Document Center
Key Management Service
Release Notes
Release notes
Product Introduction
What is Key Management Service?
Benefits
Scenarios
Terms
Limits
Pricing
Billing
Overdue payments
Quick Start
Overview
Activate KMS
Manage and use keys
Create a CMK
Encrypt resources of cloud services
Sample code for data encryption
Manage and use secrets
Create a secret
Sample code for Secrets Manager
Access Control and Audit
Use RAM to control access to KMS resources
Use ActionTrail to query KMS event logs
Dedicated KMS
Overview
Quick start
Step 1: Purchase a dedicated KMS instance
Step 2: Configure a dedicated KMS instance
Step 3: Create a CMK for a dedicated KMS instance
Step 4: Connect applications to a dedicated KMS instance
Service-linked role for dedicated KMS
Basic operations
Manage dedicated KMS instances
Manage keys
Import key material
Manage AAPs
Dedicated KMS SDKs
Quick start
Dedicated KMS SDK for Java
Key Service
Overview
Key type
Use symmetric keys
Overview
EncryptionContext
Import key material
Remove key material
Use asymmetric keys
Overview
Encrypt and decrypt data by using an asymmetric CMK
Generate and verify a digital signature by using an asymmetric CMK
Manage CMKs
Create a CMK
Disable a CMK
Enable deletion protection
Schedule a key deletion task
Manage aliases
Overview
Create an alias
Bind an alias to a different CMK
Query aliases
Query aliases bound to a specified CMK
Delete an alias
Managed HSM
Use managed HSMs
Overview
Rotate CMKs
Overview
Automatic key rotation
Manual key rotation
Secrets Manager
Overview
Manage application access points
Connect an application to Secrets Manager
Generic Secrets
Overview
Manage generic secrets
Rotate generic secrets
Dynamic ApsaraDB RDS secrets
Overview
Manage dynamic ApsaraDB RDS secrets
Monitor the rotation of dynamic ApsaraDB RDS secrets
Manage the service-linked role for dynamic ApsaraDB RDS secrets
Dynamic RAM secrets
Overview
Authorize Secrets Manager to manage AccessKey pairs of RAM users
Manage dynamic RAM secrets
Dynamic ECS secrets
Overview
Manage dynamic ECS secrets
Monitor the rotation of dynamic ECS secrets
Manage the service-linked role for dynamic ECS secrets
Certificates Manager
Overview
Quick start
Import private keys and certificates
Disable, revoke, or delete a certificate
Developer Guide
Overview of development tools
KMS SDK
SDK overview
Code samples of KMS SDK for Java
Encryption SDK
Overview
Quick Start
Quick start of Encryption SDK for Java
Quick start of Encryption SDK for Python
Encryption scenarios
Encrypt and decrypt OSS objects on the client side
Use CMKs in multiple regions to encrypt and decrypt data
Generate and verify digital signatures
Encrypt sensitive data for a database
How Encryption SDK works and what data formats are supported
How Encryption SDK works
Formats of encrypted data and signatures
Secrets Manager SDK
Secrets Manager Client
Secrets Manager JDBC
Managed secret plug-ins for Alibaba Cloud SDKs
Secrets Manager Kubernetes plug-in
Best practices
Access KMS from an ECS instance in a secure manner
Integration of Alibaba Cloud Services with KMS
Alibaba Cloud services that can be integrated with KMS
Integration with KMS
Best Practices
Use the exponential backoff method to retry requests
Use a KMS CMK to encrypt and decrypt data online
Use envelope encryption to encrypt and decrypt local data
Use KMS to protect ECS workloads with a few clicks
Use KMS to encrypt Kubernetes Secrets at rest
FAQ
What is envelope encryption?
Why am I unable to access the KMS endpoint?
Why is the error Forbidden.KeyNotFound reported during decryption?
API Reference
List of operations by function
Impact of CMK status on API operations
Request method
Request signatures
Common parameters
Sample responses
Obtain an AccessKey pair
Key
CreateKey
GetParametersForImport
ImportKeyMaterial
EnableKey
DisableKey
SetDeletionProtection
ScheduleKeyDeletion
CancelKeyDeletion
DeleteKeyMaterial
DescribeKey
ListKeys
UpdateKeyDescription
DescribeKeyVersion
ListKeyVersions
UpdateRotationPolicy
CreateKeyVersion
Encrypt
GenerateDataKey
GenerateDataKeyWithoutPlaintext
ExportDataKey
GenerateAndExportDataKey
Decrypt
ReEncrypt
AsymmetricSign
AsymmetricVerify
AsymmetricDecrypt
AsymmetricEncrypt
GetPublicKey
CreateAlias
UpdateAlias
DeleteAlias
ListAliases
ListAliasesByKeyId
Secrets
CreateSecret
ListSecrets
DeleteSecret
DescribeSecret
GetSecretValue
PutSecretValue
UpdateSecret
UpdateSecretVersionStage
RestoreSecret
ListSecretVersionIds
GetRandomPassword
RotateSecret
UpdateSecretRotationPolicy
Certificate
CreateCertificate
UploadCertificate
GetCertificate
DescribeCertificate
UpdateCertificateStatus
DeleteCertificate
CertificatePrivateKeySign
CertificatePublicKeyVerify
CertificatePublicKeyEncrypt
CertificatePrivateKeyDecrypt
Tag
TagResource
UntagResource
ListResourceTags
Other API operations
DescribeRegions
DescribeAccountKmsStatus
OpenKmsService
all-products-head
This Product
This Product
All Products
All Products
Show more
Show less