Encryption Key Management

Permission

API

Action

Dependent Permission

IAM Project

(Project)

Enterprise Project

(Enterprise Project)

Creating a CMK

POST /v1.0/{project_id}/kms/create-key

kms:cmk:create

-

Y

Y

Enabling a CMK

POST /v1.0/{project_id}/kms/enable-key

kms:cmk:enable

-

Y

Y

Disabling a CMK

POST /v1.0/{project_id}/kms/disable-key

kms:cmk:disable

-

Y

Y

Scheduling the deletion of a CMK

POST /v1.0/{project_id}/kms/schedule-key-deletion

kms:cmk:update

-

Y

Y

Canceling the scheduled deletion of a CMK

POST /v1.0/{project_id}/kms/cancel-key-deletion

kms:cmk:update

-

Y

Y

Querying the list of CMKs

POST /v1.0/{project_id}/kms/list-keys

kms:cmk:list

-

Y

Y

Queries the CMK information.

POST /v1.0/{project_id}/kms/describe-key

kms:cmk:get

-

Y

Y

Generating a random number

POST /v1.0/{project_id}/kms/gen-random

kms:cmk:generate

-

Y

Y

Creating a DEK

POST /v1.0/{project_id}/kms/create-datakey

kms:dek:create

-

Y

Y

Creating a plaintext-free DEK

POST /v1.0/{project_id}/kms/create-datakey-without-plaintext

kms:dek:create

-

Y

Y

Encrypting a DEK

POST /v1.0/{project_id}/kms/encrypt-datakey

kms:dek:crypto

-

Y

Y

Decrypting a DEK

POST /v1.0/{project_id}/kms/decrypt-datakey

kms:dek:crypto

-

Y

Y

Querying the number of instances

GET /v1.0/{project_id}/kms/user-instances

kms:cmk:getInstance

-

Y

Y

Querying the user quota

GET /v1.0/{project_id}/kms/user-quotas

kms:cmk:getQuota

-

Y

Y

Modifying the CMK alias

POST /v1.0/{project_id}/kms/update-key-alias

kms:cmk:update

-

Y

Y

Modifying the description of a CMK

POST /v1.0/{project_id}/kms/update-key-description

kms:cmk:update

-

Y

Y

Creating a grant

POST /v1.0/{project_id}/kms/create-grant

kms:grant:create

-

Y

Y

Revoking a grant

POST /v1.0/{project_id}/kms/revoke-grant

kms:grant:revoke

-

Y

Y

Retiring a grant

POST /v1.0/{project_id}/kms/retire-grant

kms:grant:retire

-

Y

Y

Querying the grant list of a CMK

POST /v1.0/{project_id}/kms/list-grants

kms:grant:list

-

Y

Y

Querying the list of grants that can be retired

POST /v1.0/{project_id}/kms/list-retirable-grants

kms:grant:list

-

Y

Y

Encrypting data

POST /v1.0/{project_id}/kms/encrypt-data

kms:cmk:crypto

-

Y

Y

Decrypting data

POST /v1.0/{project_id}/kms/decrypt-data

kms:cmk:crypto

-

Y

Y

Obtaining parameters for importing a key

POST /v1.0/{project_id}/kms/get-parameters-for-import

kms:cmk:getMaterial

-

Y

Y

Importing key material

POST /v1.0/{project_id}/kms/import-key-material

kms:cmk:importMaterial

-

Y

Y

Deleting key material

POST /v1.0/{project_id}/kms/delete-imported-key-material

kms:cmk:deleteMaterial

-

Y

Y

Enabling key rotation

POST /v1.0/{project_id}/kms/enable-key-rotation

kms:cmk:enableRotation

-

Y

Y

Modifying the rotation interval

POST /v1.0/{project_id}/kms/update-key-rotation-interval

kms:cmk:updateRotation

-

Y

Y

Disabling key rotation

POST /v1.0/{project_id}/kms/disable-key-rotation

kms:cmk:disableRotation

-

Y

Y

Querying the key rotation status

POST /v1.0/{project_id}/kms/get-key-rotation-status

kms:cmk:getRotation

-

Y

Y

Querying key resource instances

POST /v1.0/{project_id}/kms/resource_instances/action

kms:cmkTag:listInstance

-

Y

Y

Querying tags of a key

GET /v1.0/{project_id}/kms/{key_id}/tags

kms:cmkTag:list

-

Y

Y

Querying the project tags

GET /v1.0/{project_id}/kms/tags

kms:cmkTag:list

-

Y

Y

Adding or deleting key tags in batches

POST /v1.0/{project_id}/kms/{key_id}/tags/action

kms:cmkTag:batch

-

Y

Y

Adding tags to a key

POST /v1.0/{project_id}/kms/{key_id}/tags

kms:cmkTag:create

-

Y

Y

Deleting tags of a key

POST /v1.0/{project_id}/kms/{ key_id }/tags/{key}

kms:cmkTag:delete

-

Y

Y