KMS provides full-lifecycle key management and secure storage. Learn how to create, disable, and delete keys, enable deletion protection, and manage tags.
Create a key
Default key
Default keys include service keys and a customer master key (CMK). Cloud services create and manage service keys. You create and manage the CMK.
Only one default key (CMK) can be created per region. To create multiple keys, purchase a KMS instance.
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
On the Keys page, click the Default Keys tab.
-
In the Actions column of the CMK, click Enable, configure the parameters, and then click OK.
Parameter
Description
Key Alias
An alias to identify the key. The alias can contain letters, digits, underscores (_), hyphens (-), and forward slashes (/).
Description
A custom description of the key.
Advanced Settings
Key Material Origin
-
Key Management Service: The key material is generated by KMS.
-
External: KMS does not generate key material. You must import your own key material. Import key material for a symmetric key.
NoteRead the information carefully and select I understand the implications of using the external key materials key.
-
Software keys
Before creating a software-protected key, purchase and enable a KMS instance.
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
On the Keys page, click the Customer Master Keys tab. From the Instance ID drop-down list, select a software key management instance. Then, click Create Key.
-
In the Create Key panel, configure the parameters and click OK.
Parameter
Description
Key Type
Select symmetric or asymmetric.
ImportantIf you are creating a key to encrypt credential values, select Symmetric Key.
Key Specifications
The key specification. For supported specifications and algorithms, see Key types and specifications.
-
Symmetric key specification: Aliyun_AES_256
-
Asymmetric key specifications: RSA_2048, RSA_3072, RSA_4096, EC_P256, and EC_P256K
Key Usage
The purpose of the key. Valid values:
-
Key Usage:: Encrypts and decrypts data.
-
SIGN/VERIFY: Generates and verifies digital signatures.
Key Alias
An alias to identify the key. The alias can contain letters, digits, underscores (_), hyphens (-), and forward slashes (/).
Tags
Tags to help you categorize and manage keys. Each tag is a key-value pair.
NoteFormat of a tag key and a tag value: A tag key or a tag value can be up to 128 characters in length and can contain letters, digits, forward slashes (/), backslashes (\), underscores (_), hyphens (-), periods (.), plus signs (+), equal signs (=), colons (:), at signs (@), and spaces.
A tag key cannot start with
aliyunoracs:.Each key supports up to 20 tag key-value pairs.
Automatic Rotation
Only symmetric keys support automatic rotation, which is enabled by default. Key rotation.
Rotation Period
You can set the rotation period to a value from 7 to 365 days.
Description
A description of the key.
Advanced Settings
Policy
-
Default Policy: Select this policy if the key is used by the current Alibaba Cloud account or an Alibaba Cloud account in a resource share.
-
If the instance is not shared with other accounts: Only the current Alibaba Cloud account can manage and use the key.
-
If the instance is shared with other accounts: For example, Alibaba Cloud account 1 shares KMS instance A with Alibaba Cloud account 2.
-
For a key created by Alibaba Cloud account 1: Only Alibaba Cloud account 1 can manage and use the key.
-
For a key created by Alibaba Cloud account 2: Both Alibaba Cloud account 1 and Alibaba Cloud account 2 can manage and use the key.
-
-
-
Custom Policy: Select this policy if you need to authorize RAM users, RAM roles, or other Alibaba Cloud accounts to use the key.
Important-
Selecting an administrator or user does not consume Access Management Quantity quota. Selecting users from other accounts consumes the Access Management Quantity quota of the KMS instance, calculated by the number of specified Alibaba Cloud accounts.
-
After you revoke the authorization, the quota is released in about 5 minutes.
-
Administrator: Manages the key but cannot perform cryptographic operations. Select RAM users and RAM roles from your Alibaba Cloud account.
-
User: Can only perform cryptographic operations. Select RAM users and RAM roles from your Alibaba Cloud account.
-
Users from other accounts: Can encrypt and decrypt with the key. Specify RAM users or RAM roles from other Alibaba Cloud accounts.
-
RAM user: Use the format
acs:ram::<userId>:user/<ramuser>. Example:acs:ram::11********11****:user/testpolicyuser. -
RAM role: Use the format
acs:ram::<userId>:role/<ramrole>. Example:acs:ram::11********11****:role/testpolicyrole.NoteAfter authorizing a RAM user or role, use the owning Alibaba Cloud account to grant key usage permissions in the RAM console.
