The name of the Storage Account key to rotate [key1/key2/kerb1/kerb2] (relevant to azure-storage-account)

--username: The user principal name to rotate his password (relevant only for rotator-type=password)

--explicitly-set-sa[=false]: If set, explicitly provide the Storage Account details [true/false]

--resource-group-name: The resource group name (only relevant when explicitly-set-sa=true)

--resource-name: The name of the Storage Account (only relevant when explicitly-set-sa=true)

--secure-access-disable-concurrent-connections[=false]: Enable this flag to prevent simultaneous use of the same secret

-u, --gateway-url[=http://localhost:8000]: API Gateway URL (Configuration Management port)

-k, --key: The name of a key that is used to encrypt the secret value (if empty, the account default protection key will be used)

--auto-rotate: Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation

--rotation-interval: The number of days to wait between every automatic rotation (1-365), custom rotator interval will be set in minutes

--rotation-hour: The Hour of the rotation in UTC

--authentication-credentials[=use-user-creds]: The credentials to connect with use-user-creds or use-target-creds

--password-length: The length of the password to be generated

--max-verisons: Set the maximum number of versions, limited by the account settings defaults

-t, --tag: Add tags attached to this object. To specify multiple tags use the argument multiple times: --tag Tag1 -t Tag2

--delete-protection: Protection from accidental deletion of this item, [true/false]

`cassandra`

Creates a new Cassandra rotated secret item

Usage

 akeyless rotated-secret create cassandra \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>' \
--rotator-type <target/password>

Flags

-n, --name: Required, Rotated Secret name

--target-name: Required, the target name to associate

--rotator-type: Required, The rotator type. options: [target/password]

--rotated-username: Username to be rotated, if selected use-self-creds at rotator-creds-type, this username will try to rotate its password, if use-target-creds is selected, target credentials will be used to rotate the rotated password (relevant only for rotator-type=password)

--rotated-password: Rotated-username password (relevant only for rotator-type=password)

-u, --gateway-url[=http://localhost:8000]: API Gateway URL (Configuration Management port)

-k, --key: The name of a key that is used to encrypt the secret value (if empty, the account default protection key will be used)

--auto-rotate: Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation

--rotation-interval: The number of days to wait between every automatic rotation (1-365), custom rotator interval will be set in minutes

--rotation-hour: The Hour of the rotation in UTC

--authentication-credentials[=use-user-creds]: The credentials to connect with use-user-creds or use-target-creds

--password-length: The length of the password to be generated

-t, --tag: Add tags attached to this object. To specify multiple tags use the argument multiple times: --tag Tag1 -t Tag2

--delete-protection: Protection from accidental deletion of this item, [true/false]

`custom`

Creates a new custom rotated secret item

Usage

akeyless rotated-secret create custom \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>'

Flags

-n, --name: Required, Rotated Secret name

--target-name: Required, the target name to associate

--custom-payload: Secret payload to be sent with rotation request

--password-policy-contains-capital-letters: Password must contain capital letters [true/false]

--password-policy-contains-lower-letters: Password must contain lower case letters [true/false]

--password-policy-contains-numbers: Password must contain numbers [true/false]

--password-policy-contains-special-characters: Password must contain special characters [true/false]

--enable-password-policy: Enable password policy

-u, --gateway-url[=http://localhost:8000]: API Gateway URL (Configuration Management port)

-k, --key: The name of a key that is used to encrypt the secret value (if empty, the account default protection key will be used)

--auto-rotate: Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation

--rotation-interval: The number of days to wait between every automatic rotation (1-365), custom rotator interval will be set in minutes

--rotation-hour: The Hour of the rotation in UTC

--authentication-credentials[=use-user-creds]: The credentials to connect with use-user-creds or use-target-creds

--password-length: The length of the password to be generated

--max-versions: Set the maximum number of versions, limited by the account settings defaults

--timeout-sec[=40]: Maximum allowed timeout in seconds for the custom rotator to return the results

--secure-access-enable: Enable/Disable Secure Remote Access, [true/false]

--rotate-after-disconnect[=false]: Rotate the value of the secret after SRA session ends [true/false]

--secure-access-bastion-issuer: Path to the SSH Certificate Issuer for your Akeyless Bastion

--secure-access-web[=false]: Enable Web Secure Remote Access

--secure-access-web-browsing[=false]: Secure browser via Akeyless Web Access Bastion

--secure-access-web-proxy[=false]: Web-Proxy via Akeyless Web Access Bastion

--secure-access-host: Target servers for connections, For multiple values repeat this flag. (In case of Linked Target association, host(s) will inherit Linked Target hosts - Relevant only for Dynamic Secrets/producers)

--secure-access-rdp-domain: Required when the Dynamic Secret is used for a domain user

