Key Management Service:Share KMS instances across multiple accounts

Step 1: Set up Resource Directory and enable resource sharing

Set up Resource Directory:

1. Log on to the Resource Management console using the management account.

2. In the left navigation pane, go to Resource Directory > Enable Resource Directory, then click Enable Resource Directory. For details, see Enable a resource directory.

3. Create a folder to group members: go to Resource Directory > Management, click Resource Organization View in the upper-right corner, select the target folder in the directory tree, and on the Member tab, click Create Folder. Enter a Folder Name and click OK. For details, see Create a folder.

4. Add members to the folder: on the Member tab, click Create Member or Invite Member. Configure the following parameters:

   Invite members

   Parameter	Description
   Account ID or logon email address	Enter an account ID or the logon email used to register the account. Separate multiple account IDs with commas to invite in batches. To find an account ID, see How do I view the ID of an Alibaba Cloud account?
   Remarks	A remark to help the invitee verify the invitation's authenticity.
   Tag	Tags to bind to the member for easier management.
   Parent folder	The folder to place the invited account in. Defaults to the root folder. Click Modify to change.

   Create a member

   Parameter	Description
   Alibaba Cloud account name	Unique identifier for the member within the resource directory. Must be 2–50 characters and can contain letters, numbers, and _.-. Must start and end with a letter or number, and cannot contain consecutive special characters.
   Display name	2–50 characters; supports Chinese characters, letters, digits, and _.-.
   Billing account	Choose who pays for the new member's fees: the management account, an existing member, or the new member itself.
   Tag	Tags to bind to the member for easier management.
   Parent folder	Defaults to the root folder. Click Modify to change.

Enable resource sharing:

1. Log on to the Resource Sharing console using the management account. In the left navigation pane, go to Resource Sharing > Settings.

2. Click Enable, then click OK in the Resource Sharing Service-Linked Role dialog box.

   The system automatically creates a service-linked role named AliyunServiceRoleForResourceSharing to retrieve organization information from Resource Directory. For details, see Service-linked role for Resource Sharing.

Step 2: Share the KMS instance

1. Log on to the Key Management Service console as the instance owner. Select a region in the top menu bar, then click Instances in the left navigation pane.

2. Find the target KMS instance and click Share Resources in the Actions column. In the RD Multi-account Sharing Settings panel, select a sharing mode.

3. In the Add to Resource Share panel, choose how to configure the resource share:

   Warning

   Adding a KMS instance to an existing resource share grants all current principals of that share automatic access to the new instance. This consumes the instance's Access Management Quota and may cause unintended permission escalation. Proceed with caution.

   	Create (recommended)	Select an existing resource share
   Use when	Sharing for the first time, or when you need permission isolation per instance	Adding the current instance to an existing share to reuse its principals and permissions
   Permission scope	Only the current KMS instance; only newly added accounts gain access	All existing principals automatically gain access to the new instance; permission changes affect all resources in the share

4. Configure the resource share parameters and click OK:

   If creating a new resource share:

   • Resource share name — Up to 50 characters; supports Chinese characters, letters, digits, and ._-.

   • Principals — Specify which accounts can use this KMS instance. Each principal added consumes the instance’s Access Management Quota. Adding or removing principals from an existing resource share affects all resources within that share. Three principal types are supported:

     Principal type	Scope
     Alibaba Cloud Account	Shares resources with specified account IDs only
     Resource Directory Organization	Shares resources with all member accounts in the entire resource directory, including members added later
     Folder (organizational unit)	Shares resources with all members in the specified folder (format: fd-xxxxxxxx), including members added later. To find folder IDs, see View the basic information of a folder.

     Add principals by folder or Alibaba Cloud Account for fine-grained control.

   • Permissions — Select AliyunRSDefaultPermissionKMSInstance (recommended). Two versions are available (v1 and v2); new shares default to v2. To verify the version in use, see View permission details. The permission AliyunRSPermissionKMSInstanceReadWrite is deprecated and not recommended for new shares.

   If selecting an existing resource share:

   • Select resource share — The console lists all resource shares in your account. See Create a resource share for reference.

   • Shared resources — Read-only. Shows the existing resources in the selected share. After this operation, the current KMS instance is added.

   • Principals and Permissions — Same options as when creating a new share. Note: AliyunRSPermissionKMSInstanceReadWrite is deprecated; if previously used, continue using it only for that share.

Modify the principals of a resource share

From the KMS console:

1. Log on to the Key Management Service console as the instance owner. Select a region, then click Instances in the left navigation pane.

2. On the Instances page, open the Software Key Management or Hardware Key Management tab based on the instance type.

3. Find the instance and click Share Resources in the Actions column.

4. In the RD Multi-account Share Settings panel, select a Resource Share. In the Principals section, click Edit to add or remove principals, then click OK.

From the Resource Sharing console:

For detailed instructions, see Modify a resource share.

Revoke sharing for a KMS instance

Revoking a share means deleting the resource share. After deletion, all principals lose access to the resources in that share.

Perform this operation from the Resource Sharing console only:

1. Log on to the Resource Sharing console using a management account.

2. In the left navigation pane, go to Resource Sharing > Resources I Share. Find the target resource share and click its ID.

3. Click Delete Resource Share in the upper-right corner. In the confirmation dialog box, click OK.

Network connectivity

If a principal's application runs in a VPC and needs to access KMS through a private gateway, the instance owner must attach the principal's VPC to the shared KMS instance. For instructions, see Access a KMS instance from multiple VPCs in the same region.

Audit and compliance

• Resource owner: Enable ActionTrail to record all management operations on the shared instance and all key operations performed by principals.

• Principal: Enable ActionTrail to record all API calls within your account.

Change management

• Revoking sharing: Before revoking a share, principals must delete all keys and secrets they created in the shared instance. If resources remain, the revocation fails. For instructions, see Revoke sharing for a KMS instance.

• Modifying principals: Adding or removing principals from a resource share affects all resources within that share. Create separate resource shares for different business scenarios or teams to avoid permission conflicts. For instructions, see Modify the principals of a resource share.