Changes the Key Management Service (KMS) key used by the Account-level Elastic Block Storage (EBS) Default Encryption feature in a region.
Operation description
- Only Alibaba Cloud accounts can call this operation.
- Before you can call this operation in a region, make sure that the Account-level EBS Default Encryption feature is enabled in the region.
- The first time you use a customer master key (CMK), you must use the
AliyunECSDiskEncryptDefaultRolerole to grant Elastic Compute Service (ECS) access to KMS resources. For more information, see Grant access to KMS keys through RAM roles.
Debugging
Authorization information
There is currently no authorization information disclosed in the API.
Request parameters
| Parameter | Type | Required | Description | Example |
|---|---|---|---|---|
| RegionId | string | Yes | The region ID. You can call the DescribeRegions operation to query the most recent region list. | cn-hangzhou |
| KMSKeyId | string | Yes | The ID of the new KMS key. | 0e478b7a-4262-4802-b8cb-00d3fb40**** |
Response parameters
Examples
Sample success responses
JSONformat
{
"RequestId": "473469C7-AA6F-4DC5-B3DB-A3DC0DE3C83E"
}Error codes
| HTTP status code | Error code | Error message | Description |
|---|---|---|---|
| 400 | InvalidParameter.KMSKeyId.CMKNotEnabled | The CMK needs to be enabled. | The customer master key (CMK) is not enabled when KMSKeyId is specified for an encrypted disk. You can call the DescribeKey operation of KMS to query information about the specified CMK. |
| 400 | InvalidParameter.Encrypted.KmsNotEnabled | KMS must be enabled for encrypted disks. | KMS is not activated. You must activate KMS before you can encrypt disks. |
| 403 | Abs.InvalidAction.RegionNotSupport | This region does not support this action. | The operation is not supported in the region. |
| 403 | InvalidParameter.RegionIdNotExists | The specified region does not exists. | The region does not exist. |
| 403 | InvalidParameter.KMSKeyId.KMSUnauthorized | ECS service have no right to access your KMS. | ECS is not authorized to access your KMS resources. |
| 403 | InvalidOperation.KMSKeyIdNotFound | The specified KMSKeyId not found, %s. | The associated KMS encryption key cannot be found. Verify that the KMS encryption key is valid. |
| 403 | InvalidOperation.KMSServiceNotOpen | KMS service is currently not open. | The KMS service has not been enabled. |
| 403 | UserNotInTheWhiteList | The user is not in disk white list. | You are not authorized to manage the disk. Try again when you are authorized. |
| 403 | InvalidDefaultEncryption.NotFound | You have not configured default encryption setting in this region. | Cloud disk encryption by default has not been enabled for the region. |
For a list of error codes, visit the Service error codes.