From 9ef1eb82a1f4726e43e93d74a6bd4a0f5c7ee442 Mon Sep 17 00:00:00 2001 From: "Li, Qiao" Date: Thu, 6 Jul 2023 09:04:08 +0000 Subject: [PATCH] KMS User Guide 20230619 Version. Reviewed-by: Belejkanic, Lukas Co-authored-by: Li, Qiao Co-committed-by: Li, Qiao --- docs/kms/umn/.placeholder | 0 docs/kms/umn/ALL_META.TXT.json | 574 ++++++++++------- docs/kms/umn/CLASS.TXT.json | 576 ++++++++++-------- docs/kms/umn/en-us_image_0000001357372181.png | Bin 0 -> 14667 bytes docs/kms/umn/en-us_image_0000001357411985.png | Bin 0 -> 30264 bytes docs/kms/umn/en-us_image_0205545064.png | Bin 21095 -> 0 bytes docs/kms/umn/en-us_topic_0034330265.html | 34 -- docs/kms/umn/kms_01_0003.html | 2 +- docs/kms/umn/kms_01_0005.html | 1 + docs/kms/umn/kms_01_0008.html | 2 +- docs/kms/umn/kms_01_0013.html | 8 +- docs/kms/umn/kms_01_0014.html | 7 +- docs/kms/umn/kms_01_0016.html | 206 +------ docs/kms/umn/kms_01_0017.html | 4 +- docs/kms/umn/kms_01_0018.html | 14 +- docs/kms/umn/kms_01_0019.html | 6 +- docs/kms/umn/kms_01_0020.html | 8 +- docs/kms/umn/kms_01_0021.html | 8 +- docs/kms/umn/kms_01_0023.html | 4 +- docs/kms/umn/kms_01_0024.html | 31 +- docs/kms/umn/kms_01_0025.html | 6 +- docs/kms/umn/kms_01_0026.html | 4 +- docs/kms/umn/kms_01_0027.html | 11 +- docs/kms/umn/kms_01_0028.html | 2 +- docs/kms/umn/kms_01_0029.html | 6 +- docs/kms/umn/kms_01_0030.html | 11 +- docs/kms/umn/kms_01_0031.html | 6 +- docs/kms/umn/kms_01_0032.html | 4 +- docs/kms/umn/kms_01_0033.html | 4 +- docs/kms/umn/kms_01_0034.html | 6 +- docs/kms/umn/kms_01_0035.html | 4 +- docs/kms/umn/kms_01_0036.html | 6 +- docs/kms/umn/kms_01_0037.html | 18 +- docs/kms/umn/kms_01_0039.html | 2 +- docs/kms/umn/kms_01_0043.html | 8 +- docs/kms/umn/kms_01_0045.html | 12 +- docs/kms/umn/kms_01_0046.html | 8 +- docs/kms/umn/kms_01_0047.html | 6 +- docs/kms/umn/kms_01_0054.html | 26 +- docs/kms/umn/kms_01_0055.html | 87 +-- docs/kms/umn/kms_01_0072.html | 12 +- docs/kms/umn/kms_01_0074.html | 35 ++ docs/kms/umn/kms_01_0094.html | 64 +- docs/kms/umn/kms_01_0095.html | 4 +- docs/kms/umn/kms_01_0096.html | 34 +- docs/kms/umn/kms_01_0100.html | 12 + docs/kms/umn/kms_01_0101.html | 39 ++ docs/kms/umn/kms_01_0102.html | 12 + docs/kms/umn/kms_01_0106.html | 23 + docs/kms/umn/kms_01_0107.html | 21 + docs/kms/umn/kms_01_0109.html | 17 + docs/kms/umn/kms_01_0114.html | 12 + docs/kms/umn/kms_01_0138.html | 7 +- docs/kms/umn/kms_01_0139.html | 4 +- docs/kms/umn/kms_01_0193.html | 11 + docs/kms/umn/kms_01_0196.html | 11 + docs/kms/umn/kms_01_0198.html | 11 + docs/kms/umn/kms_01_194.html | 32 + docs/kms/umn/kms_01_9997.html | 27 +- docs/kms/umn/kms_01_9998.html | 2 +- docs/kms/umn/kms_01_9999.html | 34 +- .../umn/public_sys-resources/icon-arrowdn.gif | Bin 68 -> 1887 bytes .../umn/public_sys-resources/icon-arrowrt.gif | Bin 70 -> 1890 bytes 63 files changed, 1198 insertions(+), 948 deletions(-) delete mode 100644 docs/kms/umn/.placeholder create mode 100644 docs/kms/umn/en-us_image_0000001357372181.png create mode 100644 docs/kms/umn/en-us_image_0000001357411985.png delete mode 100644 docs/kms/umn/en-us_image_0205545064.png delete mode 100644 docs/kms/umn/en-us_topic_0034330265.html create mode 100644 docs/kms/umn/kms_01_0100.html create mode 100644 docs/kms/umn/kms_01_0101.html create mode 100644 docs/kms/umn/kms_01_0102.html create mode 100644 docs/kms/umn/kms_01_0106.html create mode 100644 docs/kms/umn/kms_01_0107.html create mode 100644 docs/kms/umn/kms_01_0109.html create mode 100644 docs/kms/umn/kms_01_0114.html create mode 100644 docs/kms/umn/kms_01_0193.html create mode 100644 docs/kms/umn/kms_01_0196.html create mode 100644 docs/kms/umn/kms_01_0198.html create mode 100644 docs/kms/umn/kms_01_194.html diff --git a/docs/kms/umn/.placeholder b/docs/kms/umn/.placeholder deleted file mode 100644 index e69de29b..00000000 diff --git a/docs/kms/umn/ALL_META.TXT.json b/docs/kms/umn/ALL_META.TXT.json index 3cdb1be5..048c9757 100644 --- a/docs/kms/umn/ALL_META.TXT.json +++ b/docs/kms/umn/ALL_META.TXT.json @@ -1,18 +1,28 @@ [ { - "uri":"kms_01_0045.html", + "uri":"kms_01_0109.html", "product_code":"kms", "code":"1", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", - "kw":"About KMS", - "title":"About KMS", + "kw":"Service Overview", + "title":"Service Overview", + "githuburl":"" + }, + { + "uri":"kms_01_0045.html", + "product_code":"kms", + "code":"2", + "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", + "doc_type":"usermanual", + "kw":"Key Management", + "title":"Key Management", "githuburl":"" }, { "uri":"kms_01_0003.html", "product_code":"kms", - "code":"2", + "code":"3", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Concepts", @@ -22,7 +32,7 @@ { "uri":"kms_01_0004.html", "product_code":"kms", - "code":"3", + "code":"4", "des":"Key Management Service (KMS) is a secure, reliable, and easy-to-use service that helps users centrally manage and safeguard their Customer Master Keys (CMKs).This service", "doc_type":"usermanual", "kw":"KMS,Concepts,User Guide", @@ -32,7 +42,7 @@ { "uri":"kms_01_0005.html", "product_code":"kms", - "code":"4", + "code":"5", "des":"A Customer Master Key (CMK) is a Key Encryption Key (KEK) created by a user using KMS. It is used to encrypt and protect Data Encryption Keys (DEKs). One CMK can be used ", "doc_type":"usermanual", "kw":"CMK,Concepts,User Guide", @@ -42,7 +52,7 @@ { "uri":"kms_01_0006.html", "product_code":"kms", - "code":"5", + "code":"6", "des":"A Default Master Key is automatically created by another cloud service using KMS, such as Object Storage Service (OBS). The alias of a Default Master Key ends with /defau", "doc_type":"usermanual", "kw":"Default Master Key,Concepts,User Guide", @@ -52,7 +62,7 @@ { "uri":"kms_01_0007.html", "product_code":"kms", - "code":"6", + "code":"7", "des":"Data Encryption Keys (DEKs) are used by users to encrypt data.", "doc_type":"usermanual", "kw":"DEK,Concepts,User Guide", @@ -62,8 +72,8 @@ { "uri":"kms_01_0008.html", "product_code":"kms", - "code":"7", - "des":"A hardware security module (HSM) is a hardware device that securely produces, stores, manages, and uses CMKs. In addition, it provides encryption processing services.", + "code":"8", + "des":"A Hardware Security Module (HSM) securely produces, stores, manages, and uses keys and provides encryption services.", "doc_type":"usermanual", "kw":"HSM,Concepts,User Guide", "title":"HSM", @@ -72,7 +82,7 @@ { "uri":"kms_01_0009.html", "product_code":"kms", - "code":"8", + "code":"9", "des":"Envelope encryption is an encryption method that enables DEKs to be stored, transmitted, and used in \"envelopes.\" As a result, CMKs are not used to directly encrypt and d", "doc_type":"usermanual", "kw":"Envelope Encryption,Concepts,User Guide", @@ -82,7 +92,7 @@ { "uri":"kms_01_0010.html", "product_code":"kms", - "code":"9", + "code":"10", "des":"A true random number generator (TRNG) is a device that generates unpredictable random numbers by physical procedures instead of computer programs.", "doc_type":"usermanual", "kw":"TRNG,Concepts,User Guide", @@ -92,37 +102,47 @@ { "uri":"kms_01_0012.html", "product_code":"kms", - "code":"10", + "code":"11", "des":"A project is used to group and isolate OpenStack resources, including computing, storage, and network resources. A project can be a department or a project team.Multiple ", "doc_type":"usermanual", "kw":"Project,Concepts,User Guide", "title":"Project", "githuburl":"" }, - { - "uri":"kms_01_0046.html", - "product_code":"kms", - "code":"11", - "des":"KMS can manage CMKs used for data encryption and decryption in Object Storage Service (OBS), Elastic Volume Service (EVS), Image Management Service (IMS), Scalable File S", - "doc_type":"usermanual", - "kw":"Application Scenarios,About KMS,User Guide", - "title":"Application Scenarios", - "githuburl":"" - }, { "uri":"kms_01_0047.html", "product_code":"kms", "code":"12", "des":"KMS provides the following functions:Manages CMKs.Using the KMS console or APIs, you can perform the following operations on CMKs:Creating, querying, enabling, disabling,", "doc_type":"usermanual", - "kw":"Functions,About KMS,User Guide", + "kw":"Functions,Key Management,User Guide", "title":"Functions", "githuburl":"" }, + { + "uri":"kms_01_0100.html", + "product_code":"kms", + "code":"13", + "des":"Extensive Service IntegrationKMS can be integrated with Object Storage Service (OBS), Elastic Volume Service (EVS), and Image Management Service (IMS), to manage keys of ", + "doc_type":"usermanual", + "kw":"Product Advantages,Key Management,User Guide", + "title":"Product Advantages", + "githuburl":"" + }, + { + "uri":"kms_01_0046.html", + "product_code":"kms", + "code":"14", + "des":"KMS can manage CMKs used for data encryption and decryption in Object Storage Service (OBS), Elastic Volume Service (EVS), Image Management Service (IMS), Scalable File S", + "doc_type":"usermanual", + "kw":"Application Scenarios,Key Management,User Guide", + "title":"Application Scenarios", + "githuburl":"" + }, { "uri":"kms_01_0013.html", "product_code":"kms", - "code":"13", + "code":"15", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Accessing and Using KMS", @@ -132,8 +152,8 @@ { "uri":"kms_01_0014.html", "product_code":"kms", - "code":"14", - "des":"The public cloud provides a web-based service management platform. You can access KMS using HTTPS-compliant APIs or the management console.Management consoleIf you have r", + "code":"16", + "des":"The cloud service provides a web-based service management platform. You can access KMS using HTTPS-compliant APIs or the management console.Management consoleIf you have ", "doc_type":"usermanual", "kw":"How to Access KMS,Accessing and Using KMS,User Guide", "title":"How to Access KMS", @@ -142,67 +162,77 @@ { "uri":"kms_01_0015.html", "product_code":"kms", - "code":"15", + "code":"17", "des":"Users can upload objects to and download them from Object Storage Service (OBS) in common mode or server-side encryption mode. When users upload objects in encryption mod", "doc_type":"usermanual", "kw":"How to Use KMS,Accessing and Using KMS,User Guide", "title":"How to Use KMS", "githuburl":"" }, - { - "uri":"kms_01_0016.html", - "product_code":"kms", - "code":"16", - "des":"KMS provides central management and control capabilities of CMKs for Object Storage Service (OBS). It is used for server-side encryption with KMS-managed keys (SSE-KMS) f", - "doc_type":"usermanual", - "kw":"Related Services,Accessing and Using KMS,User Guide", - "title":"Related Services", - "githuburl":"" - }, { "uri":"kms_01_0017.html", "product_code":"kms", - "code":"17", - "des":"The public cloud system provides two types of permissions by default: user management and resource management. User management refers to the management of users, user gro", + "code":"18", + "des":"The system provides two types of permissions by default: user management and resource management. User management refers to the management of users, user groups, and user", "doc_type":"usermanual", - "kw":"User Permissions,Accessing and Using KMS,User Guide", + "kw":"User Permissions,Service Overview,User Guide", "title":"User Permissions", "githuburl":"" }, { "uri":"kms_01_9999.html", "product_code":"kms", - "code":"18", + "code":"19", "des":"If you want to assign different access permissions to employees in an enterprise for the KMS resources purchased on the cloud platform, you can use Identity and Access Ma", "doc_type":"usermanual", - "kw":"KMS Permissions Management,Accessing and Using KMS,User Guide", - "title":"KMS Permissions Management", + "kw":"Permissions Management,Service Overview,User Guide", + "title":"Permissions Management", + "githuburl":"" + }, + { + "uri":"kms_01_0016.html", + "product_code":"kms", + "code":"20", + "des":"Object Storage Service (OBS) is a scalable service that provides secure, reliable, and cost-effective cloud storage for massive amounts of data. KMS provides central mana", + "doc_type":"usermanual", + "kw":"Related Services,Service Overview,User Guide", + "title":"Related Services", + "githuburl":"" + }, + { + "uri":"kms_01_0196.html", + "product_code":"kms", + "code":"21", + "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", + "doc_type":"usermanual", + "kw":"User Guide", + "title":"User Guide", "githuburl":"" }, { "uri":"kms_01_0018.html", "product_code":"kms", - "code":"19", + "code":"22", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", - "kw":"Management", - "title":"Management", + "kw":"Key