Key Management Service (KMS)
KMS is a secure, easy-to-use service that uses Hardware Security Modules (HSMs) to protect your keys. It seamlessly interworks with other services to protect service data and can be used to develop encryption applications.
20,000 free API requests each month. Learn more
Certified third-party HSMs are used to generate keys and random numbers and save Root Keys. Data Encryption Keys (DEKs) are transmitted in encrypted channels.
Key persistence is ensured by online backup of Customer Master Keys (CMKs) in redundant storage and offline backup of Root Keys on physical devices.
KMS interworks with OBS, EVS, IMS, and VBS, facilitating key management and protection of service data. Users can make KMS API requests to encrypt local data.
Default Master Keys are free of charge. CMKs can be added or removed as required, and charges are based on CMKs created and key usage. KMS provides 20,000 free API requests per month.
KMS provides server-side encryption for OBS data.
CMKs can be assigned to files for easier key management.
With CMKs, it is easier to control user access to OBS data.
KMS encrypts data, including temporary OS and application files, as well as memory SWAP, before the data is written to the system disk.
KMS performs application-unaware encryption before data is written to data disks.
Encryption keys of EVS data can be managed by KMS.
CMKs can be directly used to encrypt, decrypt, and protect up to 4 KB of data.
A CMK+DEK combination is used to protect large data objects, with the CMK protecting the DEKs that encrypt and decrypt data.
Data encryption and decryption only require an API request.
Large amounts of data can be locally encrypted or decrypted.
Deleting a CMK automatically deletes associated DEKs and the data encrypted by the DEKs.
Data can be frozen by disabling CMKs. Disabled CMKs can be enabled again.
Data can be removed or frozen with just a click.
Performs complete lifecycle management of CMKs on the cloud, from creation to deletion.
Generates, encrypts, and decrypts DEKs, and uses DEKs to perform cloud-based encryption and decryption.
Invokes an encryption or decryption API to encrypt or decrypt 4 KB of data.
Generates true random numbers from a physical device.