Key Management Service (KMS) provides three tiers of key protection: free default keys, paid software key management instances, and paid hardware key management instances. For most workloads, default keys are sufficient. They require no setup and cover server-side encryption across Alibaba Cloud services at no cost. Paid instances add capabilities such as application-level encryption, secrets management, and regulatory compliance -- but they also introduce additional management overhead and cost.
Use this guide to determine which tier matches your requirements.
Decide which tier you need
Answer the following questions to identify the right instance type. If you answer "No" to every question, default keys meet your needs.
| Decision criteria | Default keys (free) | Software instance | Hardware instance |
|---|---|---|---|
| Do you need to encrypt data in your own applications? | -- | Yes | Yes |
| Do you need to manage secrets (create, rotate, retrieve)? | -- | Yes | Yes |
| Do you need FIPS 140-2 Level 3 validated hardware security modules (HSMs)? | -- | -- | Yes |
| Do you need dedicated gateway throughput up to 8,000 queries per second (QPS)? | -- | -- | Yes |
| Do you need key backup management? | -- | Yes | -- |
Recommendations by workload
Alibaba Cloud service encryption only -- Use default keys. They are free and require no setup.
Application-level encryption or secrets management -- Use a software key management instance. It supports asymmetric keys, Bring Your Own Key (BYOK), secret lifecycle management, and multi-account sharing.
Regulatory compliance or high throughput -- Use a hardware key management instance for Federal Information Processing Standard (FIPS) 140-2 Level 3 validation and dedicated gateway QPS up to 8,000. Hardware instances require purchasing two HSMs.
Default keys
Default keys encrypt data at rest across Alibaba Cloud services at no cost. They come in two forms:
| Type | Scope | BYOK | Scheduled deletion | Key rotation |
|---|---|---|---|---|
| Service key | One per Alibaba Cloud service, per region, per account | No | No | Yes (requires a value-added plan) |
| Customer master key (CMK) | One per region, per account | Yes | Yes | Yes (requires a value-added plan) |
Both types use the Aliyun_AES_256 key specification and support data encryption and decryption through a shared gateway at 1,000 QPS. Upgrade is not supported.
Default keys do not support application-level encryption, secrets management, or multi-account sharing. If your workload needs any of these capabilities, use a paid instance.
Software key management instances
Software instances are designed for teams that need to encrypt data in custom applications or manage secrets programmatically.
Capabilities:
Symmetric keys (Aliyun_AES_256) and asymmetric keys (RSA_2048, RSA_3072, EC_P256, EC_P256K)
BYOK -- import your own key material for symmetric and asymmetric keys
Secret lifecycle management -- create, rotate, retrieve, and delete secrets (up to 100,000)
Key rotation for symmetric keys (asymmetric keys not supported)
Multi-account resource sharing
Key backup management
Up to 100,000 keys
Performance:
| Gateway type | QPS (symmetric encryption/decryption) | Upgradable |
|---|---|---|
| Shared | 1,000 | No |
| Dedicated | 1,000, 2,000, or 4,000 | Yes |
Billing: Subscription or pay-as-you-go. See Billing overview.
Hardware key management instances
Hardware instances store keys inside FIPS 140-2 Level 3 validated HSMs. Choose this tier when regulations require hardware-backed key protection or when your applications demand high-throughput cryptographic operations.
Capabilities:
All software instance capabilities except key backup management and key rotation
FIPS 140-2 Level 3 compliance
Broader key specifications -- symmetric: Aliyun_AES_256, Aliyun_AES_192, Aliyun_AES_128; asymmetric: RSA_2048, RSA_3072, RSA_4096, EC_P256, EC_P256K
Dedicated gateway QPS up to 8,000
Performance:
| Gateway type | QPS (symmetric encryption/decryption) | Upgradable |
|---|---|---|
| Shared | 1,000 | No |
| Dedicated | 2,000, 4,000, 6,000, or 8,000 | Yes |
Billing: Subscription or pay-as-you-go. Requires purchasing two HSMs. See HSM billing.
Hardware instances do not support key rotation or key backup management. If either capability is required, use a software instance and confirm that FIPS 140-2 Level 3 compliance is not mandatory for your workload.
Feature comparison
The following tables provide a complete comparison across all four key types. Use them to verify that your chosen tier supports every feature your workload requires.
Supported: Yes. Not supported: --.
