All Products
Search

This Product

    Key Management Service:CreatePolicy

    Document Center

    Key Management Service:CreatePolicy

    Last Updated:Aug 28, 2026

    Creates a permission policy that specifies which keys and secrets an AAP can access.

    Operation description

    To perform cryptographic operations and retrieve secret values, self-managed applications must access a Key Management Service (KMS) instance through a client key. To create a client key-based application access point (AAP):

    1.Create an access control rule: Configure the private IP addresses or private CIDR blocks allowed to access a KMS instance. For more information, see CreateNetworkRule.

    2.Create a permission policy: Configure the accessible keys and secrets, and bind access control rules to them.

    3.Create an AAP: Configure an authentication method and bind a permission policy to the AAP. For more information, see CreateApplicationAccessPoint.

    4.Create a client key: Configure the encryption password and validity period, and bind the client key to an AAP. For more information, see CreateClientKey.

    For more information about the RAM permissions required to call this operation, see Resource Access Management.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    No authorization for this operation. If you encounter issues with this operation, contact technical support.

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    Name

    string

    Yes

    The name of the permission policy.

    policy_test
    Description

    string

    No

    The description.

    policy description
    KmsInstance

    string

    No

    The scope of the permission policy. Specify the KMS instance that you want to access.

    kst-hzz634e67d126u9p9****
    Permissions

    string

    Yes

    The operations that can be performed. Valid values:

    • RbacPermission/Template/CryptoServiceKeyUser: allows you to perform cryptographic operations.

    • RbacPermission/Template/CryptoServiceSecretUser: allows you to perform secret-related operations.

    You can select both.

    ["RbacPermission/Template/CryptoServiceKeyUser", "RbacPermission/Template/CryptoServiceSecretUser"]
    Resources

    string

    Yes

    The keys and secrets that can be accessed.

    • Key: Enter a key in the key/${KeyId} format. To allow access to all keys of a KMS instance, enter key/*.

    • Secret: Enter a secret in the secret/${SecretName} format. To allow access to all secrets of a KMS instance, enter secret/*.

    ["secret/acs/ram/user/ram-secret", "secret/acs/ram/user/acr-master", "key/key-hzz63d9c8d3dfv8cv****"]
    AccessControlRules

    string

    No

    The name of the access control rule.

    Note

    For more information about how to query created access control rules, see ListNetworkRules.

    {"NetworkRules":["kst-hzz62ee817bvyyr5x****.efkd","kst-hzz62ee817bvyyr5x****.eyyp"]}

    Response elements

    Element

    Type

    Description

    Example

    object

    RequestId

    string

    The request ID.

    3bf02f7a-015b-4f34-be0f-c4543fda2d33
    Arn

    string

    The ARN of the permission policy.

    acs:kms:cn-hangzhou:119285303511****:policy/policy_test
    Name

    string

    The name of the permission policy.

    policy_test
    Description

    string

    The description.

    policy description
    KmsInstance

    string

    The scope of the permission policy.

    kst-hzz634e67d126u9p9****
    Permissions

    string

    The operations that can be performed.

    ["RbacPermission/Template/CryptoServiceKeyUser", "RbacPermission/Template/CryptoServiceSecretUser"]
    Resources

    string

    The keys and secrets that can be accessed.

    • key/* indicates that all keys of the KMS instance can be accessed.

    • secret/* indicates that all secrets of the KMS instance can be accessed.

    ["secret/acs/ram/user/ram-secret", "secret/acs/ram/user/acr-master", "key/key-hzz63d9c8d3dfv8cv****"]
    AccessControlRules

    string

    The name of the access control rule.

    {"NetworkRules":["kst-hzz62ee817bvyyr5x****.efkd","kst-hzz62ee817bvyyr5x****.eyyp"]}

    Examples

    Success response

    JSON format

    {
  "RequestId": "3bf02f7a-015b-4f34-be0f-c4543fda2d33",
  "Arn": "acs:kms:cn-hangzhou:119285303511****:policy/policy_test",
  "Name": "policy_test",
  "Description": "policy  description",
  "KmsInstance": "kst-hzz634e67d126u9p9****",
  "Permissions": "[\"RbacPermission/Template/CryptoServiceKeyUser\", \"RbacPermission/Template/CryptoServiceSecretUser\"]",
  "Resources": "[\"secret/acs/ram/user/ram-secret\", \"secret/acs/ram/user/acr-master\", \"key/key-hzz63d9c8d3dfv8cv****\"]",
  "AccessControlRules": "{\"NetworkRules\":[\"kst-hzz62ee817bvyyr5x****.efkd\",\"kst-hzz62ee817bvyyr5x****.eyyp\"]}"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 InvalidParameter The specified parameter is not valid. An invalid value is specified for the parameter.
    404 InvalidAccessKeyId.NotFound The Access Key ID provided does not exist in our records.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.