This topic answers common questions about keys.
Questions
Can I delete keys in KMS?
Yes. You can delete all types of keys except for service keys. You can only delete keys by scheduling the deletion.
You can set a pending deletion period of 7 to 366 days. During this period, you can assess the key's impact on your applications and dependent users. The key is unusable during this time. If you still need the key, you can cancel the scheduled deletion at any time during the pending period. After the period ends, KMS permanently deletes the key, and it cannot be recovered. For more information, see schedule key deletion.
As a best practice, first disable a key and confirm that no data requires it for decryption before you schedule its deletion. For more information, see disable a key.
Can I delete service keys?
No.
For each Alibaba Cloud account, KMS provides a free service key in each region for each type of cloud service. The corresponding cloud service manages the service key's lifecycle. If you no longer use a service key, you do not need to take any action. You can retain the key at no charge.
Can data be decrypted after CMK deletion?
No.
KMS deletes keys only through a scheduled deletion process. After the pending deletion period that you set ends, the key is permanently deleted and cannot be recovered. You can cancel the scheduled deletion at any time during the pending period.
For a key with imported key material, after the key is deleted, you cannot decrypt data encrypted with it. This remains true even if you create a new key and import the identical key material.
If you delete only the imported key material but not the key itself, you can re-import the same key material to make the key available again. You can then decrypt data encrypted by the original key.
As a best practice, first disable a key and confirm that no data requires it for decryption before you schedule its deletion.
How does KMS ensure key security?
For software-protected keys, KMS stores your keys in a dedicated database and protects them with reliable encryption algorithms.
For hardware-protected keys, KMS performs key storage and cryptographic operations inside your exclusive hardware security module (HSM) cluster. To use this feature, you must first purchase the HSM service and then configure an HSM cluster.
Does KMS support importing key material?
Yes.
When you create a key, you can either have KMS generate the key material or use material from an external source. If you use an external source, you must import the key material. For more information, see import key material for a symmetric key and import key material for an asymmetric key.
Key unavailable or "Rejected.Unavailable" error
The KMS instance that hosts the key has expired.
You must renew the KMS instance within 15 days after it expires. Otherwise, the instance is released. For instructions, see Renewal policy.
If you do not plan to use the KMS instance immediately but might need its keys or secrets later, we recommend backing it up. For more information, see Backup management.
Management issues for CMKs in the console
Problem
On the Default Keys tab, you can only view the details of customer master keys. You cannot perform other operations, such as disabling them.
Solution
These keys were created in KMS 1.0 (shared edition) and are view-only in the KMS 3.0 console. To manage these keys, switch to the KMS 1.0 console.
To improve your product experience, KMS 1.0 will enter the End of Service and Fulfillment (EOSF) phase at 00:00:00 (GMT+8) on March 30, 2025, and the End of Service (EOS) phase at 00:00:00 (GMT+8) on September 30, 2025. To avoid disruptions to your business, migrate your KMS 1.0 resources to a KMS 3.0 instance as soon as possible. For instructions, see Migrate KMS 1.0 resources to a KMS 3.0 instance.