Overview of Simple Log Service for KMS

What is Simple Log Service?

The Simple Log Service for KMS feature is based on Alibaba Cloud Simple Log Service. In the KMS console, you can query and analyze the logs of KMS instances. You can also customize the access log retention period from 180 to 3,649 days. This helps meet the requirements of China’s Cybersecurity Law and Cryptography Law, ensuring your applications remain compliant. For more details about Alibaba Cloud Log Service, see What is Simple Log Service.

Data collected

The Simple Log Service for KMS feature collects only business request information processed by KMS instances. You can use the api_name and share_gateway_api_name log fields to identify the business scenarios of requests. Requests are distinguished based on the KMS endpoint used by the caller. For more information about KMS endpoints, see Endpoint description.

• Through KMS service endpoints

  share_gateway_api_name	api_name	Event description	Event scenario
  GetSecretValue	Decrypt	Retrieves secret values.	Self-managed applications retrieving secrets.
  GenerateDataKey	GenerateDataKey	Generates a data key.	Scenario 1: Cloud service integration with KMS. Scenario 2: Self-managed applications where users create secrets or store secret values.
  GenerateDataKeyWithoutPlaintext	GenerateDataKey	Generates a data key and returns only the ciphertext of the data key.	Cloud service integration with KMS.
  Encrypt	Encrypt	Encrypts data by using a symmetric key.	Cloud service integration with KMS.
  Decrypt	Decrypt	Decrypts data by using a symmetric key.	Cloud service integration with KMS.
  AsymmetricEncrypt	Encrypt	Encrypts data by using an asymmetric key.	Cloud service integration with KMS.
  AsymmetricDecrypt	Decrypt	Decrypts data by using an asymmetric key.	Cloud service integration with KMS.
  AsymmetricSign	Sign	Signs data by using an asymmetric key.	Cloud service integration with KMS.
  AsymmetricVerify	Verify	Verifies a signature by using an asymmetric key.	Cloud service integration with KMS.

• Through KMS instance endpoints

  This scenario is used when your self-managed application uses a KMS instance. In this scenario, the share_gateway_api_name field is empty.

  api_name	Event description
  GetSecretValue	Retrieves secret values.
  AdvanceEncrypt	Encrypts plaintext into ciphertext by using a KMS key. This API operation can be used only when the key is a symmetric key of a software key management instance.
  AdvanceDecrypt	Decrypts ciphertext into plaintext by using a KMS key. This API operation can be used only when the key is a symmetric key of a software key management instance.
  AdvanceGenerateDataKey	Generates a data key. This API operation can be used only when the key is a symmetric key of a software key management instance.
  GenerateDataKeyPair	Generates an asymmetric data key pair and returns the plaintext of the private key.
  GenerateDataKeyPairWithoutPlaintext	Generates an asymmetric data key pair without returning the plaintext of the private key.
  GenerateDataKey	Generates a data key.
  Encrypt	Encrypts plaintext into ciphertext.
  Decrypt	Decrypts ciphertext into plaintext.
  Sign	Signs data by using an asymmetric key.
  Verify	Verifies a signature by using an asymmetric key.
  GetPublicKey	Retrieves the public key of an asymmetric key.

Log storage assets

After you enable Simple Log Service, Simple Log Service automatically creates a project for the KMS instance and creates a Logstore under the project. Log data is stored in the Logstore. The region of the project is the same as that of your KMS instance.

You can log on to the Simple Log Service console to view the project (named kms-log-{KMS instance ID}) and the Logstore (named kms_audit_log).

Billing

Simple Log Service for KMS is sold by KMS and is billed based on the log storage capacity. Only subscription billing is supported. The minimum log storage capacity is 1,000 GB, and the capacity must be increased in increments of 1,000 GB. The price is per 1,000 GB.

The subscription duration of Simple Log Service is tied to your KMS instance. If you enable Simple Log Service when you purchase a KMS instance, the fees of Simple Log Service are calculated based on the subscription duration of the KMS instance. If you enable Simple Log Service by upgrading a KMS instance, the fees of Simple Log Service are calculated based on the remaining duration of the KMS instance, accurate to the minute.

Limits

• After you enable Simple Log Service, access logs are stored for 180 days by default. You can extend the retention period to a value within the range of 180 to 3,649 days. To prevent existing logs from being overwritten, the retention period cannot be shortened.

• Make sure that the log storage space is sufficient. When the log storage space is full, new logs cannot be written. In this case, expand the log storage space in a timely manner. Note that you cannot downgrade the capacity after expansion.

  Note

  The log storage space usage displayed in the KMS console is not updated in real time and has a delay of two hours from the actual usage.

• After you enable Simple Log Service, you cannot directly disable it. If you need to disable it, contact Alibaba Cloud technical support. For more information, see Contact us.

• The KMS instance must be in the Available state. Otherwise, the Simple Log Service feature of KMS is suspended. If a KMS instance expires and is not renewed, the project is automatically deleted when the instance is released on the 16th day after expiration.

Estimate the required log storage capacity

In normal cases, each request log occupies approximately 1 KB of storage space. If the average request rate is 100 QPS, the storage space required for one day of logs is 100 × 60 × 60 × 24 × 1 = 8,640,000 KB (approximately 8.2 GB). The default retention period is 180 days. Therefore, the log storage capacity is approximately 8.2 × 180 = 1,476 GB. When you enable Simple Log Service, you can select a log storage capacity of 2,000 GB.