Key Management Service:Manage application access points

Prerequisites

Before you begin, ensure that you have:

• Access to the KMS console

• A RAM role (if using the RAMRole authentication method)

Steps

1. Log on to the KMS console.

2. In the top navigation bar, select the region where you want to create the AAP.

3. In the left-side navigation pane, click Applications.

4. Click Create Application Access Point.

5. In the Create Application Access Point dialog box, configure the basic information:

   1. Enter a Name and an optional Description.

      The AAP name must be unique within the selected region in your Alibaba Cloud account.

   2. In the Authentication Method section, select an authentication method and fill in the required parameters:

      For RAMRole:

      Parameter	Description	Example
      Trusted Role	The type of environment where your application runs. KMS uses this to verify the RAM role's delegated trust rules. Valid values: ECS Instance Role, ACK Worker Role, Function Compute Role	ECS Instance Role
      Role Name	The name of the RAM role bound to your application's environment	ECSRole

      For Client Key: No parameters are required at this stage. After the AAP is created, bind a client key by following Bind a client key to the AAP.

   3. Click Next.

6. Configure permission policies. Each policy defines what operations the AAP can perform and on which resources.

   The parameters work in sequence: Scope sets the KMS instance, RBAC Permissions sets the allowed operations, Accessible Resources sets the target resources, and Network Access Rules restricts which networks can call KMS.

   1. Click the icon to the right of Policies.

   2. In the RBAC Policy dialog box, configure the following parameters:

      Parameter	Description	Example
      Policy name	A name for this permission policy	RAMPolicy
      Scope	The KMS instance this policy applies to. Select Shared KMS for the shared service, or select a dedicated KMS instance ID	Shared KMS
      RBAC permissions	The permission template. SecretUser grants GetSecretValue calls on KMS. CryptoServiceKeyUser grants cryptographic operations on a dedicated KMS instance	SecretUser
      Accessible resources	The secrets or keys this policy covers. In the Resources section, select existing resources and click , or click in the Selected Resources section, enter a resource, and click Add. Use the asterisk (*) wildcard as a suffix to match multiple resources	secret/dataKey****
      Network access rules	The networks allowed to call KMS under this policy. Select an existing rule from Available Rules, or create one (see the following table)	—

      To create a network access rule, click and configure the following parameters in the Create Network Access Rule dialog box:

      Parameter	Description	Example
      Name	A name for this rule	Network
      Network type	The network path your application uses to reach KMS. Public: public endpoint. VPC: VPC address. Private: Dedicated KMS over VPC	VPC
      Description	(Optional) A description for the rule	Access the specified VPC
      Allowed IP addresses	The IP addresses permitted under this rule. For Public: public IP addresses. For VPC: VPC ID and IP addresses or CIDR blocks. For Private: private IP addresses or CIDR blocks. Separate multiple addresses with commas	192.168.0.0/16

      Click Create, then select the rule and click to add it to the policy.

   3. Click Create to save the RBAC policy.

   4. Select the policy and click to attach it to the AAP.

   5. Click Next.

7. Review the configuration and click Create.