Docs

Key Management System

Product introduction

product features

key lifecycle management Users can manage the entire lifecycle of keys through the Key Management Service (KMS). The currently supported features are as follows.

key grouping management: Manage keys by grouping them into key rings (KeyRing)

bring your own key: Users can import their own key material into the user master key for custody through the Bring Your Own Key (BYOK) feature

key distribution or injection: Automatically distribute keys to meet security requirements, enabling non-one-time key backup mechanisms and key storage

key update: Update keys according to a specified lifecycle and required strength

key archiving: Users can place keys of the same type or purpose into the same key ring for easier management

key recovery: Canceling the scheduled deletion of a user master key will restore the key to enabled status

key audit Record and audit activities related to key management. The KMS audit logs show the usage of keys by various system services.

secret lifecycle management

Secret manager: Users or applications create, retrieve, update, and delete secrets through the secret manager service to easily achieve unified lifecycle management of sensitive secrets

Secret version management (secret rotation): To enhance system security, sensitive secrets require regular updates. The secret manager service provides multi-version management, allowing application nodes to perform secure secret rotation via API or console

Cloud-native integration: Secret manager integrates with cloud-native services, supporting managed IAM, RDS, Redis, and ECS secret and configuration rotation cycles to enable dynamic secrets, effectively addressing security threats from IAM AKSK, RDS, Redis, and ECS credential leaks

Secret audit

Records and audits activities related to secret management. The key usage by various system services can be viewed in the KMS audit logs

Last updated: 2025.06.27 15:24:20