Creates a network access control rule that specifies the private IP addresses or private CIDR blocks allowed to access a Key Management Service (KMS) instance.
Operation description
Self-managed applications must use a client key to access a KMS instance for cryptographic operations and secret retrieval. To create a client key-based application access point (AAP), complete the following steps:
1.Create a network access control rule: Specify the private IP addresses or private CIDR blocks allowed to access a KMS instance.
2.Create a permission policy: Define the keys and secrets that can be accessed and bind access control rules to them. For more information, see CreatePolicy.
3.Create an AAP: Configure an authentication method and bind a permission policy to the AAP. For more information, see CreateApplicationAccessPoint.
4.Create a client key: Set the encryption password and validity period, and bind the client key to an AAP. For more information, see CreateClientKey.
For information about the RAM permissions required to call this operation, see Resource Access Management.
Try it now
Test
RAM authorization
Request parameters
|
Parameter |
Type |
Required |
Description |
Example |
| Name |
string |
Yes |
The name of the access control rule. |
networkrule_test |
| Type |
string |
Yes |
The network type. Only private IP addresses are supported. Set the value to Private. |
Private |
| Description |
string |
No |
The description. |
networkrule description |
| SourcePrivateIp |
string |
No |
The private IP address or private CIDR block. Separate multiple items with commas (,). |
["192.10.XX.XX","192.168.XX.XX/24"] |
Response elements
|
Element |
Type |
Description |
Example |
|
object |
|||
| Type |
string |
The network type. |
Private |
| RequestId |
string |
The request ID. |
3bf02f7a-015b-4f93-be0f-cc043fda2dd3 |
| Description |
string |
The description. |
networkrule description |
| SourcePrivateIp |
string |
The private IP address or private CIDR block. |
["192.10.XX.XX","192.168.XX.XX/24"] |
| Name |
string |
The name of the access control rule. |
networkrule_test |
| Arn |
string |
The ARN of the access control rule. |
acs:kms:cn-hangzhou:119285303511****:network/networkrule_test |
Examples
Success response
JSON format
{
"Type": "Private",
"RequestId": "3bf02f7a-015b-4f93-be0f-cc043fda2dd3",
"Description": "networkrule description",
"SourcePrivateIp": "[\"192.10.XX.XX\",\"192.168.XX.XX/24\"]",
"Name": "networkrule_test",
"Arn": "acs:kms:cn-hangzhou:119285303511****:network/networkrule_test"
}Error codes
See Error Codes for a complete list.
Release notes
See Release Notes for a complete list.