DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
Page History
...
| Parameter | Required | Type | Description |
|---|---|---|---|
name | Yes | String | Name of the KMS key |
description | No | String | Description of the KMS key |
purpose | Yes | String | Purpose of the key (volume, tls) |
zoneid | Yes | UUID | Zone ID where the key will be valid |
hsmprofileid | Yes | UUID | HSM profile ID to create the KEK in |
keybits | No | Integer | KEK size in bits (128, 192, 256). Default: 256 |
account | No | String | Account name (admin use) |
domainid | No | UUID | Domain ID (admin use) |
CloudMonkey Example:
cmk createKMSKey \
name="volume-encryption-key" \
description="Production volume encryption" \
purpose="volume" \
keybits=256 \
zoneid=<zone-uuid> \
hsmprofileid=<hsm-profile-uuid>
listKMSKeys
Lists KMS keys available to the caller.
...
| Parameter | Required | Type | Description |
|---|---|---|---|
id | No | UUID | List KMS key by UUID |
purpose | No | String | Filter by purpose |
zoneid | No | UUID | Filter by zone |
state | No | String | Filter by state (Enabled, Disabled) |
CloudMonkey Example:
cmk listKMSKeys purpose=volume state=Enabled
updateKMSKeyupdateKMSKey
Updates KMS key name, description, or state.
...
| Parameter | Required | Type | Description |
|---|---|---|---|
id | Yes | UUID | KMS key UUID |
name | No | String | New name |
description | No | String | New description |
enabled | No | Boolean | Enable/disable the key |
CloudMonkey Example:
...
| key |
...
deleteKMSKey
Deletes a KMS key (only if not referenced by volumes or wrapped keys).
...
| Parameter | Required | Type | Description |
|---|---|---|---|
id | Yes | UUID | KMS key UUID |
CloudMonkey Example:
cmk deleteKMSKey id=<kms-key-uuid>
rotateKMSKey
Rotates KEK by creating a new version and scheduling gradual re-encryption of wrapped keys.
...
| Parameter | Required | Type | Description |
|---|---|---|---|
id | Yes | UUID | KMS key UUID to rotate |
keybits | No | Integer | Key size for new KEK (default: same as current) |
hsmprofileid | No | UUID | Target HSM profile for cross-HSM migration |
CloudMonkey Examples:
# Same-HSM rotation
cmk rotateKMSKey id=<kms-key-uuid>
# Cross-HSM migration
cmk rotateKMSKey id=<kms-key-uuid> hsmprofileid=<target-hsm-profile-uuid>
migrateVolumesToKMS
Migrates passphrase-based volumes to KMS encryption.
migrateVolumesToKMS
Migrates passphrase-based volumes to KMS encryption.
- Authorization: Admin Authorization: Admin only
- Async: Yes
Parameters:
| Parameter | Required | Type | Description |
|---|---|---|---|
zoneid | Yes | UUID | Zone ID |
id | Yes | UUID | KMS key ID to migrate volumes to |
account | No | String | Migrate volumes for specific account |
domainid | No | UUID | Domain ID |
CloudMonkey Example:
cmk migrateVolumesToKMS zoneid=<zone-uuid> id=<kms-key-uuid>
HSM Profile APIs
addHSMProfile
HSM Profile APIs
addHSMProfile
Adds a new HSM profile for Adds a new HSM profile for connecting to an HSM device.
...
PKCS#11 details keys: library (path to PKCS#11 library), slot (slot number), pin (HSM PIN, encrypted at rest), token_label (token label), minSessions, maxSessions
CloudMonkey Example:
...
slot number), pin (HSM PIN, encrypted at rest), token_label (token label), minSessions, maxSessions
listHSMProfiles
Lists HSM profiles visible to the caller.
...
| Parameter | Required | Type | Description |
|---|---|---|---|
id | No | UUID | HSM profile ID |
zoneid | No | UUID | Zone ID |
protocol | No | String | Protocol filter |
enabled | No | Boolean | Enabled filter |
CloudMonkey Example:
...
| Boolean | Enabled filter |
updateHSMProfile
Updates an HSM profile name or enabled state.
...
| Parameter | Required | Type | Description |
|---|---|---|---|
id | Yes | UUID | HSM profile UUID |
name | No | String | New name |
enabled | No | Boolean | Enable/disable |
Note: Updating configuration
detailsis not currently supported. To change PKCS#11 parameters (e.g., PIN), delete and re-create the HSM profile.
CloudMonkey Example:
cmk updateHSMProfile id=<profile-uuid> enabled=false
deleteHSMProfile
Deletes an HSM profile (only if not in use by any KEK versions).
...
| Parameter | Required | Type | Description |
|---|---|---|---|
id | Yes | UUID | HSM profile UUID |
CloudMonkey Example:
...
Global Settings
| Setting Key | Scope | Type | Default | Description |
|---|---|---|---|---|
kms.dek.size.bits | Global | Integer | 256 | Size of DEKs in bits for new volumes (128, 192, 256) |
kms.retry.count | Global | Integer | 3 | Number of retry attempts for transient KMS failures |
kms.retry.delay.ms | Global | Integer | 1000 | Delay in milliseconds between retry attempts |
kms.operation.timeout.sec | Global | Integer | 30 | Per-attempt timeout for KMS operations |
kms.rewrap.batch.size | Global | Integer | 50 | Wrapped keys rewrapped per batch in background job |
kms.rewrap.interval.ms | Global | Long | 300000 | Interval between background rewrap executions (5 min) |
Database Changes
New Tables
...
Overview
Content Tools