What Should I Do If KMS Failed to Be Requested and Error Code 401 Is Displayed?

Symptom

An error is reported when KMS is requested or the cloud service encryption function is enabled.

Error information: httpcode=401,code=APIGW.0301,Msg=Incorrect IAM authentication information: current ip:xx.xx.xx.xx refused

Possible Causes

Access control is configured in IAM.

By default, IAM allows access from any IP addresses. If you configure ACL, the IP addresses and network segments out of the specified range cannot access KMS or use the cloud encryption feature.

Solution

• To access KMS through the cloud service console (for example, for OBS encryption purposes), allow access from network segments 10.0.0.0/8, 11.0.0.0/8, and 26.0.0.0/8.
• To call KMS via API, allow access from the source IP addresses.

Allowing Access from Specific IP Addresses

1. Log in to the management console.
2. Click on the left of the page and choose Management & Governance > Identity and Access Management. The Users page is displayed.
3. Choose Security Settings and click the ACL tab. Check whether IP Address Ranges and IPv4 CIDR Blocks are properly configured.
   

   The source IP address you use must be specified on both the Console Access and API Access tabs.