Share KMS instances across multiple accounts

Step 1: Set up Resource Directory and enable organization sharing

1. Enable Resource Directory:

   1. Log on to the console

      Use the management account to log on to the Resource Management console.

   2. Enable Resource Directory

      In the left-side navigation pane, chooseResource Directory > Enable Resource Directory,Click Enable Resource Directory. For more information, see Enable Resource Directory

   3. Create a folder

      Go to Management in the upper-right corner. In the resource directory tree on the left, click the target folder, and then on the Resource Organization View tab. In the resource directory tree on the left, click the target folder, and then on the Member tab, click Create Folder. Enter Folder Name and then click Confirm. For more information, see Create a folder.

   4. Configure members

      On the Member tab, click Create Member Account or Invite Member, and refer to Create a member Invite an Alibaba Cloud account and Move a member to configure the account name, account UID, and billing account.

      Invite Member

      Parameter	Description
      Account ID or logon email address	Account ID: To find an account ID, see How do I find my Alibaba Cloud account ID?. Logon email address: The email address that you used to register the account. If an account does not have a logon email, use its account ID. To invite multiple accounts, enter their account IDs or logon email addresses, separated by commas.
      Remarks	Enter a remark for the invitation. This helps the invitee verify the invitation's authenticity and respond faster.
      Tag	Add a tag to the member for easier filtering and management.
      Parent Folder	By default, the invited member is placed in the Root folder. You can click Modify to move the member to a different folder. You can also change the folder after the member accepts the invitation.

      Create Member Account

      Parameter	Description
      Account Name	The Alibaba Cloud account name is a unique identifier for a member and must be unique within Resource Directory. The Alibaba Cloud account name must be 2 to 50 characters in length and can contain letters, digits, and special characters_.-. It must start and end with a letter or digit and cannot contain consecutive special characters_.-.
      Member Account Name	The display name must be 2 to 50 characters in length and can contain Chinese characters, letters, digits, and special characters_.-.
      Billing Account	Specify the billing account for the newly created member. Use Management Account for Settlement of New Member: Uses the management account of the resource directory as the billing account under financial trusteeship. Use Existing Member for Settlement of New Member: Uses an existing member of the resource directory as the billing account under financial trusteeship. In the Specify Member panel, you must select a member from the directory tree of the resource directory. Note A member cannot be selected if it does not have payment capabilities. For more information about member payment capabilities, see Financial Trusteeship Notes. Use New Member Itself for Settlement: Uses the current member as its own billing account.
      Tags	Bind tags to the member for tag-based management.
      Parent Folder	By default, the invited account is placed under the root folder. You can click Modify to change the folder. You can also change the folder after the invitation is accepted.

2. Enable Resource Sharing

   After you enable Resource Sharing, the resource owner (management account or member) can share resources with the entire resource directory, folders, or members. For more information, see Enable resource sharing.

   1. Use the management account of the resource directory to log on to the Resource Sharing console. In the left-side navigation pane, chooseResource Sharing > Configure.

   2. Click Enable, and then in the Service-linked Role for Resource Sharing dialog box, click OK.

      Note

      The system automatically creates a service-linked role named AliyunServiceRoleForResourceSharing to obtain the organization information of the resource directory. For more information, see Service-linked role for Resource Sharing.

Step 2: Configure KMS instance sharing

This step guides the instance owner through sharing a KMS instance with one or more principals.

1. Log on to the console

   Log on to the Key Management Service console. In the top menu bar, select a region. In the left-side navigation pane, click Instances.

2. Select a sharing mode

   On the Instances page, find the target KMS instance, and click Share Resources in the Actions column. In the RD Multi-account Sharing Settings panel, first select the Sharing mode selection guide to choose a Sharing Model.

3. Configure the resource share

   In the Add to Resource Share area, select or create a resource share.

