ROTATE_WRAPPED_KEYSET-MaxCompute(MaxCompute)-阿里云帮助中心

You can use MaxCompute with Key Management Service (KMS) to manage keys. This topic describes how to use the ROTATE_WRAPPED_KEYSET function to decrypt a wrapped keyset, implement key rotation, and use a new key to encrypt data.

Background information and prerequisites

You can use MaxCompute with KMS to manage keys. You can generate a wrapped keyset by encrypting a keyset based on a KMS key. The ROTATE_WRAPPED_KEYSET function uses a new KMS key and a new key algorithm to re-encrypt a wrapped keyset that is generated by using the NEW_WRAPPED_KEYSET function. Compared with the REWRAP_KEYSET function, the ROTATE_WRAPPED_KEYSET function can use a new key algorithm for re-encryption.

Before you use the ROTATE_WRAPPED_KEYSET function, make sure that the following prerequisites are met:

A wrapped keyset is generated by using the NEW_WRAPPED_KEYSET function. For more information, see NEW_WRAPPED_KEYSET.
A KMS key is created and the key ARN specified by kms_cmk_arn is obtained. A RAM role is granted permissions to use the new key.

Syntax

binary ROTATE_WRAPPED_KEYSET(string <kms_cmk_arn> , string <role-arn>, string <wrapped_keyset>,string <key_type> [,string description,[string <role_chain>]])

Parameters

kms_cmk_arn: required. This parameter specifies the ARN of the KMS customer master key (CMK) that you want to use to re-encrypt a wrapped keyset. The parameter value is in the format of 'acs:kms:<RegionId>:<UserId>:key/<CmkId>'. RegionId specifies the region ID, UserId specifies the user ID, and CmkId specifies the CMK ID. You can obtain the ARN from the Key Details page in the KMS console.
role_arn: required. This parameter specifies the ARN of the RAM role that has permissions on both the old and new KMS keys. The parameter value is in the format of 'acs:ram:${<userAID>}:role/${<roleName>}'. userAID specifies the user ID, and roleName specifies the role name.
wrapped_keyset: required. This parameter specifies the wrapped keyset that you want to re-encrypt.
key_type: required. This parameter specifies the algorithm type of the key in the newly generated keyset. Valid values: AES-GCM-256, AES-SIV-CMAC-128, and AES-SIV-CMAC-256.
description: optional. This parameter provides a description of the key.
role_chain：可选，用户授权角色链，格式为'acs:ram:<userAID>:role/<roleName2>,acs:ram:<userBID>:role/<roleName3>},...'。通过角色链的方式，支持跨阿里云账号的封装密钥集调用。

返回值说明

返回BINARY类型的加密KEYSET，若有需要您可以通过HEX函数将BINARY类型转换为STRING类型，详情请参见HEX。

Examples

Note

运行以下包含变量的示例代码请使用脚本模式运行，或者将变量内联到SQL语句中（MaxCompute不支持跨SQL语句的变量作用域）。

Re-encrypt a wrapped keyset.

@kms_resource_keyId := 'acs:kms:${<RegionId>}:${<UserId>}:key/${<CmkId>}';
@role_arn := 'acs:ram:${<UserId>}:role/${<roleName>}';
@origin_key := unhex('<wrapped_keyset>');
select hex(ROTATE_WRAPPED_KEYSET(@kms_resource_keyId, @role_arn, @origin_key, 'AES-GCM-256', 'hello world'));

Re-encrypt a wrapped keyset, and allow other roles to call the wrapped keyset.

@kms_resource_keyId := 'acs:kms:${<RegionId>}:${<UserId>}:key/${<CmkId>}';
@role_arn := 'acs:ram:${<UserId>}:role/${<roleName>}';
@origin_key := unhex('<wrapped_keyset>');
@role_chain := 'acs:ram:${<UserAId>}:role/${<roleName2>},acs:ram:${<UserBId>}:role/${<roleName3>}';
select hex(ROTATE_WRAPPED_KEYSET(@kms_resource_keyId, @role_arn, @origin_key, 'AES-GCM-256', 'hello world', @role_chain));