Key Management Service：Backups

Supported instance types

• Only Software Key Management instances support the backup and restoration feature.

• Hardware Key Management instances do not support backup, but Hardware-protected key can be partially backed up using the backup feature provided by the Hardware Security Module (HSM). A hardware-protected key comprises two parts: key material and key metadata.

  • The key material refers to the hardware-protected keys mapped on the HSM, which can be backed up through the HSM backup feature. For more information, see Manage data backup and restoration.

  • The key metadata refers to information stored in KMS, such as key ID, the associated KMS instance, Alibaba Resource Name (ARN), and key policies, which does not support back up.

Scenarios

• You want to restore a KMS instance of the software key management type after the instance is released.

• You want to restore a key or a secret that is deleted.

• Your services are distributed in multiple regions. You want to copy a key or a secret to other regions for disaster recovery or nearest calls.

Features

KMS uses backup instances to back up data. You can use each backup instance to back up the data of one KMS instance of the software key management type. KMS supports automatic backup and manual backup.

• Automatic backup: If you enable a KMS instance of the software key management type that is created after 00:00 on April 26, 2024, KMS automatically creates a backup instance to back up the data of the KMS instance. For more information, see [Announcement] KMS instances of the software key management type support the automatic back feature.

• Manual backup: Backup instances include default backup instances and purchased backup instances. KMS provides a default backup instance in each region free of charge. You must enable a backup instance to allow KMS to back up data.

On the Backups page, you can quickly identify the type of a backup instance based on the Backup Type parameter. System Created indicates that the backup instance is created by KMS. Default indicates the default backup instance. Paid indicates that the backup instance is purchased.

Back up data

Automatic backup

After you enable a KMS instance of the software key management type, KMS automatically backs up data of the instance. For more information about how to enable a KMS instance, see Purchase and enable a KMS instance.

After an instance is enabled, KMS automatically creates a backup instance. To view the backup instance, go to the Backups page, find an instance whose Backup Type is set to System Created and Backup Object is set to your KMS instance.

Manual backup

1. Log on to the KMS console. In the top navigation bar, select a region. In the left-side navigation pane, choose Security Operations > Disaster Recovery > Backups.

2. (Optional) Purchase a backup instance.

   Note

   If you want to use the default backup instance, skip this step.

   1. On the Backups page, click Create Backup, configure the parameters based on your business requirements, and then click Buy Now.

      Parameter	Description
      Instance Type	The type of instance that you want to purchase. Select Value-added Plan.
      Value-added Plan	The plan that you want to purchase. Select instance backup.
      Region	The region of the KMS instance of the key management software type that you want to back up.
      Viewable days	The period of time during which you can query backup data. Unit: days.
      purchase quantity	The number of backup instances that you want to purchase. Note You can use each backup instance to back up the data of one KMS instance of the software key management type.
      Duration	The subscription duration of the backup instance.

   2. On the Confirm Order page, read and select Terms of Service, click Pay, and then complete the payment.

3. Enable the backup instance.

   1. On the Backups page, find the backup instance that you want to enable and click Enable in the Actions column.

   2. In the Enable Backup panel, configure the parameters and click OK.

      Parameter	Description
      Instance Type	Software Key Management is selected by default. You cannot change the value.
      Source Instance	The KMS instance of the key management software type that you want to back up.
      Data Type	The type of data that you want to back up. Key and Secret are selected by default. You cannot change the value.
      Backup Alias	The alias of the backup instance.

      The first time you enable a backup instance, a full backup is performed. Subsequent full backups are performed on a daily basis at 00:00. After each full backup, incremental backups are performed every 5 minutes.

4. Optional. View backup data.

   Find the backup instance whose data you want to view and click View Data in the Actions column. On the page that appears, select a date to view the backup data.

   Backup data type	Description
   Fully Backed up Keys	The keys that are fully backed up at 00:00 on the selected date.
   Incrementally Backed up Keys	The keys that are created on the selected date.
   Rotated Keys	The keys that are rotated on the selected date.
   Fully Backed up Secrets	The secrets that are fully backed up at 00:00 on the selected date.
   Incrementally Backed up Secrets	The secrets that are created on the selected date.
   Rotated Secrets	The secrets that are rotated on the selected date.

Restore data

KMS can restore the data of a source instance only to a destination instance of the software key management type within the Alibaba Cloud account of the source instance. The destination instance must meet the following requirements:

• The destination instance has a sufficient key quota or secret quota.

