Creates an application access point (AAP) that applications use to access a KMS instance.
Operation description
Self-managed applications use client keys to access a Key Management Service (KMS) instance for cryptographic operations and secret retrieval. To create a client key-based AAP, complete the following steps:
1.Create a network access rule: Configure the private IP addresses or private CIDR blocks allowed to access KMS. For more information, see CreateNetworkRule.
2.Create a permission policy: Configure the keys and secrets that are allowed to access, and bind network access rules to them. For more information, see CreatePolicy.
3.Create an AAP: Configure an authentication method and bind a permission policy to the AAP.
4.Create a client key: Configure the encryption password and validity period of a client key, and bind the client key to an AAP. For more information, see CreateClientKey.
For the access policy required for a RAM user or RAM role to call this operation, see Resource Access Management.
Try it now
Test
RAM authorization
Request parameters
|
Parameter |
Type |
Required |
Description |
Example |
| Name |
string |
Yes |
The name of the AAP. |
aap_test |
| Description |
string |
No |
The description of the AAP. |
aap description |
| AuthenticationMethod |
string |
No |
The authentication method. Currently, only ClientKey is supported. |
ClientKey |
| Policies |
string |
Yes |
The permission policy. Note
You can bind up to three permission policies to each AAP. |
["kst-hzz62ee817bvyyr5x****.efkd","kst-hzz62ee817bvyyr5x****.eyyp"] |
Response elements
|
Element |
Type |
Description |
Example |
|
object |
|||
| RequestId |
string |
The request ID. |
bcfefe15-46f0-44a3-bd96-3d422474b71a |
| Description |
string |
The description of the AAP. |
aap description |
| Policies |
string |
The permission policy. |
["kst-hzz62ee817bvyyr5x****.efkd","kst-hzz62ee817bvyyr5x****.eyyp"] |
| Name |
string |
The name of the AAP. |
aap_test |
| Arn |
string |
The Alibaba Cloud Resource Name (ARN) of the AAP. |
acs:kms:cn-hangzhou:119285303511****:applicationaccesspoint/aap_test |
| AuthenticationMethod |
string |
The authentication method. |
ClientKey |
Examples
Success response
JSON format
{
"RequestId": "bcfefe15-46f0-44a3-bd96-3d422474b71a",
"Description": "aap description",
"Policies": "[\"kst-hzz62ee817bvyyr5x****.efkd\",\"kst-hzz62ee817bvyyr5x****.eyyp\"]",
"Name": "aap_test",
"Arn": "acs:kms:cn-hangzhou:119285303511****:applicationaccesspoint/aap_test",
"AuthenticationMethod": "ClientKey"
}Error codes
|
HTTP status code |
Error code |
Error message |
Description |
|---|---|---|---|
| 409 | Rejected.ResourceExist | The request was rejected because the resource already exists. | The resource already exists. |
See Error Codes for a complete list.
Release notes
See Release Notes for a complete list.