tencent cloud

Key Management Service

DokumentasiKey Management Service

Operation Guide

Download
Mode fokus
Ukuran font
Terakhir diperbarui: 2026-07-30 16:52:53
Diterjemahkan oleh AI
This guide uses Python as an example. The approach is similar for other programming languages.

Preliminary Preparation

The sample code requires the following environment: Python 2.7.
To activate the KMS service: Activate KMS from the Tencent Cloud console.
To activate the TencentCloud API key service: Obtain the SecretID, SecretKey, and the endpoint. The endpoint typically follows the format *.tencentcloudapi.com. For example, the endpoint for KMS is kms.tencentcloudapi.com. For details, refer to the documentation of each product.
To install the SDK, run the following command. For details, see the tencentcloud-sdk-python github project.
pip install tencentcloud-sdk-python

Operation Process

You can encrypt sensitive data by following these four steps.
1. Create a Customer Master Key (CMK) through the Console or the API (CreateKey).
2. Call the KMS encryption API (Encrypt) to encrypt user-sensitive data and obtain the ciphertext.
3. Store the ciphertext data according to your business requirements.
4. When reading data, call the KMS decryption API (Decrypt) to decrypt it into plaintext.

Operation Steps

Step 1: Create a Customer Master Key (CMK)

For information on how to create a Customer Master Key, see the Create Key document.

Step 2: Encrypt Sensitive Information

Prerequisites: Ensure the Customer Master Key Created in Step 1 Is Enabled.

Console Method

Online tools are suitable for one-off or non-batch encryption and decryption operations, such as generating a key ciphertext for the first time. Developers do not need to build additional tools for non-batch encryption and decryption tasks, allowing them to focus on implementing core business capabilities. For details, see the Encryption and Decryption document.

Python SDK Method

The Encrypt API can encrypt user data. The maximum data size for encryption is 4 KB. This method is suitable for encrypting database passwords, RSA keys, or other small sensitive information. The example in this document is implemented using the Tencent Cloud Python SDK. You can also use other supported programming languages.
The KeyId and Plaintext parameters are required for this API operation. For details and to view descriptions of other parameters, see the Encrypt API documentation.

Python SDK Sample for Encryption

The following sample code demonstrates how to encrypt data using a specified CMK.

Python Code Sample

# -*- coding: utf-8 -*-
import base64

from tencentcloud.common import credential
from tencentcloud.common.exception.tencent_cloud_sdk_exception import TencentCloudSDKException
from tencentcloud.common.profile.client_profile import ClientProfile
from tencentcloud.common.profile.http_profile import HttpProfile
from tencentcloud.kms.v20190118 import kms_client, models

def KmsInit(region="ap-guangzhou", secretId="", secretKey=""):
    try:
        credProfile = credential.Credential(secretId, secretKey)
        client = kms_client.KmsClient(credProfile, region)
        return client
    except TencentCloudSDKException as err:
        print(err)
        return None

def Encrypt(client, keyId="", plaintext=""):
    try:
        req = models.EncryptRequest()
        req.KeyId = keyId
        req.Plaintext = base64.b64encode(plaintext)
        rsp = client.Encrypt(req) # Call the encryption API.
        return rsp
    except TencentCloudSDKException as err:
        print(err)
        return None

if __name__ == '__main__':
    # User-defined parameters
    secretId = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    secretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    region = "ap-guangzhou"
    keyId = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    plaintext = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

    client = KmsInit(region, secretId, secretKey)
    rsp = Encrypt(client, keyId, plaintext)
    print "plaintext=", plaintext, ", cipher=", rsp.CiphertextBlob

Step 3: Store the Encrypted Data

Store the ciphertext according to your business application scenario.

Step 4: Decrypt Sensitive Data

Console Method

For details, see the Encryption and Decryption document.

Python SDK Method

Decrypt user data via the Decrypt API.
The CiphertextBlob parameter is required for this API operation. For details and to view descriptions of other parameters, see the Decrypt API documentation.

Python Code Sample

# -*- coding: utf-8 -*-
import base64
from tencentcloud.common import credential
from tencentcloud.common.exception.tencent_cloud_sdk_exception import TencentCloudSDKException
from tencentcloud.common.profile.client_profile import ClientProfile
from tencentcloud.common.profile.http_profile import HttpProfile
from tencentcloud.kms.v20190118 import kms_client, models

def KmsInit(region="ap-guangzhou", secretId="", secretKey=""):
    try:
        credProfile = credential.Credential(secretId, secretKey)
        client = kms_client.KmsClient(credProfile, region)
        return client
    except TencentCloudSDKException as err:
        print(err)
        return None

def Decrypt(client, keyId="", ciphertextBlob=""):
    try:
        req = models.DecryptRequest()
        req.CiphertextBlob = ciphertextBlob
        rsp = client.Decrypt(req) # Call the decryption API.
        return rsp
    except TencentCloudSDKException as err:
        print(err)
        return None

if __name__ == '__main__':
    # User-defined parameters
    secretId = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    secretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    region = "ap-guangzhou"
    keyId = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    ciphertextBlob = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

    client = KmsInit(region, secretId, secretKey)
    rsp = Decrypt(client, keyId, ciphertextBlob)
    print "cipher=", ciphertextBlob, ", base64 decoded plaintext=", base64.b64decode(rsp.Plaintext)

Topik selanjutnya: Kebijakan Privasi

Bantuan dan Dukungan

Apakah halaman ini membantu?

masukan