This page answers common questions about migrating secrets from Key Management Service (KMS) 1.0 to KMS 3.0.
Migration limitations at a glance:
| Limitation | Detail |
|---|---|
| Duplicate secret names | Secrets with duplicate names in KMS 1.0, or names that already exist in the target KMS 3.0 instance, cannot be migrated |
| CMK-encrypted secrets | Migrate the customer master key (CMK) first; only then can you migrate the secret |
| Automatic rotation | Disable automatic rotation before migration |
| Cross-region | Same-region migration only; use the backup feature to move secrets across regions after migration |
Which secrets support migration?
All types of secrets can be migrated, subject to two constraints:
No duplicate names: In KMS 3.0, secret names are unique per Alibaba Cloud account, KMS instance, and region. If multiple secrets in KMS 1.0 share the same name, or if a secret with that name already exists in the target KMS 3.0 instance, migration is blocked for those secrets.
CMK-encrypted secrets require key migration first: If a secret is encrypted by a customer master key (CMK), migrate the CMK before migrating the secret. If the secret uses a system-managed CMK, migrate the secret directly—no key migration needed.
Do I need to migrate the encryption key before migrating secrets?
Yes, if the secret is encrypted by a CMK. Migrating the secret without first migrating its encryption key causes the migration to fail.
Secrets encrypted by a system-managed CMK are the exception—migrate them directly.
Do secrets with automatic rotation support migration?
Yes. Disable automatic rotation before starting migration to keep secret versions consistent.
Does the secret name or other data change after migration?
No. KMS migrates all versions of the secret along with its metadata—secret name, status, and tags all remain unchanged.
Can I operate secrets during migration?
Read operations are allowed; management operations are not.
| Operation type | Examples | Allowed during migration? |
|---|---|---|
| Read | Get secret value | Yes |
| Management | Create, modify, or delete secrets | No |
Note: Migration maintains separation between management and data planes, so read operations continue uninterrupted. To avoid migration failures caused by data consistency issues, schedule migration during off-peak hours.
Is cross-region secret migration supported?
No. Migrate secrets to a KMS 3.0 instance in the same region first, then use the backup feature to transfer them to a KMS 3.0 instance in a different region. For details, see Disaster recovery.