All Products
Search

This Product

    Key Management Service:Grant permissions

    Document Center

    Key Management Service:Grant permissions

    Last Updated:Jun 21, 2026

    This topic describes how to grant permissions to a RAM user.

    Procedure

    1. Log on to the RAM console with your Alibaba Cloud account.

    2. Create a custom policy.

      1. In the left-side navigation pane, choose Permissions > Policies.

      2. On the Policies page, click Create Policy.

      3. On the Create Policy page, click the JSON tab.

        Note

        RAM provides two methods to create a policy: visual editing and script editing. To create a custom policy for KMS resources, you must use script editing. The visual editing method only supports selecting all KMS resources and all operations.

      4. Edit the policy script, and then click Continue to Edit Basic Information.

        When you write a KMS policy script, you must define a statement. A statement includes the Effect, Action, Resource, and an optional Condition element. For more information, see Appendix: Supported resource, action, and condition elements for KMS.

        Note

        For more information about the syntax and structure of a policy, see Policy structure and syntax.

      5. Enter a name and description for the policy, and then review and optimize the policy content as prompted.

      6. Click OK.

    3. Grant the custom policy to a RAM user.

      1. In the left-side navigation pane, choose Identities > Users.

      2. On the Users page, find the target RAM user and click Add Permissions in the Actions column.

      3. In the Add Permissions panel, configure the following settings and click OK.

        Parameter

        Description

        Authorized Scope

        Select whether the permissions apply to the entire Alibaba Cloud account or a specific resource group. KMS does not support resource groups. Select Alibaba Cloud Account.

        Principal

        The RAM user who will receive the permissions. The system automatically adds the selected RAM user. You can also add other RAM users.

        Select Policy

        Select the custom policy based on your use case.

    Appendix: Supported resource, action, and condition elements for KMS

    Resource

    The resource types defined by KMS include abstract key containers, abstract secret containers, abstract alias containers, keys, secrets, and aliases. You can obtain the Alibaba Cloud Resource Name (ARN) for these resources to use in the Resource element of a RAM policy. For example, to view the ARN of a key:

    1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resource > Keys.

    2. On the Customer Master Keys tab, find the target key and click Details in the Actions column. On the key details page, you can find the ARN. The ARN format varies by resource type, as shown in the following table.

      Note

      Replace ${region} and ${account} with your actual region and Alibaba Cloud account. You can also narrow the resource scope as needed. ${region} supports the wildcard character *, which represents all supported regions.

      Resource type

      ARN

      Abstract key container

      acs:kms:${region}:${account}:key

      Abstract secret container

      acs:kms:${region}:${account}:secret

      Abstract alias container

      acs:kms:${region}:${account}:alias

      key

      acs:kms:${region}:${account}:key/${key-id}

      Note

      The ARN of a key resource supports the wildcard character (*). Examples:

      • acs:kms:${region}:${account}:key/*: Indicates all keys in the specified region for the specified account.

      • acs:kms:*:${account}:key/*: Represents all keys in all regions for the specified account.

      secret

      acs:kms:${region}:${account}:secret/${secret-name}

      Note

      The ARN of a secret resource supports the following two wildcard patterns:

      • acs:kms:${region}:${account}:secret/*: Represents all secrets in the specified region and account.

      • acs:kms:${region}:${account}:secret/prefix*: Specifies all secrets with the name prefix prefix in the specified region and account.

      alias

      acs:kms:${region}:${account}:alias/${alias-name}

    Action

    For each API that requires access control, KMS defines an Action for RAM policies, typically in the format kms:<api-name>.

    Note

    The DescribeRegions operation does not require access control. After authentication, an Alibaba Cloud account, a RAM user, or a RAM role can call this operation.

    The following tables list the KMS API operations, their corresponding actions for RAM policies, and the resource types they access.

    Note

    Replace ${region} and ${account} with your actual region and Alibaba Cloud account. You can also narrow the resource scope as needed. ${region} supports the wildcard character *, which represents all supported regions.

