CreateKey

Action

String

Yes

CreateKey

The operation that you want to perform. Set the value to CreateKey.

Description

String

No

key description example

The description of the key.

The description can be 0 to 8,192 characters in length.

KeyUsage

String

No

ENCRYPT/DECRYPT

The usage of the key. Valid values:

• ENCRYPT/DECRYPT: encrypts or decrypts data.

• SIGN/VERIFY: signs data or verifies a digital signature.

If the key supports signing and verification, the default value is SIGN/VERIFY. If the key does not support signing and verification, the default value is ENCRYPT/DECRYPT.

Origin

String

No

Aliyun_KMS

The key material origin. Valid values:

• Aliyun_KMS (default): KMS generates key material.

• EXTERNAL: You import key material.

ProtectionLevel

String

No

SOFTWARE

The protection level of the key. You do not need to configure the parameter. KMS sets a protection level for the key.

Valid values:

• SOFTWARE

• HSM

EnableAutomaticRotation

Boolean

No

true

Specifies whether to enable automatic key rotation. Valid values:

• true

• false (default)

The parameter is valid only when the key belongs to an instance type that supports automatic rotation. For more information, see Key rotation.

RotationInterval

String

No

365d

The period of automatic key rotation. Format: integer[unit]. Unit: d (day), h (hour), m (minute), or s (second). For example, both 7d and 604800s represent a seven-day interval.

• For a default key, set the value to 365 days.

• For a software-protected key, set a value that ranges from 7 to 365 days.

• A hardware-protected key does not support automatic rotation.

KeySpec

String

No

Aliyun_AES_256

The specification of the key. The valid values vary based on the KMS instance type. For more information about key specifications, standards, and key algorithms, see Key types and key specifications.

DKMSInstanceId

String

No

kst-bjj62d8f5e0sgtx8h****

The ID of the KMS instance.

Tags

String

No

[{"TagKey":"disk-encryption","TagValue":"true"}]

The tag that is added to the key. A tag consists of a key-value pair.

You can enter up to 20 tags. Enter multiple tags in the [{"TagKey":"key1","TagValue":"value1"},{"TagKey":"key2","TagValue":"value2"},..] format.

Each tag key or tag value can be up to 128 characters in length and can contain letters, digits, forward slashes (/), backslashes (\), underscores (_), hyphens (-), periods (.), plus signs (+), equal signs (=), colons (:), and at signs (@).

Policy

String

No

{"Statement":[{"Action":["kms:*"],"Effect":"Allow","Principal":{"RAM":["acs:ram::119285303511****:*"]},"Resource":["*"],"Sid":"kms default key policy"},{"Action":["kms:List*","kms:Describe*","kms:Create*","kms:Enable*","kms:Disable*","kms:Get*","kms:Set*","kms:Update*","kms:Delete*","kms:Cancel*","kms:TagResource","kms:UntagResource","kms:ImportKeyMaterial","kms:ScheduleKeyDeletion"],"Effect":"Allow","Principal":{"RAM":["acs:ram::119285303511****:user/for_test_policy"]},"Resource":["*"]}],"Version":"1"}

The content of the key policy. The value is in the JSON format. The value can be up to 32,768 bytes in length.

For more information about key policies, see Overview. If you do not specify the parameter, the default policy is used.

A key policy contains the following content:

• Version: the version of the key policy. Set the value to 1.

• Statement: the statement of the key policy. Each key policy contains one or more statements.

Example:

{
  "Version": "1",
  "Statement": [
    {
      "Sid": "Enable RAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "RAM": ["acs:ram::112890462****:root"]
      },
      "Action": [
        "kms:*"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "condition operator": {
          "condition key": "condition value"
        }
      }
    }
  ]
}

Statement description:

• Sid: optional. The statement identifier of a custom statement. The value can be up to 128 characters in length and can contain letters, digits, and the following special characters: _ / + = . @ -

• Effect: required. Specifies whether the permissions in a policy statement are allowed or denied. Valid values: Allow and Deny.

• Principal: required. The authorization principal of the policy. The following principals are supported: the current Alibaba Cloud account to which the key belongs, RAM users and RAM roles of the current Alibaba Cloud account, and RAM users and RAM roles of other Alibaba Cloud accounts.

• Action: required. The API operation that you want to allow or deny. The value must start with kms:. For more information about the API operation scope, see Overview. If you specify an API operation outside the scope, the API operation does not take effect.

• Resource: required. Set the value to an asterisk (*), which specifies the current key.

• Condition: optional. The conditions that are required for a policy to take effect. Conditions allow you to evaluate the context of an API request to determine whether a policy statement applies. Format: "Condition": {"condition operator": {"condition key": "condition value"}}. For more information, see Overview.