Amazon S3 Connector 25.4
Amazon S3 Connector Help

# Encrypt Passwords

OpenText recommends that you encrypt all passwords that you enter into a configuration file.

## Create a Key File

A key file is required to use AES encryption.

To create a new key file

1. Open a command-line window and change directory to the Amazon S3 Connector installation folder.

2. At the command line, type:

       autpassword -x -tAES -oKeyFile=./MyKeyFile.ky

   A new key file is created with the name `MyKeyFile.ky`

CAUTION: To keep your passwords secure, you must protect the key file. Set the permissions on the key file so that only authorized users and processes can read it. Amazon S3 Connector must be able to read the key file to decrypt passwords, so do not move or rename it.

## Encrypt a Password

The following procedure describes how to encrypt a password.

To encrypt a password

1. Open a command-line window and change directory to the Amazon S3 Connector installation folder.

2. At the command line, type:

       autpassword -e -tEncryptionType [-oKeyFile] [-cFILE -sSECTION -pPARAMETER] PasswordString

   where:

   Option | Description
   --- | ---
   `-tEncryptionType` | The type of encryption to use: `AES` - AES256 For example: `-tAES`
   `-oKeyFile` | AES encryption requires a key file. This option specifies the path and file name of a key file. The key file must contain 64 hexadecimal characters. For example: `-oKeyFile=./key.ky` NOTE: The full (absolute) path of the key file is included in the encrypted value, because Amazon S3 Connector requires the key to decrypt the password. If you move or rename the key file, this path becomes invalid and you must update the encrypted value.
   `-cFILE -sSECTION -pPARAMETER` | (Optional) You can use these options to write the password directly into a configuration file. You must specify all three options. `-c`. The configuration file in which to write the encrypted password. `-s`. The name of the section in the configuration file in which to write the password. `-p`. The name of the parameter in which to write the encrypted password. For example: `-c./Config.cfg -sMyTask -pPassword`
   `PasswordString` | The password to encrypt.

   For example:

       autpassword -e -tBASIC MyPassword

       autpassword -e -tAES -oKeyFile=./key.ky MyPassword

       autpassword -e -tAES -oKeyFile=./key.ky -c./Config.cfg -sDefault -pPassword MyPassword

   The password is returned, or written to the configuration file.

## Decrypt a Password

The following procedure describes how to decrypt a password.

To decrypt a password

1. Open a command-line window and change directory to the Amazon S3 Connector installation folder.

2. At the command line, type:

       autpassword -d -tEncryptionType PasswordString

   where:

   Option | Description
   --- | ---
   `-tEncryptionType` | The type of encryption: `Basic` `AES` - AES256 For example: `-tAES`
   `PasswordString` | The password to decrypt.

   For example:

       autpassword -d -tBASIC 9t3M3t7awt/J8A

       autpassword -d -tAES PasswordString

   The password is returned in plain text.

## Encrypt Secrets with HashiCorp Vault

The following procedure describes how to use the `autpassword` utility to encrypt secret parameter values with a HashiCorp Vault Transit secrets engine. The encryption key is stored in the Vault, and the Knowledge Discovery component can use HashiCorp Vault to decrypt the value when it is needed.

To encrypt secrets with HashiCorp Vault

1. In the installation folder, create a configuration file named `hashicorpVaultPasswordLib.dll.cfg`, and enter the following configuration parameters:

       [default]
       SSLMethod=Negotiate
       vault.uri=https://host.example.com:8200
       vault.authentication=TOKEN
       vault.token=root
       vault.transit.path=transit
       vault.transit.key=transit

   The parameters are described in the following table.

   Parameter | Description
   --- | ---
   `vault.uri` | The URI of your HashiCorp Vault.
   `vault.token` | The authentication token to use to access the vault.
   `vault.transit.path` and `vault.transit.key` | These parameters define the URL of your transit secret engine. The path is the name of the secret engine you created. The key is the name of the key to use for encryption and decryption. If the key does not exist it is automatically created.

2. Run the following command, where `Secret` is the parameter value to encrypt:

       autpassword -e -lhashicorpVaultPasswordLib.dll Secret

   An encrypted value is returned, that you can add to the configuration file.

   TIP: The configuration file that you created in the first step is required by the Knowledge Discovery component to decrypt the secret value, so do not delete that file and remember to include it in your backups. If you want to move your Knowledge Discovery component configuration file to another server, remember to copy `hashicorpVaultPasswordLib.dll.cfg` as well.

Copyright 2025 Open Text
Version 25.4 | Last updated October 2025

Send documentation feedback

Close

Send documentation feedback

To send feedback using your default email client, open an email window.

Otherwise, send your feedback and the information below to MFI-swpdl.idoldocsfeedback@opentext.com.

We appreciate your feedback!

Product: Knowledge Discovery Amazon S3 Connector 25.4

Topic Title: Encrypt Passwords