Key Management Service：Authorization information

Procedure

1. Log on to the RAM console by using an Alibaba Cloud account.

2. Create a custom policy.

   1. In the left-side navigation pane, choose Permissions > Policies.

   2. On the Policies page, click Create Policy.

   3. On the Create Policy page, click the JSON tab.

      Note

      RAM provides the visual editing and document editing modes to create policies. When you create a custom policy for Key Management Service (KMS) resources, you must use the document editing mode. If you use the visual editing mode, you can select only all KMS resources and all operations.

   4. Modify the policy document and click Next to edit policy information.

      When you edit a KMS policy document, you must specify a custom authorization statement. A statement contains the following elements: Effect, Action, Resource, and Condition. The Condition element is optional. For more information, see Appendix: Supported resources, actions, and conditions.

      Note

      For more information about the syntax and structure of RAM policies, see Policy structure and syntax.

   5. Specify the policy name and description. Then, check and optimize the policy document as prompted.

   6. Click OK.

3. Attach custom policies to a RAM user.

   1. In the left-side navigation pane, choose Identities > Users.

   2. On the Users page, find the RAM user to which you want to attach custom policies and click Add Permissions in the Actions column.

   3. In the Grant Permission panel, configure the parameters and click Grant Permissions.

      Parameter	Description
      Resource Scope	The scope in which you want the permissions to take effect. KMS does not support the resource group feature. You must select Account.
      Principal	The RAM user to which you want to grant permissions. The Principal parameter is automatically set to a specific RAM user. You can specify a different RAM user.
      Policy	Select custom policies based on your business requirements.

Appendix: Supported resources, actions, and conditions

Resource

KMS defines the following resource types: key container, secret container, alias container, key, secret, and alias. You can configure the Resource element in a RAM policy based on the Alibaba Cloud Resource Name (ARN) of your resource. In the following example, the ARN of a key resource is queried.

1. Log on to the KMS console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resource > Keys.

2. On the Keys tab, find the key whose ARN you want to query and click Details in the Actions column. On the details page, you can view the ARN of the key. The following table describes the ARN formats for different resource types.

   Note

   Replace ${region} and ${account} with your actual region and Alibaba Cloud account. You can also narrow the scope of resources based on your business requirements. ${region} supports the asterisk (*) wildcard character, which specifies all supported regions.

   Resource type	ARN
   Key container	acs:kms:${region}:${account}:key
   Secret container	acs:kms:${region}:${account}:secret
   Alias container	acs:kms:${region}:${account}:alias
   Key	acs:kms:${region}:${account}:key/${key-id} Note The ARN of a key resource supports the asterisk (*) wildcard character. Examples: acs:kms:${region}:${account}:key/*: specifies all keys in a region within an account. acs:kms:*:${account}:key/*: specifies all keys in all regions within an account.
   Secret	acs:kms:${region}:${account}:secret/${secret-name} Note The ARN of a secret resource supports the asterisk (*) wildcard character. acs:kms:${region}:${account}:secret/*: specifies all secrets in a region within an account. acs:kms:${region}:${account}:secret/prefix*: specifies all secrets that start with prefix in a region within an account.
   Alias	acs:kms:${region}:${account}:alias/${alias-name}

Action

KMS defines actions for each API operation that requires access control. In RAM policies, actions are in the kms:<api-name> format.

The following tables describe the RAM actions and resource types that correspond to each API operation.

Condition