kms umn 1115

Reviewed-by: Hasko, Vladimir <vladimir.hasko@t-systems.com>
Co-authored-by: Li, Qiao <qiaoli@huawei.com>
Co-committed-by: Li, Qiao <qiaoli@huawei.com>

docs/kms/umn/PARAMETERS.txt

@@ -0,0 +1,3 @@
+version=""
+language="en-us"
+type=""

docs/kms/umn/en-us_topic_0034330265.html

@@ -0,0 +1,34 @@
+<a name="en-us_topic_0034330265"></a><a name="en-us_topic_0034330265"></a>
+
+<h1 class="topictitle1">Creating a Key</h1>
+<div id="body1469675083219"><div class="section" id="en-us_topic_0034330265__section24085427155358"><h4 class="sectiontitle">Scenario</h4><p id="en-us_topic_0034330265__p54509404113454">This section describes how to create a CMK on the KMS management console. You can create up to 100 CMKs, excluding Default Master Keys.</p>
+<div class="p" id="en-us_topic_0034330265__p5404296512225">The CMK is perfectly suited for but not limited to the following scenarios:<ul id="en-us_topic_0034330265__ul6667118912318"><li id="en-us_topic_0034330265__li2815583612318">Server-side encryption on OBS</li><li id="en-us_topic_0034330265__li4493399512330">Encryption of data on EVS disks</li><li id="en-us_topic_0034330265__li6731401112130">Encryption of private images on IMS</li><li id="en-us_topic_0034330265__li173242466919">File system encryption on SFS</li><li id="en-us_topic_0034330265__li16614134361">Disk encryption for database instances in RDS</li><li id="en-us_topic_0034330265__li133130691243">DEK encryption and decryption for user applications</li></ul>
+</div>
+<div class="note" id="en-us_topic_0034330265__note5633572415214"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="en-us_topic_0034330265__p3725947115214">Aliases of Default Master Keys end with <span class="parmname" id="en-us_topic_0034330265__parmname9545448591155"><b>/default</b></span>. It is not allowed to use aliases ending with <span class="parmname" id="en-us_topic_0034330265__parmname144172522111543"><b>/default</b></span> for your CMKs.</p>
+</div></div>
+</div>
+<div class="section" id="en-us_topic_0034330265__section556861155951"><h4 class="sectiontitle">Prerequisites</h4><p id="en-us_topic_0034330265__p3227183516035">You have obtained an account and its password for logging in to the management console.</p>
+</div>
+<div class="section" id="en-us_topic_0034330265__section408105191602"><h4 class="sectiontitle">Procedure</h4><ol id="en-us_topic_0034330265__ol20373371114520"><li id="en-us_topic_0034330265__li974624615513"><span>Log in to the management console.</span></li><li id="en-us_topic_0034330265__li8729205115641"><span>Click <span><img id="en-us_topic_0034330265__image10325154918393" src="en-us_image_0237800345.png"></span> in the upper left corner of the management console and select a region or project.</span></li><li id="en-us_topic_0034330265__li5858326415513"><span>Choose <span class="menucascade" id="en-us_topic_0034330265__menucascade2153575894640"><b><span class="uicontrol" id="en-us_topic_0034330265__uicontrol6048240194640">Security</span></b> &gt; <b><span class="uicontrol" id="en-us_topic_0034330265__uicontrol3001022894640">Key Management Service</span></b></span>. The <strong id="en-us_topic_0034330265__b2994505611418">Key Management Service</strong> page is displayed.</span></li><li id="en-us_topic_0034330265__li24925741114829"><span>Click <strong id="en-us_topic_0034330265__b83353675913">Create Key</strong> in the upper right corner of the page. In the dialog box that is displayed, enter the alias and description of the key.</span><p><div class="fignone" id="en-us_topic_0034330265__fig197191687132"><span class="figcap"><b>Figure 1 </b>Create Key dialog box</span><br><span><img id="en-us_topic_0034330265__image1290331423814" src="en-us_image_0210226589.png" title="Click to enlarge" class="imgResize"></span></div>
+<ul id="en-us_topic_0034330265__ul116951630171213"><li id="en-us_topic_0034330265__li116961230101220"><strong id="en-us_topic_0034330265__b8335361392">Alias</strong> is the alias of the CMK to be created.</li><li id="en-us_topic_0034330265__li1520243416122">(Optional) <strong id="en-us_topic_0034330265__b66254812399">Description</strong> is the description of the CMK.</li></ul>