--secure-access-rdp-user: Override the RDP Domain username

--secure-access-allow-external-user[=false]: Allow providing external user for a domain users

--secure-access-url: Destination URL to inject secrets

--secure-access-ssh-user: Override the SSH username as indicated in SSH Certificate Issuer

-t, --tag: Add tags attached to this object. To specify multiple tags use the argument multiple times: --tag Tag1 -t Tag2

--delete-protection: Protection from accidental deletion of this item, [true/false]

`dockerhub`

Creates a new Docker Hub rotated secret item

Usage

akeyless rotated-secret create dockerhub \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>'

Flags

-n, --name: Required, Rotated Secret name

--target-name: Required, the target name to associate

-u, --gateway-url[=http://localhost:8000]: API Gateway URL (Configuration Management port)

-k, --key: The name of a key that is used to encrypt the secret value (if empty, the account default protection key will be used)

--auto-rotate: Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation

--rotation-interval: The number of days to wait between every automatic rotation (1-365), custom rotator interval will be set in minutes

--rotation-hour: The Hour of the rotation in UTC

--authentication-credentials[=use-user-creds]: The credentials to connect with use-user-creds or use-target-creds

--password-length: The length of the password to be generated

-t, --tag: Add tags attached to this object. To specify multiple tags use the argument multiple times: --tag Tag1 -t Tag2

`gcp`

Creates a new GCP rotated secret item

Usage

akeyless rotated-secret create gcp \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>' \
--rotator-type <target/service-account-rotator>

Flags

-n, --name: Required, Rotated Secret name

--target-name: Required, the target name to associate

--rotator-type: Required, The rotator type. options: [target/service-account-rotator]

-u, --gateway-url[=http://localhost:8000]: API Gateway URL (Configuration Management port)

--gcp-key-file-path: Path to file with the service account private key

--gcp-key: Base64-encoded service account private key text

--gcp-service-account-email: The email of the GCP service account to rotate (relevant only when rotator-type=servcie-account-rotator)

--gcp-service-account-key-id: The key ID of the GCP service account to rotate (relevant only when rotator-type=servcie-account-rotator)

-k, --key: The name of a key that is used to encrypt the secret value (if empty, the account default protection key will be used)

--auto-rotate: Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation

--rotation-interval: The number of days to wait between every automatic rotation (1-365), custom rotator interval will be set in minutes

--rotation-hour: The Hour of the rotation in UTC

--grace-rotation: A boolean flag, when enabled, a graceful mode of rotation will be conducted, where only the older service account key will be rotated. When there is only one key, a new version will be created to maintain 2 values at the same time.

--grace-rotation-interval: The number of days to wait before deleting the old key (must be bigger than rotation-interval)

--grace-rotation-hour: The number of hours of grace rotation allowed in UTC

--authentication-credentials[=use-user-creds]: The credentials to connect with use-user-creds or use-target-creds

--password-length: The length of the password to be generated

--max-versions: Set the maximum number of versions, limited by the account settings defaults

-t, --tag: Add tags attached to this object. To specify multiple tags use the argument multiple times: --tag Tag1 -t Tag2

--delete-protection: Protection from accidental deletion of this item, [true/false]

`hanadb`

Creates a new SAP HANA database rotated secret item

Usage

akeyless rotated-secret create hanadb \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>' \
--rotator-type <target/password>

Flags

-n, --name: Required, Rotated Secret name

--target-name: Required, the target name to associate

--rotator-type: Required, The rotator type. options: [target/password]

--rotated-password: Rotated-username password (relevant only for rotator-type=password)

-k, --key: The name of a key that is used to encrypt the secret value (if empty, the account default protection key will be used)

--auto-rotate: Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation

--rotation-interval: The number of days to wait between every automatic rotation (1-365), custom rotator interval will be set in minutes

--rotation-hour: The Hour of the rotation in UTC

--authentication-credentials[=use-user-creds]: The credentials to connect with use-user-creds or use-target-creds

--password-length: The length of the password to be generated

-t, --tag: Add tags attached to this object. To specify multiple tags use the argument multiple times: --tag Tag1 -t Tag2

--delete-protection: Protection from accidental deletion of this item, [true/false]

`ldap`

Creates a new LDAP rotated secret item

Usage

akeyless rotated-secret create ldap \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>' \
--rotator-type <target/ldap>

Flags

-n, --name: Required, Rotated Secret name

--target-name: Required, the target name to associate

--rotator-type: Required, The rotator type. options: [target/ldap]

--rotated-password: Rotated-username password (relevant only for rotator-type=ldap)

--user-dn: Base DN to Perform User Search

--user-attribute: LDAP User Attribute, Default value cn

-u, --gateway-url[=http://localhost:8000]: API Gateway URL (Configuration Management port)

