Where to Obtain the SecretID and SecretKey in the SDK
Log in to the API Key Management Console with your root account to obtain your SecretID and SecretKey.Ensure that you securely store your SecretID and SecretKey to prevent leakage. How to Create a Customer Master Key (CMK)
Is There a Limit on the Number of Customer Master Keys (CMKs) You Can Create?
Yes. The creation of CMKs is limited to 200 per account per region, excluding those in the scheduled deletion state. Cloud product keys are not included. To create more CMKs, please submit a ticket or contact Tencent Cloud sales. What Does "External" Mean When the Key Material Source Is Selected During Key Creation? What Is the BYOK Scheme?
External refers to using the user's own key material.
BYOK (Bring Your Own Key) is a solution that enables users to utilize their own key material. It works by having the KMS service generate a CMK with empty key material. The user then imports their own key material into this customer master key, creating an external key CMK (EXTERNAL CMK). Finally, the KMS service manages the distribution of this external key.
How Long Does It Take for Changes to a Customer Master Key's Alias or Description to Take Effect When Made via API?
The configuration takes effect immediately after the API request succeeds.
Does It Support Rotating Customer Master Keys (CMKs)? How to Enable It?
Attention:
Customer Master Keys that do not support rotation:
Asymmetric Customer Master Keys (CMKs).
Customer Master Keys (CMKs) that use external key material.
Do I Need to Make Changes to My Business After Enabling Rotation?
Key rotation only changes the key material of a Customer Master Key. The attributes of the Customer Master Key (Key ID, alias, description, permissions) remain unchanged.
After you enable key rotation, the Key Management Service automatically rotates keys based on the configured rotation period (365 days by default). Each rotation generates a new version of the Customer Master Key. The method for encrypting and decrypting data with the rotated key is as follows:
When data is encrypted, KMS automatically uses the current latest version of the Customer Master Key to perform the encryption.
When decrypting data, KMS automatically uses the Customer Master Key that was used during encryption to perform the decryption.
How to Choose a Data Encryption Algorithm
Symmetric Encryption and Decryption: Symmetric encryption and decryption algorithms include SM4 and AES. The system automatically selects the algorithm based on the region specified when the master key is created. For example, if the region is set to "China", the system selects the SM4 algorithm.
Asymmetric Encryption and Decryption: Asymmetric encryption and decryption algorithms include RSA keys with a modulus length of 2048 bits and SM2. The algorithm selection is jointly determined by the region and KeyUsage you specify when the master key is created.
Attention:
When a Customer Master Key is created via API, we recommend that you first query the encryption methods supported in the current region before creation to ensure the key is created correctly.