Management", + "title":"Key Management", "githuburl":"" }, { - "uri":"en-us_topic_0034330265.html", + "uri":"kms_01_194.html", "product_code":"kms", - "code":"20", + "code":"23", "des":"This section describes how to create a CMK on the KMS management console. You can create up to 100 CMKs, excluding Default Master Keys.The CMK is perfectly suited for but", "doc_type":"usermanual", - "kw":"Creating a Key,Management,User Guide", + "kw":"Creating a Key,Key Management,User Guide", "title":"Creating a Key", "githuburl":"" }, { "uri":"kms_01_0019.html", "product_code":"kms", - "code":"21", + "code":"24", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Creating CMKs Using Imported Key Material", @@ -212,8 +242,8 @@ { "uri":"kms_01_0054.html", "product_code":"kms", - "code":"22", - "des":"A CMK contains key metadata (key ID, key alias, description, key status, and creation date) and the key material used for encrypting and decrypting data.When a user uses ", + "code":"25", + "des":"A custom key contains key metadata (key ID, key alias, description, key status, and creation date) and key materials used for encrypting and decrypting data.When a user u", "doc_type":"usermanual", "kw":"Overview,Creating CMKs Using Imported Key Material,User Guide", "title":"Overview", @@ -222,177 +252,27 @@ { "uri":"kms_01_0055.html", "product_code":"kms", - "code":"23", + "code":"26", "des":"If you want to use your own key material instead of the KMS-generated material, you can use the console to import your key material to KMS. CMKs created using imported ma", "doc_type":"usermanual", - "kw":"Importing Key Material,Creating CMKs Using Imported Key Material,User Guide", - "title":"Importing Key Material", + "kw":"Importing a Key Material,Creating CMKs Using Imported Key Material,User Guide", + "title":"Importing a Key Material", "githuburl":"" }, { "uri":"kms_01_0020.html", "product_code":"kms", - "code":"24", + "code":"27", "des":"When importing key material, you can specify the expiration time. After the key material expires, KMS deletes it, and the status of the CMK changes to Pending import. You", "doc_type":"usermanual", - "kw":"Deleting Key Material,Creating CMKs Using Imported Key Material,User Guide", - "title":"Deleting Key Material", - "githuburl":"" - }, - { - "uri":"kms_01_0072.html", - "product_code":"kms", - "code":"25", - "des":"This section describes how to use the management console to schedule the deletion of one or multiple unwanted CMKs.If deletion is scheduled for a CMK, the deletion will n", - "doc_type":"usermanual", - "kw":"Scheduling the Deletion of One or Multiple CMKs,Management,User Guide", - "title":"Scheduling the Deletion of One or Multiple CMKs", - "githuburl":"" - }, - { - "uri":"kms_01_0021.html", - "product_code":"kms", - "code":"26", - "des":"This section describes how to configure the Simple Message Notification (SMN) function on the Cloud Trace Service (CTS) console.Decryption will fail if the CMK used has b", - "doc_type":"usermanual", - "kw":"Configuring SMN,Management,User Guide", - "title":"Configuring SMN", - "githuburl":"" - }, - { - "uri":"kms_01_0023.html", - "product_code":"kms", - "code":"27", - "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", - "doc_type":"usermanual", - "kw":"Managing Tags", - "title":"Managing Tags", - "githuburl":"" - }, - { - "uri":"kms_01_0024.html", - "product_code":"kms", - "code":"28", - "des":"Tags are used to identify CMKs. You can add tags to CMKs so that you can classify CMKs, trace them, and collect their usage status according to the tags.KMS does not supp", - "doc_type":"usermanual", - "kw":"Adding a Tag,Managing Tags,User Guide", - "title":"Adding a Tag", - "githuburl":"" - }, - { - "uri":"kms_01_0025.html", - "product_code":"kms", - "code":"29", - "des":"This section describes how to search for tags through KMS. You can search for tags of all CMKs that meet the search criteria in the current project.You have obtained an a", - "doc_type":"usermanual", - "kw":"Searching for Tags,Managing Tags,User Guide", - "title":"Searching for Tags", - "githuburl":"" - }, - { - "uri":"kms_01_0026.html", - "product_code":"kms", - "code":"30", - "des":"This section describes how to modify tag values on the KMS management console.You have obtained an account and its password for logging in to the management console.", - "doc_type":"usermanual", - "kw":"Modifying Tag Values,Managing Tags,User Guide", - "title":"Modifying Tag Values", - "githuburl":"" - }, - { - "uri":"kms_01_0027.html", - "product_code":"kms", - "code":"31", - "des":"This section describes how to delete tags on the KMS management console.You have obtained an account and its password for logging in to the management console.", - "doc_type":"usermanual", - "kw":"Deleting Tags,Managing Tags,User Guide", - "title":"Deleting Tags", - "githuburl":"" - }, - { - "uri":"kms_01_0028.html", - "product_code":"kms", - "code":"32", - "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", - "doc_type":"usermanual", - "kw":"Managing a Grant", - "title":"Managing a Grant", - "githuburl":"" - }, - { - "uri":"kms_01_0029.html", - "product_code":"kms", - "code":"33", - "des":"You can create grants for other users to use the CMK. You can create a maximum of 100 grants for a CMK.The owner of a CMK can create a grant for the CMK on the KMS manage", - "doc_type":"usermanual", - "kw":"Creating a Grant,Managing a Grant,User Guide", - "title":"Creating a Grant", - "githuburl":"" - }, - { - "uri":"kms_01_0030.html", - "product_code":"kms", - "code":"34", - "des":"This section describes how to view the details about a grant, such as the grant ID, grantee user ID, granted operation, and creation time.You have obtained an account and", - "doc_type":"usermanual", - "kw":"Querying a Grant,Managing a Grant,User Guide", - "title":"Querying a Grant", - "githuburl":"" - }, - { - "uri":"kms_01_0031.html", - "product_code":"kms", - "code":"35", - "des":"You can revoke a grant in either of the following scenarios:A grantee does not need the grant. (The grantee can either tell the user who has created the grant to revoke t", - "doc_type":"usermanual", - "kw":"Revoking a Grant,Managing a Grant,User Guide", - "title":"Revoking a Grant", - "githuburl":"" - }, - { - "uri":"kms_01_0138.html", - "product_code":"kms", - "code":"36", - "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", - "doc_type":"usermanual", - "kw":"Rotating CMKs", - "title":"Rotating CMKs", - "githuburl":"" - }, - { - "uri":"kms_01_0094.html", - "product_code":"kms", - "code":"37", - "des":"Security risks exist when a DEK is extensively and repeatedly used. For security purposes, you can configure KMS to create new key materials for the CMK.New key materials", - "doc_type":"usermanual", - "kw":"Context,Rotating CMKs,User Guide", - "title":"Context", - "githuburl":"" - }, - { - "uri":"kms_01_0139.html", - "product_code":"kms", - "code":"38", - "des":"This section describes how to enable rotation for a key on the KMS console.By default, automatic key rotation is disabled for a CMK. Every time you enable key rotation, K", - "doc_type":"usermanual", - "kw":"Enabling Key Rotation,Rotating CMKs,User Guide", - "title":"Enabling Key Rotation", - "githuburl":"" - }, - { - "uri":"kms_01_0095.html", - "product_code":"kms", - "code":"39", - "des":"This section describes how to disable rotation for a key on the KMS console.You have obtained an account and its password for logging in to the management console.The CMK", - "doc_type":"usermanual", - "kw":"Disabling Key Rotation,Rotating CMKs,User Guide", - "title":"Disabling Key Rotation", + "kw":"Deleting a Key Material,Creating CMKs Using Imported Key Material,User Guide", + "title":"Deleting a Key Material", "githuburl":"" }, { "uri":"kms_01_0032.html", "product_code":"kms", - "code":"40", + "code":"28", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Managing CMKs", @@ -402,7 +282,7 @@ { "uri":"kms_01_0096.html", "product_code":"kms", - "code":"41", + "code":"29", "des":"This section describes how to use the management console to view the information about a CMK, such as its alias, status, ID, and creation time. The status of a CMK can be", "doc_type":"usermanual", "kw":"Querying a CMK,Managing CMKs,User Guide", @@ -412,7 +292,7 @@ { "uri":"kms_01_0033.html", "product_code":"kms", - "code":"42", + "code":"30", "des":"The alias of a CMK is a user-friendly name designed to help you locate the CMK easier.This section describes how to change the alias and description of a CMK on the KMS m", "doc_type":"usermanual", "kw":"Changing the Alias and Description of a CMK,Managing CMKs,User Guide", @@ -422,7 +302,7 @@ { "uri":"kms_01_0034.html", "product_code":"kms", - "code":"43", + "code":"31", "des":"This section describes how to use the management console to enable one or multiple CMKs. Only enabled CMKs can be used to encrypt/decrypt data. A new CMK is in the Enable", "doc_type":"usermanual", "kw":"Enabling One or Multiple CMKs,Managing CMKs,User Guide", @@ -432,27 +312,177 @@ { "uri":"kms_01_0035.html", "product_code":"kms", - "code":"44", + "code":"32", "des":"This section describes how to use the management console to disable one or multiple CMKs, thereby protecting data in urgent cases.After being disabled, a CMK cannot be us", "doc_type":"usermanual", "kw":"Disabling One or Multiple CMKs,Managing CMKs,User Guide", "title":"Disabling One or Multiple CMKs", "githuburl":"" }, + { + "uri":"kms_01_0072.html", + "product_code":"kms", + "code":"33", + "des":"This section describes how to use the management console to schedule the deletion of one or multiple unwanted CMKs.If deletion is scheduled for a CMK, the deletion will n", + "doc_type":"usermanual", + "kw":"Deleting One or More CMKs,Managing CMKs,User Guide", + "title":"Deleting One or More CMKs", + "githuburl":"" + }, { "uri":"kms_01_0036.html", "product_code":"kms", - "code":"45", - "des":"This section describes how to use the management console to cancel the scheduled deletion of one or multiple CMKs prior to deletion execution.You have obtained an account", + "code":"34", + "des":"This section describes how to use the management console to cancel the scheduled deletion of one or multiple CMKs prior to deletion execution.The CMK for which you want t", "doc_type":"usermanual", "kw":"Canceling the Scheduled Deletion of One or Multiple CMKs,Managing CMKs,User Guide", "title":"Canceling the Scheduled Deletion of One or Multiple CMKs", "githuburl":"" }, { - "uri":"kms_01_9998.html", + "uri":"kms_01_0021.html", + "product_code":"kms", + "code":"35", + "des":"This section describes how to configure the Simple Message Notification (SMN) function on the Cloud Trace Service (CTS) console.Decryption will fail if the CMK used has b", + "doc_type":"usermanual", + "kw":"Configuring SMN,Key Management,User Guide", + "title":"Configuring SMN", + "githuburl":"" + }, + { + "uri":"kms_01_0023.html", + "product_code":"kms", + "code":"36", + "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", + "doc_type":"usermanual", + "kw":"Managing Tags", + "title":"Managing Tags", + "githuburl":"" + }, + { + "uri":"kms_01_0024.html", + "product_code":"kms", + "code":"37", + "des":"Tags are used to identify CMKs. You can add tags to CMKs so that you can classify CMKs, trace them, and collect their usage status according to the tags.Tags cannot be ad", + "doc_type":"usermanual", + "kw":"Adding a Tag,Managing Tags,User Guide", + "title":"Adding a Tag", + "githuburl":"" + }, + { + "uri":"kms_01_0025.html", + "product_code":"kms", + "code":"38", + "des":"This section describes how to search for tags through KMS. You can search for tags of all CMKs that meet the search criteria in the current project.Tags have been added.M", + "doc_type":"usermanual", + "kw":"Searching for a CMK by Tag,Managing Tags,User Guide", + "title":"Searching for a CMK by Tag", + "githuburl":"" + }, + { + "uri":"kms_01_0026.html", + "product_code":"kms", + "code":"39", + "des":"This section describes how to modify tag values on the KMS management console.", + "doc_type":"usermanual", + "kw":"Modifying Tag Values,Managing Tags,User Guide", + "title":"Modifying Tag Values", + "githuburl":"" + }, + { + "uri":"kms_01_0027.html", + "product_code":"kms", + "code":"40", + "des":"This