Help Center/ Data Encryption Workshop/ FAQs/ KMS Related/ What Are the Differences Between a Custom Key and a Default Key?
Updated on 2025-09-15 GMT+08:00
View PDF

What Are the Differences Between a Custom Key and a Default Key?

The following table describes the differences between a custom key and a default key.

Table 1 Differences between a custom key and a default key

Item

Definition

Difference

Custom key

A Key Encryption Key (KEK) created using KMS. The key is used to encrypt and protect DEKs.

A custom key can be used to encrypt multiple DEKs.
  • It can be disabled and scheduled for deletion.
  • It is billed per use after the being created or imported.

Default key

Automatically generated by the system when you use KMS to encrypt data in another cloud service for the first time. The suffix of the key is /default.

Example: evs/default
  • It cannot be disabled or scheduled for deletion.
  • You are not charged when you use the cloud service automatically generated by the system. If the number of API requests exceeds 20,000, you will be billed.
Parent topic: KMS Related