Key Management Service (KMS) provides secure and compliant key lifecycle management and data encryption/decryption capabilities.
For users, the core key components involved in KMS include the customer master key (CMK) and data encryption key (DEK). A CMK is a first-level key used to encrypt and decrypt sensitive data and generate DEKs. A DEK is a second-level key used in the envelope encryption process. It is protected by a CMK and used to encrypt business data.
Key Overview
CMK
The customer master key (CMK) is a core resource in KMS. These master keys are protected by third-party certified hardware security modules (HSMs) and serve as the first-level keys for user encryption and decryption. KMS is primarily a management service for CMKs.
A CMK is a logical representation of a master key, and it contains metadata such as key ID, creation date, description, and key status. Generally, you can use the automatic CMK generation feature in KMS or import your own key to generate a CMK.
A customer master key (CMK) includes two types: user keys and cloud service keys.
Customer-managed keys are CMKs created by users through the console or API. You can create/enable/disable/rotate/manage permissions for these keys.
Cloud product keys are CMKs automatically created for users when Tencent Cloud products/services (such as CBS, COS, TDSQL) call KMS. You can query and enable key rotation for cloud product keys, but you cannot disable or schedule their deletion.
Data Encryption Key (DEK)
A data encryption key (DEK) is a second-level key generated from a CMK and can be used to encrypt and decrypt user data locally.
You can use a KMS customer master key (CMK) to generate DEKs. However, KMS does not store, manage, or track your DEKs, nor does it use DEKs to perform encryption operations. You must use and manage DEKs outside of KMS.
A DEK is typically used in the envelope encryption process to encrypt local business data. It is protected by a customer master key (CMK), can be customized, and can also be created through the GenerateDataKey API. Operation Overview
|
| Quickly create a key through the console. |
| View the key ID and details through the console. |
| Edit the key name, description, and other information through the console. |
| Enable/disable a key through the console. |
| Enable key rotation through the console. |
| Encrypt data with a key through the console. |
| Quickly delete a key through the console. |
| Set permissions for sub-accounts to manage the Key Management Service. |