This topic describes the billing details and overdue payments for Key Management Service (KMS). This topic also describes how to stop billing and provides relevant billing examples.

Billing details

The fees that you are charged for KMS includes the fees for hosting keys and the fees for calling API operations.

  • Fees for hosting keys

    You are not charged for customer master keys (CMKs) that are in the Pending Deletion state. The following table describes the billing rules for CMKs that are in other states.

    Key creator Billable item Unit price in Alibaba Cloud regions (USD/day)
    Alibaba Cloud service Version of a service-managed key 0.0
    User Version of a software key 0.002
    Version of a basic hardware key 0.033
    Version of an advanced hardware key
    • 0.083 for the first 2,000 key versions
    • 0.033 for other key versions
  • Fees for calling API operations

    You are charged only when you call cryptographic operations. For more information about the cryptographic operations, see Cryptographic operations.

    Key category Unit price in Alibaba Cloud regions in the Chinese mainland (USD/10,000 calls) Unit price in Alibaba Cloud regions outside the Chinese mainland (USD/10,000 calls)
    Service-managed key 0 0
    Basic key (software and hardware) 0.08 0.03
    Advanced key (software and hardware) 0.24 0.15

Billing examples

  • Billing example 1: disk encryption

    You create 250 disks per month in the Singapore (Singapore) region and use a CMK to encrypt the disks.

    • Fees:
      • Hosted keys: one CMK
        Note The CMK can be a service-managed key or a custom hardware key.
      • API operation calls: 750 (250 calls to create data keys, 250 calls to encrypt the data keys, and 250 calls to decrypt the data keys)
    • Estimated monthly fees:
      Fee Service-managed key (USD) Custom hardware key (USD)
      Key hosting 0 1
      API operation calls 0 0.002 (0.03 × 750/10,000)
      Total 0 1.002
  • Billing example 2: OSS client-side encryption

    You use a CMK for OSS client-side encryption that is based on envelope encryption in the Singapore (Singapore) region. You upload and encrypt 10,000 objects per month. The system reads the encrypted objects 2,000,000 times per month.

    • Fees:
      • Hosted keys: one CMK
      • API operation calls: 10,000 calls to create data keys (one call for each object to be uploaded)
      • API operation calls: 2,000,000 calls to decrypt data keys
    • Estimated monthly fees:
      Fee Custom hardware key (USD)
      Key hosting 1
      API operation calls 6.03 (0.03 × 2,010,000/10,000)
      Total 7.03
  • Billing example 3: signature generation

    You use a CMK whose key type is EC_P256 to generate 100,000 signatures in the Singapore (Singapore) region.

    • Fees:
      • Hosted keys: one CMK
      • API operation calls: 100,000 calls to generate signatures
    • Estimated monthly fees:
      Fee Custom hardware key (USD)
      Key hosting 2.49
      API operation calls 1.50 (0.15 × 100,000/10,000)
      Total 3.99

Overdue payments

If your Alibaba Cloud account has overdue payments, top up your account balance at the earliest opportunity to prevent negative impacts on your business.

If you do not settle your overdue payments in seven days, your KMS service is automatically terminated. KMS retains your key-related data, but you cannot access KMS. Before you settle your overdue payments, you are not charged for KMS.

How to stop billing

After you delete the CMKs within your Alibaba Cloud account, you are no longer charged. You can log on to the KMS console to delete the CMKs that you create in each region. For more information, see Schedule a key deletion task.

Note You can only schedule key deletion tasks. After you schedule a key deletion task, the CMK enters the Pending Deletion state. When the CMK enters the Pending Deletion state, you are not charged for the CMK, and you cannot use the CMK to encrypt data, decrypt data, or generate data keys.