All Products
Search

This Product

    MaxCompute:REWRAP_KEYSET

    Document Center

    MaxCompute:REWRAP_KEYSET

    Last Updated:Mar 26, 2026

    REWRAP_KEYSET re-encrypts an existing wrapped keyset with a new Key Management Service (KMS) customer master key (CMK). Use this function to re-encrypt a wrapped keyset that was generated by NEW_WRAPPED_KEYSET using a different KMS key.

    For details on creating a wrapped keyset, see NEW_WRAPPED_KEYSET.

    Prerequisites

    Before you begin, make sure that you have:

    • A wrapped keyset generated by NEW_WRAPPED_KEYSET

    • A new KMS CMK with its key ARN (kms_cmk_arn) available

    • A RAM role that has permissions on both the old and new KMS keys, and that MaxCompute is authorized to assume

    Syntax

    binary REWRAP_KEYSET(string <kms_cmk_arn>, string <role_arn>, string <wrapped_keyset> [, string <role_chain>])

    Parameters

    ParameterRequiredDescription
    kms_cmk_arnYesARN of the new KMS CMK to use for re-encryption. Format: 'acs:kms:<RegionId>:<UserId>:key/<CmkId>'. Get this ARN from the Key Details page in the KMS console.
    role_arnYesARN of the RAM role that has permissions on both the old and new KMS keys. MaxCompute assumes this role to perform the re-encryption. Format: 'acs:ram::<UserId>:role/<roleName>'.
    wrapped_keysetYesThe wrapped keyset to re-encrypt.
    role_chainNoRole chain for cross-account authorization. Format: 'acs:ram:<UserAId>:role/<roleName2>,acs:ram:<UserBId>:role/<roleName3>,...'. Use this parameter to call wrapped keysets across Alibaba Cloud accounts.

    Return value

    Returns the re-encrypted wrapped keyset as a BINARY value. To convert it to a storable string, wrap the call with the HEX function. For details, see HEX.

    Examples

    Note

    The following examples contain variable placeholders. Run them in script mode or replace each placeholder with an actual value before running in SQL mode.

    Re-encrypt a wrapped keyset

    @origin_key := unhex('<wrapped_keyset>');
SELECT HEX(REWRAP_KEYSET(
  'acs:kms:cn-hangzhou:1**************7:key/key-hzz******************',
  'acs:ram::1**************7:role/kms',
  @origin_key
));

    Re-encrypt and enable cross-account access

    @origin_key  := unhex('<wrapped_keyset>');
@role_chain  := 'acs:ram:<UserAId>:role/<roleName2>,acs:ram:<UserBId>:role/<roleName3>';
SELECT HEX(REWRAP_KEYSET(
  'acs:kms:cn-hangzhou:1**************7:key/key-hzz******************',
  'acs:ram::1**************7:role/kms',
  @origin_key,
  @role_chain
));

    The role_chain parameter grants other Alibaba Cloud accounts permission to use the re-encrypted wrapped keyset.

    References

    Document

    Description

    Keyset usage guide

    Describes how to use keyset encryption functions.

    NEW_KEYSET

    Creates a keyset based on a specified algorithm.

    ADD_KEY_TO_KEYSET

    Adds a new key to a keyset and sets the new key as the master key.

    KEYSET_TO_JSON

    Converts a keyset of the BINARY type to a readable JSON format to view the keyset details.

    KEYSET_FROM_JSON

    Converts a keyset of the JSON type to the BINARY type.

    ROTATE_KEYSET

    The system automatically generates a new key and sets it as the master key.

    NEW_WRAPPED_KEYSET

    Creates a new wrapped keyset. This function grants a role with KMS CMK permissions to MaxCompute. You can also use a role chain to authorize other Alibaba Cloud accounts to decrypt the keyset.

    ROTATE_WRAPPED_KEYSET

    Decrypts an existing encrypted keyset, performs key rotation, and then encrypts the keyset with a new key.

    USE_WRAPPED_KEYSET

    Converts a wrapped keyset to a basic keyset to use as a parameter in encryption and decryption functions. This function also lets you obtain and save information about the wrapped keyset for easy maintenance.

    ENHANCED_SYM_ENCRYPT

    Encrypts data with a specified keyset.

    ENHANCED_SYM_DECRYPT

    Decrypts data with a specified keyset.

    What's next