Purchase and enable a KMS instance

Step 1: Purchase a KMS instance

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resource > Instances.

2. On the Instances page, click Create Instance, select the instance specifications, and click Buy Now.

   General configuration

   Parameter	Description
   Key management type	KMS provides free default keys (service keys and customer master keys) for cloud product encryption in each region. Default keys have limited features and require no instance purchase. You pay only for value-added services such as key rotation. Before purchasing, review Select a KMS instance type. Purchase a KMS instance A software key management instance suits most use cases. Select a hardware key management instance if you need physical-level security or strict compliance such as financial regulations. Software Key Management: Keys are stored in a dedicated database for your instance. Hardware Key Management: Key generation, storage, encryption, and decryption rely on a dedicated Hardware Security Module (HSM) that is compliant with Chinese national cryptographic standards or FIPS 140-2 Level 3. If you select this type, you must also purchase an HSM. Configure an HSM cluster for a hardware key management instance. External Key Management: Use keys from your external key management infrastructure to encrypt and decrypt data on Alibaba Cloud. Note Currently, only HSMs from the vendor Jiangnan Tianan are supported. If you need to manage HSMs from other vendors, contact us. Purchase value-added services for keys Expert service: One-on-one expert consultation, monitoring, and KMS 1.0-to-3.0 migration to ensure stable KMS-integrated applications. Instance Backup: Software key management instances only. KMS provides free 90-day data backups by default. If this does not meet your needs, purchase the Instance Backup service. Backup management. Default key rotation: Default keys do not support automatic rotation. Purchase this service to enable it. Default key rotation.
   Region	Select the same region as your deployed services. Regions and availability zones.
   Deployment mode	KMS instances support dual-zone or multi-zone configurations for high availability, disaster recovery, and load balancing. Note In the Philippines (Manila) and Thailand (Bangkok) regions, only a single zone is available, so KMS instances are deployed in a single zone by default. A multi-zone deployment can be configured with up to three zones. For information about the number of zones in each region, see Regions and zones.
   Compute performance	The performance specifications of the instance. For example, 2000 means up to 2,000 QPS for symmetric operations and 300 QPS for asymmetric operations independently. Note If you need a software key management instance with a compute performance of 10,000 or 20,000, contact us.
   Key quota	The quota for keys. The default is 1,000. Counted by key versions, not keys. For example, one key with five versions uses five quota units.
   Secret quota	The quota for secrets. The default is 0. Counted by secrets, regardless of version count. Note Skip this if you do not use secrets. You can add a secret quota later by upgrading.
   Access management count	This quota applies to two features: Access a KMS instance from multiple VPCs in the same region: Allows multiple VPCs in the same region to access KMS resources. One quota unit is required for each VPC. Share a KMS instance across multiple accounts: The number of quota units you need equals the number of Alibaba Cloud accounts with which you share the instance. Example: associating with three VPCs and sharing with two accounts requires a quota of at least 5. Default: 1 (the bound VPC).
   Log analysis	Whether to enable log analysis. Log Service overview. Warning Log analysis cannot be disabled once enabled. Check for costs.
   Log storage capacity	Minimum 1,000 GB, expandable in 1,000 GB increments. For capacity evaluation, please refer to Estimate your storage capacity.
   Quantity	Number of KMS instances to purchase. Important One instance is sufficient for most use cases. To purchase multiple instances, contact us.
   Duration	Subscription duration. Note You can select Auto-renewal on expiration for automatic renewal.

   Hardware Key ManagementExclusive configuration

   Note

   To purchase a virtual HSM instead, follow Purchase an HSM. To purchase a dedicated HSM, contact Alibaba Cloud technical support.

   Parameter	Description
   Number of HSMs	Select the number of HSM instances to purchase. Two HSM instances are purchased by default.
   Number of HSM Snapshots	The number of snapshots in the HSM backup. Each snapshot backs up HSM data once. HSMs managed by Hardware Key Management instances have data backup enabled by default. Important The HSM instance automatically backs up once daily at 00:00 (UTC+8), generating one snapshot. When the snapshot limit is reached, the system automatically overwrites the earliest snapshot.

Step 2: Enable a KMS instance

After you purchase a KMS instance, you must enable it before you can use key management and secret management features.

Unsubscribe from a KMS instance

KMS supports partial refund unsubscription for instances in the Pending Enable or Enabled state. Full refunds are not available.

1. Go to the Refund page under Expenses > Refunds in the Alibaba Cloud console.

2. On the Resources tab, set Product to Key Management Service (KMS), find the target instance, and click Unsubscribe in the Actions column.

3. Review the resource information, refund terms, and refund amount on the confirmation page.

4. Select the confirmation checkboxes (confirm the refund amount and confirm that data has been backed up and migrated) on the lower-left, then click Confirm Unsubscription.

Troubleshooting

FAQ

• What is a KMS-managed HSM?

  A KMS-managed HSM is an HSM instance that KMS automatically creates when you purchase a hardware key management instance, based on the HSM configuration you provide at the time of purchase.

• Can I scale out a KMS-managed HSM cluster?

  No. You can only perform backup operations. All other operations are not supported.

• Why does the instance keep showing "Connecting" during enablement?

  When enabling a KMS instance (including software key management instances and hardware key management instances), wait about 30 minutes and then refresh the page. When the instance status changes to Enabled, the KMS instance is enabled.

• What if I see "Connection failed" when enabling a hardware key management instance?

  Check whether the HSM access credentials are correct. For more information about HSM access credentials, see Configure mutual TLS authentication for an HSM instance.

• Can applications access a KMS instance across regions?

  Yes. You need to purchase a software key management instance or a hardware key management instance, and establish a cross-region VPC connection and configure PrivateZone DNS resolution to integrate applications in other regions. For more information, see Configure cross-region access to KMS instances for applications.

  Note

  Before implementation, we recommend that you evaluate the costs of VPC connection and PrivateZone, the service level agreement (SLA), bandwidth capacity, and propagation time, and develop a multi-region deployment plan that covers system architecture, network architecture, operations management, and emergency response procedures.

• What do I do if I get a "ZoneIds is not valid" or "vswitch_ids invalid" error when enabling a KMS instance using IAC or API?

  This error typically occurs when the zone or vSwitch parameters you pass do not match the KMS instance specifications. The following describes two common scenarios and their solutions:

  • Scenario 1: Availability zone count mismatch

    This error is triggered when you purchase a dual-zone KMS instance but pass three zone IDs (ZoneIds) in an IAC Stack or API call.

    Solution: Verify the number of zones supported by your instance specification. If you need to configure three zones, purchase an instance specification that supports multi-zone deployment.

  • Scenario 2: Incorrect vSwitch parameter

    This error is triggered when you pass multiple vswitch_ids values in a DKMS ConnectKmsInstance API call or Terraform configuration. The ConnectKmsInstance API only accepts a single vSwitch ID.

    Solution: Modify your configuration to pass only a single vSwitch ID (vswitch_id), then retry the operation.