   Item	Create a resource share (recommended)	Select an existing resource share
   Scenario	First-time sharing or when permission isolation is required.	When you need to add the current instance to an existing resource share and reuse its principals and permissions.
   Features	Permission isolation:Contains only the current KMS instance with independent permissions. Scope of control:Only newly added accounts can access the shared instance.	Permission sharing: All existing principals in the resource share automatically gain access to the new instance, consuming the access management quota. Any permission change to the resource share affects all resources in the share. Scope of control: Both existing principals and newly added accounts can access the shared instance. Warning This may cause unintended permission escalation and quota consumption. Proceed with caution.

4. Configure sharing parameters

   Complete the following configuration based on the selected method, and then click OK.

   Create a resource share (recommended)

   • Resource Share Name

     Supports Chinese characters, uppercase and lowercase letters, digits, and special characters (".", "_", or "-"). Maximum length: 50 characters.

   • Principals(instance principals)

     Specify the accounts that can use this KMS instance.

     Important

     • We recommend that you add resources by folder or cloud account for fine-grained control. Each addition consumes an access management quota of the instance.

     • If you add or remove principals in an existing resource share, the changes take effect on all resources in the unit.

     You can add the following three types of principals:

     • Cloud account:The resource is shared only with the specified Alibaba Cloud account (UID).

     • Resource directory organization:Share the resource with all member accounts in the entire resource directory, including members added later.

     • Folder (organizational unit):Enter a folder ID to share the resource with all members under the folder, including members added later. Folder ID format: fd-string. For more information about how to view folder information, see Folder basic information.

   • Add Permissions

     Configure the permissions for resource principals (instance principals). For detailed permission information, view the permission library in the Resource Sharing console.

     • AliyunRSDefaultPermissionKMSInstance (recommended): Two versions (v1 and v2) are available. Newly created permissions default to v2. For more information about how to view the permission version, see View the details of a permission.

     • AliyunRSPermissionKMSInstanceReadWrite (deprecated): If you used this permission before, you can continue to use it.

   Select an existing resource share

   • Select Resource Share

     The system synchronizes all resource shares under the current account. For more information, see Create a resource share.

   • Shared Resources

     This list automatically displays the existing resources in the selected resource share (read-only). After this operation, the current KMS instance is added to the resource share.

   • Principals(instance principals)

     Specify the accounts that can use this KMS instance.

     Important

     • We recommend that you add resources by folder or cloud account for fine-grained control. Each addition consumes an access management quota of the instance.

     • If you add or remove principals in an existing resource share, the changes take effect on all resources in the unit.

     You can add the following three types of principals:

     • Cloud account:The resource is shared only with the specified Alibaba Cloud account (UID).

     • Resource directory organization:Share the resource with all member accounts in the entire resource directory, including members added later.

     • Folder (organizational unit):Enter a folder ID to share the resource with all members under the folder, including members added later. Folder ID format: fd-string. For more information about how to view folder information, see Folder basic information.

   • Add Permissions

     Configure the permissions for resource principals (instance principals). For detailed permission information, view the permission library in the Resource Sharing console.

     • AliyunRSDefaultPermissionKMSInstance (recommended): Two versions (v1 and v2) are available. Newly created permissions default to v2. For more information about how to view the permission version, see View the details of a permission.

     • AliyunRSPermissionKMSInstanceReadWrite (deprecated): If you used this permission before, you can continue to use it.

ActionTrail

• Scope: You can only view business operations performed through shared gateways.

• Procedure:

  1. Log on to ActionTrail console. In the left-side navigation pane, choose Event Query.

  2. In the top navigation bar, select the region where the shared KMS instance is deployed.

  3. Set the query condition to Resource Name and enter the key or secret ID created under the shared instance.

Simple Log Service for KMS

• Scope: Supports viewing business operations performed through dedicated gateways and shared gateways.

• Procedure:

  1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Security Operations > Simple Log Service for KMS.

  2. In the top navigation bar, select the region where the shared KMS instance is deployed.

  3. Select the shared instance ID and click Search.

     Note

     If log service is not enabled for the current instance, first Enable Simple Log Service for KMS.