Help Center> Data Encryption Workshop> API Reference (ME-Abu Dhabi Region)> APIs> Creating a CMK
Updated on 2022-02-22 GMT+08:00
View PDF

Creating a CMK

Function

This API is used to create customer master keys (CMKs) used to encrypt data encryption keys (DEKs).

Default Master Keys are created by services integrated with KMS. Names of Default Master Keys end with /default. Therefore, in naming your CMKs, do not choose those ending with /default.

Enterprise project users' Default Master Keys belong to their default enterprise projects. The keys and cannot be moved to other enterprise projects, but can be used for cloud-based encryption in non-default enterprise projects to meet compliance requirements.

URI

  • URI format

    POST /v1.0/{project_id}/kms/create-key

  • Parameter description
    Table 1 Parameters

    Parameter

    Mandatory

    Type

    Description

    project_id

    Yes

    String

    Project ID

Requests

Table 2 Request parameters

Parameter

Mandatory

Type

Description

key_alias

Yes

String

Alias of a non-default master key (The alias's length ranges from 1 to 255 characters and matches the regular expression ^[a-zA-Z0-9:/_-]{1,255}$. In addition, it must be different from the alias of a Default Master Key created by the system.)

enterprise_project_id

No

String

Enterprise project ID.

  • If the enterprise project function is not enabled, you do not need to set this parameter.
  • If the enterprise project function is enabled, you can set this parameter when creating a resource.

    If this parameter is not specified, the resource you create will be put under the default enterprise project (whose project ID is 0).

    If you do not have the permission to create resources under the default enterprise project, an error will be reported.

key_description

No

String

CMK description (The value ranges from 0 to 255 characters.)

origin

No

String
Origin of a CMK. The default value is kms. The following values are enumerated:
  • kms indicates that the CMK material is generated by KMS.
  • external indicates that the CMK material is imported.

sequence

No

String

36-byte serial number of a request message

Example: 919c82d4-8046-4722-9094-35c3c6524cff

Responses

Table 3 Response parameters

Parameter

Mandatory

Type

Description

key_info

Yes

Array of objects

Information about keys. For details, see Table 4.
Table 4 key_info field description

Parameter

Mandatory

Type

Description

key_id

Yes

String

CMK ID

domain_id

Yes

String

User domain ID

Examples

The following example describes how to create a CMK with an alias of test.

  • Example request
    {
    "key_alias": "test"
}
  • Example response
    {
    "key_info": {
        "key_id": "bb6a3d22-dc93-47ac-b5bd-88df7ad35f1e",
        "domain_id": "b168fe00ff56492495a7d22974df2d0b"
    }
}

    or

    {
    "error": {
        "error_code": "KMS.XXXX",
        "error_msg": "XXX"
    }
}

Status Codes

Table 5 lists the normal status code returned by the response.
Table 5 Status codes

Status Code

Status

Description

200

OK

Request processed successfully.

Exception status code. For details, see Status Codes.

Parent topic: APIs