Overview
Key Management Service (KMS) is a comprehensive security management solution designed to simplify the creation and administration of cryptographic keys, ensuring the confidentiality, integrity, and availability of sensitive data. It effectively addresses key management and compliance requirements across diverse applications and business environments.
Benefits
Security and Compliance
KMS utilizes a certified third-party hardware security module (HSM) for the generation and safeguarding of keys. It employs secure data transfer protocols, distributed clustered service deployment, and hot backup to ensure uninterrupted availability. The security measures and quality control standards adhered to by KMS are endorsed by numerous compliance frameworks.
Rich function
The Key Management Service offers an array of robust management functionalities, encompassing key creation, activation, deactivation, rotation configurations, alias management, key details viewing, and related information modification.
Seamless Integration with Cloud Services
KMS offers seamless integration with various Cloud services including COS, CloudDB for MySQL, and CBS, allowing users to effectively manage their keys using KMS.
Easy Management
The KMS console seamlessly integrates with CAM and Cloud Monitor, facilitating effortless key creation for access control. Additionally, all management operations and key usage are meticulously logged for comprehensive monitoring and auditing.
Low Costs
The pay-as-you-go KMS can be swiftly deployed with a simple click, allowing for rapid implementation. The cloud service handles all backend maintenance, eliminating the need for investing in dedicated hardware encryption devices and enabling businesses to concentrate entirely on their developmental endeavors.
Supports External Key Import
KMS enables the encryption and decryption of sensitive data using a customized key through the implementation of the Bring Your Own Key (BYOK) solution.
Features
Managed Key Services
KMS offers an extensive array of management functionalities, encompassing key creation, activation, deactivation, rotation settings, alias assignment, key details viewing, and relevant information modification. This empowers users to efficiently generate and safeguard keys.
Rich function
KMS includes a feature for rotating customer master keys (CMKs), which is initially deactivated but can be enabled as required. When enabled, CMK rotation occurs once annually.
Permission Control
Seamlessly integrated with CAM, KMS offers comprehensive control over the access and management of sensitive keys, allowing precise regulation of accounts and roles through identity and policy management.
Built-in Audit
KMS seamlessly incorporates Audit functionality to meticulously document all API requests, providing comprehensive logs of key management operations and key utilization.
Scenarios
Sensitive Data Encryption
Envelope Encryption
Bring Your Own Key
Encryption of sensitive information stands as a fundamental feature of KMS, primarily employed to safeguard confidential data (under 4 KB in size) stored on server disks, including keys, certificates, and configuration files.
Envelope encryption stands as an efficient encryption and decryption method, particularly suited for handling extensive volumes of data. Utilizing envelope encryption within KMS streamlines the process by transferring only the data encryption keys (DEKs) to the KMS server, which are encrypted and decrypted using the Customer Master Key (CMK). Subsequently, all data undergoes processing with efficient local symmetric encryption, ensuring minimal disruption to user access.
The Bring Your Own Key (BYOK) solution enables the utilization of custom keys for encrypting and decrypting sensitive data stored in the Cloud. With BYOK implementation, you can create a Customer Master Key (CMK) devoid of key material, subsequently importing your own key to establish an external CMK. This external CMK can then be effectively managed and distributed alongside KMS.
Compute
Edge Computing
Container
Distributed Cloud
Microservice
Serverless
Essential Storage Service
Data Migration
Data Process and Analysis
Relational Database
NoSQL Database
Enterprise Distributed DBMS
Database SaaS Tool
Networking
CDN and Edge platform
Network Security
Data Security
Application Security
Endpoint Security
Business Security
Security Services
Security Management
Domains & Websites
Office Collaboration
Enterprise Applications
Data Analysis
Image Recognition
Face Recognition
Voice Technology
AI Platform Service
Natural Language Processing
Optical Character Recognition
Internet of Things
Message Queue
Middleware
Communication
Interactive Video Services
Stream Services
Media On-Demand
Media Process Services
Media SDK
Cloud Real-time Rendering
Game Services
Game Video Service
Education Services
Blockchain Service
Building Services
Cloud Resource Management
Management and Audit Tools
Developer Tools
Monitor and Operation
Education