section describes how to delete tags on the KMS management console.", + "doc_type":"usermanual", + "kw":"Deleting Tags,Managing Tags,User Guide", + "title":"Deleting Tags", + "githuburl":"" + }, + { + "uri":"kms_01_0138.html", + "product_code":"kms", + "code":"41", + "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", + "doc_type":"usermanual", + "kw":"Rotating CMKs", + "title":"Rotating CMKs", + "githuburl":"" + }, + { + "uri":"kms_01_0094.html", + "product_code":"kms", + "code":"42", + "des":"Keys that are widely or repeatedly used are insecure. To enhance the security of encryption keys, you are advised to periodically rotate keys and change their key materia", + "doc_type":"usermanual", + "kw":"Key Rotation Overview,Rotating CMKs,User Guide", + "title":"Key Rotation Overview", + "githuburl":"" + }, + { + "uri":"kms_01_0139.html", + "product_code":"kms", + "code":"43", + "des":"This section describes how to enable rotation for a key on the KMS console.By default, automatic key rotation is disabled for a CMK. Every time you enable key rotation, K", + "doc_type":"usermanual", + "kw":"Enabling Key Rotation,Rotating CMKs,User Guide", + "title":"Enabling Key Rotation", + "githuburl":"" + }, + { + "uri":"kms_01_0095.html", + "product_code":"kms", + "code":"44", + "des":"This section describes how to disable rotation for a key on the KMS console.The CMK is in Enabled status.The Origin of the CMK is KMS.Key rotation has been enabled.", + "doc_type":"usermanual", + "kw":"Disabling Key Rotation,Rotating CMKs,User Guide", + "title":"Disabling Key Rotation", + "githuburl":"" + }, + { + "uri":"kms_01_0028.html", + "product_code":"kms", + "code":"45", + "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", + "doc_type":"usermanual", + "kw":"Managing a Grant", + "title":"Managing a Grant", + "githuburl":"" + }, + { + "uri":"kms_01_0029.html", "product_code":"kms", "code":"46", + "des":"You can create grants for other users to use the CMK. You can create a maximum of 100 grants for a CMK.The owner of a CMK can create a grant for the CMK on the KMS manage", + "doc_type":"usermanual", + "kw":"Creating a Grant,Managing a Grant,User Guide", + "title":"Creating a Grant", + "githuburl":"" + }, + { + "uri":"kms_01_0030.html", + "product_code":"kms", + "code":"47", + "des":"This section describes how to view the details about a grant, such as the grant ID, grantee user ID, granted operation, and creation time.You have created a grant.Table 1", + "doc_type":"usermanual", + "kw":"Querying a Grant,Managing a Grant,User Guide", + "title":"Querying a Grant", + "githuburl":"" + }, + { + "uri":"kms_01_0031.html", + "product_code":"kms", + "code":"48", + "des":"You can revoke a grant in either of the following scenarios:A grantee does not need the grant. (The grantee can either tell the user who has created the grant to revoke t", + "doc_type":"usermanual", + "kw":"Revoking a Grant,Managing a Grant,User Guide", + "title":"Revoking a Grant", + "githuburl":"" + }, + { + "uri":"kms_01_9998.html", + "product_code":"kms", + "code":"49", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Permissions Management", @@ -462,7 +492,7 @@ { "uri":"kms_01_9997.html", "product_code":"kms", - "code":"47", + "code":"50", "des":"This section describes IAM's fine-grained permissions management for your KMS resources. With IAM, you can:Create IAM users for employees based on the organizational stru", "doc_type":"usermanual", "kw":"Creating a User and Authorizing the User the Permission to Access KMS,Permissions Management,User Gu", @@ -472,7 +502,7 @@ { "uri":"kms_01_9996.html", "product_code":"kms", - "code":"48", + "code":"51", "des":"Custom policies can be created as a supplement to the system policies of KMS. For details about the actions supported by custom policies, see \"Permissions Policies and Su", "doc_type":"usermanual", "kw":"Creating a Custom KMS Policy,Permissions Management,User Guide", @@ -482,7 +512,7 @@ { "uri":"kms_01_0037.html", "product_code":"kms", - "code":"49", + "code":"52", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"FAQs", @@ -492,7 +522,7 @@ { "uri":"kms_01_0073.html", "product_code":"kms", - "code":"50", + "code":"53", "des":"Key Management Service (KMS) is a secure, reliable, and easy-to-use service that helps users centrally manage and safeguard their Customer Master Keys (CMKs).This service", "doc_type":"usermanual", "kw":"What Is Key Management Service?,FAQs,User Guide", @@ -502,37 +532,37 @@ { "uri":"kms_01_0074.html", "product_code":"kms", - "code":"51", + "code":"54", "des":"A Customer Master Key (CMK) is a Key Encryption Key (KEK) created by a user using KMS. It is used to encrypt and protect Data Encryption Keys (DEKs). One CMK can be used ", "doc_type":"usermanual", "kw":"What Is a Customer Master Key?,FAQs,User Guide", "title":"What Is a Customer Master Key?", "githuburl":"" }, + { + "uri":"kms_01_0101.html", + "product_code":"kms", + "code":"55", + "des":"The following table describes the differences between a custom key and a default key.", + "doc_type":"usermanual", + "kw":"What Are the Differences Between a Custom Key and a Default Key?,FAQs,User Guide", + "title":"What Are the Differences Between a Custom Key and a Default Key?", + "githuburl":"" + }, { "uri":"kms_01_0038.html", "product_code":"kms", - "code":"52", + "code":"56", "des":"A data encryption key (DEK) is used to encrypt data.", "doc_type":"usermanual", "kw":"What Is a Data Encryption Key?,FAQs,User Guide", "title":"What Is a Data Encryption Key?", "githuburl":"" }, - { - "uri":"kms_01_0039.html", - "product_code":"kms", - "code":"53", - "des":"The decision to delete a CMK should be taken with caution. Before deletion, confirm that the CMK's encrypted data has all been migrated. Once the CMK is deleted, you will", - "doc_type":"usermanual", - "kw":"Why Cannot I Delete a CMK Immediately?,FAQs,User Guide", - "title":"Why Cannot I Delete a CMK Immediately?", - "githuburl":"" - }, { "uri":"kms_01_0040.html", "product_code":"kms", - "code":"54", + "code":"57", "des":"Object Storage Service (OBS), Elastic Volume Service (EVS), Image Management Service (IMS), Scalable File Service (SFS), and Relational Database Service (RDS) can use KMS", "doc_type":"usermanual", "kw":"Which Cloud Services Can Use KMS for Encryption?,FAQs,User Guide", @@ -542,17 +572,87 @@ { "uri":"kms_01_0093.html", "product_code":"kms", - "code":"55", + "code":"58", "des":"No.The pending period of a CMK from its scheduling till its deletion is not charged.However, if you cancel the scheduled deletion, the charging resumes from the time when", "doc_type":"usermanual", "kw":"Will a CMK Be Charged After It Is Scheduled to Delete?,FAQs,User Guide", "title":"Will a CMK Be Charged After It Is Scheduled to Delete?", "githuburl":"" }, + { + "uri":"kms_01_0039.html", + "product_code":"kms", + "code":"59", + "des":"The decision to delete a CMK should be taken with caution. Before deletion, confirm that the CMK's encrypted data has all been migrated. Once the CMK is deleted, you will", + "doc_type":"usermanual", + "kw":"Why Can't I Delete a CMK Immediately?,FAQs,User Guide", + "title":"Why Can't I Delete a CMK Immediately?", + "githuburl":"" + }, + { + "uri":"kms_01_0198.html", + "product_code":"kms", + "code":"60", + "des":"Yes.", + "doc_type":"usermanual", + "kw":"Is There a Limit on the Number of CMKs That I Can Create on KMS?,FAQs,User Guide", + "title":"Is There a Limit on the Number of CMKs That I Can Create on KMS?", + "githuburl":"" + }, + { + "uri":"kms_01_0106.html", + "product_code":"kms", + "code":"61", + "des":"Envelope encryption is the practice of encrypting data with a DEK and then encrypting the DEK with a root key that you can fully manage. In this case, CMKs are not requir", + "doc_type":"usermanual", + "kw":"What Are the Benefits of Envelope Encryption?,FAQs,User Guide", + "title":"What Are the Benefits of Envelope Encryption?", + "githuburl":"" + }, + { + "uri":"kms_01_0102.html", + "product_code":"kms", + "code":"62", + "des":"No.To ensure CMK security, users can only create and use CMKs in KMS.", + "doc_type":"usermanual", + "kw":"Can I Export a CMK from KMS?,FAQs,User Guide", + "title":"Can I Export a CMK from KMS?", + "githuburl":"" + }, + { + "uri":"kms_01_0107.html", + "product_code":"kms", + "code":"63", + "des":"You can use the online tool to encrypt or decrypt data in the following procedures:The key you clicked is used for encryption.To clear your input, click Clear.To copy the", + "doc_type":"usermanual", + "kw":"How Do I Use the Online Tool to Encrypt or Decrypt Small Volumes of Data?,FAQs,User Guide", + "title":"How Do I Use the Online Tool to Encrypt or Decrypt Small Volumes of Data?", + "githuburl":"" + }, + { + "uri":"kms_01_0114.html", + "product_code":"kms", + "code":"64", + "des":"No.Keys created using KMS-generated materials cannot be updated. You can only use KMS to create new CMKs to encrypt and decrypt data.", + "doc_type":"usermanual", + "kw":"Can I Update CMKs Created by KMS-Generated Key Materials?,FAQs,User Guide", + "title":"Can I Update CMKs Created by KMS-Generated Key Materials?", + "githuburl":"" + }, + { + "uri":"kms_01_0193.html", + "product_code":"kms", + "code":"65", + "des":"The mechanism of KMS prevents anyone from accessing your keys in plaintext. KMS relies on hardware security modules (HSMs) that safeguard the confidentiality and integrit", + "doc_type":"usermanual", + "kw":"How Does KMS Protect My Keys?,FAQs,User Guide", + "title":"How Does KMS Protect My Keys?", + "githuburl":"" + }, { "uri":"kms_01_0043.html", "product_code":"kms", - "code":"56", + "code":"66", "des":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "doc_type":"usermanual", "kw":"Change History,User Guide", @@ -562,7 +662,7 @@ { "uri":"kms_01_0044.html", "product_code":"kms", - "code":"57", + "code":"67", "des":"For details about the glossaries in this document, see Glossary.", "doc_type":"usermanual", "kw":"Glossary,User Guide", diff --git a/docs/kms/umn/CLASS.TXT.json b/docs/kms/umn/CLASS.TXT.json index 8d587983..1b2aed58 100644 --- a/docs/kms/umn/CLASS.TXT.json +++ b/docs/kms/umn/CLASS.TXT.json @@ -2,8 +2,8 @@ { "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "product_code":"kms", - "title":"About KMS", - "uri":"kms_01_0045.html", + "title":"Service Overview", + "uri":"kms_01_0109.html", "doc_type":"usermanual", "p_code":"", "code":"1" @@ -11,20 +11,29 @@ { "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "product_code":"kms", - "title":"Concepts", - "uri":"kms_01_0003.html", + "title":"Key Management", + "uri":"kms_01_0045.html", "doc_type":"usermanual", "p_code":"1", "code":"2" }, + { + "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", + "product_code":"kms", + "title":"Concepts", + "uri":"kms_01_0003.html", + "doc_type":"usermanual", + "p_code":"2", + "code":"3" + }, { "desc":"Key Management Service (KMS) is a secure, reliable, and easy-to-use service that helps users centrally manage and safeguard their Customer Master Keys (CMKs).This service", "product_code":"kms", "title":"KMS", "uri":"kms_01_0004.html", "doc_type":"usermanual", - "p_code":"2", - "code":"3" + "p_code":"3", + "code":"4" }, { "desc":"A Customer Master Key (CMK) is a Key Encryption Key (KEK) created by a user using KMS. It is used to encrypt and protect Data Encryption Keys (DEKs). One CMK can be used ", @@ -32,8 +41,8 @@ "title":"CMK", "uri":"kms_01_0005.html", "doc_type":"usermanual", - "p_code":"2", - "code":"4" + "p_code":"3", + "code":"5" }, { "desc":"A Default Master Key is automatically created by another cloud service using KMS, such as Object Storage Service (OBS). The alias of a Default Master Key ends with /defau", @@ -41,8 +50,8 @@ "title":"Default Master Key", "uri":"kms_01_0006.html", "doc_type":"usermanual", - "p_code":"2", - "code":"5" + "p_code":"3", + "code":"6" }, { "desc":"Data Encryption Keys (DEKs) are used by users to encrypt data.", @@ -50,17 +59,17 @@ "title":"DEK", "uri":"kms_01_0007.html", "doc_type":"usermanual", - "p_code":"2", - "code":"6" + "p_code":"3", + "code":"7" }, { - "desc":"A hardware security module (HSM) is a hardware device that securely produces, stores, manages, and uses CMKs. In addition, it provides encryption processing services.", + "desc":"A Hardware Security Module (HSM) securely produces, stores, manages, and uses keys and provides encryption services.", "product_code":"kms", "title":"HSM", "uri":"kms_01_0008.html", "doc_type":"usermanual", - "p_code":"2", - "code":"7" + "p_code":"3", + "code":"8" }, { "desc":"Envelope encryption is an encryption method that enables DEKs to be stored, transmitted, and used in \"envelopes.