Create an application access point

Method 1: Quick creation

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Application Access > Multi-Cloud Access (formerly AAP).

2. On the Application Access tab, click Create AAP. In the Create AAP panel, configure the parameters.

   Parameter	Description
   Mode	Select Quick Creation.
   Scope (KMS Instance)	Select the KMS instance that your application needs to access.
   Application Access Point Name	Enter a name for the application access point.
   Authentication Method	This is set to ClientKey and cannot be changed.
   Default Permission Policy	The value is key/* secret/* and cannot be changed. This means the application can access all keys and secrets in the specified KMS instance.

3. Click OK. The browser automatically downloads the ClientKey. The ClientKey includes the following files:

   • Credential (ClientKeyContent): The default filename is clientKey_****.json.

   • Credential password (ClientKeyPassword): The default filename is clientKey_****_Password.txt.

Method 2: Standard creation

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Application Access > Multi-Cloud Access (formerly AAP).

2. Create a network access rule.

   Note

   If you do not need to restrict access based on source IP addresses, you do not need to create a network access rule. However, for better security, we recommend configuring one.

   1. Click the Network Access Rules tab, and then click Create Network Access Rule.

   2. In the Create Network Access Rule panel, configure the parameters and click OK.

      Parameter	Description
      Rule Name	Enter a name for the network access rule.
      Network Type	Private: The application uses a KMS instance endpoint to access keys and secrets. Public: The application uses a KMS service endpoint (public endpoint) to access secrets. VPC: The application uses a KMS service endpoint (VPC endpoint) to access secrets. This option is available only in the China (Hangzhou), China (Shanghai), China (Shenzhen), and China (Zhangjiakou) regions. Note Cryptographic operations: Supported only when you use the KMS instance SDK to access KMS through a KMS instance endpoint. This requires a network access rule with the Network Type set to Private. Retrieving secret values: You can use the KMS instance SDK or the secrets SDK. We recommend using the secrets SDK with a network access rule whose Network Type is set to Private to achieve higher QPS and better security. KMS instance SDK: The network type must be Private. The source IP address must be an IP address in the VPC associated with the KMS instance. Secrets SDK: The network type can be Private, Public, or VPC.
      Allowed Source IP Addresses	In most cases, enter the IP address of your application server. The IP address must correspond to the selected network type. If the network type is Private, enter an IP address from the VPC associated with the KMS instance. If the network type is Public, enter a public IP address. If the network type is VPC, enter a VPC ID and a VPC IP address.
      Description	Enter a description for the rule.

3. Create a permission policy.

   1. Click the Policies tab, and then click Create Policy.

   2. In the Create Policy panel, configure the parameters and click OK.

      Parameter	Description
      Policy Name	Enter a name for the permission policy.
      Scope	If you select Private for Network Type when you create a network access rule, select a specific KMS instance. If you select Public or VPC for Network Type, select Shared KMS Gateway.
      RBAC Permissions	If you select a specific KMS instance for Scope: CryptoServiceKeyUser: Allows the use of keys in the KMS instance. This permission supports the cryptographic operations of the instance API. For more information, see Key-related operations. CryptoServiceSecretUser: Allows the use of secrets in the KMS instance. This permission supports the secret-related operations of the instance API. For more information, see Secret-related operations. If you select Scope for Shared KMS Gateway: SecretUser: Allows the use of all secrets under the current account. This permission supports the GetSecretValue OpenAPI operation.
      Accessible Resources	Select the keys and secrets that the application needs to access. Important If you select multiple secrets and the total length of the secret names exceeds the limit, you receive an "invalid parameter" error. In this case, use a wildcard to specify the accessible secrets. For example, if you set this parameter to secret/rds-ibm*, the application can access all secrets whose names have the prefix rds-ibm.
      Network Access Rules	Select the network access rule that you created. Note If you do not need to restrict access based on source IP addresses, you do not need to select a network access rule. However, for better security, we recommend configuring one.
      Description	Enter a description for the policy.

4. Create the application access point.

   1. Click the Application Access tab, and then click Create AAP.

   2. In the Create AAP panel, configure the parameters.

      Parameter	Description
      Mode	Select Standard Creation.
      Application Access Point Name	Enter a name for the application access point.
      Authentication Method	Supported methods: ClientKey and RAMRole. This topic uses ClientKey as an example.
      Encryption Password	A password to encrypt the ClientKey. The password must be 8 to 64 characters in length and include characters from at least two of the following types: digits, uppercase and lowercase letters, and special characters ~!@#$%^&*?_-.
      Validity Period	The validity period of the ClientKey. Important We recommend that you set the validity period to one year to reduce the risk of ClientKey leakage. You must rotate the ClientKey before it expires to avoid service disruptions. For more information, see Rotate a ClientKey.
      Policies	Select the permission policy that you created.
      Description	Enter a description for the application access point.

   3. Click OK. The browser automatically downloads the ClientKey. The ClientKey includes the following files:

      • Credential (ClientKeyContent): The default filename is clientKey_****.json.

      • Credential password (ClientKeyPassword): The default filename is clientKey_****_Password.txt.

Obtain the KMS instance CA certificate

KMS instances have built-in SSL/TLS certificates and use the HTTPS protocol for authentication and encrypted communication. You use the instance CA certificate to verify the validity of the instance's SSL/TLS certificate. This verification checks if the certificate was issued by the correct CA, is within its validity period, and corresponds to the KMS instance endpoint.

Obtain the KMS instance endpoint

1. On the Instances page, click the Software Key Management or Hardware Key Management tab, and then select the target KMS instance.

2. Click the instance ID to go to the details page and view the Instance VPC Endpoint.

3. To obtain the KMS instance endpoint, remove https:// from the Instance VPC Endpoint value.