eSurfing Cloud Identity and Access Management (IAM) is a basic service that supports user permission management and can help you securely control access and operation permissions of your cloud services and resources. You can define enterprise projects and create sub-users through the IAM service for IAM sub-users to easily control access to KMS resources and assign permissions.

KMS Permission Management

By default, a new IAM user created by the primary account does not have any permissions assigned. You need to add it to a user group and assign the KMS permissions policies (including system policies and custom policies) to the user group. After authorization, IAM users can get permission to use the KMS products defined in these policies.

KMS supports enterprise project management. To group and manage the resources in KMS in a logically isolated manner, you can create enterprise projects and divide the resources into different enterprise projects. Different enterprise projects can be bound with different user groups, and the user groups can be granted KMS permission policies (including system policies and user-defined policies) to authorize specific resources.

KMS Permission Configuration

IAM permission management: Go to the IAM permission configuration page, create IAM users and user groups, and click Authorize in the user group list to add the permission policies of the KMS products to the user groups. KMS permission policies include system policies and user-defined policies. System policies are provided by default. You can also create user-defined policies on the Policy Management page. You can view and manage user group authorization records on the Authorization Management page.

Enterprise project management: Go to the IAM permission configuration page, and create and manage enterprise projects on the Enterprise Project page. After creating enterprise projects, you can migrate or delete resources, bind user groups, and grant the user groups KMS permission policies (including system policies and user-defined policies).

KMS Permissions and Authorization Items

Policies include system policies and user-defined policies. If system policies are not satisfactory for authorization, administrators can create user-defined policies and grant them to user groups for fine-grained access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

Permissions: statements in a policy that allow or deny certain IAM operations;
APIs: APIs that can be called in a permission policy;
Authorization items: Permission triples for authorization operations. When a user-defined policy is created, you can write permission triples in the JSON view to configure the policy.
Permission types: read and write types of authorization operations.

Authorization Items Supported by KMS

Key Management

Permission	API	Authorization Item	Read or Write Type
Service Activation	——	kms:kmsService:open	Write
Create Key	/v1/cmkManage/createKey	kms:cmk:create	Write
Enable Key	/v1/cmkManage/enableKey	kms:cmk:enable	Write
Disable Key	/v1/cmkManage/disableKey	kms:cmk:disable	Write
Schedule Key Deletion	/v1/cmkManage/scheduleKeyDeletion	kms:cmk:delete	Write
Cancel scheduled deletion key	/v1/cmkManage/cancelKeyDeletion	kms:cmk:undelete	Write
Update Key	/v1/keyManage/updateKeyDescription	kms:cmk:update	Write
View Key List	/v1/keyManage/listAliasKeys	kms:cmk:list	Read
View Key Details	/v1/keyManage/describeKey	kms:cmk:describe	Read
Enable Deletion Protection	/v1/cmkManage/deleteProtect	kms:cmk:deleteProtect	Write
Cancel Deletion Protection	/v1/cmkManage/cancelDeleteProtect	kms:cmk:cancelDeleteProtect	Write
Obtain the parameters for importing the key material	/v1/importKey/getParametersForImport	kms:cmk:getParameters	Write
Import Key Material	/v1/importKey/importKeyMaterial	kms:cmk:importMaterial	Write
Delete Key Material	/v1/importKey/deleteKeyMaterial	kms:cmk:deleteMaterial	Write
Configure/Update Rotation Policy	/v1/versionControl/updateRotationPolicy	kms:cmk:updateRotation	Write
Create Key Version	/v1/versionControl/createKeyVersion	kms:cmk:createVersion	Write
Lists All Versions of the CMK	/v1/versionControl/listKeyVersions	kms:cmk:listVersions	Read
View Information of a Specified Key Version	/v1/versionControl/describeKeyVersion	kms:cmk:describeVersion	Read
Create Alias	/v1/keyName/createAlias	kms:cmk:createAlias	Write
Delete Alias	/v1/keyName/deleteAlias	kms:cmk:deleteAlias	Write
Update Alias (Non-console Feature)	/v1/keyName/updateAlias	kms:cmk:updateAlias	Write
List the Aliases Bound to the Specified Key	/v1/keyName/listAliasByUuid	kms:cmk:listAliasByUuid	Read
List All Aliases (Non-console Feature)	/v1/keyName/listAlias	kms:cmk:listAlias	Read
Online encryption	/v1/keyCompute/encrypt	kms:cmk:encrypt	Write
Product DEK (Envelope Encryption)	/v1/keyCompute/generateDataKey	kms:cmk:generateDataKey	Write
Generate a DEK with no Plaintext Return Value (Envelope Encryption)	/v1/keyCompute/generateDataKeyWithoutPlaintext	kms:cmk:generateDataKeyWithoutPlaintext	Write
Export DEK	/v1/keyCompute/exportDataKey	kms:cmk:exportDataKey	Write
Generate and Export an DEK	/v1/keyCompute/generateAndExportDataKey	kms:cmk:generateAndExportDataKey	Write
Decrypt	/v1/keyCompute/decrypt	kms:cmk:decrypt	Write
Re-encryption	/v1/cmkManage/reEncrypt	kms:cmk:reEncrypt	Write
Generate Digital Signatures	/v1/asymmetric/asymmetricSign	kms:cmk:asymmetricSign	Write
Verify Signatures	/v1/asymmetric/asymmetricVerify	kms:cmk:asymmetricVerify	Write
Asymmetric Key Encryption	/v1/asymmetric/asymmetricEncrypt	kms:cmk:asymmetricEncrypt	Write
Asymmetric Key Decryption	/v1/asymmetric/asymmetricDecrypt	kms:cmk:asymmetricDecrypt	Write
Get the Public Key of the Asymmetric Key	/v1/asymmetric/getPublicKey	kms:cmk:getPublicKey	Write

Certificate Management

Permission	API	Authorization Item	Read or Write Type
Create Certificate CSR	/v1/manageCertificate/createCertificate	kms:cert:create	Write
Import Certificate	/v1/manageCertificate/importCertificate	kms:cert:import	Write
View the Certificate List	/manageCertificate/listCertificate	kms:cert:list	Read
View Certificate Information	/v1/manageCertificate/describeCertificate	kms:cert:describe	Read
Update Certificate Status	/v1/manageCertificate/updateCertificateStatus	kms:cert:update	Write
Obtain Certificate	/v1/manageCertificate/getCertificate	kms:cert:get	Write
Export Certificate Private Key	/v1/manageCertificate/exportCertifiicatePrivatkey	kms:cert:exportPrivatkey	Write
Delete a certificate	/v1/manageCertificate/deleteCertificate	kms:cert:delete	Write
Certificate Private Key Signature	/v1/certificateCompute/certificatePrivateKeySign	kms:cert:privateKeySign	Write
Certificate Public Key Signature Verification	/v1/certificateCompute/certificatePublicKeyVerify	kms:cert:publicKeyVerity	Write
Certificate Public Key Encryption	/v1/certificateCompute/certificatePublicKeyEncrypt	kms:cert:publicKeyEncrypt	Write
Certificate Private Key Decryption	/v1/certificateCompute/certificatePrivateKeyDecrypt	kms:cert:privateKeyDecrypt	Write
Generate a Random Number	/v1/certificatecompute/getRandom	kms:cert:getRandom	Write

Key Management Service

Permission Management