Key Management Service:CreateKey

The description of the key.
The description can be 0 to 8,192 characters in length.

The usage of the key. Valid values:

• ENCRYPT/DECRYPT: encrypts and decrypts data.

• SIGN/VERIFY: generates and verifies digital signatures.

Default value: If the key supports signature verification, the default value is SIGN/VERIFY. Otherwise, the default value is ENCRYPT/DECRYPT.

The source of the key material. Valid values:

• Aliyun_KMS (default): The key material is generated by Alibaba Cloud KMS.

• EXTERNAL: The key material is imported.

• If you set this parameter to EXTERNAL, import key material. For more information, see Import key material for a symmetric key or Import key material for an asymmetric key.

You do not need to specify this parameter. KMS automatically sets an appropriate protection level for your key.

The protection level of the key. Valid values:

• SOFTWARE

• HSM

• If you do not specify DKMSInstanceId, leave this parameter empty. KMS sets the protection level. If a managed HSM is available in the region, KMS sets this parameter to HSM. Otherwise, KMS sets this parameter to SOFTWARE. For more information, see Managed HSM overview.

Specifies whether to enable automatic key rotation. Valid values:

• true: enables automatic key rotation.

• false (default): disables automatic key rotation.

This parameter is valid only when the key management type of the key supports automatic rotation. For more information, see Key rotation.

The automatic rotation period. The format is `integer[unit]`. `integer` indicates the length of the period. `unit` indicates the unit of time. Valid units: d (day), h (hour), m (minute), and s (second). For example, both 7d and 604800s represent a period of 7 days.

• If the key is a default key, the value is 365d.

• If the key is a software-protected key, the value can be from 7d to 365d.

• If the key is a hardware-protected key, automatic rotation is not supported.

The specification of the key. The valid values vary based on the key management type. For more information about key specifications, supported standards, and algorithms, see Key management types and key specifications.

The ID of the KMS instance.

The tags to bind to the key. Each tag consists of a key-value pair (Key:Value), which includes a tag key and a tag value.

Specify a maximum of 20 tags. To specify multiple tags, use the following format: [{"TagKey":"key1","TagValue":"value1"},{"TagKey":"key2","TagValue":"value2"},...].

Each tag key and tag value can be up to 128 characters in length and can contain uppercase letters, lowercase letters, digits, forward slashes (/), backslashes (\), underscores (_), hyphens (-), periods (.), plus signs (+), equal signs (=), colons (:), and at signs (@).

The content of the key policy. The value is in the JSON format. The policy can be up to 32,768 bytes in length. For more information about key policies, see Key policy overview. If you do not specify this parameter, the default credential policy is used.

A key policy contains the following content:

• Version: The version of the key policy. Only version 1 is supported.

• Statement: The statements of the key policy. Each key policy contains one or more statements.

The following is the format of a key policy:

{
  "Version": "1",
  "Statement": [
    {
      "Sid": "Enable RAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "RAM": ["acs:ram::112890462****:root"]
      },
      "Action": [
        "kms:*"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "condition operator": {
          "condition key": "condition value"
        }
      }
    }
  ]
}

Details about a statement:

• Sid: (Optional) The custom statement identifier. The identifier can be up to 128 characters in length and can contain uppercase letters (A-Z), lowercase letters (a-z), digits (0-9), and special characters, including underscores (_), forward slashes (/), plus signs (+), equal signs (=), periods (.), at signs (@), and hyphens (-).

• Effect: (Required) The effect of the policy statement. Valid values: Allow and Deny.

• Principal: (Required) The principal to which the permission is granted. Set this parameter to the current Alibaba Cloud account (the Alibaba Cloud account to which the key belongs), a RAM user or RAM role of the current Alibaba Cloud account, or a RAM user or RAM role of another Alibaba Cloud account.

• Action: (Required) The API operations that are allowed or denied. The value must start with "kms:". For a list of supported operations, see Key policy overview. If you specify an operation that is not in the list, the setting does not take effect.

• Resource: (Required) The value can only be *, which indicates the current KMS key.

• Condition: (Optional) The conditions for the authorization to take effect. Use conditions to evaluate the context of an API request to determine whether to apply the policy statement. The format is "Condition": {"condition operator": {"condition key": "condition value"}}. For more information, see Key policy overview.

The key storage location. This parameter is valid only when DKMSInstanceId is specified for a hardware key management instance. Valid values:

• HsmInternal (default): The key is stored in an HSM and does not support rotation.

• HsmEncryptedDatabase: The key is stored in a database.

  • Symmetric keys: Rotation is supported.

  • Asymmetric keys: Rotation is not supported.