Key Management Service:Terms

Key Management

Key Management provides cryptographic operations such as secure key storage and lifecycle management, data encryption and decryption by using keys, and digital signature generation and verification. For more information about Key Management, see Understanding KMS keys.

Secrets Manager

Secrets Manager provides full lifecycle management of secrets and a secure, convenient way for applications to access secrets. This helps you avoid the risk of sensitive information leaks that is caused by hardcoding secrets in your code. For more information about Secrets Manager, see Secret management.

KMS instance

KMS provides two instance types: software key management instances and hardware key management instances. KMS instances can be integrated by Alibaba Cloud services for server-side encryption, or by your self-managed applications to build application-layer cryptographic solutions.

• Software key management instance: A software key management instance provides Key Management and Secrets Manager, and securely stores your keys and secrets in a KMS instance that is dedicated to you. It offers high scalability and security.

• Hardware key management instance: A hardware key management instance provides Key Management by connecting to the hardware security module (HSM) cluster that you use in Alibaba Cloud Cloud Hardware Security Module. It also supports Secrets Manager and securely stores your secrets in a KMS instance that is dedicated to you. This provides Key Management and Secrets Manager with a higher level of security and compliance. Before you enable a hardware key management instance, you must purchase HSMs and configure an HSM cluster in Cloud Hardware Security Module, and then connect the cluster in KMS.

  Note

  The HSMs in Cloud Hardware Security Module use hardware that is certified by the State Cryptography Administration of China or FIPS 140-3 Level 3.

When you purchase a KMS instance, you can select the instance performance. For more information, see Performance data.

Hardware security module (HSM)

A hardware security module is a hardware device that performs cryptographic operations and securely generates and stores keys. An HSM appliance is the most commonly used type of hardware security module for building IT systems.

KMS supports integration with the HSM cluster that you use in Alibaba Cloud Cloud Hardware Security Module. This provides a higher level of security and compliance for the keys that you host in KMS and meets the testing and certification requirements of regulatory authorities.

Customer master key (CMK)

A customer master key (CMK) is a key that you create and host in KMS. It is also referred to as a master key. A master key consists of a key ID, basic metadata, and key material.

Default key

Default keys can be integrated only by Alibaba Cloud services for server-side encryption. Default keys include:

• Service key: A key that an Alibaba Cloud service creates and hosts on your behalf for server-side encryption.

• Master key: A master key whose lifecycle you create and manage on your own. You can create only one master key in each region. The key material can be generated by KMS or imported by you.

For default keys, KMS supports only the AES_256 symmetric cryptographic algorithm.

Service key

A service key is a key that an Alibaba Cloud service creates on your behalf and hosts in KMS. It is used by default when the Alibaba Cloud service performs server-side encryption.

Key material

Key material is one of the important inputs for cryptographic operations. To protect the cryptographic operations that are based on key material, we recommend that you keep the private key material of asymmetric cryptographic algorithms and the key material of symmetric cryptographic algorithms confidential.

• Default key: When you create a master key among default keys, the key material can be generated by KMS (the Origin attribute is Aliyun_KMS) or imported by you (the Origin attribute is EXTERNAL).

• Software key: When you create a software key, the key material can be generated by KMS (the Origin attribute is Aliyun_KMS) or imported by you (the Origin attribute is EXTERNAL).

• Hardware key: When you create a hardware key, the key material can be generated by the HSM that is connected to KMS (the Origin attribute is Aliyun_KMS) or imported by you (the Origin attribute is EXTERNAL).

Secrets

Secrets are sensitive information that is used to authenticate applications, such as database usernames and passwords, SSH keys, sensitive addresses, and AccessKey pairs.

Application access point (AAP)

An application access point (AAP) is an access control solution that is implemented by KMS. It is used for identity authentication and behavior authorization when applications access KMS resources. For more information, see Overview of AAPs.