Key Management Service (KMS) instances provide key-related and secret-related features. You can use keys to encrypt and decrypt sensitive data. You can use secrets to reduce risks that are caused by hardcoded secrets in code. This helps improve data security. This topic describes how to purchase and enable a KMS instance.
Overview
Before you purchase a KMS instance, you must get familiar with the specifications of KMS instances and the business components of KMS. Then, you can select appropriate specifications based on your business scenarios and security compliance requirements. For more information, see Instance selection.
Step 1: Purchase a KMS instance
Log on to the KMS console. In the top navigation bar, select the required region. In the left-side navigation pane, click Instances.
On the Instances page, click Create Instance. On the buy page, configure the parameters and click Buy Now.
Parameter
Description
Site
The site on which you want to deploy the KMS instance. Valid values: Regions Outside Chinese Mainland and Regions in Chinese Mainland.
Instance Type
The type of the KMS instance. Valid values:
Software Key Management: allows you to create a key store. You can manage the lifecycles of keys and use keys for encryption and decryption.
Hardware Key Management: allows you to manage the keys that are stored in a hardware security module (HSM) cluster and helps you quickly build a key management center in the cloud.
Value-added Plan: provides the instance backup feature and the default key rotation feature. For more information, see Backups and Configure key rotation.
Region
The region of the KMS instance. For more information, see Supported regions.
Computing Performance
The computing performance of the KMS instance. For more information, see Performance data.
If the provided computing performance of KMS instances of the software key management type on the buy page cannot meet your business requirements, you can submit a ticket to contact your account manager to apply for the computing performance of 10,000 QPS or 20,000 QPS.
Number of Keys
The maximum number of keys that can be created in the KMS instance.
Number of Secrets
The maximum number of secrets that can be created in the KMS instance.
Access Management Quantity
The quota of objects that are allowed to access the KMS instance. The quota includes the number of principals that use the resources of the KMS instance and the number of virtual private clouds (VPCs) that are associated with the KMS instance. Default value: 1.
For example, if your KMS instance needs to be associated with three VPCs and shared with two principals, specify a value of at least 5 for the parameter to meet your business requirements.
Log Analysis
Specifies whether to enable the log analysis feature. For more information, see Overview of Simple Log Service for KMS.
Log Storage Capacity
The storage capacity for logs, with a minimum allocation of 1,000 GB. The capacity increases in increments of 1,000 GB. For more information about how to evaluate the storage capacity, see Overview of Simple Log Service for KMS.
purchase quantity
The number of KMS instances that you want to purchase.
ImportantIn most cases, you need to purchase only one KMS instance. If you want to purchase more than one KMS instance, submit a ticket.
Duration
The subscription duration of the KMS instance.
NoteYou can select Auto-renewal to automatically renew the KMS instance when the instance expires.
Read and select Terms of Service, and click Pay to complete the payment.
The system requires 1 to 5 minutes to create the KMS instance. You can view the created instance on the Instances page.
Step 2: Enable the KMS instance
After you purchase a KMS instance, you must enable the instance to use the features of Key Management and Secrets Manager of KMS.
Enable a KMS instance of the software key management type
Prerequisites
A virtual private cloud (VPC) and a vSwitch are available in the region of the KMS instance.
Before you enable the KMS instance, we recommend that you log on to the VPC console and view the existing VPCs, vSwitches, and zones where the vSwitches reside. You can also create a VPC and a vSwitch. For more information, see Create a VPC and a vSwitch or Create a vSwitch.
Alibaba Cloud DNS PrivateZone is activated. If you use an account on the China site (aliyun.com) to purchase a KMS instance outside the Chinese mainland or use an account on the International site (alibabacloud.com) to purchase a KMS instance in the Chinese mainland, you must manually activate Alibaba Cloud DNS PrivateZone. For more information, see Activate Alibaba Cloud DNS PrivateZone.
NoteIf you use an account on the China site (aliyun.com) to purchase a KMS instance in the Chinese mainland or use an account on the International site (alibabacloud.com) to purchase a KMS instance outside the Chinese mainland, Alibaba Cloud DNS PrivateZone is automatically activated.
The fees for domain name resolution are billed to KMS. You do not need to complete payments on the Alibaba Cloud DNS PrivateZone side.
Procedure
Log on to the KMS console. In the top navigation bar, select the required region. In the left-side navigation pane, click Instances.
