Key Management Service:Create access credentials

1. Log on to the RAM console. On the Users page, click the name of the target RAM user.

2. On the Secret Management tab, in the AccessKey section, click Create AccessKey.

3. Grant the RAM user permissions to access KMS.

   • Method 1: Configure an identity-based policy

     In the Actions column of the RAM user, click Grant Permission to attach a built-in system permission policy for KMS to the RAM user. For more information about the system permission policies for KMS, see System policies for KMS.

     Note

     You can also create custom permission policies. For more information, see Create a custom policy.

   • Method 2: Configure a resource-based policy

     KMS supports resource-based policies that grant access permissions for individual keys and secrets. You can use these policies to control which Alibaba Cloud accounts, RAM users, and RAM roles can manage or use KMS keys and secrets. For more information, see Key policies and Secret policies.

An ECS instance RAM role allows you to obtain a temporary access credential (STS token) from within an ECS instance to call KMS API operations, without needing to configure an AccessKey pair.

For more information, see Instance RAM roles.

1. Log on to the RAM console and create a RAM role for a trusted Alibaba Cloud service.

   • Trusted Entity Type: Select Elastic Compute Service.

   • Trusted entity: Select Elastic Compute Service (ECS).

2. Grant the RAM role permissions to access KMS.

   • Method 1: Configure an identity-based policy

     In the Actions column of the RAM role, click Grant Permission to attach a built-in system permission policy for KMS to the RAM role. For more information about the system permission policies for KMS, see System policies for KMS.

     Note

     You can also create custom permission policies. For more information, see Create a custom policy.

   • Method 2: Configure a resource-based policy

     KMS supports resource-based policies that grant access permissions for individual keys and secrets. You can use these policies to control which Alibaba Cloud accounts, RAM users, and RAM roles can manage or use KMS keys and secrets. For more information, see Key policies and Secret policies.

3. Log on to the ECS console and attach the RAM role to an ECS instance.

Security Token Service (STS) issues a temporary access credential, an STS token, to a RAM user or RAM role. This token allows access to KMS with specific permissions for a limited validity period. After the token expires, it automatically becomes invalid.

1. Log on to the RAM console to create a RAM user or a RAM role. For more information, see Create a RAM user and Create a RAM role.

2. Grant the AliyunSTSAssumeRoleAccess permission to the RAM user or RAM role. For more information, see Manage RAM user permissions and Grant permissions to a RAM role.

3. Grant the RAM user or RAM role permissions to access KMS.

   • Method 1: Configure an identity-based policy

     In the Actions column of the RAM role or user, click Grant Permission to attach a built-in system permission policy for KMS. For more information about the system permission policies for KMS, see System policies for KMS.

     Note

     You can also create custom permission policies. For more information, see Create a custom policy.

   • Method 2: Configure a resource-based policy

     KMS supports resource-based policies that grant access permissions for individual keys and secrets. You can use these policies to control which Alibaba Cloud accounts, RAM users, and RAM roles can manage or use KMS keys and secrets. For more information, see Key policies and Secret policies.

4. Use the RAM user or RAM role to call the STS AssumeRole operation to obtain a temporary STS access credential. For more information, see AssumeRole.

RAM users or cloud services can assume a role to obtain temporary permissions (STS token) instead of using long-term keys, which reduces the risk of key leaks. For example, in a temporary data processing task, a RAM user or cloud service temporarily assumes a role with a specific RamRoleArn. After the task is complete, the role permissions are revoked, minimizing the risk of exposure.

1. Create a user AccessKey pair

   1. Log on to the RAM console. In the left-side navigation pane, choose Identities > Users. On the Users page, click the name of the target RAM user.

   2. Attach the AliyunSTSAssumeRoleAccess system policy or a custom policy that includes the sts:AssumeRole action to the RAM user.

   3. On the Secret Management tab, in the AccessKey section, click Create AccessKey.

2. Create and authorize a RAM role:

   1. In the left-side navigation pane, choose Identities > Roles. On the Roles page, click Create Role. For more information, see Create a RAM role.

   2. Grant the RAM role permissions to access KMS.

      • Method 1: Configure an identity-based policy

        In the Actions column of the RAM role, click Grant Permission to attach a built-in system permission policy for KMS to the RAM role. For more information about the system permission policies for KMS, see System policies for KMS.

        Note

        You can also create custom permission policies. For more information, see Create a custom policy.

      • Method 2: Configure a resource-based policy

        KMS supports resource-based policies that grant access permissions for individual keys and secrets. You can use these policies to control which Alibaba Cloud accounts, RAM users, and RAM roles can manage or use KMS keys and secrets. For more information, see Key policies and Secret policies.

3. Obtain the RamRoleArn of the target RAM role. For more information, see View the information about a RAM role.

   1. In the left-side navigation pane, choose Identities > Roles. On the Roles page, click the name of the target role.

   2. On the role details page, find the RamRoleArn in the ARN section.

      Note

      The RamRoleArn is the Alibaba Cloud Resource Name (ARN) of the RAM role to assume. The format is acs:ram::$accountID:role/$roleName, where $accountID is the Alibaba Cloud account ID and $roleName is the RAM role name.