Key Management Service (KMS) covers three core security needs: meeting compliance requirements for information systems, encrypting sensitive data in applications, and managing secrets for third-party software vendors.
Security compliance requirements of information systems
Organizations face two types of compliance situations:
Regulations mandate cryptographic techniques. Key management infrastructure must conform to specific technical standards and security regulations.
Regulations don't require cryptography, but adopting it accelerates the compliance process—for example, earning higher scores in scoring-based frameworks.
KMS provides the following features to help organizations meet compliance requirements.
Feature | Description | Learn more |
Cryptographic compliance | Connect hardware security module (HSM) clusters in Data Encryption Service to KMS to manage keys and run cryptographic operations. Hardware-protected keys used during cryptographic operations must be stored in HSM clusters and support common algorithms for data encryption and digital signatures (signing and verification). HSMs in Data Encryption Service meet the compliance requirements specified by Federal Information Processing Standard (FIPS) Publication 140-3 Level 3. | |
Secrets management | Secrets Manager handles the full lifecycle of secrets such as AccessKey pairs for Resource Access Management (RAM) users, passwords for ApsaraDB RDS accounts, and SSH keys for Elastic Compute Service (ECS) instances. It also provides tooling to contain data leaks efficiently. | |
Data confidentiality | Encrypt data to prevent leaks when systems are compromised, and meet the requirements of data protection laws and regulations. | |
Authentication and access control | KMS integrates with RAM for centralized authentication and authorization. KMS Instance supports access only from IP addresses within a virtual private cloud (VPC). Application-level authentication and authorization are managed through application access points (AAPs). | |
Key audit | All KMS API call records are stored in ActionTrail for compliance auditing. Enable security audit for KMS instances to send all KMS instance API call records to a specified Object Storage Service (OSS) bucket. |
Sensitive data encryption
KMS provides multiple methods to protect sensitive data stored or processed in the cloud. Choose based on your throughput requirements and data size. KMS significantly reduces costs compared with self-built key management facilities and encryption and decryption facilities.
Method | When to use | How it works | Learn more |
Direct encryption of data in application systems by using KMS | Low queries per second (QPS) or data size ≤ 6 KB. Typical data: AccessKey pairs, database credentials. | Call the KMS encryption API operation to encrypt data directly by using keys. | |
Envelope encryption of data in application systems by using KMS | High QPS or large data. Typical data: mobile phone numbers, ID card numbers. | Store CMKs in KMS and deploy enveloped data keys (EDKs) locally. Decrypt EDKs with KMS to get plaintext data keys (DKs), then use DKs to encrypt or decrypt local data. Alternatively, use the Encryption SDK, which encapsulates envelope encryption. | |
Server-side encryption of cloud services | Baseline protection for data stored in Alibaba Cloud services. Typical cases: OSS buckets with sensitive data, database tables using transparent data encryption (TDE). | Enable server-side encryption on the cloud service. | |
Secrets Manager | Prevent data leaks from hardcoded secrets in code. Typical data: passwords, tokens, SSH keys, AccessKey pairs. | Store credentials in Secrets Manager and access them through application-level security mechanisms. Rotate secrets dynamically to reduce the risk of leaks. |
Third-party secret management solution
Independent software vendors (ISVs) often need access to customer secrets to deliver their services—but customers don't want to expose those secrets directly to ISVs. KMS acts as a third-party security protection system between the two parties.
Customers store secrets in KMS and grant ISV services access to specific secrets, typically through cross-account resource authorization. All access is auditable through ActionTrail.
Role | Responsibility | Learn more |
User administrator | Manages secrets in KMS and uses RAM to control permissions. Grants ISV services access to specific secrets based on methods such as resource authorization across Alibaba Cloud accounts. | Grant permissions across Alibaba Cloud accounts with a RAM role |
Service of ISVs | Integrates the KMS API to retrieve and use specified secrets. | |
User auditor | Uses ActionTrail to audit all key usage records in KMS. |