\" As a result, CMKs are not used to directly encrypt and d", @@ -68,8 +77,8 @@ "title":"Envelope Encryption", "uri":"kms_01_0009.html", "doc_type":"usermanual", - "p_code":"2", - "code":"8" + "p_code":"3", + "code":"9" }, { "desc":"A true random number generator (TRNG) is a device that generates unpredictable random numbers by physical procedures instead of computer programs.", @@ -77,8 +86,8 @@ "title":"TRNG", "uri":"kms_01_0010.html", "doc_type":"usermanual", - "p_code":"2", - "code":"9" + "p_code":"3", + "code":"10" }, { "desc":"A project is used to group and isolate OpenStack resources, including computing, storage, and network resources. A project can be a department or a project team.Multiple ", @@ -86,16 +95,7 @@ "title":"Project", "uri":"kms_01_0012.html", "doc_type":"usermanual", - "p_code":"2", - "code":"10" - }, - { - "desc":"KMS can manage CMKs used for data encryption and decryption in Object Storage Service (OBS), Elastic Volume Service (EVS), Image Management Service (IMS), Scalable File S", - "product_code":"kms", - "title":"Application Scenarios", - "uri":"kms_01_0046.html", - "doc_type":"usermanual", - "p_code":"1", + "p_code":"3", "code":"11" }, { @@ -104,26 +104,44 @@ "title":"Functions", "uri":"kms_01_0047.html", "doc_type":"usermanual", - "p_code":"1", + "p_code":"2", "code":"12" }, + { + "desc":"Extensive Service IntegrationKMS can be integrated with Object Storage Service (OBS), Elastic Volume Service (EVS), and Image Management Service (IMS), to manage keys of ", + "product_code":"kms", + "title":"Product Advantages", + "uri":"kms_01_0100.html", + "doc_type":"usermanual", + "p_code":"2", + "code":"13" + }, + { + "desc":"KMS can manage CMKs used for data encryption and decryption in Object Storage Service (OBS), Elastic Volume Service (EVS), Image Management Service (IMS), Scalable File S", + "product_code":"kms", + "title":"Application Scenarios", + "uri":"kms_01_0046.html", + "doc_type":"usermanual", + "p_code":"2", + "code":"14" + }, { "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "product_code":"kms", "title":"Accessing and Using KMS", "uri":"kms_01_0013.html", "doc_type":"usermanual", - "p_code":"1", - "code":"13" + "p_code":"2", + "code":"15" }, { - "desc":"The public cloud provides a web-based service management platform. You can access KMS using HTTPS-compliant APIs or the management console.Management consoleIf you have r", + "desc":"The cloud service provides a web-based service management platform. You can access KMS using HTTPS-compliant APIs or the management console.Management consoleIf you have ", "product_code":"kms", "title":"How to Access KMS", "uri":"kms_01_0014.html", "doc_type":"usermanual", - "p_code":"13", - "code":"14" + "p_code":"15", + "code":"16" }, { "desc":"Users can upload objects to and download them from Object Storage Service (OBS) in common mode or server-side encryption mode. When users upload objects in encryption mod", @@ -131,53 +149,62 @@ "title":"How to Use KMS", "uri":"kms_01_0015.html", "doc_type":"usermanual", - "p_code":"13", - "code":"15" + "p_code":"15", + "code":"17" }, { - "desc":"KMS provides central management and control capabilities of CMKs for Object Storage Service (OBS). It is used for server-side encryption with KMS-managed keys (SSE-KMS) f", - "product_code":"kms", - "title":"Related Services", - "uri":"kms_01_0016.html", - "doc_type":"usermanual", - "p_code":"13", - "code":"16" - }, - { - "desc":"The public cloud system provides two types of permissions by default: user management and resource management. User management refers to the management of users, user gro", + "desc":"The system provides two types of permissions by default: user management and resource management. User management refers to the management of users, user groups, and user", "product_code":"kms", "title":"User Permissions", "uri":"kms_01_0017.html", "doc_type":"usermanual", - "p_code":"13", - "code":"17" + "p_code":"1", + "code":"18" }, { "desc":"If you want to assign different access permissions to employees in an enterprise for the KMS resources purchased on the cloud platform, you can use Identity and Access Ma", "product_code":"kms", - "title":"KMS Permissions Management", + "title":"Permissions Management", "uri":"kms_01_9999.html", "doc_type":"usermanual", - "p_code":"13", - "code":"18" + "p_code":"1", + "code":"19" + }, + { + "desc":"Object Storage Service (OBS) is a scalable service that provides secure, reliable, and cost-effective cloud storage for massive amounts of data. KMS provides central mana", + "product_code":"kms", + "title":"Related Services", + "uri":"kms_01_0016.html", + "doc_type":"usermanual", + "p_code":"1", + "code":"20" }, { "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "product_code":"kms", - "title":"Management", - "uri":"kms_01_0018.html", + "title":"User Guide", + "uri":"kms_01_0196.html", "doc_type":"usermanual", "p_code":"", - "code":"19" + "code":"21" + }, + { + "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", + "product_code":"kms", + "title":"Key Management", + "uri":"kms_01_0018.html", + "doc_type":"usermanual", + "p_code":"21", + "code":"22" }, { "desc":"This section describes how to create a CMK on the KMS management console. You can create up to 100 CMKs, excluding Default Master Keys.The CMK is perfectly suited for but", "product_code":"kms", "title":"Creating a Key", - "uri":"en-us_topic_0034330265.html", + "uri":"kms_01_194.html", "doc_type":"usermanual", - "p_code":"19", - "code":"20" + "p_code":"22", + "code":"23" }, { "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", @@ -185,179 +212,44 @@ "title":"Creating CMKs Using Imported Key Material", "uri":"kms_01_0019.html", "doc_type":"usermanual", - "p_code":"19", - "code":"21" + "p_code":"22", + "code":"24" }, { - "desc":"A CMK contains key metadata (key ID, key alias, description, key status, and creation date) and the key material used for encrypting and decrypting data.When a user uses ", + "desc":"A custom key contains key metadata (key ID, key alias, description, key status, and creation date) and key materials used for encrypting and decrypting data.When a user u", "product_code":"kms", "title":"Overview", "uri":"kms_01_0054.html", "doc_type":"usermanual", - "p_code":"21", - "code":"22" + "p_code":"24", + "code":"25" }, { "desc":"If you want to use your own key material instead of the KMS-generated material, you can use the console to import your key material to KMS. CMKs created using imported ma", "product_code":"kms", - "title":"Importing Key Material", + "title":"Importing a Key Material", "uri":"kms_01_0055.html", "doc_type":"usermanual", - "p_code":"21", - "code":"23" + "p_code":"24", + "code":"26" }, { "desc":"When importing key material, you can specify the expiration time. After the key material expires, KMS deletes it, and the status of the CMK changes to Pending import. You", "product_code":"kms", - "title":"Deleting Key Material", + "title":"Deleting a Key Material", "uri":"kms_01_0020.html", "doc_type":"usermanual", - "p_code":"21", - "code":"24" - }, - { - "desc":"This section describes how to use the management console to schedule the deletion of one or multiple unwanted CMKs.If deletion is scheduled for a CMK, the deletion will n", - "product_code":"kms", - "title":"Scheduling the Deletion of One or Multiple CMKs", - "uri":"kms_01_0072.html", - "doc_type":"usermanual", - "p_code":"19", - "code":"25" - }, - { - "desc":"This section describes how to configure the Simple Message Notification (SMN) function on the Cloud Trace Service (CTS) console.Decryption will fail if the CMK used has b", - "product_code":"kms", - "title":"Configuring SMN", - "uri":"kms_01_0021.html", - "doc_type":"usermanual", - "p_code":"19", - "code":"26" - }, - { - "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", - "product_code":"kms", - "title":"Managing Tags", - "uri":"kms_01_0023.html", - "doc_type":"usermanual", - "p_code":"19", + "p_code":"24", "code":"27" }, - { - "desc":"Tags are used to identify CMKs. You can add tags to CMKs so that you can classify CMKs, trace them, and collect their usage status according to the tags.KMS does not supp", - "product_code":"kms", - "title":"Adding a Tag", - "uri":"kms_01_0024.html", - "doc_type":"usermanual", - "p_code":"27", - "code":"28" - }, - { - "desc":"This section describes how to search for tags through KMS. You can search for tags of all CMKs that meet the search criteria in the current project.You have obtained an a", - "product_code":"kms", - "title":"Searching for Tags", - "uri":"kms_01_0025.html", - "doc_type":"usermanual", - "p_code":"27", - "code":"29" - }, - { - "desc":"This section describes how to modify tag values on the KMS management console.You have obtained an account and its password for logging in to the management console.", - "product_code":"kms", - "title":"Modifying Tag Values", - "uri":"kms_01_0026.html", - "doc_type":"usermanual", - "p_code":"27", - "code":"30" - }, - { - "desc":"This section describes how to delete tags on the KMS management console.You have obtained an account and its password for logging in to the management console.", - "product_code":"kms", - "title":"Deleting Tags", - "uri":"kms_01_0027.html", - "doc_type":"usermanual", - "p_code":"27", - "code":"31" - }, - { - "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", - "product_code":"kms", - "title":"Managing a Grant", - "uri":"kms_01_0028.html", - "doc_type":"usermanual", - "p_code":"19", - "code":"32" - }, - { - "desc":"You can create grants for other users to use the CMK. You can create a maximum of 100 grants for a CMK.The owner of a CMK can create a grant for the CMK on the KMS manage", - "product_code":"kms", - "title":"Creating a Grant", - "uri":"kms_01_0029.html", - "doc_type":"usermanual", - "p_code":"32", - "code":"33" - }, - { - "desc":"This section describes how to view the details about a grant, such as the grant ID, grantee user ID, granted operation, and creation time.You have obtained an account and", - "product_code":"kms", - "title":"Querying a Grant", - "uri":"kms_01_0030.html", - "doc_type":"usermanual", - "p_code":"32", - "code":"34" - }, - { - "desc":"You can revoke a grant in either of the following scenarios:A grantee does not need the grant. (The grantee can either tell the user who has created the grant to revoke t", - "product_code":"kms", - "title":"Revoking a Grant", - "uri":"kms_01_0031.html", - "doc_type":"usermanual", - "p_code":"32", - "code":"35" - }, - { - "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", - "product_code":"kms", - "title":"Rotating CMKs", - "uri":"kms_01_0138.html", - "doc_type":"usermanual", - "p_code":"19", - "code":"36" - }, - { - "desc":"Security risks exist when a DEK is extensively and repeatedly used. For security purposes, you can configure KMS to create new key materials for the CMK.New key materials", - "product_code":"kms", - "title":"Context", - "uri":"kms_01_0094.html", - "doc_type":"usermanual", - "p_code":"36", - "code":"37" - }, - { - "desc":"This section describes how to enable rotation for a key on the KMS console.By default, automatic key rotation is disabled for a CMK. Every time you enable key rotation, K", - "product_code":"kms", - "title":"Enabling Key Rotation", - "uri":"kms_01_0139.html", - "doc_type":"usermanual", - "p_code":"36", - "code":"38" - }, - { - "desc":"This section describes how to disable rotation for a key on the KMS console.You have obtained an account and its password for logging in to the management console.The CMK", - "product_code":"kms", - "title":"Disabling Key Rotation", - "uri":"kms_01_0095.html", - "doc_type":"usermanual", - "p_code":"36", - "code":"39" - }, { "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "product_code":"kms", "title":"Managing CMKs", "uri":"kms_01_0032.html", "doc_type":"usermanual", - "p_code":"19", - "code":"40" + "p_code":"22", + "code":"28" }, { "desc":"This section describes how to use the management console to view the information about a CMK, such as its alias, status, ID, and