    Key API operations

    KMS API

    Action

    Resource type

    ARN format

    ListKeys

    kms:ListKeys

    Abstract key container

    acs:kms:${region}:${account}:key

    CreateKey

    kms:CreateKey

    DescribeKey

    kms:DescribeKey

    key

    acs:kms:${region}:${account}:key/${key-id}

    UpdateKeyDescription

    kms:UpdateKeyDescription

    EnableKey

    kms:EnableKey

    DisableKey

    kms:DisableKey

    ScheduleKeyDeletion

    kms:ScheduleKeyDeletion

    CancelKeyDeletion

    kms:CancelKeyDeletion

    GetParametersForImport

    kms:GetParametersForImport

    ImportKeyMaterial

    kms:ImportKeyMaterial

    DeleteKeyMaterial

    kms:DeleteKeyMaterial

    ListAliasesByKeyId

    kms:ListAliasesByKeyId

    CreateKeyVersion

    kms:CreateKeyVersion

    DescribeKeyVersion

    kms:DescribeKeyVersion

    ListKeyVersions

    kms:ListKeyVersions

    UpdateRotationPolicy

    kms:UpdateRotationPolicy

    Encrypt

    kms:Encrypt

    Decrypt

    kms:Decrypt

    ReEncrypt

    • kms:ReEncryptFrom

      Note

      You must have the kms:ReEncryptFrom permission on the source key.

    • kms:ReEncryptTo

      Note

      You must have the kms:ReEncryptTo permission on the destination key.

    GenerateDataKey

    kms:GenerateDataKey

    GenerateDataKeyWithoutPlaintext

    kms:GenerateDataKeyWithoutPlaintext

    ExportDataKey

    kms:ExportDataKey

    GenerateAndExportDataKey

    kms:GenerateAndExportDataKey

    AsymmetricSign

    kms:AsymmetricSign

    AsymmetricVerify

    kms:AsymmetricVerify

    AsymmetricEncrypt

    kms:AsymmetricEncrypt

    AsymmetricDecrypt

    kms:AsymmetricDecrypt

    GetPublicKey

    kms:GetPublicKey

    ListAliases

    kms:ListAliases

    Abstract alias container

    acs:kms:${region}:${account}:alias

    CreateAlias

    kms:CreateAlias

    alias and key

    • Alias: acs:kms:${region}:${account}:alias/${alias-name}

    • Key: acs:kms:${region}:${account}:key/${key-id}

    UpdateAlias

    kms:UpdateAlias

    DeleteAlias

    kms:DeleteAlias

    Secret API operations

    KMS API

    Action

    Resource type

    ARN

    CreateSecret

    kms:CreateSecret

    Abstract secret container

    acs:kms:${region}:${account}:secret

    ListSecrets

    kms:ListSecrets

    DescribeSecret

    kms:DescribeSecret

    secret

    acs:kms:${region}:${account}:secret/${secret-name}

    DeleteSecret

    kms:DeleteSecret

    UpdateSecret

    kms:UpdateSecret

    RestoreSecret

    kms:RestoreSecret

    GetSecretValue

    • kms:GetSecretValue

    • kms:Decrypt

    Note

    The kms:Decrypt permission is required only if the secret is encrypted with a customer master key (CMK) that you created.

    PutSecretValue

    • kms:PutSecretValue

    • kms:GenerateDataKey

    Note

    The kms:GenerateDataKey permission is required only if the secret is encrypted with a CMK that you created.

    ListSecretVersionIds

    kms:ListSecretVersionIds

    UpdateSecretVersionStage

    kms:UpdateSecretVersionStage

    GetRandomPassword

    kms:GetRandomPassword

    N/A

    N/A

    Tag API operations

    KMS API

    Action

    Resource type

    ARN

    ListResourceTags

    kms:ListResourceTags

    key

    • Key: acs:kms:${region}:${account}:key/${key-id}

    • Secret: acs:kms:${region}:${account}:secret/${secret-name}

    UntagResource

    kms:UntagResource

    key or secret

    TagResource

    kms:TagResource

    Condition

    The optional Condition element specifies the conditions that must be met for a policy to be in effect. You can use condition keys in a RAM policy to control access to KMS. Authentication is successful only if the specified conditions are met.

    • Alibaba Cloud common condition keys use the following naming format: acs:<condition-key>. For example, you can use the acs:CurrentTime condition to restrict the time when a policy is effective.

      For more information, see Elements of a RAM policy.

    • Product-level condition keys use the format kms:<condition-key>. For a list of product-level condition keys that KMS supports, see Policy Condition Keys.