Custom policies for Key Management Service. Grant permissions to a RAM user. Grant permissions to a RAM role.
-
-
Key Material Origin
-
Key Management Service: The key material is generated by KMS.
-
External (Import Key Material): KMS does not generate key material. You must import your own key material. Import key material for a symmetric key. Import key material for an asymmetric key.
NoteRead the information carefully and select I understand the implications of using the external key materials key.
-
Hardware keys
Before creating a hardware-protected key, purchase and enable a KMS instance.
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
On the Keys page, click the Customer Master Keys tab. From the Instance ID drop-down list, select a hardware key management instance. Then, click Create Key.
-
In the Create Key panel, configure the parameters and click OK.
Parameter
Description
Key Type
Select symmetric or asymmetric.
ImportantIf you are creating a key to encrypt credential values, select Symmetric Key.
Key Specifications
The key specification. For supported specifications and algorithms, see Key types and specifications.
-
Symmetric key specifications: Aliyun_AES_256, Aliyun_AES_192, and Aliyun_AES_128
-
Asymmetric key specifications: RSA_2048, RSA_3072, RSA_4096, EC_P256, and EC_P256K
Key Usage
The purpose of the key. Valid values:
-
ENCRYPT/DECRYPT: Encrypts and decrypts data.
-
SIGN/VERIFY: Generates and verifies digital signatures.
Key Alias
An alias to identify the key. The alias can contain letters, digits, underscores (_), hyphens (-), and forward slashes (/).
Tags
Tags to help you categorize and manage keys. Each tag is a key-value pair.
NoteFormat of a tag key and a tag value: A tag key or a tag value can be up to 128 characters in length and can contain letters, digits, forward slashes (/), backslashes (\), underscores (_), hyphens (-), periods (.), plus signs (+), equal signs (=), colons (:), at signs (@), and spaces.
A tag key cannot start with
aliyunoracs:.Each key supports up to 20 tag key-value pairs.
Description
A description of the key.
-
Default Policy: Select this policy if the key is used by the current Alibaba Cloud account or an Alibaba Cloud account in a resource share.
-
If the instance is not shared with other accounts: Only the current Alibaba Cloud account can manage and use the key.
-
If the instance is shared with other accounts: For example, Alibaba Cloud account 1 shares KMS instance A with Alibaba Cloud account 2.
-
For a key created by Alibaba Cloud account 1: Only Alibaba Cloud account 1 can manage and use the key.
-
For a key created by Alibaba Cloud account 2: Both Alibaba Cloud account 1 and Alibaba Cloud account 2 can manage and use the key.
-
-
-
Custom Policy: Select this policy if you need to authorize RAM users, RAM roles, or other Alibaba Cloud accounts to use the key.
Important-
Selecting an administrator or user does not consume Access Management Quantity quota. Selecting users from other accounts consumes the Access Management Quantity quota of the KMS instance, calculated by the number of specified Alibaba Cloud accounts.
-
After you revoke the authorization, the quota is released in about 5 minutes.
-
Administrator: Manages the key but cannot perform cryptographic operations. Select RAM users and RAM roles from your Alibaba Cloud account.
-
User: Can only perform cryptographic operations. Select RAM users and RAM roles from your Alibaba Cloud account.
-
Users from other accounts: Can encrypt and decrypt with the key. Specify RAM users or RAM roles from other Alibaba Cloud accounts.
-
RAM user: Use the format
acs:ram::<userId>:user/<ramuser>. Example:acs:ram::11********11****:user/testpolicyuser. -
RAM role: Use the format
acs:ram::<userId>:role/<ramrole>. Example:acs:ram::11********11****:role/testpolicyrole.NoteAfter authorizing a RAM user or role, use the owning Alibaba Cloud account to grant key usage permissions in the RAM console.
Custom policies for Key Management Service. Grant permissions to a RAM user. Grant permissions to a RAM role.
-
-
-
Key Management Service: The key material is generated by KMS.
-
External (Import Key Material): KMS does not generate key material. You must import your own key material. Import key material for a symmetric key. Import key material for an asymmetric key.
NoteRead the information carefully and select I understand the implications of using the external key materials key.
This parameter is available only when Key Type is set to Asymmetric Key.