• The key or secret that you want to restore does not exist in the region where the destination instance resides. Otherwise, the restoration fails. If you want to restore a key or secret in this scenario, delete the existing key or secret.

• If you want to restore a secret, the key that is used to encrypt the secret must exist in the destination instance.

1. Log on to the KMS console. In the top navigation bar, select a region. In the left-side navigation pane, choose Security Operations > Disaster Recovery > Backups.

2. Find the backup instance whose data you want to restore and click View Data in the Actions column. On the page that appears, select the date to which you want to restore data.

   Important

   If the backup instance is a purchased backup instance and the date that you want to select is not included in the queryable range, you can extend the queryable range and restore data again. If you want to restore data before the backup instance is enabled, an extension of the queryable period does not achieve this.

   For example, you enable a backup instance on May 1, 2024 and the queryable range is 10 days. On May 20, 2024, you can extend the queryable range to 16 days if you want to restore the data that is generated on May 5, 2024.

3. Restore data.

   Data type	Procedure
   Key	Click the required key tab such as Fully Backed up Keys, find the key that you want to restore, and then click Restore Data in the Actions column. In the Restore Data panel, select the destination instance to which you want to restore the data and the region of the instance, and click OK.
   Secret	Restore the key that is used to encrypt a secret. Note If you want to restore a secret, the key that is used to encrypt the secret must exist in the destination instance. If the key exists in the destination instance, skip this step. Click the required key tab such as Fully Backed up Keys, find the required key, and then click Restore Data in the Actions column. In the Restore Data panel, select the destination instance to which you want to restore the data and the region of the instance, and click OK. Restore the secret. Click the required secret tab such as Fully Backed up Secrets, find the secret that you want to restore, and then click Restore Data in the Actions column. In the Restore Data panel, select the destination instance to which you want to restore the data and the region of the instance, and click OK.

More operations

Extend the queryable range

1. Log on to the KMS console. In the top navigation bar, select a region. In the left-side navigation pane, choose Security Operations > Disaster Recovery > Backups.

2. Find the required backup instance and click View Data in the Actions column.

3. On the details page of the backup instance, click Extend Queryable Range, select the number of days to which you want to extend the queryable range, click Buy Now, and then complete the payment.

Reset a backup instance

You can reset only default backup instances and purchased backup instances. You can reset a backup instance to delete the backup data and disassociate the backup instance from the source KMS instance.

1. Log on to the KMS console. In the top navigation bar, select a region. In the left-side navigation pane, choose Security Operations > Disaster Recovery > Backups.

2. Find the backup instance that you want to reset and click Reset in the Actions column.

3. In the Reset message, confirm the information and click OK.

   After you reset the backup instance, the backup instance enters the Disabled state. You can associate the backup instance with a new KMS instance of the software key management type.

Renew a backup instance

You can renew only purchased backup instances.

1. Log on to the KMS console. In the top navigation bar, select a region. In the left-side navigation pane, choose Security Operations > Disaster Recovery > Backups.

2. Find the backup instance that you want to renew and click Renew in the Actions column.

3. On the Renew page, configure Subscription Period, read and select Terms of Service, click Buy Now, and then complete the payment.

Download backup data

1. Log on to the KMS console. In the top navigation bar, select a region. In the left-side navigation pane, choose Security Operations > Disaster Recovery > Backups.

2. Find the backup instance whose backup data you want to download and click Download in the Actions column.

3. In the Export Backup Data panel, configure Backup Date and click OK.

   Note

   If you want to download backup data whose date is not included the Queryable Range, you must extend the queryable range and redownload the data.

4. Save the backup data.

   • Click the icon next to Encryption Key to copy and save the encryption key to your computer.

   • Click Download next to Backup Data to download the backup data. Keep the backup data confidential.

   Important

   Encryption keys are used to decrypt downloaded backup data. KMS does not store the encryption keys or the backup data . We recommend that you keep encryption keys and backup data confidential.

Upload a backup data file

1. On the Backups page, click Upload Backup.

2. In the Import Backup Data panel, configure Decryption Key and Backup Name, and then click OK.

3. In the dialog box that appears, select the backup data file that you want to upload and click Open.

   After you upload the backup data file, you can view the uploaded data on the Backups page. The Backup Type of the uploaded data is set to Upload.

FAQ

How do I view the queryable range?

On the Backups page, you can view the value of Queryable Range.

References

• Migrate keys across regions

• Migrate secrets across regions