On the Software Key Management tab, find the KMS instance that you want to enable and click Enable in the Actions column.
In the Enable KMS Instance panel, configure the parameters and click OK.
Parameter
Description
Dual-zone Deployment
Select two zones. Dual-zone deployment improves service availability and disaster recovery capabilities.
VPC
Select the ID of the VPC of the KMS instance.
vSwitch
Select the vSwitch in the two zones. The vSwitch must have at least one available IP address.
Wait for approximately 30 minutes and then refresh the page. If the status of the KMS instance changes to Enabled, the KMS instance is enabled.
Enable a KMS instance of the hardware key management type
Prerequisites
An HSM cluster to which the KMS instance is connected is available. For more information, see Configure an HSM cluster for a KMS instance of the hardware key management type.
Alibaba Cloud DNS PrivateZone is activated. If you use an account on the China site (aliyun.com) to purchase a KMS instance outside the Chinese mainland or use an account on the International site (alibabacloud.com) to purchase a KMS instance in the Chinese mainland, you must manually activate Alibaba Cloud DNS PrivateZone. For more information, see Activate Alibaba Cloud DNS PrivateZone.
NoteIf you use an account on the China site (aliyun.com) to purchase a KMS instance in the Chinese mainland or use an account on the International site (alibabacloud.com) to purchase a KMS instance outside the Chinese mainland, Alibaba Cloud DNS PrivateZone is automatically activated.
The fees for domain name resolution are billed to KMS. You do not need to complete payments on the Alibaba Cloud DNS PrivateZone side.
Two vSwitches are available in the VPC of the KMS instance.
(Recommended) Use the two vSwitches that are bound to your HSM: You do not need to create vSwitches. Make sure that four available IP addresses are reserved for each vSwitch.
Do not use the two vSwitches that are bound to your HSM: You need to create two vSwitches in different zones. Make sure that four available IP addresses are reserved for each vSwitch. For more information, see Create a vSwitch.
To view the number of available IP addresses on a vSwitch, you can perform the following operations: Log on to the VPC console. On the vSwitch page, click the ID of the vSwitch.
Procedure
Log on to the KMS console. In the top navigation bar, select the required region. In the left-side navigation pane, click Instances.
On the Hardware Key Management tab, find the KMS instance that you want to enable and click Enable in the Actions column.
In the Connect to HSM panel, specify an HSM cluster and click Connect to HSM. To specify an HSM cluster, you must configure the following parameters.
Parameter
Description
Configure HSM Cluster
Select the HSM cluster that you created in Cloud Hardware Security Module.
NoteYou can connect a KMS instance of the hardware key management type to only one HSM cluster.
Configure HSM Access Secret.
Username: the username of the crypto user. The value is fixed as
kmsuser.Password: the password of the crypto user. Enter the password that you specified when you created the crypto user.
Security Domain Certificate: a root certification authority (CA) certificate in the PEM format. To obtain the certificate, perform the following operations: Log on to the Cloud Hardware Security Module console. Find the HSM cluster and the master HSM in the cluster. Click the
icon to the right of the ID of the master HSM. In the Cluster Details dialog box, download the ClusterOwnerCertificate file.
Dual-zone Deployment
Select two zones. Dual-zone deployment improves service availability and disaster recovery capabilities.
VPC
Select the ID of the VPC of the KMS instance.
vSwitch
Select the ID of a vSwitch in one zone that you selected. Four available IP addresses must be reserved for the vSwitch.
vSwitch
Select the ID of a vSwitch in the other zone that you selected. Four available IP addresses must be reserved for the vSwitch.
If you configured the Number of Secrets parameter when you purchased the KMS instance, the system requires approximately 30 minutes to enable the KMS instance. Wait approximately 30 minutes and then refresh the page. If you did not configure the Number of Secrets parameter when you purchased the KMS instance, the system requires approximately 10 minutes to enable the KMS instance. Wait approximately 10 minutes and then refresh the page. If the status of the KMS instance changes to Enabled, the KMS instance is enabled.
FAQ
Why is a KMS instance always in the Enabling state when I enable the instance?
What do I do if an error occurs when I enable an instance of the software key management type?
What do I do if an error occurs when I enable an instance of the hardware key management type?
How do I configure an HSM cluster for a KMS instance of the hardware key management type?