• Key Management Service

  1. Help Center
  2. Key Management Service
  3. User Guide
  4. Management
  5. Managing a Grant
  6. Creating a Grant

Creating a Grant


You can create grants for other users to use the CMK. You can create a maximum of 100 grants for a CMK.

The owner of a CMK can create a grant for the CMK on the KMS management console or by making the API calls. A user, who has been granted with the grant creation permission by the owner of the CMK, can create grants for the CMK only by making the API calls.


  • You have obtained an account and its password for logging in to the management console.
  • You have obtained the user ID of the grantee (user to whom permissions are to be authorized).
  • The desired CMK is in Enabled status.


  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Choose Security > Key Management Service. The Key Management Service page is displayed.
  4. Click the alias of the desired CMK to go to the page displaying its details. You can create grants on the Grants tab page.

    Figure 1 Creating a grant

  5. Click Create Grant. The Create Grant dialog box is displayed.

    Figure 2 Creating a grant

  6. In the dialog box that is displayed, enter the ID of the user to be authorized and select permissions to be granted.

    A grantee can perform the authorized operations only by calling the necessary API. For details, see the Key Management Service API Reference.

    Table 1 Parameter description



    Example Value

    Key ID

    ID of a CMK (automatically read by the system)



    The user ID of the grantee is required.


    The user IDs are provided by grantees who can obtain their IDs by clicking their portraits and choosing My Credential > User ID.


    Granted Operations

    The following permissions can be authorized:

    • You can create multiple grants on a CMK to provide different permissions to the same user. The user's permissions on the CMK are the combination of all the grants.
    • This parameter cannot be left blank.
    • Create Grant cannot be selected exclusively.
    • Create Data Key Without Plaintext
    • Create Data Key
    • Encrypt Data Key
    • Decrypt Data Key
    • Query Key Information
    • Create Grant
    • Retire Grant
      • A grantee can retire a grant if the grantee does not need that permission.
      • If, before retiring a grant, the grantee has granted the permission to another user, that user's permission will not be affected by the grant retirement.


  7. Click OK. When message Grant of key alias created successfully is displayed in the upper right corner, the grant has been created.

    In the list of grants, you can view the grant ID, grantee ID, granted operation, and creation time of the grant.