Billing
| Item | Service key | CMK | Software instance | Hardware instance |
|---|---|---|---|---|
| Billing method | Free | Free | Subscription or pay-as-you-go | Subscription or pay-as-you-go (requires two HSMs) |
Scenarios
| Item | Service key | CMK | Software instance | Hardware instance |
|---|---|---|---|---|
| Server-side encryption in Alibaba Cloud services | Yes | Yes | Yes | Yes |
| Data encryption in self-managed applications | -- | -- | Yes | Yes |
| Secret lifecycle management | -- | -- | Yes | Yes |
| FIPS 140-2 Level 3 compliance | -- | -- | -- | Yes |
Quotas and performance
| Item | Service key | CMK | Software instance | Hardware instance |
|---|---|---|---|---|
| Symmetric encryption/decryption QPS | 1,000 (upgrade not supported) | 1,000 (upgrade not supported) | Shared: 1,000 (upgrade not supported). Dedicated: 1,000, 2,000, or 4,000 (upgradable). | Shared: 1,000 (upgrade not supported). Dedicated: 2,000, 4,000, 6,000, or 8,000 (upgradable). |
| Keys | 1 per Alibaba Cloud service per region per account | 1 per region per account | 1,000--100,000 | 1,000--100,000 |
| Secrets | -- | -- | 0--100,000 | 0--100,000 |
| Network endpoints | Public and virtual private cloud (VPC) | Public and VPC | Public and VPC | Public and VPC |
Management
| Feature | Service key | CMK | Software instance | Hardware instance |
|---|---|---|---|---|
| Multi-account resource sharing | -- | -- | Yes | Yes |
| Backup management | -- | -- | Yes | -- |
| Security audit (ActionTrail) | Yes | Yes | Yes | Yes |
Key management
| Feature | Service key | CMK | Software instance | Hardware instance |
|---|---|---|---|---|
| Key specifications | Aliyun_AES_256 | Aliyun_AES_256 | Symmetric: Aliyun_AES_256. Asymmetric: RSA_2048, RSA_3072, EC_P256, EC_P256K. | Symmetric: Aliyun_AES_256, Aliyun_AES_192, Aliyun_AES_128. Asymmetric: RSA_2048, RSA_3072, RSA_4096, EC_P256, EC_P256K. |
| BYOK (import external key material) | -- | Yes | Yes | Yes |
| Key rotation | Yes (requires a value-added plan) | Yes (requires a value-added plan) | Yes (symmetric keys only) | -- |
| Scheduled key deletion | -- | Yes | Yes | Yes |
| Key deletion protection | -- | Yes | Yes | Yes |
| Key alias | Yes | Yes | Yes | Yes |
| Key tag | Yes | Yes | Yes | Yes |
Cryptographic operations
| Feature | Service key | CMK | Software instance | Hardware instance |
|---|---|---|---|---|
| Data encryption and decryption | Yes | Yes | Yes | Yes |
| Signature generation and verification | -- | -- | Yes | Yes |
Secret management
| Feature | Service key | CMK | Software instance | Hardware instance |
|---|---|---|---|---|
| Secret creation | -- | -- | Yes | Yes |
| Secret deletion | -- | -- | Yes | Yes |
| Secret rotation | -- | -- | Yes | Yes |
| Secret tag | -- | -- | Yes | Yes |
| Secret value retrieval | -- | -- | Yes | Yes |
References
| Resource | Link |
|---|---|
| Billing overview | Billing overview |
| HSM billing | HSM billing |
| Scenarios | Scenarios |
| Performance quotas | Performance quotas |
| Regions and endpoints | Regions and endpoints |
| Key management overview | Key management overview |
| Import key material (symmetric) | Import key material into a symmetric key |
| Import key material (asymmetric) | Import key material into an asymmetric key |
| Key rotation | Configure key rotation |
| Scheduled key deletion | Schedule a key deletion task |
| Key deletion protection | Enable key deletion protection |
| Key aliases | Manage key aliases |
| Tag management | Tag management |
| Multi-account sharing | Share a KMS instance across multiple Alibaba Cloud accounts |
| Backups | Backups |
| Security audit | Use ActionTrail to query KMS events |
| SDK reference | Alibaba Cloud SDK |
| Secret management | Secret management |
| Secret client | Secret client |
| Secret JDBC client | Secret JDBC client |
| RAM secret plug-in | RAM secret plug-in |