creation time. The status of a CMK can be", @@ -365,8 +257,8 @@ "title":"Querying a CMK", "uri":"kms_01_0096.html", "doc_type":"usermanual", - "p_code":"40", - "code":"41" + "p_code":"28", + "code":"29" }, { "desc":"The alias of a CMK is a user-friendly name designed to help you locate the CMK easier.This section describes how to change the alias and description of a CMK on the KMS m", @@ -374,8 +266,8 @@ "title":"Changing the Alias and Description of a CMK", "uri":"kms_01_0033.html", "doc_type":"usermanual", - "p_code":"40", - "code":"42" + "p_code":"28", + "code":"30" }, { "desc":"This section describes how to use the management console to enable one or multiple CMKs. Only enabled CMKs can be used to encrypt/decrypt data. A new CMK is in the Enable", @@ -383,8 +275,8 @@ "title":"Enabling One or Multiple CMKs", "uri":"kms_01_0034.html", "doc_type":"usermanual", - "p_code":"40", - "code":"43" + "p_code":"28", + "code":"31" }, { "desc":"This section describes how to use the management console to disable one or multiple CMKs, thereby protecting data in urgent cases.After being disabled, a CMK cannot be us", @@ -392,26 +284,161 @@ "title":"Disabling One or Multiple CMKs", "uri":"kms_01_0035.html", "doc_type":"usermanual", - "p_code":"40", - "code":"44" + "p_code":"28", + "code":"32" }, { - "desc":"This section describes how to use the management console to cancel the scheduled deletion of one or multiple CMKs prior to deletion execution.You have obtained an account", + "desc":"This section describes how to use the management console to schedule the deletion of one or multiple unwanted CMKs.If deletion is scheduled for a CMK, the deletion will n", + "product_code":"kms", + "title":"Deleting One or More CMKs", + "uri":"kms_01_0072.html", + "doc_type":"usermanual", + "p_code":"28", + "code":"33" + }, + { + "desc":"This section describes how to use the management console to cancel the scheduled deletion of one or multiple CMKs prior to deletion execution.The CMK for which you want t", "product_code":"kms", "title":"Canceling the Scheduled Deletion of One or Multiple CMKs", "uri":"kms_01_0036.html", "doc_type":"usermanual", - "p_code":"40", + "p_code":"28", + "code":"34" + }, + { + "desc":"This section describes how to configure the Simple Message Notification (SMN) function on the Cloud Trace Service (CTS) console.Decryption will fail if the CMK used has b", + "product_code":"kms", + "title":"Configuring SMN", + "uri":"kms_01_0021.html", + "doc_type":"usermanual", + "p_code":"22", + "code":"35" + }, + { + "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", + "product_code":"kms", + "title":"Managing Tags", + "uri":"kms_01_0023.html", + "doc_type":"usermanual", + "p_code":"22", + "code":"36" + }, + { + "desc":"Tags are used to identify CMKs. You can add tags to CMKs so that you can classify CMKs, trace them, and collect their usage status according to the tags.Tags cannot be ad", + "product_code":"kms", + "title":"Adding a Tag", + "uri":"kms_01_0024.html", + "doc_type":"usermanual", + "p_code":"36", + "code":"37" + }, + { + "desc":"This section describes how to search for tags through KMS. You can search for tags of all CMKs that meet the search criteria in the current project.Tags have been added.M", + "product_code":"kms", + "title":"Searching for a CMK by Tag", + "uri":"kms_01_0025.html", + "doc_type":"usermanual", + "p_code":"36", + "code":"38" + }, + { + "desc":"This section describes how to modify tag values on the KMS management console.", + "product_code":"kms", + "title":"Modifying Tag Values", + "uri":"kms_01_0026.html", + "doc_type":"usermanual", + "p_code":"36", + "code":"39" + }, + { + "desc":"This section describes how to delete tags on the KMS management console.", + "product_code":"kms", + "title":"Deleting Tags", + "uri":"kms_01_0027.html", + "doc_type":"usermanual", + "p_code":"36", + "code":"40" + }, + { + "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", + "product_code":"kms", + "title":"Rotating CMKs", + "uri":"kms_01_0138.html", + "doc_type":"usermanual", + "p_code":"22", + "code":"41" + }, + { + "desc":"Keys that are widely or repeatedly used are insecure. To enhance the security of encryption keys, you are advised to periodically rotate keys and change their key materia", + "product_code":"kms", + "title":"Key Rotation Overview", + "uri":"kms_01_0094.html", + "doc_type":"usermanual", + "p_code":"41", + "code":"42" + }, + { + "desc":"This section describes how to enable rotation for a key on the KMS console.By default, automatic key rotation is disabled for a CMK. Every time you enable key rotation, K", + "product_code":"kms", + "title":"Enabling Key Rotation", + "uri":"kms_01_0139.html", + "doc_type":"usermanual", + "p_code":"41", + "code":"43" + }, + { + "desc":"This section describes how to disable rotation for a key on the KMS console.The CMK is in Enabled status.The Origin of the CMK is KMS.Key rotation has been enabled.", + "product_code":"kms", + "title":"Disabling Key Rotation", + "uri":"kms_01_0095.html", + "doc_type":"usermanual", + "p_code":"41", + "code":"44" + }, + { + "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", + "product_code":"kms", + "title":"Managing a Grant", + "uri":"kms_01_0028.html", + "doc_type":"usermanual", + "p_code":"22", "code":"45" }, + { + "desc":"You can create grants for other users to use the CMK. You can create a maximum of 100 grants for a CMK.The owner of a CMK can create a grant for the CMK on the KMS manage", + "product_code":"kms", + "title":"Creating a Grant", + "uri":"kms_01_0029.html", + "doc_type":"usermanual", + "p_code":"45", + "code":"46" + }, + { + "desc":"This section describes how to view the details about a grant, such as the grant ID, grantee user ID, granted operation, and creation time.You have created a grant.Table 1", + "product_code":"kms", + "title":"Querying a Grant", + "uri":"kms_01_0030.html", + "doc_type":"usermanual", + "p_code":"45", + "code":"47" + }, + { + "desc":"You can revoke a grant in either of the following scenarios:A grantee does not need the grant. (The grantee can either tell the user who has created the grant to revoke t", + "product_code":"kms", + "title":"Revoking a Grant", + "uri":"kms_01_0031.html", + "doc_type":"usermanual", + "p_code":"45", + "code":"48" + }, { "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", "product_code":"kms", "title":"Permissions Management", "uri":"kms_01_9998.html", "doc_type":"usermanual", - "p_code":"19", - "code":"46" + "p_code":"22", + "code":"49" }, { "desc":"This section describes IAM's fine-grained permissions management for your KMS resources. With IAM, you can:Create IAM users for employees based on the organizational stru", @@ -419,8 +446,8 @@ "title":"Creating a User and Authorizing the User the Permission to Access KMS", "uri":"kms_01_9997.html", "doc_type":"usermanual", - "p_code":"46", - "code":"47" + "p_code":"49", + "code":"50" }, { "desc":"Custom policies can be created as a supplement to the system policies of KMS. For details about the actions supported by custom policies, see \"Permissions Policies and Su", @@ -428,8 +455,8 @@ "title":"Creating a Custom KMS Policy", "uri":"kms_01_9996.html", "doc_type":"usermanual", - "p_code":"46", - "code":"48" + "p_code":"49", + "code":"51" }, { "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", @@ -438,7 +465,7 @@ "uri":"kms_01_0037.html", "doc_type":"usermanual", "p_code":"", - "code":"49" + "code":"52" }, { "desc":"Key Management Service (KMS) is a secure, reliable, and easy-to-use service that helps users centrally manage and safeguard their Customer Master Keys (CMKs).This service", @@ -446,8 +473,8 @@ "title":"What Is Key Management Service?", "uri":"kms_01_0073.html", "doc_type":"usermanual", - "p_code":"49", - "code":"50" + "p_code":"52", + "code":"53" }, { "desc":"A Customer Master Key (CMK) is a Key Encryption Key (KEK) created by a user using KMS. It is used to encrypt and protect Data Encryption Keys (DEKs). One CMK can be used ", @@ -455,8 +482,17 @@ "title":"What Is a Customer Master Key?", "uri":"kms_01_0074.html", "doc_type":"usermanual", - "p_code":"49", - "code":"51" + "p_code":"52", + "code":"54" + }, + { + "desc":"The following table describes the differences between a custom key and a default key.", + "product_code":"kms", + "title":"What Are the Differences Between a Custom Key and a Default Key?", + "uri":"kms_01_0101.html", + "doc_type":"usermanual", + "p_code":"52", + "code":"55" }, { "desc":"A data encryption key (DEK) is used to encrypt data.", @@ -464,17 +500,8 @@ "title":"What Is a Data Encryption Key?", "uri":"kms_01_0038.html", "doc_type":"usermanual", - "p_code":"49", - "code":"52" - }, - { - "desc":"The decision to delete a CMK should be taken with caution. Before deletion, confirm that the CMK's encrypted data has all been migrated. Once the CMK is deleted, you will", - "product_code":"kms", - "title":"Why Cannot I Delete a CMK Immediately?", - "uri":"kms_01_0039.html", - "doc_type":"usermanual", - "p_code":"49", - "code":"53" + "p_code":"52", + "code":"56" }, { "desc":"Object Storage Service (OBS), Elastic Volume Service (EVS), Image Management Service (IMS), Scalable File Service (SFS), and Relational Database Service (RDS) can use KMS", @@ -482,8 +509,8 @@ "title":"Which Cloud Services Can Use KMS for Encryption?", "uri":"kms_01_0040.html", "doc_type":"usermanual", - "p_code":"49", - "code":"54" + "p_code":"52", + "code":"57" }, { "desc":"No.The pending period of a CMK from its scheduling till its deletion is not charged.However, if you cancel the scheduled deletion, the charging resumes from the time when", @@ -491,8 +518,71 @@ "title":"Will a CMK Be Charged After It Is Scheduled to Delete?", "uri":"kms_01_0093.html", "doc_type":"usermanual", - "p_code":"49", - "code":"55" + "p_code":"52", + "code":"58" + }, + { + "desc":"The decision to delete a CMK should be taken with caution. Before deletion, confirm that the CMK's encrypted data has all been migrated. Once the CMK is deleted, you will", + "product_code":"kms", + "title":"Why Can't I Delete a CMK Immediately?", + "uri":"kms_01_0039.html", + "doc_type":"usermanual", + "p_code":"52", + "code":"59" + }, + { + "desc":"Yes.", + "product_code":"kms", + "title":"Is There a Limit on the Number of CMKs That I Can Create on KMS?", + "uri":"kms_01_0198.html", + "doc_type":"usermanual", + "p_code":"52", + "code":"60" + }, + { + "desc":"Envelope encryption is the practice of encrypting data with a DEK and then encrypting the DEK with a root key that you can fully manage. In this case, CMKs are not requir", + "product_code":"kms", + "title":"What Are the Benefits of Envelope Encryption?", + "uri":"kms_01_0106.html", + "doc_type":"usermanual", + "p_code":"52", + "code":"61" + }, + { + "desc":"No.To ensure CMK security, users can only create and use CMKs in KMS.", + "product_code":"kms", + "title":"Can I Export a CMK from KMS?", + "uri":"kms_01_0102.html", + "doc_type":"usermanual", + "p_code":"52", + "code":"62" + }, + { + "desc":"You can use the online tool to encrypt or decrypt data in the following procedures:The key you clicked is used for encryption.To clear your input, click Clear.To copy the", + "product_code":"kms", + "title":"How Do I Use the Online Tool to Encrypt or Decrypt Small Volumes of Data?", + "uri":"kms_01_0107.html", + "doc_type":"usermanual", + "p_code":"52", + "code":"63" + }, + { + "desc":"No.Keys created using KMS-generated materials cannot be updated. You can only use KMS to create new CMKs to encrypt and decrypt data.", + "product_code":"kms", + "title":"Can I Update CMKs Created by KMS-Generated Key Materials?", + "uri":"kms_01_0114.html", + "doc_type":"usermanual", + "p_code":"52", + "code":"64" + }, + { + "desc":"The mechanism of KMS prevents anyone from accessing your keys in plaintext. KMS relies on hardware security modules (HSMs) that safeguard the confidentiality and integrit", + "product_code":"kms", + "title":"How Does KMS Protect My Keys?", + "uri":"kms_01_0193.html", + "doc_type":"usermanual", + "p_code":"52", + "code":"65" }, { "desc":"HUAWEI CLOUD Help Center presents technical documents to help you quickly get started with HUAWEI CLOUD services. The technical documents include Service Overview, Price Details, Purchase Guide, User Guide, API Reference, Best Practices, FAQs, and Videos.", @@ -501,7 +591,7 @@ "uri":"kms_01_0043.html", "doc_type":"usermanual", "p_code":"", - "code":"56" + "code":"66" }, { "desc":"For details about the glossaries in this document, see Glossary.", @@ -510,6 +600,6 @@ "uri":"kms_01_0044.html", "doc_type":"usermanual", "p_code":"", - "code":"57" + "code":"67" } ] \ No newline at end of file diff --git a/docs/kms/umn/en-us_image_0000001357372181.png b/docs/kms/umn/en-us_image_0000001357372181.png new file mode 100644 index 0000000000000000000000000000000000000000..ccec1bee2509fec2349010dc59ae669ee40764ce GIT binary patch literal 14667 zcmcJ01yogCxAvjCTN;t>lx`4(LpQ>q5u{5>K)So6yFp4irBkH44j>^&gMi!