4.3 Secure Properties Tool, Encryption & Maven Project Packaging

Salesforce Certified MuleSoft Developer I Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Creating Application Networks & API-Led Connectivity

1.1 The IT Delivery Gap & API-Led Connectivity Architecture 1.2 Application Network Foundations & Center for Enablement (C4E) 1.3 Anypoint Platform Architecture & Core Components

2 Chapter 2: Designing APIs with RAML & API Designer

2.1 RAML 1.0 Fundamentals, Data Types & Resource Hierarchy 2.2 Reusable API Fragments, ResourceTypes & Traits 2.3 API Mocking Service, Documentation & Anypoint Exchange Publishing

3 Chapter 3: Accessing and Modifying Mule Events

3.1 Mule 4 Event Architecture: Message, Payload, Attributes & Variables 3.2 Flow Variable Management & Target Variables Pattern 3.3 Accessing Event Metadata, Inbound Attributes & Context Properties

4 Chapter 4: Structuring Mule Applications

4.1 Modular Flow Composition: Flows, Subflows & Private Flows 4.2 Configuration Property Files & Environment Management 4.3 Secure Properties Tool, Encryption & Maven Project Packaging

5 Chapter 5: Building API Implementation Interfaces

5.1 APIkit Scaffolding, Router Configuration & Interface Generation 5.2 HTTP Listener Configuration, Path Matching & Query/URI Parameters 5.3 Interface vs. Implementation Separation & Backend Flow Wiring

6 Chapter 6: Using Connectors & External Systems

6.1 Database Connector: Select, Insert, Update, Stored Procedures & Watermarking 6.2 HTTP Request Connector: Headers, Query Params, Response Timeouts & Target Variables 6.3 Salesforce Connector, JMS Messaging & File/FTP Connectors

7 Chapter 7: Processing Records & Batch Integration

7.1 For Each Scope: Payload Iteration, Batch Size & Streaming Data 7.2 Batch Job Architecture: Input, Process, and Complete Phases 7.3 Batch Step Accept Expression, Failure Handling & Batch Aggregator 7.4 Object Store: Persisting Data Between Flow Executions

8 Chapter 8: Transforming Data with DataWeave 2.0

8.1 DataWeave 2.0 Syntax, Type System & Selectors 8.2 Core Functions: map, filter, pluck, reduce, groupBy & orderBy 8.3 Custom Functions, Format Transformations & Type Coercion 8.4 Calling Mule Flows from DataWeave & Reusing DataWeave Modules

9 Chapter 9: Routing Events & Flow Control

9.1 Choice Router: Conditional Expressions & Default Routing 9.2 Scatter-Gather Router: Parallel Execution, Aggregation & Error Traps 9.3 Async Scope, Round Robin & First Successful Routing 9.4 Validating Mule Events with the Validation Module

10 Chapter 10: Handling Errors & Exception Management

10.1 Mule 4 Error Object Hierarchy & Custom Error Types 10.2 On-Error Continue vs. On-Error Propagate Mechanisms 10.3 Try Scope Exception Isolation & Global Error Handling Strategies

11 Chapter 11: Debugging and Troubleshooting Mule Applications

11.1 Logger Configuration, Categories & Thread/Context Diagnostics 11.2 Anypoint Studio Debugger: Breakpoints, Expression Watches & Step-Through 11.3 MUnit 2.x Testing: Unit Tests, Mocking Connectors & Assertions

12 Chapter 12: Deploying and Managing APIs and Integrations

12.1 CloudHub 1.0 & 2.0 Architecture: Workers, vCores & Clustering 12.2 Runtime Manager: Application Management, Alerts, Insights & Logs 12.3 API Manager: Auto-Discovery, API Gateway, SLA Tiers & Standard Policies

4.3 Secure Properties Tool, Encryption & Maven Project Packaging

Key Takeaways Explain This Topic AI

The Anypoint Secure Configuration Properties module encrypts sensitive property values (passwords, tokens, API secrets) at rest and decrypts them dynamically in memory.

The Mule Secure Properties Tool ( secure-properties-tool.jar ) provides CLI commands to encrypt individual strings or entire property files using algorithms like AES, Blowfish, DES, DESede, and RSA.

Encrypted values are formatted as ![encrypted_string] in YAML/properties files and are accessed using the secure:: namespace prefix: ${secure::db.password} in XML and p('secure::db.password') in DataWeave.

The encryption key should NEVER be hardcoded in XML or stored in source control; it must be injected at runtime via -M-Dencryption.key=mySecretKey or Runtime Manager properties.

