This topic describes the billing details and overdue payments for Key Management Service (KMS). This topic also describes how to stop billing and provides relevant billing examples.

Billable item

Note From March 31, 2022, KMS is upgraded to Dedicated KMS. The upgrade does not affect the existing users of KMS. If new users want to manage keys, the users must purchase Dedicated KMS. For more information, see [Upgrade Announcement] KMS is upgraded to Dedicated KMS.

Billing method: pay-as-you-go.

The fees that you are charged for KMS include the fees for hosting keys and the fees for calling API operations.

  • Fees for hosting keys

    You are not charged for customer master keys (CMKs) that are in the Pending Deletion state. The following table describes the billing rules for CMKs that are in other states.

    Key creator Billable item Unit price in Alibaba Cloud regions (USD/day)
    Alibaba Cloud service Version of a service-managed key 0.0
    User Version of a software key 0.002
    Version of a basic hardware key 0.033
    Version of an advanced hardware key
    • 0.083 for the first 2,000 key versions
    • 0.033 for other key versions
  • Fees for calling API operations

    You are charged only when you call cryptographic operations. For more information about the cryptographic operations, see Cryptographic operations.

    Key category Unit price in Alibaba Cloud regions in the Chinese mainland (USD/10,000 calls) Unit price in Alibaba Cloud regions outside the Chinese mainland (USD/10,000 calls)
    Service-managed key 0 0
    Basic key (software and hardware) 0.08 0.03
    Advanced key (software and hardware) 0.24 0.15

Billing examples

  • Billing example 1: cloud disk encryption

    You create 250 cloud disks per month in the Singapore (Singapore) region and use a CMK to encrypt the cloud disks.

    • Fees:
      • Key hosting: one CMK
        Note The CMK can be a service-managed key or a custom hardware key.
      • API operation calls: 750 (250 calls to create data keys, 250 calls to encrypt the data keys, and 250 calls to decrypt the data keys)
    • Estimated monthly fees:
      Fee Service-managed key (USD) Custom hardware key (USD)
      Key hosting 0 1
      API operation calls 0 0.002 (0.03 × 750/10,000)
      Total 0 1.002
  • Billing example 2: OSS client-side encryption

    You use a CMK for OSS client-side encryption that is based on envelope encryption in the Singapore (Singapore) region. You upload and encrypt 10,000 objects per month. The system reads the encrypted objects 2,000,000 times per month.

    • Fees:
      • Key hosting: one CMK
      • API operation calls: 10,000 calls to create data keys (one call for each object)
      • API operation calls: 2,000,000 calls to decrypt data keys
    • Estimated monthly fees:
      Fee Custom hardware key (USD)
      Key hosting 1
      API operation calls 6.03 (0.03 × 2,010,000/10,000)
      Total 7.03
  • Billing example 3: signature generation

    You use a CMK whose key type is EC_P256 to generate 100,000 signatures in the Singapore (Singapore) region.

    • Fees:
      • Hosted keys: one CMK
      • API operation calls: 100,000 calls to generate signatures
    • Estimated monthly fees:
      Fee Custom hardware key (USD)
      Key hosting 2.49
      API operation calls 1.50 (0.15 × 100,000/10,000)
      Total 3.99

Overdue payments

If your Alibaba Cloud account has overdue payments, top up your account balance at the earliest opportunity to prevent negative impacts on your business.

If you do not settle your overdue payments in seven days, your KMS service is automatically terminated. In this case, KMS retains your key-related data but you cannot access KMS. Until you settle your overdue payments, you are not charged for KMS.

Query of bills and bill details

You can query and export KMS bills and bill details in User Center.

How to stop billing

After you delete the CMKs within your Alibaba Cloud account, you are no longer charged.

You can only schedule the deletion task of a CMK. After you schedule a deletion task of a CMK, the CMK enters the Pending Deletion state. When the CMK enters the Pending Deletion state, you are not charged for the CMK, and you cannot use the CMK to encrypt data, decrypt data, generate signatures, verify signatures, or generate data keys. After the scheduled period elapses, the CMK is deleted and cannot be restored. For more information, see Schedule a key deletion task.

Note You cannot delete service-managed keys. The Schedule Key Deletion button for service-managed keys is dimmed. You are not charged for service-managed keys. The aliases of service-managed keys are in the acs/Cloud service format.