Key Management Service:Authorization information

Step 1: Create a custom policy

1. Log on to the RAM console using your Alibaba Cloud account.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

4. On the Create Policy page, click the JSON tab.

5. Replace the default policy content with your custom policy document. The following example grants a RAM user permission to encrypt and decrypt using a specific key, without the ability to manage or delete it:

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "kms:Encrypt",                    // encrypt data using the key
           "kms:Decrypt",                    // decrypt data using the key
           "kms:GenerateDataKey"             // generate a data key for envelope encryption
         ],
         "Resource": "acs:kms:${region}:${account}:key/${key-id}"
       }
     ]
   }

   Replace ${region}, ${account}, and ${key-id} with your actual values. To target all keys in an account, use acs:kms:*:${account}:key/*.

6. Click Optimize to validate and format the policy document (optional).

7. Click OK.

8. Enter a policy name and description, then click OK.

Step 2: Attach the policy to a RAM user

1. In the left-side navigation pane, choose Identities > Users.

2. On the Users page, find the target RAM user and click Add Permissions in the Actions column.

3. In the Grant Permission panel, configure the following parameters and click Grant Permissions.

   Parameter	Description
   Resource Scope	Select Account. KMS does not support the resource group feature.
   Principal	The RAM user to grant permissions to. Defaults to the user you selected; change as needed.
   Policy	Select the custom policy you created in step 1.

Resource

KMS defines six resource types. Configure the Resource element in a RAM policy using the ARN of the target resource.

To find a key's ARN:

1. Log on to the KMS console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resource > Keys.

2. On the Keys tab, find the key and click Details in the Actions column. The ARN appears on the details page.

   

Replace ${region} and ${account} with your actual region and Alibaba Cloud account ID. ${region} supports the asterisk (*) wildcard to target all supported regions.

Wildcard examples

For keys:

• acs:kms:${region}:${account}:key/* — all keys in a specific region within an account

• acs:kms:*:${account}:key/* — all keys in all regions within an account

For secrets:

• acs:kms:${region}:${account}:secret/* — all secrets in a specific region within an account

• acs:kms:${region}:${account}:secret/prefix* — all secrets whose names start with prefix

Action

KMS defines an action for each API operation that requires access control. Actions follow the kms:<api-name> format.

The DescribeRegions operation does not require access control. It can be called by any Alibaba Cloud account, RAM user, or RAM role after passing RAM authentication.

Key-related API operations

Secret-related API operations

Tag-related API operations

Condition

The Condition element is optional. Add condition keys to a RAM policy to enforce additional constraints — RAM authentication succeeds only when all specified conditions are met.

Two types of condition keys are supported:

• Common condition keys in acs:<condition-key> format — for example, use acs:CurrentTime to restrict a policy to a specific time window. For the full list, see Policy elements.

• KMS-specific condition keys in kms:<condition-key> format — for the full list, see Condition keys.

For more information about RAM policy syntax and structure, see Policy structure and syntax.