Mule 4 applications are packaged as lightweight executable .jar archives by the mule-maven-plugin , containing mule-artifact.json , classloading definitions, and isolated dependency repositories.

Last updated: August 2026

4.3 Secure Properties Tool, Encryption & Maven Project Packaging

Enterprise security and compliance standards prohibit storing plain-text passwords, client secrets, API tokens, and private keys in application repositories or source control. Mule 4 addresses this with the Anypoint Secure Configuration Properties module and the Mule Secure Properties Tool .

Additionally, Mule 4 fundamentally overhauled project dependency management and build packaging by migrating from legacy .zip archives to structured Mule Application .jar archives powered by the Mule Maven Plugin .

1. Anypoint Secure Configuration Properties Module

The Secure Configuration Properties module allows developers to encrypt sensitive values at rest in YAML or .properties files. At application startup, the Mule runtime uses a master decryption key provided at runtime to decrypt the values into memory.

XML Configuration Declaration

To use secure properties, add the module dependency to pom.xml and declare the <secure-properties:config> element in global.xml : <secure-properties:config name="Secure_Properties_Config"

file="config-secure-${env}.yaml"
key="${encryption.key}">
<secure-properties:encrypt algorithm="AES"
mode="CBC"
encoding="UTF-8"
useRandomIVs="true"/>
</secure-properties:config>

Configuration Attributes:

name : The global configuration identifier.

file : The location of the secure properties file in src/main/resources (e.g., config-secure-dev.yaml ).

key : The master decryption key. Must always reference a dynamic runtime property ( ${encryption.key} or ${mule.key} ) rather than a hardcoded string.

algorithm : Cryptographic algorithm. Defaults to AES . Options: AES , Blowfish , DES , DESede (Triple DES), RSA .

mode : Cipher block mode. Defaults to CBC . Options: CBC , CFB , ECB , OFB .

useRandomIVs : When set to true , generates a random Initialization Vector for each encryption operation (recommended for maximum security).

Caution

Never Hardcode the Encryption Key: Hardcoding the decryption key in XML ( key="MySecretKey123" ) completely defeats the purpose of property encryption. Always pass the key dynamically via runtime VM arguments ( -Dencryption.key=... ) or secure properties in Runtime Manager.

2. Mule Secure Properties Tool ( secure-properties-tool.jar )

MuleSoft provides a standalone command-line utility, secure-properties-tool.jar , to encrypt and decrypt strings or entire files. +-----------------------------------------------------------------------------+

| SECURE PROPERTIES TOOL CLI SYNTAX |
| |
| java -cp secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool \
| <method> <-- 'string' or 'file' |
| <operation> <-- 'encrypt' or 'decrypt' |
| <algorithm> <-- 'AES', 'Blowfish', 'DES', 'DESede', 'RSA' |
| <mode> <-- 'CBC', 'CFB', 'ECB', 'OFB' |
| <key> <-- 16, 24, or 32 character encryption key |
| <value/file> <-- String literal to encrypt OR input file path |
| [output_file] <-- Target output file path (for file method) |
+-----------------------------------------------------------------------------+
A. Encrypting a Single String

To encrypt a database password ( "MyDatabasePass2026!" ) with AES-CBC using key "MySecretKey12345" : java -cp secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool \

string encrypt AES CBC MySecretKey12345 "MyDatabasePass2026!"
Output: 0qKz8B7z61Nl8XqQ8Y...==
B. Encrypted Value Notation in Property Files

In YAML or .properties files, encrypted values must be wrapped in the ![...] syntax : # src/main/resources/config-secure-dev.yaml

database:

host: "dev-db.internal.corp" # Non-sensitive value (plain text)
user: "db_user"
password: "![0qKz8B7z61Nl8XqQ8Y...==]" # Encrypted value

salesforce:

client_secret: "![w8Kj29VxL019mQ...==]"
C. Encrypting an Entire File

To encrypt all values inside a property file in bulk: java -cp secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool \

file encrypt AES CBC MySecretKey12345 config-dev.yaml config-secure-dev.yaml
3. Accessing Encrypted Properties in Mule

To access properties managed by the Secure Configuration Properties module, prefix the property key with the secure:: namespace.

