Key Management Service:Purchase and enable a KMS instance

Step 1: Purchase a KMS instance

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resources > Instances.

2. On the Instances page, click Create Instance, select a billing method and instance specifications, and click Buy Now.

   Subscription

   Parameter	Description
   Site	The site where the instance's region is located. Options: International regions and Chinese mainland regions.
   Key management type	KMS provides free default keys (service keys and customer master keys) for cloud product encryption in each region. Default keys have limited features and require no instance purchase. You pay only for value-added services such as key rotation. Before purchasing, review Select a KMS instance type. Purchase a KMS instance A software key management instance suits most use cases. Select a hardware key management instance if you need physical-level security or strict compliance such as financial regulations. Software Key Management: Keys are stored in a dedicated database for your instance. Hardware Key Management: Key generation, storage, encryption, and decryption rely on a dedicated Hardware Security Module (HSM) that is compliant with Chinese national cryptographic standards or FIPS 140-3 Level 3. If you select this type, you must also purchase an HSM. Configure an HSM cluster for a hardware key management instance. Purchase value-added services for keys Instance Backup: Software key management instances only. KMS provides free 90-day data backups by default. If this does not meet your needs, purchase the Instance Backup service. Backup management. Default key rotation: Only free default keys require this value-added service. Default key rotation. If you purchased a KMS instance, the keys in the instance support rotation by default and do not require this value-added service.
   Region	Select the same region as your deployed services. Regions and availability zones.
   Deployment mode	KMS instances support dual-zone or multi-zone configurations for high availability, disaster recovery, and load balancing. Note In the Philippines (Manila) and Thailand (Bangkok) regions, only a single zone is available, so KMS instances are deployed in a single zone by default. A multi-zone deployment can be configured with up to three zones. For information about the number of zones in each region, see Regions and zones.
   Compute performance	The performance specifications of the instance. For example, 2000 means up to 2,000 QPS for symmetric operations and 300 QPS for asymmetric operations independently. Note If you need a software key management instance with a compute performance of 10,000 or 20,000, contact us.
   Key quota	The quota for keys. The default is 1,000. Counted by key versions, not keys. For example, one key with five versions uses five quota units.
   Secret quota	The quota for secrets. The default is 0. Counted by secrets, regardless of version count. Note Skip this if you do not use secrets. You can add a secret quota later by upgrading.
   Data key quota	The quota for data keys (DK). The default is 0. Counted by data key versions, not data keys. For example, one data key (DK) with five versions uses five quota units.
   Access management count	This quota applies to two features: Access a KMS instance from multiple VPCs in the same region: Allows multiple VPCs in the same region to access KMS resources. One quota unit is required for each VPC. Share a KMS instance across multiple accounts: The number of quota units you need equals the number of Alibaba Cloud accounts with which you share the instance. Example: associating with three VPCs and sharing with two accounts requires a quota of at least 5. Default: 1 (the bound VPC).
   Log analysis	Whether to enable log analysis. Log Service overview. Warning Log analysis cannot be disabled once enabled. Check for costs.
   Log storage capacity	Minimum 1,000 GB, expandable in 1,000 GB increments. For capacity evaluation, please refer to Estimate your storage capacity.
   Quantity	Number of KMS instances to purchase. Important One instance is sufficient for most use cases. To purchase multiple instances, contact us.
   Duration	Subscription duration. Note You can select Auto-renewal on expiration for automatic renewal.

   Pay-as-you-go

   Parameter	Description
   Site	The site where the instance's region is located. Options: International regions and Chinese mainland regions.
   Key management type	A software key management instance suits most use cases. Select a hardware key management instance if you need physical-level security or strict compliance such as financial regulations. Software Key Management: Keys are stored in a dedicated database for your instance. Hardware Key Management: Key generation, storage, encryption, and decryption rely on a dedicated Hardware Security Module (HSM) that is compliant with Chinese national cryptographic standards or FIPS 140-3 Level 3. If you select this type, you must also purchase an HSM. For more information, see Configure an HSM cluster for a hardware key management instance.
   Region	Select the same region as your deployed services. Regions and availability zones.
   Compute performance	The performance specifications of the instance.
   Key quota	The quota for keys. The default is 1,000. Counted by key versions, not keys.
   Secret quota	The quota for secrets. The default is 0. Note Skip this if you do not use secrets. You can add a secret quota later by upgrading.

   After purchase, go to the Instances page to enable the instance.

   1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resources > Instances.

   2. On the Instances page, click Create Instance, find the target KMS instance, and click Enable in the Actions column.

   3. In the Connect to HSM panel, configure the settings and then click Connect to HSM to specify the HSM cluster.

      1. Instance Name: A custom name for the KMS instance. The name can contain letters, digits, and the following special characters: _/+=.@-.

      2. Select Cluster: Select the HSM cluster that you configured in CloudHSM.

         Note

         A hardware key management instance can be bound to only one HSM cluster.

   4. Enablement takes about 30 minutes. Refresh the page to confirm the instance status changes to Enabled.

Step 2: Enable a KMS instance

After you purchase a KMS instance, you must enable it before you can use key management and secret management features.

Unsubscribe from a KMS instance

KMS supports partial refund unsubscription for instances in the Pending Enable or Enabled state. Full refunds are not available.

1. Go to the Refund page under Expenses > Refunds in the Alibaba Cloud console.

2. On the Resources tab, set Product to Key Management Service (KMS), find the target instance, and click Unsubscribe in the Actions column.

3. Review the resource information, refund terms, and refund amount on the confirmation page.

4. Select the confirmation checkboxes (confirm the refund amount and confirm that data has been backed up and migrated) on the lower-left, then click Confirm Unsubscription.

Troubleshooting

FAQ

• What is a KMS-managed HSM?

  A KMS-managed HSM is an HSM instance that KMS automatically creates when you purchase a hardware key management instance, based on the HSM configuration you provide at the time of purchase.

• Can I scale out a KMS-managed HSM cluster?

  No. You can only perform backup operations. All other operations are not supported.

• Why does the instance keep showing "Connecting" during enablement?

  When enabling a KMS instance (including software key management instances and hardware key management instances), wait about 30 minutes and then refresh the page. When the instance status changes to Enabled, the KMS instance is enabled.

• What if I see "Connection failed" when enabling a hardware key management instance?

  Check whether the HSM access credentials are correct. For more information about HSM access credentials, see Create and activate a cluster.

• What do I do if I get a "ZoneIds is not valid" or "vswitch_ids invalid" error when enabling a KMS instance using IAC or API?

  This error typically occurs when the zone or vSwitch parameters you pass do not match the KMS instance specifications. The following describes two common scenarios and their solutions:

  • Scenario 1: Availability zone count mismatch

    This error is triggered when you purchase a dual-zone KMS instance but pass three zone IDs (ZoneIds) in an IAC Stack or API call.

    Solution: Verify the number of zones supported by your instance specification. If you need to configure three zones, purchase an instance specification that supports multi-zone deployment.

  • Scenario 2: Incorrect vSwitch parameter

    This error is triggered when you pass multiple vswitch_ids values in a DKMS ConnectKmsInstance API call or Terraform configuration. The ConnectKmsInstance API only accepts a single vSwitch ID.

    Solution: Modify your configuration to pass only a single vSwitch ID (vswitch_id), then retry the operation.