GenerateMac - Key Management Service - Alibaba Cloud Documentation Center

Operation description

For details about the access policy required when a RAM user or RAM role invokes this operation, refer to access control.

This operation can be invoked through a shared gateway or a dedicated gateway. For more information, refer to Alibaba Cloud SDK.

Shared gateway: Access KMS through a public or VPC endpoint. This method requires you to enable the public network access switch. For more information, refer to accessing keys in a KMS instance over the Internet.
Dedicated gateway: Access KMS through a KMS private endpoint (<YOUR_KMS_INSTANCE_ID>.cryptoservice.kms.aliyuncs.com).

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request syntax

POST  HTTP/1.1

Request parameters

Parameter	Type	Required	Description	Example
KeyId	string	Yes	The ID of the key. You can also specify a key alias or a key Amazon Resource Name (ARN). For more information about aliases, refer to Manage key aliases. Note When you access a key that belongs to a different Alibaba Cloud account, you must specify the key ARN. The format of a key ARN is `acs:kms:${region}:${account}:key/${keyid}`.	key-hzz630494463ejqjx****
Message	string	Yes	The data for which you want to generate a message authentication code. The value is Base64-encoded. For example, if the hexadecimal data is `[0x31, 0x32, 0x33, 0x34]`, the corresponding Base64-encoded value is `MTIzNA==`.	VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIHRoZSBsYXp5IGRvZy4=
Algorithm	string	Yes	The algorithm that is used to generate the message authentication code. Valid values vary based on the key specification: HMAC_SM3 HMAC_SHA_224 HMAC_SHA_256 HMAC_SHA_384 HMAC_SHA_512	HMAC_SHA_256
DryRun	string	No	Specifies whether to enable DryRun mode. true: enabled false (default): disabled DryRun mode is used to test API calls and verify whether you have the required permissions on the corresponding resources and whether the request parameters are correctly configured. When DryRun mode is enabled, KMS always returns a failure and provides the failure reason. Failure reasons include: DryRunOperationError: The request would succeed without the DryRun parameter. ValidationError: The parameters specified in the request are invalid. AccessDeniedError: You are not authorized to perform this operation on the KMS resource.	false

Response elements

Element	Type	Description	Example
	object	Schema of Response
RequestId	string	The ID of the request. Alibaba Cloud generates a unique identifier for each request. You can use this ID to troubleshoot issues.	4c8ae23f-3a42-6791-a4ba-1faa77831c28
KeyId	string	The globally unique identifier of the customer master key (CMK). Note If the KeyId parameter in the request uses a CMK alias, the response returns the CMK identifier that corresponds to the alias.	key-hzz630494463ejqjx****
Algorithm	string	The algorithm that is used to generate the message authentication code. Valid values vary based on the key specification: HMAC_SM3 HMAC_SHA_224 HMAC_SHA_256 HMAC_SHA_384 HMAC_SHA_512	HMAC_SHA_256
Mac	string	The Base64-encoded message authenticate code.	vz1Snp+jGJbgydCFRWVWxAwIMdyfKCSp+jnMWQ==

Examples

Success response

JSON format

{
  "RequestId": "4c8ae23f-3a42-6791-a4ba-1faa77831c28",
  "KeyId": "key-hzz630494463ejqjx****",
  "Algorithm": "HMAC_SHA_256",
  "Mac": "vz1Snp+jGJbgydCFRWVWxAwIMdyfKCSp+jnMWQ=="
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.