Overview

KMS

• Creating a Key

  • A customer master key (CMK) contains metadata, including key ID, key alias, description, key status, and creation date, as well as key materials used to encrypt and decrypt data.

    On the KMS console, you can create a key, which will automatically generate key materials.

    You can also import key materials to KMS for unified management as needed.

    

    Region: All

    

    Creating a Key

    

    Importing Key Materials

• Key Lifecycle Management

  • You can manage the entire lifecycle of the CMK on the KMS console.

    

    Region: All

    

    Enabling a Key

    

    Disabling a Key

    

    Deleting a Key

• Data Encryption and Decryption

  • To encrypt or decrypt small-volume data, such as passwords, certificates, and phone numbers, you can use the online tools on the KMS console or call the required KMS APIs to directly encrypt or decrypt data with a specified CMK.

    To encrypt or decrypt large volumes of data, such as pictures, videos, and database files, you can use the envelope encryption method, where the data does not need to be transferred over the network.

    

    Region: All

    

    How Do I Encrypt and Decrypt a Small Amount of Data?

    

    How Do I Encrypt and Decrypt a Large Amount of Data?

• Key Rotation

  • Keys that are widely or repeatedly used are insecure. To enhance the security of encryption keys, you are advised to periodically rotate keys and change their key materials.

    Periodic key rotation can reduce the amount of data encrypted by each key, enhance security incident handling, and strengthen data isolation, thereby improving the security of encryption keys.

    After key rotation is enabled, you will be charged for storing the key. Each rotated version is calculated as an independent master key resource.

    

    Region: All

    

    Enabling Key Rotation

    

    Billing

• title

  • txt

    

    Region: All

    

    xref01

    

    xref02

• Signature Verification

  • Signature verification is an encryption mechanism that ensures data transmission security and integrity, preventing information from being tampered or forged during transmission.

    

    Region: All

    

    Signature Data

    

    Signature Verification

• Key Grants

  • You can create a grant for other IAM users or accounts to perform operations on your custom keys. The grants can be created via API calls.
    You can revoke a grant on the KMS console in either of the following scenarios:
    

    • The grantee no longer uses the granted custom key. The grantee can either tell you to revoke the grant or call required APIs to retire the grant directly.
    • You do not want the grantee to have the grant.
    

    Region: All

    

    Creating a Grant

    

    Revoking a Grant

• Hardware True Random Numbers

  • A device that generates random numbers through physical processes instead of computer programs. Random numbers ranging from 8 bits to 8,192 bits can be generated by calling APIs.

    

    Region: All

    

    Generating Random Numbers

CSMS

• Creating a Secret

  • Currently, you can create shared secrets and RDS secrets on the CSMS console.

    Full lifecycle management is supported for customized secrets in different scenarios. You can use CSMS to centrally manage, retrieve, and securely store various types of secrets, such as database account passwords, server passwords, SSH keys, and access keys. Multiple versions can be managed, so you can rotate secrets.

    Database secret leakage is the main cause of data leakage. CSMS supports RDS secrets host and automatic and manual rotation, meeting various database secret management scenarios and reducing security risks faced by service data.

    

    Region: CN-Hong Kong, AP-Bangkok, AP-Singapore, AP-Jakarta, AF-Johannesburg, LA-Mexico City1, LA-Mexico City2, LA-Sao Paulo1, and LA-Santiago

    

    Creating a Shared Secret

    

    Creating a Rotated Secret

• Secret Rotation

  • Secrets need to be periodically updated to enhance security. To rotate a secret, you need to update the secret in all the applications and configurations using it, which is time-consuming, error-prone, and may cause service interruption.

    With CSMS, you can conveniently manage multiple secret versions. Applications can call CSMS APIs or SDKs to securely update secrets without making mistakes.

    

    Region: CN-Hong Kong, AP-Bangkok, AP-Singapore, AP-Jakarta, AF-Johannesburg, LA-Mexico City1, LA-Mexico City2, LA-Sao Paulo1, and LA-Santiago

    

    Rotating Secret Version

    

    Managing Version Status

• Secret Event Notification

  • After you subscribe to an associated event for a secret object, if the event is enabled and a basic event is triggered on the secret object, an event notification is sent to the notification topic specified by the event through Simple Message Notification (SMN).

    Basic event types include new secret version creation, secret version expiration, secret deletion, and secret rotation. After configuring event notification, you can use event-driven managed functions in FunctionGraph to automatically rotate secrets.

    

    Region: CN-Hong Kong, AP-Bangkok, AP-Singapore, AP-Jakarta, AF-Johannesburg, LA-Mexico City1, LA-Mexico City2, LA-Sao Paulo1, and LA-Santiago

    

    Creating an Event

KPS

• Creating a Key Pair

  • For system security purposes, it is recommended that you use the key pair authentication mode to authenticate the user who attempts to log in to an ECS. You can create a key pair and use it for authentication when logging in to your ECS.

    If you need to use your own key pair, for example, a key pair created using PuTTYgen, you can import the public key to the management console and use the private key to remotely log in to the ECS. You can also manage the private key in Huawei Cloud for unified management.

    

    Region: CN-Hong Kong, AP-Bangkok, AP-Singapore, AP-Jakarta, AF-Johannesburg, LA-Mexico City1, LA-Mexico City2, LA-Sao Paulo1, and LA-Santiago

    

    Creating a Key Pair

    

    Importing a Key Pair

    

    Upgrading a Key Pair

• Using a Key Pair

  • You can use a key pair to log in to Linux ECSs password-free. This prevents password interception and cracking, improving ECS security.

    When purchasing an ECS, you can choose to authenticate users trying to log in to your ECS with the SSH key pair provided by KPS, or use the key pair to obtain the password for logging in to a Windows ECS.

    

    Region: CN-Hong Kong, AP-Bangkok, AP-Singapore, AP-Jakarta, AF-Johannesburg, LA-Mexico City1, LA-Mexico City2, LA-Sao Paulo1, and LA-Santiago

    

    Binding a Key Pair

    

    Resetting a Key Pair

    

    Replacing a Key Pair

    

    Unbinding a Key Pair

• Using a Private Key

  • You can import local private keys to the KPS console for easy and unified management. The import private keys are encrypted by the keys provided by KMS, ensuring security for storage, import, and export of the private keys. You can download the private keys from the management console whenever you need. To ensure the security of the private keys, keep the downloaded private keys properly.

    

    Region: CN-Hong Kong, AP-Bangkok, AP-Singapore, AP-Jakarta, AF-Johannesburg, LA-Mexico City1, LA-Mexico City2, LA-Sao Paulo1, and LA-Santiago

    

    Importing a Private Key

    

    Exporting a Private Key

    

    Clearing a Private Key

    

    Logging in to a Linux ECS Using a Private Key

    

    Using a Private Key to Obtain the Login Password of Windows ECS

Dedicated HSM

• title

  • txt

    

    Region: All

    

    xref01

    

    xref02

Audit Logs

Permission Management

APIs

SDKs