+</p></li><li id="en-us_topic_0034330265__li94550558617"><span>(Optional) Add tags as needed, and enter the tag key and tag value.</span><p><div class="note" id="en-us_topic_0034330265__note1398105573314"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="en-us_topic_0034330265__ul5912584341"><li id="en-us_topic_0034330265__li2062319186403">When a CMK has been created without any tag, you can add a tag to the CMK later as necessary. Click the alias of the CMK. The page with key details is displayed. Then you can add tags to the CMK.</li><li id="en-us_topic_0034330265__li179165818342">The same tag (including tag key and tag value) can be used for different CMKs. However, under the same CMK, one tag key can have only one tag value.</li><li id="en-us_topic_0034330265__li5915812343">A maximum of 10 tags can be added for one CMK.</li><li id="en-us_topic_0034330265__li21951634133510">If you want to delete a tag to be added when adding multiple tags, you can click <strong id="en-us_topic_0034330265__b84235270693629">Delete</strong> in the row where the tag to be added is located to delete the tag.</li></ul>
+</div></div>
+</p></li><li id="en-us_topic_0034330265__li6331023914251"><span>Click <strong id="en-us_topic_0034330265__b1125524134017">OK</strong>.</span><p><p id="en-us_topic_0034330265__p38796286141356">In the CMK list, you can view created CMKs. The default status of a CMK is <span class="parmname" id="en-us_topic_0034330265__parmname2314745293727"><b>Enabled</b></span>.</p>
+</p></li></ol>
+</div>
+<div class="section" id="en-us_topic_0034330265__section1638212611642"><h4 class="sectiontitle">Related Operations</h4><ul id="en-us_topic_0034330265__ul366744581153"><li id="en-us_topic_0034330265__li49152713125435">For details about how to upload objects with server-side encryption, see section <span class="filepath" id="en-us_topic_0034330265__filepath987572475112840"><b>Uploading a File with Server-Side Encryption</b></span> in the <em id="en-us_topic_0034330265__i842352697112933">Object Storage Service User Guide</em>.</li><li id="en-us_topic_0034330265__li62734777115417">For details about how to encrypt data on EVS disks, see section <span class="filepath" id="en-us_topic_0034330265__filepath241712021162243"><b>Creating an EVS Disk</b></span> in the <em id="en-us_topic_0034330265__i34028223416231">Elastic Volume Service User Guide</em>.</li><li id="en-us_topic_0034330265__li7779218112256">For details about how to encrypt private images, see section <span class="filepath" id="en-us_topic_0034330265__filepath46808451162352"><b>Encrypting an Image</b></span> in the <em id="en-us_topic_0034330265__i19558150162446">Image Management Service User Guide</em>.</li><li id="en-us_topic_0034330265__li14595149151010">For details about how to encrypt the file system on SFS, see section <span class="filepath" id="en-us_topic_0034330265__filepath15244373129"><b>Creating a File System</b></span> in the <em id="en-us_topic_0034330265__i842352697113934">Scalable File Service User Guide</em>.</li><li id="en-us_topic_0034330265__li14492103123114">For details about how to encrypt disks for a database instance in RDS, see section <span class="filepath" id="en-us_topic_0034330265__filepath18914175565815"><b>Creating an RDS MySQL DB Instance</b></span> in the <em id="en-us_topic_0034330265__i1146920454528">Relational Database Service User Guide</em>.</li><li id="en-us_topic_0034330265__li320837341026">For details about how to create a DEK and a plaintext-free DEK, see sections <span class="filepath" id="en-us_topic_0034330265__filepath579501344104811"><b>Creating a DEK</b></span> and <span class="filepath" id="en-us_topic_0034330265__filepath948627244104811"><b>Creating a Plaintext-Free DEK</b></span> in the <em id="en-us_topic_0034330265__i1798235270104838">Key Management Service API Reference</em>.</li><li id="en-us_topic_0034330265__li333984961153">For details about how to encrypt and decrypt a DEK for a user application, see sections <span class="filepath" id="en-us_topic_0034330265__filepath149751496011912"><b>Encrypting a DEK</b></span> and <span class="filepath" id="en-us_topic_0034330265__filepath26571164911912"><b>Decrypting a DEK</b></span> in the <em id="en-us_topic_0034330265__i177637891916225">Key Management Service API Reference</em>.</li></ul>
+</div>
+</div>
+<div>
+<div class="familylinks">
+<div class="parentlink"><strong>Parent topic:</strong> <a href="kms_01_0018.html">Management</a></div>
+</div>
+</div>
+
+
+<script language="JavaScript">
+<!--
+image_size('.imgResize');
+var msg_imageMax = "view original image";
+var msg_imageClose = "close";
+//--></script>