An additional key usage allows a single key to serve multiple purposes. However, additional usages do not apply to data encryption with cloud services.
-
External keys
-
Ensure you have purchased and enabled an external key management instance. Purchase and enable a KMS instance.
-
Use the XKI proxy service in your key management infrastructure (KMI) to create a key and record its ID.
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
On the Keys page, click the Customer Master Keys tab. From the Instance ID drop-down list, select an external key management instance. Then, click Create Key.
-
In the Create Key panel, configure the parameters and click OK.
Parameter
Description
External Key ID
The key ID generated by the XKI management service.
NoteYou can use the same external key ID to create one or more KMS keys.
Key Specifications
The specification of the key. Only Aliyun_AES_256 are supported.
NoteFor supported specifications and algorithms, see Key types and specifications.
Key Usage
The purpose of the key.
ENCRYPT/DECRYPT: Encrypts and decrypts data.
Key Alias
An alias to identify the key. The alias can contain letters, digits, underscores (_), hyphens (-), and forward slashes (/).
Tags
Tags to help you categorize and manage keys. Each tag is a key-value pair.
NoteFormat of a tag key and a tag value: A tag key or a tag value can be up to 128 characters in length and can contain letters, digits, forward slashes (/), backslashes (\), underscores (_), hyphens (-), periods (.), plus signs (+), equal signs (=), colons (:), at signs (@), and spaces.
A tag key cannot start with
aliyunoracs:.Each key supports up to 20 tag key-value pairs.
Description
A description of the key.
Advanced Settings
-
Default Policy: Select this policy if the key is used by the current Alibaba Cloud account or an Alibaba Cloud account in a resource share.
-
If the instance is not shared with other accounts: Only the current Alibaba Cloud account can manage and use the key.
-
If the instance is shared with other accounts: For example, Alibaba Cloud account 1 shares KMS instance A with Alibaba Cloud account 2.
-
For a key created by Alibaba Cloud account 1: Only Alibaba Cloud account 1 can manage and use the key.
-
For a key created by Alibaba Cloud account 2: Both Alibaba Cloud account 1 and Alibaba Cloud account 2 can manage and use the key.
-
-
-
Custom Policy: Select this policy if you need to authorize RAM users, RAM roles, or other Alibaba Cloud accounts to use the key.
Important-
Selecting an administrator or user does not consume Access Management Quantity quota. Selecting users from other accounts consumes the Access Management Quantity quota of the KMS instance, calculated by the number of specified Alibaba Cloud accounts.
-
After you revoke the authorization, the quota is released in about 5 minutes.
-
Administrator: Manages the key but cannot perform cryptographic operations. Select RAM users and RAM roles from your Alibaba Cloud account.
-
User: Can only perform cryptographic operations. Select RAM users and RAM roles from your Alibaba Cloud account.
-
Users from other accounts: Can encrypt and decrypt with the key. Specify RAM users or RAM roles from other Alibaba Cloud accounts.
-
RAM user: Use the format
acs:ram::<userId>:user/<ramuser>. Example:acs:ram::11********11****:user/testpolicyuser. -
RAM role: Use the format
acs:ram::<userId>:role/<ramrole>. Example:acs:ram::11********11****:role/testpolicyrole.NoteAfter authorizing a RAM user or role, use the owning Alibaba Cloud account to grant key usage permissions in the RAM console.
Custom policies for Key Management Service. Grant permissions to a RAM user. Grant permissions to a RAM role.
-
-
Disable a key
If you no longer need a key, disable it first. After confirming it is not in use, delete it. A disabled key cannot perform cryptographic operations.
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
On the Keys page, on the Customer Master Keys or Default Keys tab, find the key that you want to disable and click Disable in the Actions column.
-
In the Disable Key dialog box, confirm the information and click OK.
Click Key Association to check whether a cloud service uses the key for server-side encryption. Key association check.
After the key is disabled, its status changes from Enabling to Disabled. You can also click Enable to re-enable the key.
Enable deletion protection
Deletion protection prevents a key from being deleted through the console or API. To delete a protected key, disable deletion protection first.
You cannot enable deletion protection for a key in the Pending Deletion state.
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
On the Keys page, on the Customer Master Keys or Default Keys tab, find the key for which you want to enable deletion protection and click Details in the Actions column.
-
On the key details page, turn on the Deletion Protection switch.
