Creating a key is a management operation that can only be performed through the shared gateway. This page walks through a Java SDK example that initializes a KMS client and calls the CreateKey API to create a key.
Prerequisites
Before you begin, make sure you have:
A Dedicated KMS (DKMS) instance ID (
DKMSInstanceId)The
ALIBABA_CLOUD_ACCESS_KEY_IDandALIBABA_CLOUD_ACCESS_KEY_SECRETenvironment variables set in your runtime environment
If your project code is exposed, the AccessKey pair could be compromised. For production workloads, use Security Token Service (STS) tokens instead of long-term AccessKey credentials. See Manage access credentials for details.
Complete example
package com.aliyun.sample;
import com.aliyun.tea.*;
public class Sample {
public static com.aliyun.kms20160120.Client createClient() throws Exception {
com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
// Read credentials from environment variables.
.setAccessKeyId(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"))
.setAccessKeySecret(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"));
// For a list of endpoints, see https://api.alibabacloud.com/product/Kms.
config.endpoint = "kms.ap-southeast-1.aliyuncs.com";
return new com.aliyun.kms20160120.Client(config);
}
public static void main(String[] args_) throws Exception {
java.util.List<String> args = java.util.Arrays.asList(args_);
com.aliyun.kms20160120.Client client = Sample.createClient();
com.aliyun.kms20160120.models.CreateKeyRequest createKeyRequest = new com.aliyun.kms20160120.models.CreateKeyRequest()
.setKeyUsage("ENCRYPT/DECRYPT")
.setOrigin("Aliyun_KMS")
.setEnableAutomaticRotation(false)
.setDKMSInstanceId("kst-hzz65f176a0ogplgq****");
com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
try {
// Write your own code to display the response if needed.
client.createKeyWithOptions(createKeyRequest, runtime);
} catch (TeaException error) {
// Handle exceptions based on your actual business scenario.
// Do not ignore exceptions in production code.
System.out.println(error.getMessage());
System.out.println(error.getData().get("Recommend"));
com.aliyun.teautil.Common.assertAsString(error.message);
} catch (Exception _error) {
TeaException error = new TeaException(_error.getMessage(), _error);
System.out.println(error.getMessage());
System.out.println(error.getData().get("Recommend"));
com.aliyun.teautil.Common.assertAsString(error.message);
}
}
}Example analysis
Initialize the client
createClient() builds a Config object with your AccessKey ID and AccessKey secret, sets the endpoint, and returns a com.aliyun.kms20160120.Client. The client is reused for all subsequent API calls.
Replace kms.ap-southeast-1.aliyuncs.com with the endpoint for your target region. See Endpoints for the full list.
Call the CreateKey API
CreateKeyRequest accepts the following parameters. The values in the example are for reference — replace them with values that match your use case.
| Parameter | Example value | Description |
|---|---|---|
KeyUsage | ENCRYPT/DECRYPT | The intended use of the key. |
Origin | Aliyun_KMS | The source of the key material. Aliyun_KMS means the key material is generated by KMS. |
EnableAutomaticRotation | false | Specifies whether to enable automatic rotation for the key. |
DKMSInstanceId | kst-hzz65f176a0ogplgq**** | The ID of the Dedicated KMS instance to associate the key with. |
After a successful call, createKeyWithOptions() returns a response object. Add your own code to extract fields such as the key ID from the response as needed.