docs/kms/umn/kms_01_0003.html

@@ -0,0 +1,29 @@
+<a name="kms_01_0003"></a><a name="kms_01_0003"></a>
+
+<h1 class="topictitle1">Concepts</h1>
+<div id="body1469675083217"></div>
+<div>
+<ul class="ullinks">
+<li class="ulchildlink"><strong><a href="kms_01_0004.html">KMS</a></strong><br>
+</li>
+<li class="ulchildlink"><strong><a href="kms_01_0005.html">CMK</a></strong><br>
+</li>
+<li class="ulchildlink"><strong><a href="kms_01_0006.html">Default Master Key</a></strong><br>
+</li>
+<li class="ulchildlink"><strong><a href="kms_01_0007.html">DEK</a></strong><br>
+</li>
+<li class="ulchildlink"><strong><a href="kms_01_0008.html">HSM</a></strong><br>
+</li>
+<li class="ulchildlink"><strong><a href="kms_01_0009.html">Envelope Encryption</a></strong><br>
+</li>
+<li class="ulchildlink"><strong><a href="kms_01_0010.html">TRNG</a></strong><br>
+</li>
+<li class="ulchildlink"><strong><a href="kms_01_0012.html">Project</a></strong><br>
+</li>
+</ul>
+
+<div class="familylinks">
+<div class="parentlink"><strong>Parent topic:</strong> <a href="kms_01_0045.html">About KMS</a></div>
+</div>
+</div>
+

docs/kms/umn/kms_01_0004.html

@@ -0,0 +1,13 @@
+<a name="kms_01_0004"></a><a name="kms_01_0004"></a>
+
+<h1 class="topictitle1">KMS</h1>
+<div id="body1481514797769"><p id="kms_01_0004__p8060118">Key Management Service (KMS) is a secure, reliable, and easy-to-use service that helps users centrally manage and safeguard their Customer Master Keys (CMKs).</p>
+<p id="kms_01_0004__p76522375203">This service uses hardware security modules (HSMs) to protect CMKs. HSMs help you create and control CMKs with ease. All CMKs are protected by root keys in HSMs to avoid leakage caused by human error.</p>
+<p id="kms_01_0004__p49164707142016">KMS implements access control and log-based tracking on all operations involving CMKs. Additionally, it provides use records of all CMKs, meeting your audit and regulatory compliance requirements.</p>
+</div>
+<div>
+<div class="familylinks">
+<div class="parentlink"><strong>Parent topic:</strong> <a href="kms_01_0003.html">Concepts</a></div>
+</div>
+</div>
+