Creates a client key for authenticating application access to a KMS instance.
Operation description
Self-managed applications must use a client key to access a Key Management Service (KMS) instance for cryptographic operations and secret retrieval. To create a client key-based application access point (AAP), follow these steps:
1.Create an access control rule: Configure the private IP addresses or private CIDR blocks allowed to access a KMS instance. For more information, see CreateNetworkRule.
2.Create a permission policy: Configure the keys and secrets that can be accessed, and bind access control rules to them. For more information, see CreatePolicy.
3.Create an AAP: Configure an authentication method and bind a permission policy to the AAP. For more information, see CreateApplicationAccessPoint.
4.Create a client key: Configure the encryption password and validity period of the client key, and bind it to an AAP.
Precautions
Client keys have a validity period. After a client key expires, applications that use it can no longer access the KMS instance. Replace the client key before it expires, and delete the expired key after the replacement is in use.
For the RAM permissions required to call this operation, see Resource Access Management.
Try it now
Test
RAM authorization
Request parameters
|
Parameter |
Type |
Required |
Description |
Example |
| AapName |
string |
Yes |
The operation that you want to perform. Set the value to CreateClientKey. |
aap_test |
| Password |
string |
Yes |
The name of the AAP. |
bcfefe15-46f0**** |
| NotAfter |
string |
No |
The encryption password of the client key. The password must be 8 to 64 characters in length and must contain at least two of the following types: digits, letters, and special characters. Special characters include |
2028-08-31T17:14:33Z |
| NotBefore |
string |
No |
The end of the validity period of the client key. Specify the time in the ISO 8601 standard. The time must be in UTC. The time must be in the yyyy-MM-ddTHH:mm:ssZ format. Note
|
2023-08-31T17:14:33Z |
Response elements
|
Element |
Type |
Description |
Example |
|
object |
|||
| RequestId |
string |
The beginning of the validity period of the client key. Specify the time in the ISO 8601 standard. The time must be in UTC. The time must be in the yyyy-MM-ddTHH:mm:ssZ format. Note
|
2312e45f-b2fa-4c34-ad94-3eca50932916 |
| ClientKeyId |
string |
The request ID. |
KAAP.66abf237-63f6-4625-b8cf-47e1086e**** |
| KeyAlgorithm |
string |
The ID of the client key. |
RSA_2048 |
| PrivateKeyData |
string |
The algorithm that is used to encrypt the private key of the client key. Currently, only RSA_2048 is supported. |
MIIJqwIBAzCCCXcGCSqGSIb3DQEHAaCCCWgEgglkMIIJYDCCBBcGCSqGSIb3DQEHBqCCBAgwgg****** |
| NotBefore |
string |
The private key of the client key. |
2023-08-31T17:14:33Z |
| NotAfter |
string |
The beginning of the validity period of the client key. |
2028-08-31T17:14:33Z |
Examples
Success response
JSON format
{
"RequestId": "2312e45f-b2fa-4c34-ad94-3eca50932916",
"ClientKeyId": "KAAP.66abf237-63f6-4625-b8cf-47e1086e****",
"KeyAlgorithm": "RSA_2048",
"PrivateKeyData": "MIIJqwIBAzCCCXcGCSqGSIb3DQEHAaCCCWgEgglkMIIJYDCCBBcGCSqGSIb3DQEHBqCCBAgwgg******",
"NotBefore": "2023-08-31T17:14:33Z",
"NotAfter": "2028-08-31T17:14:33Z"
}Error codes
See Error Codes for a complete list.
Release notes
See Release Notes for a complete list.