Docs

Key Management System

Key management service

Multi-region key management

The multi-region key feature allows users to securely create, manage, and use replica keys of a primary regional key across multiple geographic regions to enhance data availability, fault tolerance, and compliance. This feature supports interchangeability between primary keys and replica keys in different regions. Each set of associated multi-region keys shares the same key material, enabling encryption and decryption across regions without re-encryption or cross-region KMS API calls. Multi-region keys are divided into two management objects: primary regional keys and replica keys. Each set contains only one primary regional key, which can switch other replica keys to become the primary. Replica keys can be multiple, but only one replica key can be created per region within a set. The primary regional key and replica keys within one set share the following attributes. These shared attributes belong to the primary regional key and synchronize regularly to replica keys. The shared attributes are as follows:

Key ring name and key name (the regional elements of the key ring/key TRN differ)

Key material

Key material source

Key specification and encryption algorithm

Key purpose

Automatic key rotation: users can only enable or disable automatic key rotation on the primary key.

Usage process

1. Create a primary key that supports cross-region synchronization\nUsers can create multi-region keys in the KMS console or by using the Open API - create key

Console creation\nStep 1: On the key ring details page, click the "Create Key" button\nStep 2: Turn on the cross-region synchronization switch and enter the key alias\nNote:

Aliases for keys that support cross-region synchronization will have the prefix mrk- added by default and cannot be modified

The cross-region synchronization feature can only be enabled when creating the key. If it is not enabled during creation, it cannot be enabled later

2. Open API creation

When calling the create key API, ensure the MultiRegion parameter is set to true and the Key name parameter includes the prefix mrk-

Create a backup key\nStep 1: Enter the key details page, go to the "Cross-Region Key Synchronization" tab, and click the "Create Backup Key" button\nStep 2: Select the region for the backup key, enter a description for the backup key, then click confirm to complete creation\nNote:

Selecting primary key regions or regions with existing backup keys is not supported

Choosing regions without activated services will fail to create. After activating the region, click the refresh button to recreate

Switch primary region

Prerequisite: The key already has a backup key created

Step 1: Go to the key details page, select the "Cross-Region Key Sync" tab, and click the "Switch primary region" button

Step 2: Choose the original backup region to switch as the primary region and click confirm. This completes the primary region switch, and the original primary region becomes the backup region

Last updated: 2025.06.27 15:24:20