By default, keys in a Key Management Service (KMS) instance are accessible for cryptographic operations only from a VPC. To access keys over the public network, you must enable public network access in the console. You can then call OpenAPI operations to perform cryptographic operations. This topic describes how to enable public network access.
Precautions
-
Regardless of the Queries Per Second (QPS) that you select when you purchase a KMS instance, the QPS for cryptographic operations over the public network is capped at 1,000. For more information, see Performance metrics. If your application has high performance requirements, use VPC network access.
-
By default, credentials in a KMS instance are accessible over the public network and from a VPC. If you access credentials only from the internal network, you do not need to enable public network access.
-
Public network access can be enabled only in the console, not by calling OpenAPI operations.
-
In a multi-account scenario where a KMS instance is shared, only the instance owner can enable public network access.
Enable public network access
Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose .
-
In the instance list, click the ID of the target instance. On the details page, turn on the Public Network Access switch in the RD Multi-Account section.
NoteIf a KMS instance is shared among multiple Alibaba Cloud accounts, you can set public network access permissions for each account.
-
On the Basic Information tab of the instance details page, find the Public Endpoint. The endpoint is displayed after you enable public network access and has a format similar to
kms.cn-hangzhou.aliyuncs.com.
What to do next
Use an Alibaba Cloud software development kit (SDK) to perform cryptographic operations over the public network. For more information, see Alibaba Cloud SDKs.