A. In Mule XML Attributes: ${secure::property.key} <db:config name="Database_Config">
<db:my-sql-connection host="${db.host}"
port="${db.port}"
user="${db.user}"
password="${secure::database.password}"/>
</db:config>

<salesforce:sfdc-config name="Salesforce_Config">
<salesforce:basic-connection username="${sfdc.username}"
password="${secure::sfdc.password}"
securityToken="${secure::sfdc.token}"/>
</salesforce:sfdc-config>
B. In DataWeave 2.0: p('secure::property.key') %dw 2.0
output application/json
--
{
clientSecret: p('secure::salesforce.client_secret'),
apiKey: Mule::p('secure::api.master_key')
}

Location Standard Property Syntax Secure Property Syntax
XML Attributes ${db.password} ${secure::db.password}
DataWeave Scripts p('db.password') p('secure::db.password')

Important

If you attempt to access an encrypted property using standard ${database.password} without the secure:: prefix, Mule will return the raw, encrypted ciphertext string ( ![0qKz8...] ) rather than the decrypted plain-text value.

4. Mule Maven Plugin & pom.xml Architecture

Mule 4 applications are standard Maven projects. The build lifecycle, dependency resolution, testing (MUnit), and deployment are controlled by the Project Object Model ( pom.xml ) and the mule-maven-plugin . <?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<groupId>com.company.integration</groupId>
<artifactId>orders-system-api</artifactId>
<version>1.0.0</version>
<packaging>mule-application</packaging>

<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<app.runtime>4.4.0</app.runtime>
<mule.maven.plugin.version>3.8.2</mule.maven.plugin.version>
</properties>

<build>
<plugins>
<plugin>
<groupId>org.mule.tools.maven</groupId>
<artifactId>mule-maven-plugin</artifactId>
<version>${mule.maven.plugin.version}</version>
<extensions>true</extensions>
<configuration>
<sharedLibraries>
<sharedLibrary>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
</sharedLibrary>
</sharedLibraries>

<cloudHubDeployment>
<uri>https://anypoint.mulesoft.com</uri>
<muleVersion>${app.runtime}</muleVersion>
<username>${anypoint.username}</username>
<password>${anypoint.password}</password>
<applicationName>orders-sys-api-prod</applicationName>
<environment>Production</environment>
<workerType>MICRO</workerType>
<workers>1</workers>
<properties>
<env>prod</env>

<anypoint.platform.analytics_base_uri>https://analytics-ingest.anypoint.mulesoft.com</anypoint.platform.analytics_base_uri>

</properties>
</cloudHubDeployment>
</configuration>
</plugin>
</plugins>
</build>

<dependencies>
<dependency>
<groupId>org.mule.connectors</groupId>
<artifactId>mule-http-connector</artifactId>
<version>1.7.3</version>
<classifier>mule-plugin</classifier>
</dependency>
<dependency>
<groupId>org.mule.connectors</groupId>
<artifactId>mule-db-connector</artifactId>
<version>1.14.0</version>
<classifier>mule-plugin</classifier>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<version>8.0.30</version>
</dependency>
</dependencies>
</project>

Key pom.xml Elements Tested on the Exam:

<packaging>mule-application</packaging> : Instructs Maven to package the project using the Mule 4 application packaging structure.

<classifier>mule-plugin</classifier> : Identifies connector dependencies as Mule extensions that plug into the runtime's classloader isolation model.

<sharedLibraries> : In Mule 4, classloader isolation prevents connectors from seeing arbitrary project dependencies. For third-party Java libraries (such as database JDBC drivers: MySQL, Oracle, PostgreSQL), you must explicitly declare the library under <sharedLibraries> in the mule-maven-plugin configuration so the Database connector can load the driver class.

5. Mule 4 Deployable JAR Archive Anatomy

Building a Mule 4 project ( mvn clean package ) produces a deployable JAR archive (e.g., orders-system-api-1.0.0-mule-application.jar ). orders-system-api.jar

├── META-INF/
│ ├── maven/.../pom.xml
│ └── mule-artifact/
│ └── mule-artifact.json # Application deployment descriptor
├── repository/ # Embedded dependency repository

│ └── org/mule/connectors/...

├── api/ # API specifications (RAML / OAS)
├── config-dev.yaml # Configuration property files
├── config-secure-dev.yaml
└── *.xml # Application flows (global.xml, interface.xml, impl.xml)
The mule-artifact.json Descriptor

Generated automatically during compilation, mule-artifact.json dictates the application's runtime boundaries:

minMuleVersion : Minimum compatible runtime engine version.

classLoaderModelLoaderDescriptor : Defines classloading isolation.

secureProperties : Declares property keys that should be masked/hidden from the Anypoint Runtime Manager UI.