(zVG{e z_xtY{|3CgQ?ioYbC)QqT&3NXVYd$+v87zl^`UDjO0%6F%kX8kO;1+@F6=Yc8|J<>F z0^kpfld7B~sB(;K7kC42A)zP%0#!$&-5MbP?@{bu=s1Bum|q_L!Sve|n}R^k*W{%o z)ZZEW$QZYyXlOb*T6NaaA>V}MZ>g*qE|pMzH!TyBF;3@-X6h6_y-bXOPYMGIzXOj< zRqQ&IH>4c!MDV3POc1!DSYw(PQ~eS-3gTC31sQne@&a4pBON{D(I{1qr z*7eUa_nnMOAN_|F1Fs|`e1Sh#!|-8bk5|5CuripBSDjpbG)RwEkW}$lxW}tc3fTiN zk5}4s1vK~PRX*MXAP!Q?!P5<-c%(f1|-h+aQl~^pm?x-upr;JzQD8z{|p5I%VFq>Q$i+2 z1MUt3EK~Wzvn*^5LJ-Il4p@FR{3}sv2nz@_fXLto5=Tk$lI+w5fnqR#34L*a36V+n z7wtL<(8I9AZm~m)ii*;m&-d!BXJel0(saq=f|+nleCXfRp~S!3uymEqm88c_r(MsN z3H3u!vbY`qg^~HD{+Vz9q+kNV|L3;E)-EoI(Vzijg|{)B|N0co6<+5 zJ^UWh?Wy#vV&GD>qIqKKhOC{*$nL>Vqd3)1h}Lv&1xfGqAylc|lcQM>RcuYZ+(5ps)mW zi=?|=5&Tsyb#%y>T5+X_E3yxa$iGoMA%pVMJ@&2oPVGI2B1$x#sV0bYJHS*ZfS@R>e2P|IVjvG|PY! znB)Tg61zzF^~@kDJ?b`wB8w<&JW?MliSHY9bD0PGI=>nP=TPiJ4H&5s8St^>lNVH9 zy|`?we6HuJn~dVTG-x56@#?wNc0&~b=lqi!$*0>1mf4lO&HC}PmDSR-Hm3HkzB;sE zdza+4M?!)iZVG^_nt}>BL18%rO}Jj4!$bvCa0K%v&Dex=i>38A!%{SKLo+4_Gikc% zZQQM7M!UBNHX>5H+BJJjUCYdI7>&X43eaBuk&TfBUf0NHg3BY>r0UXF5wAlMheQ3E zq~epKJE17VXq1QkEL}Z_B%3a~ZA^}mR#JEcnDTx}s$Y}x3gcWfDnf2}^V8JK%+65s zG6g42!bsf?i#JBlUCnXSFmU7$PDUAI=-8@S`@}PA$5MK+H_|ooTr$-v&?B2!j6H74 zkwH9me-r_ci+Kj<)}(c^#ZE@_$=%Q^+=h8;4eB)v5iD~ozSaO>$A8>jm43#KzHA_o z?kGDi9LWkR>TK(i1Elytj zUdTvh1*4>!_gxCy2-e4|KVBB^wUp#~-Slqyy;#*~8bj8kmGN+z(#LK#u4xO}XYi;J zOf@7MQ=%ori)MPKG^!a3$KeJ5Y%aaYV5I6~ zhk+4;g;iP^8JwNPlNg9kGF&7lC5D8V>|wN_~Gr5ZBiHbtSiHYiex zH5VeN=*b}@aAnn#Kdjj%^KMoq2Q*~J*_7m^Zc$2sAac*>(!$UJF7*=f3$+?RM zHIvjlD@x}oGuQicZMJbMZfR(W@nghRb}?iyI~9Py7~)&~WPYN>hLC4TblTw)t>;ss zkawxdwm&q@$T+|CtYf^6(_=8Le%tDP+cL{5 z>bP*-X}`vJR`&W~4hE%!+%7}MdXfO0!q~1KAELC-R5V_uGyIhBACtof86uW~GN|UD&1fvx zbD3@4_td-M5cV=Y4eu~jBFQa)O(bKGNRLBtr54m#m-dV9A=#6e=&&0Jdy6x zwr@yric3McpUJdjdTJrqW4{KsO@MY=I)Qa#!}{YM?vQNa6RhZ_5IPM$G?)><1wvMZK{nZjSN(0TkhBI1Lr(t^TQgQRHfSx zh7lQ{T4Codd}e&-vn5tFYR1b4XPWv{uPRG;dGwtvv8u_-&cMpEoeDV=r?D{q!i=yh z`_*}`$P9<$i#L>L&>-Dq*&lCnUkYjJuWP|_)w4{6{)!ppSlnXPq1_dpanCcz!`5Li zd9AgL!@11G4C_ICQbMq{rm(B|Rj{*;0`Y{!%M{2!|8_Jwi+++)wVNvJuW0tl%ik*p zdh3FyD3OoO{>kb(wejlmzQUf)50&xnN>Fx6xa9fM%u?bQ>ALv`#r!uDoT-K5kjUL; zqT_p!q22Ls?);x|A4rxT^GKL~&-4D{LvfhD@?-!Gey)oS;QnuCrGJ|%khA|QmH3Yj zePRDj*MY3|i}#-(`giL8PgZOi;pQRr;FsG?P`lOkyNzD7sC=nTZTn@aR~*$6dp*Bw zfXv=}NH|&e{FgtL=nHT{zlSS`?!}aTZx3P#-hRVlqJ64=GPU1vyTv{jdh&nfPLJYx z{7EvqAszkDdX@wtaWy4sy=lmuE>B{224vk z1lQLceDk=fzQ>v+dmvO@+WnuU_Ps0Oe=tR}%vYHnqsFaNC@K^jg!=rC+W0%k=Nf;e z)Moz7mcv_x;;)2&;NMDv5vM`5DxIK31^oo1h`@du2`1_5bYZ%ST8nY;ep6%PnirKE zEZ&MI>O;Zs=Ux~FMnk#6uTAc*_8iaGPL|Jy@7=it^_yJWUCvM1Jd^o5+FRYc-0g?V zK1dIK+ey#J_;GYpRaG^ah5ci0X{puc{q%9 zV@8?^xR}X5U67M#o#tOGHEzO)0iAKOei{ zuKoG*XRuNZ?FoEXdRHb42u8-BA6^C!F<$l4>uDuQgZAH{`-s7qP!k`oUK@}ACohr= zrjebUosCW8`HA+y;bENGhODptPw=?9$x5`Hy%<(-|K{NDZ!_CqskYc#CnBAN2lF~eAsaZu;0%2%T3=N}2& z;0m7tmXllYF}lx8@V!Pbb3@PUewS(JiNNs3In-|(NJvO-M=OcO@0gT5!C-J>DC7j5 zuJuxVJB-W|5#(ap1SOJeGjCds2n{(YA=z*9th7i2H(vAd<0?d|dyP#@Oia}^qTH2q zVjxV?JroL#nh%Rd#@0UZ^z=NqsrC05)otNa!`_NN8CP?yU}|lNsybANr8Py|eeFt! zXYS^9d3&3#hmPCRLRh2mI2KR)#Cb1V;re8lUB|NjlkMNWr7?X+jBXa(+b=Df|qvO44_FaylaU@R_-pcGb>iY?8 z;nB7Zp2SLsKCVk8AOm4oY0bn-rCs_y-47VD>~e^sO^BC3;y&QeyV)Pzqy>2rz^^09 zH6Z<V39?89Ofo4OiTSJ6xCpYRLmxEue^8Aj627~e zEZ&xp$+1e6>8>s#;ON(P(Mxh1W{A_YIztY5tremU~%l&1OgK^N^cBv%;1vXFRP%uTuE zmZ7@0K2$M$+0pGCNxSP{j914uJ2R6XG8)k0b|mU~5z&IA`epyyq}qedz6W;36{)>6 zv?7yfzabss%C5wq-m}$rQQyuamP`na?3G)7?oBP4;MA)2%};;7i}7-7xGXDRQ^P2P zl(NDwRpv8sDy89Zm-BaPW9Ey?OPxV;n8D*_O1Rv!yu7?0KWxUBnhZZRG`LX-2n!3d zQdRX5@dx$ATORvMLy1fFVzV4N8XGMq`Xzuvmma`JBUZXHIrX|}l&pqv)nbQDR!1Ei za?@^~!PpS2;Y^LKB0jMz+v8dcFcZp%{7swf_GmaRPixc2T`CiokgvZ@!yO;zx$)Sf)v65Nw$!Y1$CgAJflsZSH*WN z_hxAZ?bPuh1~uUg&BQic{2VrwE_?ZQUwdi=y^v7^(UbiUSNY*oFesLL}IQDa}tpHl4oNKr8Dj9pRwK(z%A${hCt;z}2ChcD%Ig#FSBtlXYmLan4A=LYu$4y?v*^-tq6((oekCSzT+g z+iNRxax5J?{1f;Mm4TQX&5a@ZP}vkbZUY_I1|G1DmqWPE3S)KsX@mxMV<<*%x0wcR(s^!wE2bxNW5l7VB)x4 z&vaVtLSM(aEWIRm&TeBLsmHj)B@k^KC)qXp|`>D>`n(x(P@R@%AMEL$Y6dMc{a-fpDQk_@cU0x)i%C zNjDLNO|>17wldTc+(Uk?N2d|!T#xW;!)m)G8^XFV(8{J7d&%67vWHKJ(YcG}rt|EH z!HuOh0OO=t(<^e>&Vu{US?Yt-ePLRJz1c4vPM?|9XJM*lR$H7!f1CxqCqKxZoI_*$ zENmO2#y*v%5d=WK??{DOAFAr9%j#@-OKqiqsOWY%LAQ@G0)-FO{arT6I=G4GNcV*- z0PrEGbKIShkAb9); z!NsQ|(4Dd@SC20>WN$A+72$113w!;%SOV%!vK{r;6Ppx8t*8(b1XI`gv@$32V`7CDyqhR7NWO zUO;#EIikpkYTgA*o_Hy|xa zZzbDI^PbW&$gkiGH!p)V$_^tgp303i2&df}Nx_ZH;wx`n>&Kj*yPRYJ{_6GS3(Nxo z8LDC56o0$QT@q@Gf5;Pc;eqXlYeN~mOG;koQR}#Th|sRN67pslpJsOTWA<5wwfVs^ zMp7`ZqhYi4hQ2lfVrVr@1MX!$@q<2>z}U(|^;1*KCfH*spz~YWzQ0qt&pM=2zhd{< zHxQDhLdrG##RHDSx73^XTJ6M#Jz{sja~8vtvO1U3h2^!d8&Gz^?>eRTIahMcY1Z%i z^J)~`xC&mL5_?sbeCZNwHn8NxO-7s+uFoxW;dx#wM7EVs_@v;(w zOF>E|LNRoOd=1Kddj`BNpVu>7FfgLH=I7^iTExD5FKsu_ECbTRHw-|HPyu&=t}HjF z!;mBatG3%}14&7X(+yZzYFc&T5SJEzYDoVFw?&dtw<{t}Say<)X` zGxq+NB5op6i*tTqAxr~s@&+jSBBRMKA*PE|yxzk@+m;SWo?pA!?Z|dDUZycYKzcIq z3^EQf02GjDZXwJ+TWew|07i#q4U!8C)06GBXMBS%EnA>;e$5}G00-BKPQjwO=Wb;DwS4D`3~+41TgC1KpIK}-frpWFyR?H zi-H0Ac8gE*U7+VCU>Fu!AX>eHrF=TUzpWoy*y{dSGNw9^#BAC*V-q{X9_vJpQ z0LsYAop?Zu|EyBv{p|}Lw_P;fLT6Lw* zwN_icZrUNHx*g^W$caaCz{pV0q>1>CW-?XqM{wHrrNe5!nA7I=L-E~8=c z_%+iXEuG7tAL$#bO@*fO^@YWp9(Umg#JxUb=7{R@+a{^jSs7NSKE8lr$9H+rCx9VP z5V(VmbO+>Om3+n_wVng6Ux+ath44^r7~`O#CNcDf`c_+_t>?Xa;xX%U&px(FW-h6f=v>t*#SaR1d_b?%z0M4G(!%!#p)-ZZRz^e6^ z$z!zb-xxalHn7xw6A$?<&JGCY0Ma`Op*AA9#t%k?!Ucv*v}-|~>sidMdi6HmV3Vx; zo_6sbF=Ha>k$Ceo4|Sd5$CK%29nEZbtG}*X*Cj=^;K|>%VbLGkoM}neaC|0iP6~V7 ziuU}AC?>G(L7gNm2@jvsGXT|zmPtDm%#mIC}Nln+vig=TEce zn`F4Bn$@b6W?@=JF+$%$`>Gp%>@S7h0o_@a3RDRjNAn9p(~Azg^E6UJ=gp*F@`DYnFWlL5Hfn$zFgLT=#4kOjUen| z?S+ladxR^3t=9s{@}Jm$QjwK^gV!yZ`7!UTc{eQoES#)dE*$%_zl-%*;x2npUl-~S z6OW|pte^r@*hx62(X1|f)d#KTUsgT>ZA>#`es!pH^mr_PRUOJU9xnz#Q;L8xjv}si zF%Dh!fRt%1fNvrp^$F`i>!b6W)rgNyqu@G-g?j#R>w>26X@96+#Pm{29Ocb1f#Gyu zu#elTLt=xwo@ce}Ka~ZwcT1qvt`T$z45B4f`Dk8aF$_bTcSR2Rg4%|WnOxRGoKAwo z8ZU(1`tQ$*g^%6@=}8h;jOcNH92XD~F#{ZWXFLnQGWQcG3ef`6HhZY7cP$>1v4k;( zRR9XZ3HJN}0P9#=x^eMb@fcsyYE6vE$9w^ZPd$jE#NXp(KBS6&fSNw5!`F;w8;}z0 zqPZyQ?Xpwcg_MG50)qm_)AHYkC$LD&cujQ;E1$iS70#x=vrg(oeU}_vq#V-Cu2e(kp+tvS zxVHrTTP<|dbk0ZPZ=#|1(Afo!DE0MyzRy-jGdUKA*ymFI3)Ma8KN(#)AOaYRjNg=u zGUNdC*4SJl&MWbCh2|!S+U^GYNzU{>&k;F`hoIb%@N;k=wXRmZMflEDorfBOusFN*zc!US6_k1R2QIQz*{(6+Tn9A zn*5C!Ft)u}@p%ez->_n-NP**@ImfEgwq953!CvZJLT#t&P<*;ZKzNIO7*9jE*YbXl z$aDX33e8mlI_3woZl0^oa4Yz_)TR14%@E76NDATCsa}1+L-ZC|AYbJo^C4Iwm+ zCj7}lX@D$rMhx8gwJUC)VybE{dxc~8A)-IoIm{A~y-o-4DT9VSSGaRo_Yl^7#k_wd1h-&4v<#SFWWdns$GqXYL*FUWXzEEECFUNlwY`7nu!He) zleT+}-9lqHfjQ6q?(mPwXOqDj3Gwb?1YPKTd)nli3d_4hb$BiG;^u=+*n@0RDYJD`f8vU5_{)y)1~fBClM+ z?O3-z-LK9l#jNs?#3XdXMp{1uK+w~OCkyXp6dWvQXYcBI@qHo>sJ+JcQPrPnVabTn zn$Db_I#GPjyt-Jl16q=9tob7d5=LSGkrnuK~%H5iHV7Y#m?H=8Wb9Ec6WSy{1vMh zo{GOfFpxwPdpt|*=+Zqgkhc6`rr+moJNI{RNowQ882&*-J+LyFVGl65XWM^y*fhp8 z@iVwPuFmZCq~TB}z|}|x$p3$luaJoQpch+cjg22$Slmaj_oDzuvr@5mbKKalFm;fP zSMRBcXMuBWz;O;;X^WsN#nNB)vl6fvy1OoLlV0?PdOJFHd+?!+SZE=~ZNF-@$Rhdj z1D2%yPT5ZcE{Dz6Rl#cz3;tYC;L$6VqujlaOS;EJ1O0!no`J=))pws)v$L@UT}@{` za|F(8yyL|aF1xc^#DVJW;ru}SC*s$Sq3qXw*#`9VkI9JIdLE|fDK#y^^ErcVY@q*i zi05fxAs1HZRUCHmaDIifLE=G#tnlur#1vluSVR{}Hrk}&iIjL77#xKsMarCpMXkX> z&f;*S{g!fmX_7<`Xcb{#9TU_)J#79O(-re05DP`4Y z*1I2XAYj3y(5~!eq|nfRvH*QWD`9aL2aqg}{Iq2Y2eadr)s0Lcrk(Br-S9?plT}DS(VBE62<)A;1U}A0OW!kqYC#?^$dXbx<07?a>>Ft&2H=I%m2adxJ1+@A6 zP>w_r^J(bGECIn&ijx%1@t(g z6c~Y(X81Uw>6w^CAAizjlp`wTee4agthtV;1zp47(Q1d1$d;%-O3d{l7CD(%ni}x) zAjC&T;A7jP&*7zefZJ@78^o*6=O%~lW)VtCN(yw>mh?E>xzwQnn>MG&z(E)CAEEm% zOgJc(1oMmaGgrjrtcEID@opwpmRD2&ig(bGKn2pqldyDqFWWsBPekHi=j2;-6k=;j zAwf*0W&16{_qWu~JhJ9U!cXGk@eXNIaIZV=zJ_nQPhtR5SkksZcVs)Yr52AZvYKs~ zdVxN~#!gI^qt4JGmSPS57I37sB*MW7065)a=c4+r0d>z#Cm^P45Uu#@iQ{yjzXzvy zFd}`uvO?j8t`OZBaG5zI{owYX5SsI6V$4al<<8^>iF%EboCI_mPBl1NjY6Uhk044Z z0|qMoYylFM>uU}KlY;M%)myT07;wn$Rr-|7^>T~b@xj$u>g*y`*~9Osm7xzT(}xC~ z@Ed_SYtpNv+dAzH;M*96)s>Z`UwoW={QSq}iBmwi`)GOa3?~3<&DvC`a04RdJ%E82 z%GKS|-q;8nR2XHXAx}Ym>3t9a#q|ocajQe&ADVh`lX2q!DY36%vxl680(QjTfzDMo zmrN`!i;&y<#)tsuwFV5n9o$ju)P7aHY5MS+bgox`DwAoYuNM{;fYa~BUMieFQ4dhQ zxbJO}S08W`*}_X1IXtZ~Tgxi4M%@{Tx8>BAK8HuN1*jhY-<{7NoF9=Uo!|j!dg%+g~2Op6MPA(mlC4HnAmp5!2Lh_X!i&$@4!}R_Am&p{f%W zeRoZijCDVT0h+W>wG%7fyuI~8ZT7OW!#YwQOaYqR2!Mci9(6F2fAFIH@UDu@@V>{z z|1OBRfo-+L?HXxGWaQ%(_^s*}IXSug{e6}gIa6!v{j;-#MHntX$U6lC1b|&oZP!A% zsUYQV7GjqUkS;xcd$c*0UPd*c#_+49%mID!yj{mqGanyHvAcM@cQ;1xfVHNluE!}Q z`&QH0_WMs(+7g0!NeizpzR;y-X2$8SEG?N{FHu@sTVqiOcPedI$d|8X*3--aM#F77 z_DWO$$nX_2qE)xoS9|Hh_&W$Iul7oR_Su(S<7_z<3RI7ejYUO89j2 zZWCQK2ozy#le#)2|T;I{!cPRy*)fUenAKE1mB;1#|gDF23qq0 zSKHg$>+9>`MC^@JG3*bpf$$ft<}bEr3c|fMNBs(#95DzTCLwqFtGUeY~NP%>*|DuQd;bBuWAe3NlIX%!y z9$M`GFc%>#F)%585Y7Mb!?hp5AYa)B&h{hgIUjcAJ@UU(Te_nDP(uD^ZD|3y3Q z0=58(1f&EIa{wMGDzM8Gg8#<%uBfbhfAgauK_W*+slNv}ss%TDoG;W{zaV3cU86;z zH;cU*6FRbQg=w%`)kKm~INA=)n{PF*HV*LNi#K#&~ z83GvQqETzmu}D%k@N=%$Cx^@S3SLY95cC1wlRShNKUbpg7d|`+nxNVX+}P0=`V0BK z5fiQLsvJbaaDcn3J9@SNW+~T$I{x~GTthI00vkYgPX?N)!6DjWK#H_L^ z&5iC+{c2uCn`LLRw|H9nZ%QKv8a~-j6p#I?NuEk(5;(IZ@t^^R``m zu+Z(P*6eI!;{?kd1ZN0xR00rE<@4iRHMmm9cAZeP32Zti5T(SUgyZLz;x`3zJfCwf?YDeqkpCv}v>nIaOg$n`OUX^K;n%d&8ww{Z$HjHf>{UTS`ZN7{jm zX*hW`{{`NCi?%zXR2z=Q;&asvzKB|#K^kL7!ElEds`Is`n%VoJ-3JoexhlcpQOcwAUX)yYzcs{`WAR^)(mP=MtKW&A^KNn`nyQT{Z$S^MVow@x+DXX0IBKUh&K&c& z1RLFwWH&2qs!wxUJi10k2ywA~sHg3zFx zPa4TuS;F^aH*pL?cyQLN8zP+mePt0AR=mcgHBq_I*!ev$FxHl*l%ZhZQ?9D4#m^}X zWmajLmnQ|>GBWD+sb!X04*HOp=gKac-ne77ng;sHHc~30o1<&_FM3?soeLR0SI$o< zq{0Ip7}lwy%-3to#pV9M(tWLC`<_3mdafHEqj-Z^Gy9`fI%m?m2eHz`t61SwXl~~# zI~)1zovMdxg`5qvt8=1`7rW)DYvF642*GMMbKg+%M!lAh*%27S8;6(Ip?>X#&=O^FrVy5$5WsnW`@nY zCUg24UZS04X6rUQG22jjVv$v_v8z^+n}`@ps(M8F3vl*fSWzD(qY}zZO42MR3`iKcZ8K#r>dtSdMq(N+-PZtUZ(wB5N9j_Nn!N_I!z;h5Z@uJj=rN+}V z75F}pmp$Jj?P8@3 z!{>~Z&x*0psJ4pL4C|0Z8d7J?^)xKi-U@r6`M5%ju#f?5pG{f$X|!g3A$H3tfbb&= zJSoQY5aJ=_midJo6Tfno)@=wNdx%<6A&tx!OSg0ycR0RmeBrLcG|)EKizRw^_#UgpcDsyR S5#{N_NAfaY=}Jk+hyMcEQ6-oF literal 0 HcmV?d00001 diff --git a/docs/kms/umn/en-us_image_0000001357411985.png b/docs/kms/umn/en-us_image_0000001357411985.png new file mode 100644 index 0000000000000000000000000000000000000000..0434f34ee526630d96a972752a1682f7db4f325d GIT binary patch literal 30264 zcmc$`3pCW*|35q~UDUxz=cHUusT83@$i2%+MJR<_he|?&2r(FyL!FX}A$OHa?!p+i z8A?Sal-sz@a5N?cBZHYSX6D(S!8yP0`JVspdDeQKwVu{$sgKXz`+a%6U;Dk^`#p32 ztmR4ZO){HcFqru1Q@>fmV4^G-OnCRk_29`}Z}dF)ArxSJ@))e7U2X#WN7Un}#ZegS zb=>AEDiCxaBg<6~pfK2v=q?9lsGj)3b1v zvZ-AUcdX}sAGy0>NdIcI=cDh35VE|;*w|P{gq7m8{OQHs*nVj@ZLfn$2M$z5I{ebO zQB8ek&5>VritRj?^Yl0Lw%zD$&EJr!3P1fE>R+d;Imo=;Bg%n3zfMn(&A zY|@}^X1np#FLEIbu+JH(alyl?>IJ@=6H;t6_!o)tdc6(FFqq8ipM~Ie zQmo`KNiJ%(Aq`h<#$-um$;0t=G?&@iOH{lyqt^;wN;Bq6^DNfEK1aq%vV2fwG#B>w z(16@-L-aX?9n(UML4|3u#cbV35&Uf#j7)!w-)v!;5GI8@>Xm=~4S=ol~vd8dh{_V<>nN%~i zLVtH>SR|tAh7eht*(4ce${8wbzyo;m*PD929vBNG%Qv`OsFm@Bm_(mnkuV=Dequ;!=y`)}IGxRdaXn|h$8Z{4pUtr&Z+SsR(m*L|kap?QmI2im0SzMC3MzoSFUO!6ZG?t^d4a zowwYq7+c3~nt^oE>ySAU&!F{?490|EeYUbc&$d-0@!FD@T1`KpSnMT^$Hm3&rkR3u zkbD<7%L+*klny?Kl!RRy1{T4XdOIz4YDvZ#9&F2w)Y$WN@BpS`=7t#S*$FrdR_Q|% zHnuQid~OlxI>*; z4=f48vI2#TQ?j3I$kn?B2~vFW-&E5S27>r5{F`ctKhNewg%$p*YM&r8JEs4eYVI4t z_U|Nn{hMk{ zAN!)#7J(oMK|_p{V4ZsL82)|Fs)vODgF+sbn%$qHgNX`zu%->*T!Eu@kDNC{_=~Z} z|FO`So71t_sU97{KwMN9V`X4jL}uN1?F@}v|B{bjh_L`jro$S8d8nE!&H`Bvb&30) z!$+D>eNLA#EBKs-;X;Jh$Y!BTYcE-|7F|aO3Wb|kUg2-bc;j;#^8qu7l1?mLB==3j zQV)4L@47K0aBaFIt1~O_G?(bRe3z;{lON|CcEZF1DK$jV>ouLARMo5V2l?N}XIS?) zEaeX#Z_G;=NR*nhfK(tB2;<9NdJoAa4D_CxVVt^^OuZOSdR4DJc&u>)tkSZPc|9Oy zuXaqzR7z)-Rp^Y^V%4uhn}x`WJ<_FI&I~bvQ$M3d<$bj8GFiHB&dlXcAbErKUD%qv zMnsE}U|xSrEj)C1umGEXH|eo&IfO)8`Pu0g0UfB0ZYmz}lCy5bog02&l`|tqoU8cm zqR$5`7!gE|R|h;g$0)O7cMX~4%O_4AoT3^(7|4y(cysz~M)xo?tW>|Fx^=n6cX|;~ zL?~IBBXNH1@IGwx#w8c~)2u~kNve}Qu_$1=%A#0$} zdEDMRhLLNp#+0>Hz#b~oGd$dN>9DUo_Dtb^B$1#O+3H_D( zb`TgEaW*QYC#Ic#YoaC|`L(ob)|kM0YF%L=1Q)Zk-cf9u>TxkS?^Aok;WLKMJ_Fyjf^#_emyWHo=qTbUe3PXvCP(O@K`$hRnFKn4^LTx`UI~y$Oqlneyh(5(nq{PDE(LB~hrnrs?2BSuuG=fY^i?>amK!-ineY z&QCdtX5=S`nTBF6CU^~-mEoE3sL4sn?|x2=u^hbo?s&9(G>tONK% zIzLp;1>}m$PNkGfV8*dwzn)Suz97RHO^Pf}8`b{}|677-c=hsJSoCw!Ss#LCj2Gd4 zy`??BdsbVOmO%Yg!h}#B%@8Qtz*pq^)5%dL7`FAE?Pe`WsJwN*>2)}c!@nMUFSo1y zTljdfJ?