Key Management System (KMS) offers secure and compliant full lifecycle management and encryption/decryption capabilities for keys.
For users, the core key components involved in the KMS service include Customer Master Keys (CMKs) and Data Encryption Keys (DEKs). CMKs are first-level keys belonging to users, used for encrypting and decrypting sensitive data as well as deriving DEKs. DEKs are second-level keys in the envelope encryption process, used for encrypting business data and protected by the user's CMK.
For scenarios where CMKs and DEKs are used for business data encryption and decryption, please see Sensitive Data Encryption and Envelope Encryption Best Practices.
Key Overview
Customer Master Key (CMK)
A CMK, as a core resource in KMS, is protected by a third-party certified hardware security module (HSM) and used as a first-level key for encryption and decryption. KMS is mainly a management service for CMKs.
A Customer Master Key (CMK) is the logical representation of a primary key. CMKs include metadata such as key ID, creation date, description, and key status. Typically, you can use KMS's auto-generated customer master key feature to create CMKs, and it also supports importing your own keys to form CMKs.
There are two types of CMKs: Customer Managed CMK and Tencent Cloud Managed CMK.
User Keys are Customer Master Keys created by users through the console or API. You can perform operations such as creating, enabling, disabling, rotating, and controlling permissions for user keys.
Cloud Product Keys are CMKs automatically created for users by Tencent Cloud products/services (such as CBS, COS, TDSQL, etc.) when invoking the Key Management System. You can query and enable key rotation for cloud product keys, but disabling and scheduled deletion operations are not supported.
Data Encryption Key (DEK)
Data Encryption Keys (DEKs) are secondary keys generated based on CMKs and can be used for local data encryption and decryption. You can generate DEKs using KMS Customer Master Keys (CMKs); however, KMS does not store, manage, or track your DEKs, nor does it perform encryption operations with DEKs. You must use and manage DEKs outside of KMS.
Typically, DEKs are used in the envelope encryption process for encrypting local business data. DEKs are protected by the Customer Master Key (CMK) and can be customized or created through the GenerateDataKey interface.
Operation Overview
Action | Note |
Create a key quickly in the console. | |
Viewing Key ID and Details Information via Console | |
Edit key name, description, and other information via the console. | |
Enable/Disable a key through the console | |
Enable key rotation in the console. | |
Encrypting Data with Keys in the Console | |
Quickly delete a key through the console. | |
Enable or disable key archiving in the console. | |
Set sub-account permissions for managing the Key Management System |