-k, --key: The name of a key that is used to encrypt the secret value (if empty, the account default protection key will be used)

--auto-rotate: Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation

--rotation-interval: The number of days to wait between every automatic rotation (1-365), custom rotator interval will be set in minutes

--rotation-hour: The Hour of the rotation in UTC

--authentication-credentials[=use-user-creds]: The credentials to connect with use-user-creds or use-target-creds

--password-length: The length of the password to be generated

--grace-rotation: Create a new access key without deleting the old key from AWS for backup (relevant only for AWS) [true/false]

--secure-access-enable: Enable/Disable Secure Remote Access, [true/false]

--rotate-after-disconnect[=false]: Rotate the value of the secret after the SRA session ends [true/false]

--secure-access-rdp-domain: Required when the Dynamic Secret is used for a domain user

--secure-access-web[=false]: Enable Web Secure Remote Access

--secure-access-url: Destination URL to inject secrets

--host-provider[=explicit]: Host provider type [explicit/target], Relevant only for Secure Remote Access of SSH cert issuer and LDAP rotated secret

--target: A list of linked targets to be associated, Relevant only for Secure Remote Access for SSH cert issuer and LDAP rotated secret, To specify multiple targets use argument multiple times

-t, --tag: Add tags attached to this object. To specify multiple tags use the argument multiple times: --tag Tag1 -t Tag2

--delete-protection: Protection from accidental deletion of this item, [true/false]

`mongodb`

Creates a new MongoDB rotated secret item

Usage

akeyless rotated-secret create mongodb \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>' \
--rotator-type <target/password>

Flags

-n, --name: Required, Rotated Secret name

--target-name: Required, the target name to associate

--rotator-type: Required, The rotator type. options: [target/password]

--rotated-password: Rotated-username password (relevant only for rotator-type=password)

-u, --gateway-url[=http://localhost:8000]: API Gateway URL (Configuration Management port)

-k, --key: The name of a key that is used to encrypt the secret value (if empty, the account default protection key will be used)

--auto-rotate: Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation

--rotation-interval: The number of days to wait between every automatic rotation (1-365), custom rotator interval will be set in minutes

--rotation-hour: The Hour of the rotation in UTC

--authentication-credentials[=use-user-creds]: The credentials to connect with use-user-creds or use-target-creds

--password-length: The length of the password to be generated

--secure-access-enable: Enable/Disable Secure Remote Access, [true/false]

--rotate-after-disconnect[=false]: Rotate the value of the secret after the SRA session ends [true/false]

--secure-access-db-name: The DB name (relevant only for DB)

--secure-access-web[=false]: Enable Web Secure Remote Access

--secure-access-bastion-issuer: Path to the SSH Certificate Issuer for your Akeyless Bastion

-t, --tag: Add tags attached to this object. To specify multiple tags use the argument multiple times: --tag Tag1 -t Tag2

--delete-protection: Protection from accidental deletion of this item, [true/false]

`mssql`

Creates a new MSSQL rotated secret item

Usage

akeyless rotated-secret create mssql \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>' \
--rotator-type <target/password>

Flags

-n, --name: Required, Rotated Secret name

--target-name: Required, the target name to associate

--rotator-type: Required, The rotator type. options: [target/password]

--rotated-password: Rotated-username password (relevant only for rotator-type=password)

-u, --gateway-url[=http://localhost:8000]: API Gateway URL (Configuration Management port)

-k, --key: The name of a key that is used to encrypt the secret value (if empty, the account default protection key will be used)

--auto-rotate: Whether to automatically rotate every --rotation-interval days, or disable existing automatic rotation

--rotation-interval: The number of days to wait between every automatic rotation (1-365), custom rotator interval will be set in minutes

--rotation-hour: The Hour of the rotation in UTC

--authentication-credentials[=use-user-creds]: The credentials to connect with use-user-creds or use-target-creds

--password-length: The length of the password to be generated

--secure-access-enable: Enable/Disable Secure Remote Access, [true/false]

--rotate-after-disconnect[=false]: Rotate the value of the secret after the SRA session ends [true/false]

--secure-access-db-name: The DB name (relevant only for DB)

--secure-access-web[=false]: Enable Web Secure Remote Access

--secure-access-bastion-issuer: Path to the SSH Certificate Issuer for your Akeyless Bastion

--secure-access-db-schema: The DB scheme

-t, --tag: Add tags attached to this object. To specify multiple tags use the argument multiple times: --tag Tag1 -t Tag2

--delete-protection: Protection from accidental deletion of this item, [true/false]

`mysql`

Creates a new MySQL rotated secret item

Usage

akeyless rotated-secret create mysql \
--name <Rotated Secret name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL:8000>' \
--rotator-type <target/password>