(tPAWN@UYlKkiZsdh^U&LnNo5fP7Dy&ngD;^)ZWGcrxsSUVf)@VwNVQ67X7n+;)2c-M=^ANbJC$d4Z* zfG!h89|&rrL$^Z3dZKa1BT5%`uyI2=7c#6Y)J6yagi1r=_oal4JsocQx;_x@kCrE% zSRnwSZdtt7_J|yzw#plQ+bC6T@eYee;!-DG1M_4RA9_D#G{1)>tB!Qga&c_XM35qV zJ8OTUY<@pWFtg9QQK8tC!90q%+?e#sF8e0O>6(W%!V-gyt$mJZ8GS`9;7dilXXp!j_gAR z?q__xK^V)KV;sINhfl2W-QlL^$vfSFS(cBEvrGJSVs`rb7@AE+zTtD4LR$S}7+;Ma zM8Po)z6A$#`4V{^{bLIN+rG9gcTc18<`m#x4da{6mexyFO&r@hCN-B1B_G5B5&UWG z%9cfS##iPtJU!==oug0x%%k8bci#7MEwW##@r6N!Bv0*R4XilwkJB{k?$8&@#uD5= zh7ukAim}GM31&_DC2q%!)P5{nca5Qw*Ol^ZyY3|A!JF#+8C7Wxhq2ch?U0X-Q+|zB z+Ll**z6Q}bruYs-3%f>iSJ$0Fsa@#I7{--Q;doIqwjMfD%a?TA{(~RyOviHm0oCVb z1)}gVSCua7HLJxBYKAYTwJtXW?mud&Hg8sj9*ht2cv*$}) zl%SfsJ0w0qRis6ov5(P29Oh?JQ(BQ(LnaK0UZVR$k(%~23?Hpl#s8lwGgZ{g8oBtQvRHN+}#mRG;wDsoE<(ehXo1B z0!W66^+!~V-c(0#>nBmj%f>?=EHx2$%_X1eVYR_OM>q1HLB`OXW+yBtE{cp%58Dok zJtHd@pZ76W6J(L;k-nzK^$!6v{to7~9@9TmeE(7BPkEkk{@>`VvJ6kc{x;UEd1EDY zYYn2BS23;;_iKGeWuOYy!hv-3x_6_UaQuy12`WOT#m>wHsQpr4Q$s&I-^hCX;> zdtx>)nE-g%1;riN)C=SCC6|w7o-vQqO4GGDmhNy$zofifEP7o2+_P5NQ_c^HmplDi zYsafJ5nmeM$tXjaV$ru<$I1q1Nh+wZ5aRQCTMAR^&)6nh{oat0F`}}KaF=1`vI~hW zb|{8HiAZ+ga4ZYTjhm?Uxv@zN2n=l}T(IFwu*P4vES6l?h%su~o$OofEU&6G)++H4 zQu5nvpyVKPVB>Piz>-y}N$cew=CS5F{94tflCi8ISW1biHaO6Q?qet`abV~rasOz_p^26dp>utr_Nyy93`>1E_WJk{9;tx zx+G4Pr0~0D0|$EtD31ku9YUNHJxDmMN%nIzOgyX3NbpmqGY8yCyAsbIdo#LtYk;wz zW-_(mL&uGx`5#RIpBF{{4}5r*Yax11?9SExa-#n@+|tmQV|@^zmlL9>5TP~A{>?{L zhqPz+P=_ANYg@>)G^SVxULa~NX4YCMm6FhS+2KgSS*4?9#}cgFlgHS~YA=TpQ?!e_ zSs@82!Qp$2@;+rwu!9fdwh5z0inq1)cy;Pa`kHS{%#5))RxzqiVGijyndXUF=mY{lfZgmh~)? zuq?Ju3vqbUYd|;=#ksMjMO@TC??BJ0VK%c`AJv7Z?|Q(Qg z%!9}?NaGNN8blwXd+Fix&gO?5Z*)D={T;pRSM%nVxk%_-(>Z0i>D?cm7B|l=eop#= z#H%z_*!<@c-@kt1< zOG>9~0?ON9o3dKoRJ|@u0PmYU@*o%h-Tv6C(RLynQ6a5|<1~`{_q?!-C(T z3tpYe7|*6b>xx`-fl=IvUXM=wy+5|jFB_y~$UNc|;4CW&s@lf}$Hf{zB3VC^)4H!* z>H|n>DeUe$6=$r_WCG1PHTYt(vJiZ_>O?`kLWsK9E@du)5UQqmNu6Lup&Dimp-AVR z<@@uCE*H1fwsWvU^8=U_2!Z^d-=)W^x{W|j#^w&`43W?Xzk=)7^X!m5WI}Uh?!zJT z9#hsy9|HgP@@Y%Tjn?_^kLo&!2~TcMNY42t1S&2Xo(sC3tK8xp&(^eJo9IV8{A4gu zL#gU6-?)-BFXbYw#bqg-Q@L*Ps@T}n;X@Ue<`#c~!i+!XfP2Ss_Lkf3dV8*`qRHmx zjcrpn)}CJHsyvgsi1=|00m`%^ z6dsgxWV7?ug*APFyZ=Ny?3ZFY7O2qsA|~i6X&}I2k1L2g-^0`NCo-0)Hyy>^mS;4v zKWIlxaeG-9mC|riISI)eHTtkUO}l6gOVF&S7Zt*=y|g>V+Bgn~^V8NVs1oD=L;I^T zr=1bV6ejMOO6 z_6=dQr>1)1-;cfpnSD>n*L|_KzRso@_GX8~wAQxi+l^cdd3b`3l^9f*&6!)bfAkDb zUa_S5)R9CLAv3kJ1#NI2bMZWjO%Kc>HPcXE7CvfvGm>C=+rZ09yMJn}&GBNKDKPBy zOOLS;E;W}}*O;6d)-(dDEu{k-I zkQxsmvkQ7gxO72+7)`W+&Q);fVlZ_>$&07*$mwxa~wFy}s zDh+Zh5VZ`MI#6dAV|X>A$&d6YiRzf)T~Oqh8z=JWjFot%cS!wms;AhZRFFkzIDveb zRc-Gw6OYoe5-#>988MS}!wV4_9d)1Va^t9Nm%D`v z2Lg(5c(zf8cV}&HuSO~RV2cbd`~yQAPW9BD_|6z=WhfYTh=z_egsY6YPcQ6y?mDA| zM_8j_ff=sYhj-*QRH$88%`@t@&5ECVpQEvlzacL+k-&jB>ehkcB|6ggZfrxP)u5K5 zFrIq-d?WS`fIEq|iS}Y?<;!l3+Qr-KGfxxRHLWodA!OylGM4Zlu(hMSu^#eLcPLa% zdQszz&H(561&cP$vt*A9cA^cXCff^}q#{H%bW0D7z{t%(^%jh`5PU}uT!s5KJ79WS zvejS9A9vRX6UL=|*5_Nw*4TahG2MRWNJ-y9q;FDzT(7?B5r;r`d9%j6ZH1!AJ8F_1 zUwU%(e7bXSbQn~Wn!ePiJGJF%x_RmRPx0!FuQ#t%i%vHZeZ)nwG$*~c-q98!U$Wsn zVq@iu4e6tAz5FrT1rk9uzP~F#7{@)`s^}+hn*PvD2T%nl)SN3%Ao_&#I0%RVs!aaR z$w-+7n&Bv%#mXrftA%CV-rPMCZ5$dq@6t&@aE8~8Y3ZitiCbw%u zWTo6FY@E|wlDH*oHf%MR#2?3B;nQ?^Zy4&?PvWn31l)+V8BAEX7!_%?AM=1B7dHJ7 z?aS{e<@xXj1N@)IcDsS!K3hGsVTC&Dsd5*_epItd_%z>ypB&CDYThLpW|r@)YWD?k zUeAhhRv4oh-uv@SJJ0jImlf6)J-B~_puicJw_!nt{QE*Aed1-HCKy*>+k|@sg#u9+ zALW^xDDT&7W%$|3Io8m2DPdqAF0iEe=vq`X0wU~veX{=0H`I3?pJWw+4=ifd6k`pP zYPfKiNSiu@HN~vBCe#~jT`F;@?iArIm_f9I2S#q@1e5{;Xr2(p1V(xFvvu=N-VZEZ zof_26l5!7O(00A-Y7HM3$6akRQ5#9Unh}`kkujvB3jS$Q>UQN&;|peTQe^40S)(m} zK4MxCZ=arLn{4vN2`o2RUWl*97FqnjGGiSs5ltLuFJ1-tul^W!vTa9h5G1go_cQ^m9rO7SdRNNjX?w?YDvs&OK%v`N%XAYU#zMan@06=MWlIc zr0EBS4WD$=^192CTIlh;FAa&-_NDW%%kKD7lD|4(hdg#1%@ow`+t-JQ<#tx*CaXO^ z?|HC!=f!?xdbAcJ`*i#Ao}t!xx8wM4%Q4e8*JxqFlY$x5sy zy33qW1ukAbbZC{@yu}SIer&)^77YSzOa9jO)T@N)^Hu5Y9NVgpWSt9DPil+?NuLac z6vh{ypP+VBc3(u0ioETEs_NW_%}vgJ;w+axEXUiMPHgedd{L!fZ)zVmeIVW@QosS!5!rpC_FmVvTgIZtwc4(|21>q`*ZFiVR}!2FIDml}gt4p1 z_Vkn!#Ft^Gcc4zUR1WEow!#y&eOQvm8nLP9Mm2g)hzLH)B{}#>Q`mWqIIDF`Ep(>w zgqL+=l1gdE-u3Zbyn!4)4X7^d;O=`i0pVUXcHCW7j}+~mnp&oU6~`hUv}cmfUrtVR z7w?%dDLvg$dcC39$n14XXhQnk{AH&E;_f&jQomiIb{fiLm5-EiKFaCjbfpY-{wSF` zc!H`Crpq(!?Aq+1T^uFpF(f;3))mc`!8Y6gKEsw{0cdXd79(_^1zq zBj0uWUsZ)W-sCO2q?&Y<7rm&OcD^uU5)t8^?qy_g#vyLNvVETt)7wBFlp6$6)(bQZ z(jPHzL9f?p^Ug2NyVZBf(%Z+|jR+#o%Y`t%3rl6XDH*lZca$E`#S#zHDqw!`AMm#J zNu6hLc8&}VwZ2!FV=Ba5GA~0<L+P=HR-ya{`kHepF-5cwM>IbNS9${ z3nLXX#4S4Mqe$`)Xh{ueGjGJ!*tEy%{?Kf_!`YUUIrf-_lU{B>cEu=l%yACCYt_`k zMO__h1!Yy=!{N8SJQ|%pZF8)0PR{IJ5-091q1ZlOFl51rsZt!#eI-LC_yh(+Y z=yyBw4!<=5=Pul>?XG1!^ z0gkCCYlcIvbd6C%hyL=_FI2n4)P<7dN`)rs!NkF>2Y>2viT5AOZU(VS9=Cm4xQyGX zFP`Ud#r_WNp|$J=#GWjf^`K;AB1C2x=d|uD!wh}^m!f9Xx)V3@>@I6ZbZ1m zefQSP_Y#6fv{x1p4qv;F3a?w;ks#%!Kk<`BcV?f+&5Qmp*z!Eh162L6zEFI6Gdu?T z44kTRFbfJmJv61aiu`2Ii}q`n#POV%?ThREaksteL%B7G}VpP%QA@0nML z$x1wal@S2$4us!)AI(p$`V?7Obbh+(hPVh`s?%aqyT4<|&<#+cDDs^?JLLauX4dIW z7f6^BP0})+AjQr~+b8NT4=k+m&(+2xzEXb50AdXB_3RD{llrU=FBnwjz%t;TpWUgX zvW8d5mG!TNbr2kRP+n8O7<*hB0QHkrM7#pZWi^4gEqV?--|9tRtMY$m+uXk}x<&2S-Mox(_i!iBG)67-m^^$6iUX zVoze+2M)h;2nOefUg(0ON)_uqytikztpEG9_foB~lHBwQ@xpj(_url$57cdlLV7@V znV3hBrBn4XWZOYg)2bSZ)~-SRr7vtk5b^-TD^psv*rf(XPAqW!RRF^M;uRG$7sxebm&f){0;U zgLEp@nX()}aYBlvN5AZq@^^QLP!}Q|e%x9K?suf>(apuqqDozafaE+gmVNuyXU#3N zUo(8I+cvSxp6O3$Tc@6Ti=zs(1rC>cn}Q-#sSQ>x!;5}LxYyZLeXOynY66?c5Xi`= z8k%ZYarCrjB095T>VO6fo>&LaW$2!4Z|YSYP+FysoL8j~A7q_Ky?7p6XGjRH{d_z$ z%AbG}>*f4I>7EMa0fyIi6Dm8OC91^I`d%^$-1cEx7!M8&+M6bu zn0VkWb%yT#s)`k->rQLuYk#9u4R99$4YARmRp?1li{dB0p&zS`+K=b2bE@H%iQo-g zl5I^%u_tBJ^)Hn?bp133N?BtM?wl#K7lI#a8Bzy4Ej5!~46&&D`mp{9ZBiA5d3~$* zV3Q`I-npILbfo0sP2L&RLFy28JKyDsqr&)1LKD6%%A%0FD7u}dP33mrKc@w zihE5Ctg0u1KNX)E{aVyM{)eV~|4h%=@fQr~WMxp*{iMVgH;$KhpUh;7TR4(-Q*La- zkyXT4It^y`>|~$Y9cz#>?GY|HlljxE_+6}9&&>JBEFpNW9=zauQJ8G{mTt0GVbr0SH|#;8 z+D&=Lzc6fn!F1GFx!MKAVC^5K#zFRRAT!dJQ5bbgEY(YCzV%-91+|gZ`5X6a-WDIw zQkt-C@+%9ni{Ath?SaYTkC;Xt!Z6* z8fk?%zh{InT3vJG6mR%lz=i?}+Ryh_Xl5 zQcQ^aUK(DMFfdZ^yI-NoD2eyarUd;dQ{Gc^^>bzjzv6&|Vn4d;KWB$pT|l>l7*nDI zM9hEnrN|3q`uXau4f>z`G2l*KjF|{s9sbuKG&HE@Uk5=e{d=3p&(I+4e;bqttz`SJ zD@_7 zIo43Clyq2D<_?(aW~j?2Qu5hV6EF$guYPW9p@Z(0&bSXcu|_bN1r5Q`3+0F`c{8-9>N3}JfM5%d6S02{5ZQxa;2GZVJoLF6+WK6wSk>nz-N{@Ls-@FGX;D03?e#PI$d7#%6~aL4t2ImQ zOH{B%fw|8#`8o{d==D+?>eUw{tg&jaIpp%a`v@0w0CH{B8=o)?1#NY+qlb2C#}!iC0^)^@9s<|1@vtX?Pu( zZU>3CsL#Dg1eP!1d}Q{RFwru0Bvn)df@l<0i`ps#J9Oox2)+e$+@Xp{ul8$OxhFJ> zGZ%gLMSAQ3x?@H+SY`CzX7sAo&HOAKIQ+oaiM;LAaG`X>>?h=(u}SGW-efX2!HyK_ z7>_&v_#(%8$Y2~q@-7sY=NZ2=nBxg;H)~WL5&@lTP*dlVtnoRIh6nB%TvZbv4V-@6 zTtrL8QoV_0N>fIt>r*%f1K&C$1cSBp6@c_KarA?%?-WWH2J4FeSrGWscj^DbpILfX zlfFRTh60*P*ij;v5nSl}N;Xsav?svjC_+o+8GYG3*aSu|i^()ooXFXpoULfLT?>aLZC6{#9!3PXlFw$h-F;7z?l6}`}#nPG5#F3i<~qEdiCyi+G` zc3C7C?3l%|=Xe%EuriS<;}Il?2aEIpoaP-Zf|pRo>{v_>UHObGOt-IA8c-FG7*3=!QVv_{m2LzQVu|V?}{%DoZa*Dd_`s%M}_bu0%U5*0x0 z6N>x@c4OGI_ui2~n;g##uvgH%TcuSamI9tP9xCPN@@>KH`T4LAIdLoaRagC}g)j8Z zAp;C8Br<7Wz%x^5A>*}$z}^lUPzJA;h7a@AfV1{4rIW+!pqXz#Gq>IX zGt&*}VIWgDGA0`4XbFa&Q35Ys0~r|sI-`3EblWjLKrjQ*dmpBKh6>zUlY+(KU>FrkF%K9D5+4lvSbV5C;`cOb}- z*fobLgZXp+6C-PO0sc1*{Fui9_U))yV!)wZE&)nbH2d&KuIBWAK2lS7Zvq zj(D$W1Vq%WpHTZtM96r5DKVp@$W?_L`(#ZxW-_4!T6HUM{t9*k)=u@sLmA-T7?v{# za{7-4e@U`u1W65{GXKNY0we*jv={O_))2A=D3`!?4e0H^-MHp9!5jYvv*DL|K;ty5 z@i!|IZsi)FgTJ;|K;o)EJ{?@Oz$fS;;#%seKkYkJm#54lO8DX{Q3EVanosqe1`tkD z!yNq}g2TJP@mW?|%%3WJ9cl1C+gIAwVQSF1^aG$>gttR&H8bd9ENJ!XC2H zK@gEp{Qiepf2w7Fi*{(%up8 zBQlFW!H%?{ZZ#W#X<*`8XSI(29nLV?8ST;#)X%KW0(b^;uz+WN`}>)3K>yDIAnzLS zjs&(}p*tNRxCjJ=Lu*paKF#EWK*9)64GB{}nFinX7pj3Ig3;s7D7M0?g~ay>kte!V zB9A>1VR~;n|g-KUJqy}FY_F3VdGW;)=fe1oC zs{lu<`rGlRFGJEti?L*8qjhmmteu%(4aL8#@|SG|Gnh3pf!XLQzJZH?=mO{m)`_GF zLUBz=!H)1>Ci=e#5__8)La zh@=PDapOSnHwLW6kapHzTgKnd1b7f|bSf}Du!(C5J&fwJ<|Tp6*SP24n$ZE}w0Wa) z{^1z94RzTc+8q-&vSj>tirm)_WKOLF4P3;SH5vyQ^8T7Q|G6}9HVcj_2XoHKL92tf z0vLhw*1@(L1WqPEk?#hO1?%31RM|fp_FmEJATDdImhcJwWR&oX_g^ic1LNLF;pYwnV;F%zRCz1%q z=K(SOs_fDk1PDc@U@~y+6r2$p0pa#KfN=QIO~?|qz!HLG_6w0;Uv7r>naX3U@g*QL zXrcdBNw6BYb`0HNW7DehIT_75!#eW zDko|T1$5v9kl6{yK#av}G9dMXWaqG>7^_nkkjyq<69AzP@~|ucZvS^12?*zZ5ql2V zfGUB^cWzB9QV5B?W}!7Zc&OLCfRF=>E6!>Uo`HDcynwMFwSblWVm!!6z^(xa%QzKQ}`JzD~8j>ND{?x3XIcV(I$;kxPb5^J0GE#Lv98Qm*Nm2v2a| zJqH>X>2-pXZNCuQlq({Du@dkag9d{=Ttm`-n&H0}Tnqe-P|ypQ9>k(4WU7@E9GD8S zI7Bbf@IXtxEXcE0y#Su=1Ro@GTy^P6Ozs}>erM2OfGTxs7>$;N#9M&@=oYyrH5(4d z1lnEydL~#_5K9)T%L-Txv9_#$0^(O4otVl09sUyl)uB_3M8QZxVLO|Gix^$;7R=$7 z5pRLQ0;b!$icJC2=>Tj(7G7aGNSa_S1t}mlC^Dg6e}5y1x>D-KZ#l__vLZjIUVJ1K zXt%<@E9WaPa%E+27mg}4a{b!GAuC)XXSB2cp+arVN+7{mOJ;=sSBd@?Tl~3}FbilI zG8IJ2i!zHQ+=_;8eremVPfZ;s5?mc?3D$@l{R!pITo)z>qoqCSc&~ ze=#>bgwA0u{T|0(P!=%#5n$}nh=p2QG?y8{9|FQO_CpjjwXm5j4T}r{o5Kx|LmxlOd8@w+1#SwL@~>0>m~zWW4#G>b?8& z5>EE+^X=1zvkkMN5y?Z%}v%t26CEFQ?(pR z<1g|x+$&6Usma;m!bd~c(xqjh8%sD=fW6ArdnROi?JwrsPgICThXVDK@iIeOfI`XUY^D-oEL)C&UB$T$rZwAfm78R;X$inBKlDKC?jxW~eMZ zA`^|&0B1Y8WoFQ&z{nHnq4OWd@8WI@vx@1#Rz`@!iq|!T;Kz;UzBEi4^N5*KC=u8# z%eVDWq2M;Zi;;x|2s_HlOt2gOQ9z=0whI101 ziyOAVrrnxh4%W^*byOy52L}#MOBxT(8enx`*U?as>pl5fExe(U<`VqzYv_V<-Hf}m zu^pdLif7bp3FGquJcey2wWWiH2aSn=P)#=c&uheR_Do3~=K|4aI*isR!C4AcD2R5c zvrU4dit3oRo0sg?_3akMizkjuL!ZPiwhJ1DJ`2xd*V)-=;76vSjo~sky$v$sP7aP6)7SDd8|ZQ{UOaplt%&l1lf_8V|`a}zUp zd?I{`_g>Gpn2bNN=gOJBXX$s|8fSsavyW)TkH+7#M~BPyi-yVm+48!C)6@|R)slT* z=sur&|6&T$u}>K0%5L4rvzeaaWJXY|>M~iyR(8Gyr*MnsorAxq1#J|b{&A+Qq=R&; z9y#kKef^HbFCzxOK{pMkd5Ts{UAGLyq9iJu>M|TCxtxX4gf-s&%K1`P3g>R*DRNLg z6A|+!nXgDy55dJiyJ!MzaB7f@tdzNyPbKESxh}!f?UK=Us+Qi~s{m_Hd!U|I@d}|4T&y`@f|F{@ z{c)x^cP^#&t$I;hr0+*fFZ$2YJ+cGNMZ}0!bdXRVLW~(S;WrdA=`I~K{ADY5v#8&_ zC}d%=z*kfE^Eh_07xxH}rNo$%Xbo-Mp}~ezptA1o;xOuh^UppmVZZ+Hfw#DY3+nZw zleJ}`!uUN~W-LmbT)*B)U6S4m3yLJU;+L8_GHYfxHtGZ3@f;<|&}tnOr{E#3HlktX zvv-xXXBoYYrG|`9p(BJS|BM=kiUJ^$A$IV#$dQ-8n}yH?KnX4nwMEGGx9Z^Pzz%Ln(dNQkBL*;V4N6<5 z_^p=UOM{<+U5f&jp6K(T_4E(C_o5dy!6h2eqr{*$J?!01=dw-0_;9HiwLIQ8f-`eo zi~C>`%yH`L*jt=?PpU?+nWSrtrO{HhpYL%MyWa3WPs4@Xz|PJ2WysNog86iB1NcUR z(7P0(s)_nnkwmI09F--bli!rDLGo` zl8y&>?~KF#_{Mu?myHG^Ad4IRr*v;$w<&@cik8;wHJ3ZV<7Z?Mgw-})tK4rST4 zj(TJ_({ID`)BOvqi9AljHoqT*@p>DXy>>OBBn)$2!w`1;)%^N~2+wfG+(ftu8((4& z`U3S`Xq)RiX-UPd1^3;NOn(&4|2~uKkp}mbPLF5}(Ut&};Ps=VCED+bQ?+$g3n*~o zb1?L7Q@%8O#j9h3up2t*)WA<&e zDh+$rC*Q0vjC`~s{n?i+<`BQH^LVuq)`V$naU`)>Z{gdVPEbhk)@n2n13oFP=38nn zQPIxHGK{lMPHecr>$R7(HE+~?9|AAXP4Y5AAJ3dSu?ePg+s{{Pa@uYI^<(6Ih4AJ4 zna#`uSy2;Z;+Tss@R z?u9I=l08=n)l32j@*7O@x<8)GNRv56#Ta~h{)X+?o#?EBYPzf7z?BT{6?u0WeeMbP zfL!UHFB~V^vh~yaDTXkKLGX1b*mIM!lPPseCK8ROB!&-#`eL;A4{_>VN?xGCJ=}-= zdGEO?!M_bSZ#evJ;l6Tazk!`IqNb@8eUGVHder5?fPW17cs3LHDnP=%L@mHpjBR_o zQTOS&GQIl&#ZNB8oG(e+(CCKb=FtZC1>Rb?BY6{S*NdoMB5%v(+Hd~3+h1jLA~zbD z<6k`!alA0(WHu$Rg$(rS zjDND(w?y~Jq#psm?C=4s@mVs6*wQ5DzCdNkh~3*hKMOI1=W}h271NDwEpDLa{*KI9 z3@E8T0amH^*J~Kr<^TQhKzVM@ix_$8?6(2`+@4+FU%nYnP#DSqYwV0t{S{3ia^x3e zs&i=#>l1k+taqXW z$M5Wg<2j$$u~*T!d00{W7bLA1+!NCPdk}}iX9JQda>lE-E1y9(@w|54(Z5Cc-1Ge5 zqrr|-uLFsO)K-IU_bO>V>EZXhO_$`qKJHDc(4fww?v43D@#}ItLoO(cgCm%Tl1||% zKh7>>L@e@8r?fg$-#${Pd$<8$laS)BILzL> z?WfPyo1J`=UQ<3>wc%y|1m`l{D4?D2@KfdGByNjaG6v>`Mi;(|_@2mN3YUSr+lxM# zw?WKa=e55vc61*G7|5CtWlPxpL`N;V)jR1)1csw#y+ciJ|EV)9-Raf_hOLA_`|n;} zGbRh~%t(Wb<=AJSY+m=ZHxv?*gBaN=ihdHNt4Oa!W^$L$AX<}d7m)``9T0cJK?dyAt>K8jmp}xcM>}5quzepr#_6{`F%4pzNQ?N6xhU}_#4`tr={()Tyl=^f zQE!t#(3#w?lUrUSR|~$fp>}4Nn3*4SVq&2LAAk%0t;$=k`*6qWhn7x@zaN!S7{8-L z!Gyg(;gP}6bkCb&eg0;$yzJi*xBOhG!zjj$LQic7;E@iRs~40#a#fS|JM7Q-IMePy zeg+*_kmJczWpyz(|5NS~A)j{MtFc1Z51tLNU>L^WdFgER-(K(6R;zRvzgL;oRJxa* zG_cIcPsMYWRcYhgs!zvrydkVI-9_)ktME^b8+9k^3y~{2`*z^484i`VtuCjHC<~pv zlQp1e4z9O7WR?$A<$SanN!)t~8PzqlH_ZHQro+|qDbz#ww}0wo9uD~Sz5MHAv|+>O z-apf6SeNih4H@qp_A@amoVL+A$r-NY=MoPDW6542R1Dd#N^csSlj}0%${0`HU zx!Rc&b%Vm)^;JaT0f@SMhw7wX=r0^=XX-W5`zI=9HfO2PUbyteUy?Tj>Brk$`;Ai>R9m&iWlEftE!g-Zr#(QhPc4mA0uKR^VZp-Bd&T5#w zFSB^ODoX6QL*Sn79STw@nE@O95hTPbxj!6>ynb^4UrvP%o_o?0_1u2^e!SI`(FdI5 zfglR`M1fpTT2qHNw)DjeEmQiz)>$KO+p!lCE|{{tw_Q@cg@|O@Tv#kp?5^D6nJxqYt9F9Bul(Uhd4bPvi!3e+C(kn2XqY%XQBcY@4B6`HVS! zRPv>Se?|(#^^c!&72ZB=x;4%&k6-Ac*YN${JQ&dQMl+~ZmdAQw zyk0Kp?io@=BgP^QXzo&b$zXOVenOt|R#EzeSs~vxq3J~^wCQy>F_4jz%BD$fH{WQt zd9#G|4o~LSh*Xx|l|w^&GYRT3i4sQ3edirRu9XbnTh}>V90H%tT>M;GrDHUt8puX) zTh&~@Z1LpiMY#`z_24(D-NCK>4_ug<+Xx5U;q(3-<=> zD)~hnFQ~2N*J=Rwrlnlj@<5?8#bLf|?BP;s;LO+!wa~urn(BT@3`zB|vmOIw4-2y- zXn)Y+N)HXGO3j5wh}qdW2Z?tyY}=r>!O>KB{Ma_a;djYxNeuySN0$`~aEjx_^o)zV zmVW5VgRs}`W{;ObG|CYxUewy9c9dA(d5=z={hk)*L2}vsyg#BHk)Xqcz-P-F^1c z$3zU+0uvrfUW^HZce~lC7#%Uql|+R4K5nh@$OxdwU-``ekjb`+`mvNHF16U6+SwKq zK5zmzo^KCW5Chn_dkz(JbN5bzYso_Jc8ab#Gm;D5XfQeo;EAf5+3!CONtvPfcx$JJ_N(99@;8d#Y_y zapJGL5Vof<505)^HGKWkHU3lWD`GvGdBeh`=`KiHRE##%A(Dm2U+Q{wLrYsm8|_GC z%c`|Ad2k6bxZ%VHmE9z1Mna_T4FmaEO1(U0z1z>|Tn(iRse-RzzIqA2 zw7DL8cENP7UZ!VdCu;9P4D38W(9hPU*POO%Cm=y%Ft9E;Z;4Se^2Qhj*qSJhn;QfV7<1A zff{ZRR|Zxe_;Z{+2nzu@p21EL1mZLWKA>pf>l$ZPtly9yyF21Xl{C)##FepJ?h_a9 zL)UEB2>Tr2H&rvxQLN#9vD{Df8U=c?z?VVKT8(rRE-60jyxLkHqnOoq zv&c-$6~*cxaOGhhAPkZ)%b~nkBc;He8*xio<$-hQs`W&>b->xE314D4ZJA&sr5iM0 zA+B<0;@=ftmhX1VcxsH+L!