KMS encrypts sensitive information and is suitable for small-scale sensitive data (less than 6KB), such as passwords, identity information, certificates, and background configuration files.

Through the online encryption API, KMS directly encrypts sensitive data and information by using the customer master key (CMK) instead of storing the plaintext, ensuring the security of sensitive data.

Scenario Diagram

Operation Procedure (taking certificate encryption as an example)

Create a CMK on the KMS console or by calling the CreateKey API;
Call the Encrypt API of KMS to encrypt the plaintext certificate into the ciphertext certificate.
Deploy the ciphertext certificate on a server;
Call the Decrypt API of the KMS to decrypt the ciphertext certificate into a plaintext certificate when the server starts and needs to use the certificate.

Operation Steps

Create the CMK on the KMS console;
Encrypt sensitive data through online encryption APIs.
Request Parameters

Parameter	Required or Not	Parameter Position	Parameter Type	Description
cmkUuid	Yes	body	String	The globally unique identifier of the CMK.
plaintext	Yes	body	String	Plaintext to be encrypted (Base64 encoded).

Sample Request

{
"plaintext": "SGVsbG8gd29ybGQ=", 
"cmkUuid": "241ede22-6261-4617-9caf-10d89990516c"
}
Returned upon a success
{
"code": 200,
 "result": {
        "ciphertextBlob":
"MDA2NE1qUXhaV1JsTWpJdE5qSTJNUzAwTmpFM0xUbGpZV1l0TVRCa09EazVPVEExTVRaakpqUTVaV00zTm1RM0xXTmpOR010TkRBd1pTMDVaakU1TFdZNU1EQXhOVGczWVdVd1pnPT3oCYiGAy7mNTLitIlJaQ92",
"cmkUuid": "241ede22-6261-4617-9caf-10d89990516c",
"keyVersionId": "49ec76d7-cc4c-400e-9f19-f9001587ae0f"
},
"statusCode": 200,
"success": 1
}

Response Parameters

Parameter	Description
ciphertextBlob	The ciphertext generated after data is encrypted by the specified CMK primary version.
cmkUuid	The globally unique identifier of CMK. If the Cmk_uuid parameter in the request uses a CMK alias, the CMK identifier for the alias will be returned in the response.
keyVersionId	The version identifier of the key used to encrypt the plaintext, which is the primary version of the CMK specified.

Store the encrypted data;

Store the ciphertext based on service application scenarios.

Decrypt ciphertext data through the decryption API.

Request Parameters

Parameter	Required or Not	Parameter Position	Parameter Type	Description
ciphertextBlob	Yes	body	String	The ciphertext of the DEK encrypted by the CMK.

Returned upon a success

{
    "statusCode": 800,
    "returnObj": {
        "code": 200,
        "result": {
            "cmkUuid": "8bca8f33-d42a-448a-866b-a064f44b29b7",
            "keyVersionId": "73670b28-4eea-4260-b497-ae0334cc0c85",
            "plaintext": 
"sc7280+klUSln3Y9FHdfKGUT+6kPrcIMW41uZQeXxGU="
        },
        "statusCode": 200,
        "success": 1
}
}

Response Parameters

Parameter	Description
cmkUuid	The globally unique identifier of CMK. If the Cmk_uuid parameter in the request uses a CMK alias, the CMK identifier for the alias will be returned in the response.
keyVersionId	Key version ID. The globally unique identifier of the primary key version.
plaintext	The value of the decrypted plaintext after Base64 encoding.

Key Management Service

Encrypt and Decrypt Data Online Using KMS CMK