-
In the Enable dialog box, click Enable.
Schedule key deletion
KMS does not allow immediate key deletion. You schedule a waiting period, and the key is deleted after that period expires. Disable deletion protection before scheduling.
Disable the key first. After confirming it does not affect your business, schedule deletion.
-
The key is permanently deleted after the waiting period. All content encrypted with this key, including derived data keys, becomes permanently undecryptable. Ensure the key is no longer in use before scheduling deletion, or your services may become unavailable.
-
Service keys cannot be deleted. The cloud service manages their lifecycle. Unused service keys require no action and incur no fees.
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
On the Customer Master Keys or Default Keys tab, find the key that you want to delete. In the Actions column, click the
icon and then click Schedule Deletion. -
In the Schedule Deletion dialog box, specify a waiting period and click OK.
Click Key Association to check whether a cloud service uses the key for server-side encryption. Key association check.
After you specify a waiting period, the key state changes from Enabling to Pending Deletion. A key in the Pending Deletion state cannot be used for encryption, decryption, or data key generation. Before the waiting period ends, you can Cancel Deletion.
Download the public key
Download the public key of an asymmetric key. The private key cannot be downloaded.
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
On the Customer Master Keys or Default Keys tab, find the key whose public key you want to download and click Details in the Actions column.
-
On the key details page, click the Key Version tab. Then, find the key version that you want to manage and click View Public Key in the Actions column.
-
In the View Public Key dialog box, click Download.
Generate and download a CSR
KMS can generate a Certificate Signing Request (CSR) for an asymmetric CMK. Submit the CSR to a certification authority (CA) to obtain a digital certificate for use cases such as secure email, code signing, endpoint protection, and identity management.
To create a certificate from a CSR, see Create a certificate in Certificate Management Service (Original SSL Certificate).
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
On the Customer Master Keys tab, find the key for which you want to generate a CSR and click Details in the Actions column.
-
On the key details page, click the Key Version tab. Find the key version for which you want to generate a CSR and click Generate CSR in the Actions column. Configure the parameters and click OK.
Parameter
Description
Common Name (CN)
The subject to which the certificate is bound, such as a domain name, service name, or device name.
Organization (O)
The legal name of your organization, which is used for certificate ownership verification.
-
The name must exactly match the name on your business license, including punctuation and capitalization.
-
If the organization name contains special characters, such as
&and-, they must be retained.
Organizational Unit (OU)
The specific department or team within your organization.
State or Province (S)
The name of the province, municipality, or autonomous region where your organization is located. You can use Chinese or English characters. You do not need to add "Province".
Locality (L)
The name of the city where your organization is located. You can use Chinese or English characters. You do not need to add "City".
Country or Region (C)
The two-letter country code per ISO 3166-1 alpha-2.
Signature Algorithm
Select a signature algorithm based on your CA capabilities, security standards, and compatibility requirements.
-
RSA_PKCS1_SHA_256: calculates the hash value of data by using the SHA-256 algorithm and calculates the signature by using the RSASSA-PKCS1-v1_5 algorithm that is defined in RFC 3447/PKCS#1.
-
RSA_PSS_SHA_256: calculates the hash value of data by using the SHA-256 algorithm and calculates the signature by using the RSASSA-PSS algorithm that is defined in RFC 3447/PKCS#1. MGF1 with SHA-256 is used.
Email Address
Enter your contact email address.
-
-
In the CSR dialog box, click Download CSR File and save the file in a secure location.
Key association check
Check whether cloud services use a key for server-side encryption. Self-managed application usage is not checked. If the key is still in use, exercise caution before deleting it.
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
On the Customer Master Keys or Default Keys tab, find the key whose associations you want to check and click Details in the Actions column.
-
On the Key Association tab, click Check. Wait about 1 minute, and then click the
icon on the right to view the check result.-
Cloud Service: Supported cloud services include ECS, MSE, Message Queue for RabbitMQ, Message Queue for Apache RocketMQ, and ACK.
-
Last Called At: The last time the cloud service accessed the key in KMS.
NoteCall times are displayed only for requests within the last 365 days.
-
Check Status: The status of the check. If the check fails, refresh the page and try again.
-
Service Console: A feature provided by the cloud service to query which of its resources are encrypted by the KMS key.
ImportantOnly resources that the current account has permissions to access are displayed.
-