Use REWRAP_KEYSET to re-encrypt a wrapped keyset with a new KMS key - MaxCompute - Alibaba Cloud - MaxCompute

MaxCompute integrates with Key Management Service (KMS) for key management. This topic describes the REWRAP_KEYSET function. This function re-encrypts a wrapped keyset with a specified KMS key.

Background

MaxCompute integrates with KMS to manage keys. A KMS key encrypts a generated keyset to create a wrapped keyset. The REWRAP_KEYSET function re-encrypts a wrapped keyset that was generated by the NEW_WRAPPED_KEYSET function with a new KMS key.

Prerequisites

Before you use the REWRAP_KEYSET function, complete the following tasks:

You have an encapsulated keyset generated by the NEW_WRAPPED_KEYSET function. For more information, see NEW_WRAPPED_KEYSET.
Create a new KMS key and obtain its Alibaba Cloud Resource Name (ARN) (kms_cmk_arn). Grant the RAM role the permission to use the new key. For more information, see Enable KMS and complete the configuration.

Syntax

binary REWRAP_KEYSET(string <kms_cmk_arn> , string <role-arn>, string <wrapped_keyset>, [string <role_chain>])

Parameters

kms_cmk_arn: Required.
The ARN of the KMS customer master key (CMK) used to re-encrypt the keyset. The format is 'acs:kms:<RegionId>:<UserId>:key/<CmkId>'. The ARN contains the region ID, user ID, and CMK ID. Obtain the ARN from the key details page in the Key Management Service console. For more information, see Enable KMS and complete the configuration.
role_arn: Required.
The ARN of the RAM role that has permissions on both the old and new KMS keys. This role must be granted to MaxCompute. The format is 'acs:ram:${<userAID>}:role/${<roleName>}'. The ARN contains the user ID and role name. To obtain the ARN, see Enable KMS and complete the configuration.
wrapped_keyset: Required.
The wrapped keyset to re-encrypt.
role_chain: optional.
This parameter specifies the role chain for user authorization. The parameter value is in the format of 'acs:ram:<userAID>:role/<roleName2>,acs:ram:<userBID>:role/<roleName3>},...'. You can use role chains to call wrapped keysets across Alibaba Cloud accounts.

Return value

A wrapped keyset of the BINARY type is returned. You can use the HEX function to convert the wrapped keyset of the BINARY type into a keyset of the STRING type based on your business requirements. For more information about the HEX function, see HEX.

Usage examples

Note

You can run the following sample code that contains variables in the code editor, or you can inline the variables into the SQL statement. MaxCompute does not support variable scopes across SQL statements.

Re-encrypt a wrapped keyset:

SELECT hex(REWRAP_KEYSET('acs:kms:cn-hangzhou:1**************7:key/key-hzz******************', 'acs:ram::1**************7:role/kms', unhex('<wrapped_keyset>')));

Re-encrypt a wrapped keyset and allow roles of other Alibaba Cloud accounts to call it:

SELECT hex(REWRAP_KEYSET('acs:kms:cn-hangzhou:1**************7:key/key-hzz******************', 'acs:ram:${<UserId>}:role/${<roleName>}', unhex('<wrapped_keyset>'), 'acs:ram:${<UserAId>}:role/${<roleName2>},acs:ram:${<UserBId>}:role/${<roleName3>}')));