Cross-account key sharing in ECS-Elastic Compute Service(ECS)-阿里云帮助中心

Use cases

Centralize key management for compliance

Key sharing centralizes key permissions in a single account, which facilitates auditing, tracking, and unified management.
Optimize costs by sharing keys

To reduce costs, you can purchase Key Management Service (KMS) instances and create keys in one Alibaba Cloud account. You can then share the keys with other Alibaba Cloud accounts used by different teams or projects. This allows these accounts to create and use encrypted resources without purchasing their own KMS instances.

How it works

In cross-account key sharing, the key owner account shares a key by granting permissions to a RAM role in another Alibaba Cloud account. The specific RAM role that requires authorization varies by use case. Snapshots and images encrypted with a shared key can still be shared.

Prerequisites

Role

Prerequisites

key owner account

You have the UID of the receiving Alibaba Cloud account.
Ensure that the following conditions are met:
- You have created a customer master key (CMK) in a Key Management Service (KMS) 3.0 instance.
- The access management quota for the KMS instance is greater than the total number of accounts the key will be shared with. After purchase, you can upgrade the KMS instance to change this setting.
  
  The access management quota specifies how many VPCs can be associated with a KMS instance and how many other Alibaba Cloud accounts it can be shared with. This quota directly affects the instance's usage scope and resource-sharing capabilities.

receiving account

The receiving account must create different RAM roles depending on the use case.

Log on to the RAM console by using your Alibaba Cloud account or a RAM user with the AliyunRAMFullAccess permissions.

Choose Identities > Role and search for the target role.
- Using a shared key to create encrypted cloud disks or copy encrypted snapshots and images requires the AliyunECSDiskEncryptDefaultRole role.
- Sharing an encrypted image with another account requires the AliyunECSShareEncryptImageDefaultRole role.
- Sharing an encrypted snapshot with another account requires the AliyunECSShareEncryptSnapshotDefaultRole role.

If the target role does not exist, choose Permissions > Policies, click RBAC Policy, and add a new policy on the JSON Editor tab.

Permissions for the AliyunECSDiskEncryptDefaultRole role.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "kms:List*",
                "kms:DescribeKey",
                "kms:TagResource",
                "kms:UntagResource"
            ],
            "Resource": [
                "acs:kms:*:*:*",
                "acs:kms:*:*:*/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": [
                "acs:kms:*:*:*/*"
            ],
            "Effect": "Allow"
        }
    ]
}

Permissions policy for the AliyunECSShareEncryptImageDefaultRole or AliyunECSShareEncryptSnapshotDefaultRole role.

{
    "Version": "1",
    "Statement": [
        {
            "Action": "kms:List*",
            "Resource": "acs:kms:<region-of-key-owner>:<uid-of-key-owner>:key",
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:DescribeKey",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "acs:kms:<region-of-key-owner>:<uid-of-key-owner>:key/<kms-key-id>",
            "Effect": "Allow"
        }
    ]
}

Note

Replace <region-of-key-owner>, <uid-of-key-owner>, and <kms-key-id> with the ID of the region where the KMS key resides, the UID of the key owner account, and the ID of the KMS key, respectively.

Choose Identities > Role and click Create Role. For Principal Type, select Alibaba Cloud Service. For the service, select ECS. Enter the target role name and click OK.
Click the role name to open the details page. Click the Permissions > Grant Permission. Select the policy you created and click OK.
(Conditional) For the AliyunECSShareEncryptImageDefaultRole or AliyunECSShareEncryptSnapshotDefaultRole role, configure a trust policy. On the role details page, click the Trust Policy > Edit Trust Policy. Edit the policy and click OK.
Trust policy for the AliyunECSShareEncryptImageDefaultRole or AliyunECSShareEncryptSnapshotDefaultRole role.
```
{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "<UID>@ecs.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}
```
Note
Replace <UID> with the UID of the receiving Alibaba Cloud account.

Owner account: Configure key sharing

Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resources > Keys.
On the Key Management page, select the Keys tab, and click a key ID to open the key details page.
On the key details page, click the Key Policy tab and then click Configure Key Policy.
Click Add ARN of Cross-account User, enter the principal ARN, and click OK.
```
acs:ram::<uid-of-receiving-account>:role/<ram-role-name>
```
For example, to share a key with the AliyunECSDiskEncryptDefaultRole role in the Alibaba Cloud account with UID 119285303511**, use the following principal ARN:
```
acs:ram::119285303511**:role/AliyunECSDiskEncryptDefaultRole
```

Receiving account: Use a shared key

This topic uses the creation of a standalone encrypted cloud disk as an example. The steps to select a key are similar when you copy a snapshot or copy an image with encryption.

On the details page of the encrypted resource, you can view only the ID of the KMS key that is used. The ARN and alias of the KMS key are not displayed due to permission limits set by the key owner account. This display limitation does not affect the use of the encrypted resource.

Console

This section describes only the encryption settings for creating a cloud disk. For information about other configurations, see Create an empty data disk.

Go to ECS-Block Storage.
In the upper-left corner of the page, select the resource group and region for the target resource.
Click Create Disk. In the OK for the Disks, select Encrypt, select Specify Custom KMS Key, and then manually enter the shared key ID.

API

You can call the CreateDisk API operation to create a data disk. In the request, set the Encrypted and KMSKeyId parameters to encrypt the data disk.

FAQ

The key owner account receives a Rejected.ShareQuotaExceedLimit error when configuring the key policy.

Cause and solution: The access management quota for a KMS instance must be greater than the total number of times a key is shared. After you purchase an upgrade, you can reconfigure the quota by upgrading the KMS instance.

The access management quota specifies how many VPCs can be associated with a KMS instance and how many other Alibaba Cloud accounts it can be shared with. This quota directly affects the instance's usage scope and resource-sharing capabilities.

The key owner account receives an InvalidParameter error when configuring the key policy.

Cause and solution: The required role does not exist in the receiving account. Create and authorize the role as described in Prerequisites.