Sharing KMS Resources

Scenarios

To share your KMS resources with other accounts, create a resource share first. During the creation, you need to specify resources to be shared, configure permissions, specify users to be shared with, and confirm the configuration.

You can use shared KMS to encrypt the secrets and key pairs in DEW, and create an encryption task for instances in Relational Database Service (RDS), Document Database Service (DDS), and Object Storage Service (OBS).

Creating Shared KMS Resources

1. Log in to the RAM console.
2. In the navigation pane on the left, choose Shared by Me > Resource Shares. The Resource Shares page is displayed.
3. Click Create Resource Share in the upper right corner.
   Figure 1 Specifying shared resources
   

4. Set resource type to kms:KeyId, choose the corresponding region, and select keys to be shared. Click Next: Associate Permissions.
5. Associate a RAM managed permission with each resource type on the displayed page. Then, click Next: Specify Principals in the lower right corner.
6. Specify the target principals and click Next: Confirm in the lower right corner.

   Table 1 Parameters

   Parameter	Description
   Principal Type	Organization For details about how to create an organization, see . NOTE: If you have not enabled resource sharing with organizations, this parameter cannot be set to Organization. For details, see . Huawei Cloud account ID

7. Check the configurations and click Submit in the lower right corner.
   

   After a shared instance is created, the organization accepts the instance automatically, while Huawei cloud accounts need to perform certain operations. For details, see .

Viewing Shared KMS Resources

1. Log in to the DEW console.
2. Click in the upper left corner on the displayed page and select a region.
3. Check the shared key resources in the Shared Key tab.
   Figure 2 Shared keys
   
   

   In the Shared Key tab, you can choose a scenario by entering the copied KMS encryption key ID.

Using Shared KMS Resources

1. Log in to the DEW console.
2. Click in the upper left corner on the displayed page and select a region.
3. In the navigation pane on the left, choose Cloud Secret Management Service > Secrets.
4. Click Create Secret. On the displayed page, select or enter a shared key for KMS Encryption Key.
   Figure 3 Selecting a shared key
   
   

   • When creating a key pair, you can select shared KMS keys.
   • When creating an RDS, DDS, or OBS instance, you can choose shared KMS keys.