Key Management Service:Manage application access points

View AAP details

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Application Access > Access Control (Formerly Access Point) .

2. On the Application Access tab, filter by Instance ID or AAP name to locate the target AAP.

3. Click the AAP to view its details.

   1. Policies: for more information about each item, see Overview of AAPs.

   2. Client Key: you can only view the client key's Key ID, Algorithm, Validity Period, and Created. The specific content of the client key cannot be viewed.

Change permission policies for an AAP

1. On the Application Access tab, locate the target AAP.

2. Click the AAP to open the details page. On the Policies tab, click Configure Permission Policy.

3. In the Update AAP panel, reselect Policies. You can select up to three.

   If existing policies do not meet your requirements, create a permission policy first.

Delete an AAP

1. On the Application Access tab, locate the target AAP. In the Actions column, click Delete.

2. After you complete security verification, KMS deletes the AAP.

Create a permission policy

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Application Access > Access Control (Formerly Access Point) .

2. On the Policies tab, click Create Policy. In the Create Permission Policy panel, configure the parameters and click Confirm.

   Parameter	Description
   Policy Name	Enter a name for the permission policy.
   Scope	If you select Private for Network Type when you create a network access rule, select a specific KMS instance. If you select Public or VPC for Network Type, select Shared KMS Gateway.
   RBAC Permissions	If you select a specific KMS instance for Scope: CryptoServiceKeyUser: Allows the use of keys in the KMS instance. This permission supports the cryptographic operations of the instance API. For more information, see Key-related operations. CryptoServiceSecretUser: Allows the use of secrets in the KMS instance. This permission supports the secret-related operations of the instance API. For more information, see Secret-related operations. If you select Scope for Shared KMS Gateway: SecretUser: Allows the use of all secrets under the current account. This permission supports the GetSecretValue OpenAPI operation.
   Accessible Resources	Select the keys and secrets that the application needs to access. Important If you select multiple secrets and the total length of the secret names exceeds the limit, you receive an "invalid parameter" error. In this case, use a wildcard to specify the accessible secrets. For example, if you set this parameter to secret/rds-ibm*, the application can access all secrets whose names have the prefix rds-ibm.
   Network Access Rules	Select the network access rule that you created. Note If you do not need to restrict access based on source IP addresses, you do not need to select a network access rule. However, for better security, we recommend configuring one.
   Description	Enter a description for the policy.

   After the permission policy is created, you must bind it to an AAP.

Edit a permission policy

Delete a permission policy

1. On the Policies tab, locate the target policy. In the Actions column, click Delete.

2. After confirming, in the Confirm dialog, click OK.

Create a network access rule

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Application Access > Access Control (Formerly Access Point) .

2. Click the Network Access Rules tab, and then click Create Network Access Rule.

3. In the Create Network Access Rule panel, configure the parameters and click OK.

   Parameter	Description
   Rule Name	Enter a name for the network access rule.
   Network Type	Private: The application uses a KMS instance endpoint to access keys and secrets. Public: The application uses a KMS service endpoint (public endpoint) to access secrets. VPC: The application uses a KMS service endpoint (VPC endpoint) to access secrets. This option is available only in the China (Hangzhou), China (Shanghai), China (Shenzhen), and China (Zhangjiakou) regions. Note Cryptographic operations: Supported only when you use the KMS instance SDK to access KMS through a KMS instance endpoint. This requires a network access rule with the Network Type set to Private. Retrieving secret values: You can use the KMS instance SDK or the secrets SDK. We recommend using the secrets SDK with a network access rule whose Network Type is set to Private to achieve higher QPS and better security. KMS instance SDK: The network type must be Private. The source IP address must be an IP address in the VPC associated with the KMS instance. Secrets SDK: The network type can be Private, Public, or VPC.
   Allowed Source IP Addresses	In most cases, enter the IP address of your application server. The IP address must correspond to the selected network type. If the network type is Private, enter an IP address from the VPC associated with the KMS instance. If the network type is Public, enter a public IP address. If the network type is VPC, enter a VPC ID and a VPC IP address.
   Description	Enter a description for the rule.

   After the network access rule is created, bind it to a permission policy.

Edit a network access rule

1. On the Network Access Rules tab, locate the target rule. In the Actions column, click Edit.

2. In the Modify Network Access Rule panel, modify Allowed Source IP Addresses, and then click OK.

Delete a network access rule

1. On the Network Access Rules tab, locate the target rule. In the Actions column, click Delete.

2. After confirming, in the Confirm panel, click OK.

Create a client key

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Application Access > Access Control (Formerly Access Point) .

2. Click the Application Access tab. Find the target application access point (AAP) by filtering by its Instance ID or name.

3. Click the name of the AAP. On the details page, click the Client Key tab, and then click Create Client Key.

4. In the Create Client Key dialog box, set the Encryption Password and Validity Period.

   • Encryption Password: Must be 8 to 64 characters in length and contain digits, uppercase and lowercase letters, and the following special characters: ~!@#$%^&*?_-.

   • Validity Period: The default is 5 years. We recommend setting it to 1 year to reduce the risk of compromise.

5. Click OK. The browser automatically downloads the ClientKey. The ClientKey includes the following files:

   • Credential (ClientKeyContent): The default filename is clientKey_****.json.

   • Credential password (ClientKeyPassword): The default filename is clientKey_****_Password.txt.

Delete a client key

1. On the Application Access tab, locate the target AAP.

2. Click the AAP to open the details page. On the Client Key tab, locate the target client key. In the Actions column, click Delete.

3. After confirming in the Confirm dialog, click OK.

4. After you complete security verification, KMS deletes the client key.