{{BZryfYLGN(o+6VC(ma(1|gF}upQB{I;cvN#x(=viU z5p;-ojlD>Nyyn~1xUm|F{9jM$B={vzi#t>A>V*y`@-`JnTPwcj;9eCzA7!kIzF?uY zxc{!2>3V#bafPh8%Bh{>nMIMRdoe^8kHMwCKgjskM4Dokz1tI1(N|887QG|!id)Vq zpfl4Kk7(V5;U4r?z9Wox&^Hzx_Pmn4Eppvg9gDw$azOAy>HFSgty!!Ubj^riN1dp5 z51!XAxsU;0iYgGOhBF2)M=v~!dfMni!Xc9d|$IG=daLf=V9%{rY z>C#|u7T6C29Cayqe~*E>Q`9`JWg2nk4WuzZ6CujbhYmd+v>+x61x3Vj>|=* zg+Kh*R^)f1rh9APly_vQrEZye#2QhDUT2VNG`Iht6Ldga?m2bsCj?(rk`)UVjJ8Is z4qTJ9uT{&yWog7Z2FOlV5e(cvVRNGKvW;BP0=qZnkC?Z}Rn;y>`Z7W^lWN}}o~pC{ z$mPbiVxV`)$g9LJCvNnCvC?+bvaX&vxov>$84%5C41jJe9*AR-)Znu*LIitM!I{oOs<*$J!f)=sHZ@f-h~deR1H z?fkise)-UTJI{mjWj&2IrYeE@Km$vkPid`IQ(j4Z!35*QBB0qOdjTKzL_Gp;B#m3b z&=imB*Iw|d3nxm7JLn$O@(rk8wr>GqZfv8<#IyZt0*WZflsT}pEo154@`t48GQmOd zWX}9RBrR*uX$~t+=TF(Q5O&1Wi$*qWh;+R2($*r24v||YSVpp9SV>!K|VP9AxNpK}wc~MWI z;quR+=_1z#{ZkWeGwRyibiLYBmtrQHv&j~dSAG{2jg=VFZI+>$Xq-)Zs?LRV>Yu?z z)CS7&Qq95=vXn~A66m%;s2hy7!gS=mW0<#gcDFw?GI(Szmn>_rw$NOGa|-QOY`m%} zMfs`r&nB@DcCeIQS8)!I z$Y6q7=uP*H3XG*+FU1;6gZAh|gb~$?^X>`#cdXmw`E>PVXRoBTk`MlwwDNeQfiNp+ zej!Uph^}~BEx(Mw@e=JD(}j%n$XIbsj39M@+fm=cxr5D}Jm?2< z4l3W85~DNn_scNG1+sh%_i-G&PTiO~65ke<_;g=c`OgOJgvsXv(;0;(9(q(kB3I1C z2GX*{*)iQLVb2tlH@*=#fHccQ`(wnb&tfaN0{8oEqqt6t@X9dQ5S1c=f=4 z@j@E6j;LcpHn{Ul`4EvfWvERPs(Q9-IhyO5KJ)x!)k?l~ltbNXvzZ?=u{Kh|O!1TB z#Xax@s)@G?_m0NsP&l;%8R$)KRqGDZb<$TZrC69nk~glINp1bBaZ1 zaw6$yMQKnFtLI|IO?4pq%-Heuq#Vu2X}Z@4*b8mm6oxE_7G@w;E@rd5ViyCDb$X#Z zxVdp1@4Ke(JN5-!4a^uM^ef=*zR2+u-G6R~@FAljqoavFKjXqwRSf^24Rm!{MGWqT zirUEnYN2>6p!9#Q7C}y5eOTe4ACby>K0pi{3tzAjo?*+N%FaX@^pg)t z9m0+p^c6n*`|8xh&Nlhrmw~Fob+bXt#KxiO+UzaF(|oEc+H=o!V9I<-$y(1you&e)~<+RzK*q zpA12^&1S5LWJW$p_>s01(e~ojP13s>{}rem>!jRr=pp8LIngq+X&Ga=tDM`iPHFzx z+*w$|f78>k1rZ18x?Fk7eUU(xU0&VZ+6^W?ERf`Z4RjDx8ol36-3?4dHKqy8omb(X zFueAJLrieFi?@EHe=#EEqEsz6L)Ru$xH#i!`3XZRu#m|<-eNNL(N{~19@fBby z$-lV^zuq)-q=5ON7|hFJhoc75wObZ7-r`V*=9c53OQv)58bbH!>I4~-Zr{g(X!oDV zd5}a;*A~Q(g?IwUFVG`LgU_`fB7kf#WD-yD1AR$e;#IpxFIg6_RhONGY)~a0t9ly8 zBr5|F3x{$5Wn3-BJ;Mx2BgC>J{;AlIE#^Zt}8Yr*4fk z*QC795rUD?SF%F{`$zIn8|FHrh03qeY>`L*CnyQxThst)wf;U`x~8=sG+MY=`u7{Ej! zw4!j-#FEx`;0;k{Bkxzd32y%LXmg8JJsqccX%IG+njC*T2g7g=$9dFrb<>tY`h8wr zi1^udV;j|f)$nshKB)h66S8DtS=tHX(_sy+{-4z?sxHNX2g5gdEslDMi*c1}nAHf3FRn9uB4oM!iv^DiD80oN2gl4n((uL;L6ycN2 zx)ygvANgvvOF^UJm;K?+NiQNnuO>g#Y-my5&x4U?@c6Y&os;~QtDfMUJiEF24%!#B zUW#(d!>$GKh27C;zYAFcofz-*dt4Llg^+YOW1bOC4S~nz3adIT1+~t>2e22l>!-Gm zQFgsL6g508{C=AwY(QivIpSEu z-%$*^LF!Ntd^?bNF+ex{Qm(I2nQ?sl6#t(h!HHF(%Ib^uUx@tr z1djr-_rXH1yO(-4n$zAU&u2taKg=D~u!|NTlQ_ZQ?fSs0%5G$eRo5ACryze?qw~+T zbA;x^_y_!(gn&Exe;c2+&NUSxeHWttbON0RfT!C}O%9~$BxpYIH~pGO%HBe;K)Lo@}iV1Q06gzz}fO65Chy>+;e)-ipN!H9DSN3 z<*q2+*?W;NV!WpO=ECmRCcE-Y)%A?d&Tf5_5StpKWdmQL@#qoepJ}$kNiXvZE4-g$|!id1Ly! zuF7EN^E3|=;T5(2QXD{xYqHz%tLtHL>U+GrI>HCKIt1HQi+bu#!H)O&0%x-gdo-zi zijTWsuMuP=?gMR2-Y_dAwr>2%-7o*o5FBf;wIC?5e%r;25>Yw80QXFN`kR%LMg>64 zjoZCrf2UfGe2KcNNfJ=&=it-3VP-WQ|J{)4Vm?u0c}iNdhHX}MX2|Sgq7*cu;$_w! zZOmJ8E8R49rBP=tM*|&yAJf~^9jF|-k)ezE{l|gWUP-D@Ji?65gG#fM7Z-AaXldrU zpo1K(G3Zj0{PcfD7~qVTew=sO#4zfuY&FnaZnK*A$E0u?dXbJ7(YYjWBu;cDlC zNeMt2qBuA6c$J3V!+xAA{G>QMRyYTSYZOq7J=r`T)slWj>Ad3iH^xuUUo!;HN>N?9 zSo_syYu1)QyM@OK_OE4h0rI5cl%GyfkGa7OY`(5L!igB)=rqQ7M=s^LE88D zns9G7P!Vq4v+loJ>${Q^|Yb_gbhey~|#|`^} zEMyK_S+IWSoGTfZqny>e5V4l3@i-;I+zsKqNy-%Sh6^{F5vgI z>;WsEMCRw0pqtQ1B*L>&<)b&7%TmH}ExHL!sBtwo9lsL!%>H3s!l@ZkG!QVGpU`E& zN&>ORVD`ofo-Qrvo-Uo~EXI`KXVTSM$D)N6O6=gM_87$nCn=R-JnAs=@( zGhYE|Nly58l!cv}wq!XPIZ6jU>pF+e|2OID?XATHkF>^yJ{}Lolet$^Y5k9Xd`z;Z zPoa*!w(jMtD~|j>vnAieFCnb92du9F{=bdCh-1#T)twO=TEDDak#D;Y)t86vT$|m0 zCZxVo>vFX;4!W8TCC$Yd&`Pc&%8aOIeQpbv7_A9T+@uIYIS#{&GvgcLjx2L1mUQi` z*ehWjr>*%bhvjn;ncq7GkstnXIPchTK8VEq3^GtA2$9ZHR_S8RdC%v{_wt&3XE3fulpn(EX+hMgJ>*B#~Ojx@Ee~;U>qc{8BaQ@9sL2#dR2ho4!M-p)m zmX#VNqvZcN7KRfNO;$D~FRX>ALHE7V@gs*^iy7{!>zp+^qvR~gGF5*HJV!8QgS=C5 z4u{L#wk$5BH8KUZM-1Js`@{%8tb2$uFB}3pwpymVtGb=AEh`|YAd32~Z-9SbAPcmy znHYy$DpwW2VBU|c?#I30pS(R6q5KW*Ph=3T6U`q<&DevH)h@@ zD8Ru&wv!W&Ot!Ela z$9v4F773*#7^T2_Z(vUYt1(DTr`F3vZx>T7C%e#viSdTUL-%fp$cgdDNE-#pRWQt$ zapCS-6eBw={nB>mwTL6s#2+s-Ip*Qhm^q&}To0Cdtt8WxLABWG9j2buug+80``RZz?}Jbup&M4 zs6QN~h<;t*t!j`kakE5nO(sAH)xzGU^OJ#O0iU5WY-+ptGrn5sLHkp zyaS~lU~e-2F$F0+bM>tMH4nSNfnze^i)Z4FzN7##>+aO=?>=Ftwl3-w6Nf*GSM%B7 zW@W2g+$?k5qM@lci6w*v(LB8S%aQ9@hXcS??9bvrO~6-i5D>FC5)E$~>?5=#2;Got zZDlrVDDcY-YqhJEf^yi*cGvus9m&4$pOV!aDf?5R9xnZHZAioZmW_vka(}B%f_HYz z+`OS(XCcQ6^JHajlKD;KYw#e-!i|?QLZ(JNHLSj)snwFLUUp=#B*(NWbi~x#DK=-> zo2yXr(|t)!!@4P8=4)`|7Vbs#TVGAPP|8rc6&q4*$4TG$yuz2mm#TZ`=AIf_BXpkK z{>WZo{*5Pk5u_Aq!>2L3Pw1TkUD!-o2#R2W_NVmVwZv9rWt^HSYZs>T@JMYXg6Uuw`{V<#6 zx@aCKv#sv0P86-miz~U-yxCapuqMv*kww<959Sk0&;2~U)Uz}FdkW!RQGp8qb8yrv zD{C{)dgZ2p*-d4)3+BwPMsIkf%=rd4?@O^y9ZJ-9-eE1pA(~Yg>;e?2Z$y_A!feMa&wHKK*xn(gW0Qy;;+9FybRoeu+x+HRB`Azukfnfuy zq-7JV@{B?bT)J7^&LabnEGf3;V;4S)m%TLSL;`U=rtv3|!qmK%2B5S~EMRu16rUPy zOebMleS_kc0n@CaM+!k07kU1!D2_Z#S|i~M^Va^!p7n5m+}wUg-nnqCMFqWf7wh32 z(KGV-;P3bw*sslHtUh(SEN;F?jvX4_M?&>!Kl9vKo7il2w4(4fp*XA-Um+k$N+6V& zDHeIJ`8AEp!^E0(hN+c|`x)87`Q}1g+xz)>{1<7HCFz}suG#eS)*ZntJ!hNcii3?R znSzH{*h5m!nci1iTe6bm2$?WjW-W48@dhPu{Ej@_lD)#Zm?>kS`aS)4LD-G!3%I#? z$&NN`&Fw5iVH?jb;6~i#*pHM~L6Pf{jVOmf3MTn-8dc_>O9{C9dZ2EB6u{dtH*OMVBOGQLjs-J}B`|shhM-FB%4^CKTSh zf}Q_Vjee8<{c&Q9pLQq?Vd85xd5|C`lKp-+K+#VQY&liq0xGKa z$CmssiP6wnz zRXgJJjM`9=x+w5B%Cw7O&-%0g+B$3G?BK-|PQO4p|IGe=@~bKA!0sb~UR z@Hi?JM-NZ`>ITO((FxcnT({Oo)rU4tK6lOz0_i?W2dh{!0%P#zHs;MgXlgyU@9 zR0;Ul0N`(cJ?)G~pVopVV?X+%qZdTSHoovD!8NCHGa+Tf-v+hOKIIoG z1_lt>k<8wUbvAdW;fI~3&i?tA{4&OKM8dOuYLqDW#}D4+t-MZ7HIGL$`9%NpXTxrk z69hk4bvY?>_cP{3zIpl!gTY@7s|%DzMD1QR_va}|mcx?dIcO%2=yni*`r?yu{>qE& zAL_)Njx}p!^ArajL>?bbnBbPIE=!*&gmYR~C4Ps{NkigREeASgYraRQ&YJEjr)@b8A$~c8Yb%Y92Fw;e;U{s9 zgj}`xy(KdqMVH742D4)3UW*1~0gr0>q7*^gd9KEsUE9l!)rGjHJUvhfOX=Xd1tJW$AmUrDoi@sJ+FC=n7o5_$Q=AtMd@<>5fuZZvS}yR2@53 zJ#PP&WxeKGLPnc@iB#}DYH7XT@(vh20nj5m$NF%PG{nSKf9Cv%Z!voy7&Nybt~3Dr&HiHVsAqaA zWb*Wjq!Iw#XX`kWxuJ^aUc&ANP8i__HJRewkV+|KT{*rYT4L*AMfF~2c_PQ>xJi;_ z?4Y8VIzU3>Q3-D5Cst=3iU{HhX~$1afn?7G;$#A(J&PJH(@^=|9jh=*ER?`&GBiX6FC|dt+kI%UrAlx!JHH z3(Q4udKbYY^n)bWcA8=&Ao9Q5_9nBN;D6=##EUf4#Mh$Jkf9xz_rb7?g0ze1`kAkR z7a@xHi%#OJT!g)5(If9hPdCb)_ekCcK#Ol2l99%(-^h3Mk{q@-2G)ox>soefT`n&G zr{h&L3R^`dH<+C`hNI0%$YG#LsfIqk_iPW<>-;es!uulp*nmh!VJ-QpFmW@)>r`jm zC?MkFkuBFxcOpQ9Wn>{LcAyrHjfHj;GcuYD&2bQ~eYOvLC<-e>!P=`K%l-?bJ3KEP;RG-`613^8B0T zxe8NXVz|xSs@Qjsop)A?12}eVuq#6dKD(mbb)1%&P-`zD&8tV zDm|rfM;Zi|MrbGuCzTE3x}|YPr9YGm&V%d$Ca{#%KXqh}+(=c2WzSk(_d@z;RKyg@OpXrDava1?yzio|;m2Fe z&zZe@uS1sl3kccB;r33M7##$Adu519ZysoyL|uu0CV;) ALI3~& literal 0 HcmV?d00001 diff --git a/docs/kms/umn/en-us_image_0205545064.png b/docs/kms/umn/en-us_image_0205545064.png deleted file mode 100644 index af7d8b32165dabe042469dc302d75962ac062203..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 21095 zcmd?Q1y>zS&@PGwg1ZL`65N8jySrPE;O-JO?g4^31b255+}#~E65Kt=9rAwX+;!Le z181!>3!2SL@1E(J>aM4%o(fk|kVHlxK!AXNK$eygQ-Oeh)&f3{!9xKpZKp&$@CVXa zMN$N!a-8S@_y@*9SY8+cq9zvc$ru*+|Gk5hwlf3-O3&Lb2Y9^7b)HD9{fT^x<=UommuBFd-y)tVs)2H#F0CFEA4eR(?-GNhyh&-$<9mrwLC_;06-S+Q_H|9ux90a5thsT8E( zVAB7F3;926xRg!L>;0(_reE#Jz!c@$9}ml{zOyk?t^coVYRq7l%Nfr5>^dI0IC zRCfWb2n=G^b;z3>jRS!;2p$J?AWtOX;OY6W)f2i7GT?ZZXkWwdi} zQli9YF&Z}CQ?w}#4gRFOte0oFf4ld8cU@%zSp^J9RYTve!bwO-%r7j=K_z&WS5~^Y zyO+WKzk>mD>4m(7%)#L^CQI3}v9YPPPBB&?1Rfl@EhLr8Xn}bf)5g~gnN7~B2blU6 zzAzOE(gZVbtzrpz!J%utN&9%IN@Kml9~I{gXOPlJ3xDKCfti#le-{kChOYq^-R$|G zlUduXUsyhJXD3HOec%$t!3@+ z*De~EjxV^S^R?yLl5ElS7;{oIaaM9{!>k$%b%P$SeiqoQnzmwe%59oRV4?2+>Ed<75q=`Ig!`K@yYYV0=1hek7 z*PCzUl*74^N}zFSS<7(azUq&dmt3xU{YJwBbxWnOPqJ3Jw3||w!2@EnW`re>b!|`J?scW5RR4RK102$?M?U#B4aOx~9R5V~g(>AEjN8CGR4GA4@-DFGinz6`M;g z3VT|we_o}V^zNUx-lM${!{>A!r5K}M*6KGy#L`$HZwV@uey&R-%_D%eoMKooH&+`J z`R*79tm%aB_`xmo#w$Sp?M9Z?eyjmO|37oN>hD6I8hOf$!{6D^^8CMES zW5~=GYLVO4sG}zqYsP^96$xqyX)tgiZ<2g^;V;!)VPu}wz@aHs&%2BhdA%;wb{ye} zk4&LLeP1ENV7EBLiq((^@uRRR|2LM4Mz6?RNmc)E`cIg){8X6a-WDQKm-;<%@v6J;jL_qn3Z?57=!CZxKuL#~sGdwM zn1EG=g*fILB}PUEP00qE-!?GmA80OwLGav-n+Zr!{_~ci=!&mMNab;Zv}Tbb#^X{y zqM0KHyEdw)t;x#G7(SK~KgE{A?!Sw9C$_W?+tA$DIt%?5LJ2Xemj>J z=<@f`N&o(**mky@^3uCm1ZlMfUMe+rWWocD_(YR4bRDMyIA7gK5NnNz7p3{Cd12M; z7+2}LF$1bJrL@M1MoT%0l_=|$@meq8zol_!HgE|n|MU_}&<|k}&4)6(h>;8^ruou9 zu~Y_v)o+~`gZ?7c1R4UVBC9#Uz1(XGnzh-8o{Q0FRn`3Nyy=vZ zhRYl;l&)YZFb5^n6fMJn$7N!4SO&?vK;J8^Bj%ZF8FI&&C`Jfos~_5@{Z4)F<{MyJ z3t%Y^PwEIvsg`BGJ{wakJDnJcO*o}#J5p`GSs#i$b95wv7~@$Y)zMd%Pb-!F@4_|G zX0-bC-_gl*^R#ZkB zxn(>EW<3uGt%%e@*a{|sbrPYZt!&LZ9vhSPX_VFX-^Vq-$Tzgg=jq74*3-Rw&bUdZ zGH;cQ4Jc+pf39$oBIvNj`|xM_;$@PTA9iU-(_$LpZC^48%3(SFx=kFzc=-EEbm-gb zBcc5|#Cu&ps(!Zed|hCAPC)s)q5j_v_P*JA zQK~7v9IGRHH@+eIb8$v}{H<4s6h4Ex_{GGq%8ichV#Jb4hPMtyLaAD6nm&af6d?aH zajfuK=%fJQ-eH-d)+mZ}voFZ+?4lR(zur_DyR5mjhI%biY}(1wt~@QvJ^ot&Vb)qA zp?H|qcr_>@Z!d^9L{Y7T-o;c`*t)`8dYFAXCO<3KF5jVoT1DfplN$^AkfXH$1xlTi zEsdm!eh)@P{fI?0KDz&w=XKS)0|6=4Mmw$kuez zdj-mY#1_#NgTnx=te{sPH6Q$*jF+f14jEE=>r6uhGb4&n_~QPb2du!20`|)jaC|)TQ9PY zGSi^`2VpSb7U90>oCgIPh4j4j_I&GoOkfWFrr#5#Sbehu^esVt>uUj%%Eipr16*qi z(eFV@xcvVcc;H&fkI*-$RB23w0^H^vMmPJd@A6w;4~g&L(EnFF0t(HDwTY=}xxLbt zx%=SC^2kKwh;lN=54s9A1m@}Y17A3R*EcvkoR*rZj9Bvi{{z56VN3Q;C&C{8lAl!$ zT47T2^zQP4T|&9mscP+2J@VxP!E!}hzM@!n5owUhoS%qCBQ9WBI=;;IOf&Zw zk?nV_cX;2OtRzoA_ppKFi14zE0VJi{Q@N#7UCS6^F1`|WZ{2Y}fpHPD(6CBgaf0- zl3*zkVPt#D`ZNiB*}$miF>zF{h?F+fg7<fVG< zsUB{%HHB_dxL#gE+%q1=7=w@8gFgW;fd9J)8a+L|kbMnjzW%m3M+O9^ zk+QBZK|@AyI^>?ddS6Z6WRfFEkhy8>86SeA`$K;qV(w zSlS`;14En%N!4iAzcD}%+iPW2ojSU@Wl5?*)$fJ5Lqi?Q?UbH6lzr$Fea>N!*#Wu5 z;#1dip^JatM(r~L3nzxbk9(UvJ(z-n=`XVAFGgs2tUqKG(1=o@Rii>QYz|ez3zwsp z+Ie|-Sy@?`nVC5`Ir;byWn*Guii(Q%^zL`ZaF6gWuyx$C(1;(Z85sy?Eh-%7VH^IrGqe`YE^SMX{%;CY#~{0u-PX4Q3Lgt*x!Du5QJR z4WDT3;T6u;?r;6`NHI%*K8yd5$QBH*LL-9pa>ad7p_gVzl%`&03Z|;BG#(T<&Q|hZ zU|_(;#x5u*xTmL~p`oSiws3TG6c!dXFd!zs9~~N^p{Ey<@$>WZ^z@AGiYDZ2ZEI5= z0)xrLqDqs)ao-#k>hLMgi)62DfmqQ-Vdk$}ybmt?;C$FQVk%o;DFgsMltLy?Fm#j- zJU>|~dWJ4GKPDKpVdqZ+)e{t|B0r-!Y66Qs@wSl)4ZU3KEh~zwndr)fOin z=VUNfX5gpegM;@zniHQF*)u3|pzic*qTSmt3|gh^z{UbA3QU0RZqmX)#!!9_v?5y# z5{92gnHDV<@QKJ$+r(4Hz!GrIVkGxz7E+Wo`=2F3p##sz$T&VR;qKz{nS*0*Z*SPM zQ%J~GDJU^9(fw>)Uq=VL)OByP;J^wWj__j((_-H#XATP_uB^X7((DK0A>u{MCtJKl#!N}mY!bCgrRG5 zwz8sv;i<^YI8eVQJXp;r+F1`#)Z?+*(yF4TsZi^|y8shNbjR;Ha#$`}#GUU4RAy_})r7Y{tHn7nRK+J-{sQi)O$B1$q^!3F;N-=mdGub^mjF0sU`-sN5s{aNr?AM=-7!?ZCm_Ii=J{qkm$sq1Xd*n}#3Vj@A<+tk946O~lxsSc zD~MFcKIl(k?>$bq8!~EP8ZcpNZWkJqZ5a%`9-3SzO5nKvaN*lqX>?R)&4ovM7LJD;wx1lxpwC zWB4;}g^9L33;8yYm@To^5LGEy89>9&V;+khWue?P9$l9a(?p5F4<6r#Yar~RRxEbnLh!OxV%&k!h+YjSgdsIcCP>hzLgRpP~)kG-Z zDADexKY9*bo%bKWbA<2up&Aemtn%lGVshEZ2M^Ni|VB#ENcxl{ZGs^G{O1>kGOzuOgEfjg#AuDWdEw6 zMnw6Mt~GD*?-|ZsPN&|#ij&8t&l(m*)&BKDsI|g`o$(Bns~-;z#wN=>u0pt0WlnPw zKFH*HL11e+EBag_&H3ku|G1eF1CfXmnrp#R1?c-wI)Z{WFL^qQFH_apa(4S>z*o5Y z2uXr-Q-LTiQ=eYuNpJOYi@;2mbA|-}aQBxsk@NWq-L}8)xU&Z(3|gEDa&vQAT3UK? zDk>_fs_d<-WPI`am2Tgr`|H;sQE4|3J@z6W14}Y9@{^-Q` z7KWzrNc4FlQ+Gb`kO)wAW-_Ib+-J%oQPaaD^wWN3sejUcct2HFUtixWHG`+6r>iT90KQ*ceNk5$qKUWs zr|@#X|Km;ztMOjS1IGx2%rov$x8S z2Q^0CSc*p7!@BobOspK=?S-xKvV__bJ>(F$dgBYcCRyUk7&8otFn>KBrVGbp`N&l# zceQ`{^OJh_YgyiuP}TuMMfi=plgy@MwD5g{`NfqC&xudVcLgd(rau>8HE$XaKl@n~ z2e(pIYDm-}5nJ?|_Q~>n4;xXnH6Ho9B2lMucs8W~z|?MUZ+~}(*gzRZeMF^}vU~+V z4*>xIsqga2%EdMmKR-VzF`tlobWDs0SNGzCY=knKpXFp40OFaw^}LttLQBmA+^r}Btq~AQ^7FkoJQLjFSIIxUB-WX?@Mrvt zPWCeiP5Inz`aak7GcPUqV95eTf&Bv4w3WYJF*C$ll9Vn+zlFQII=)_<@LjC36m=lc zRKRM(Q(?Ne#v4j!z>|e-V2!5{{Q@z=A!#cGSQEN17#YWMEy`%7KUD`2(>=$jx}Zne zMLFKo1cHY|uPK6xP*hL@V@*?rL#I|`z%qEU!fpN=d%gZV)8*q-jBV%m-Z1M zZQ8MBv%B=(FL!1dfy;b!=_L1?zpALcqNCO!IGFTYrq6B_J|=)nA;9gS5(ylsmJw zhTKIl5aD1_BJ_ayiGd;ba)ez8=S7GnjCMA^vz>6C(=0O~5L?*M%Tl;lMeUO}YIJ}b z5dndUr(G1F%x2vf48ps>rbn!U#zS0tb2wL4%W_%aHCZdL`=L<)kmjGMJRZkud;zzR zRUGan@iB;&cg*BMlP-$iSHRu!7s0aOUKH#KDiiJ{ZH|T|d39exyA+^4QwC{CGr0~<&s~>p3 z)0ckghg2+dy@PoBAQj|K=kzPf-W>3WVi0xEI+ID9ce-+(hw6U%eh^3di4(OQ;n=4c`%RYJPoPfcwA?!{P7kNnRegnbo)PuA$tc=fSJ1tK!n; zX022Lk-C~1micCWc6L~A{r03EKQ;+l4sXWB{v#HaXbB@PxayF4WHJxUF_HHK`DB9vX2-SDS+XO zcQ;*J+!+45PZi4mchs@hmg_~;YhT6XoZrLgEdET2+_q_t?2>lM><~na66XfvOqW-y z=reTZnqk=a!;5Ljl&qP~=vwYgg18{tkJo4r16gMuc2srHJO_@je#(;NDj?ze=}6Ez z__8r$hn-&=Uj#>9Uqis*(Y>IFlKk?BsKj+yO>A#fNQlf9`14uf+x*kBx@%7a?7Ii= zna|x^QD%$o!BntB*9sA5*jyhryuRTCskrbL8j(26Ay3_-zc~!w1&p&$f=)|HOA%yX zWk_%A)>>ili@dsi{`&Q+wN(fIt6qnftC7*~snkV;@7hz0u7mT9jg6MMEzQjycc*Ln zG^1&0X<1oW`_hs&1he^3dFT1COYB5~_i=xHTFxyt$VY}gsYt|J)q}odC?P?84 zUN`{NxsxEQL(Mt{6_Zl$d8y8G)q zmAF|Cz0Be1Fl#L^&r17Dpaco5RO)gFR3~k18N;XLsO12z*cVGnsbA2hE-thAbZP17 zMMXtq6+c-*;P-7b=iqZ-fk;EqUmxZ3u0XiU;Xcd5!$SwqAGEalPFmh~x>mw(-u%GO zi6kT2(-h=K6bZRk&8(qpwsETM6x^rohs2O1x2Jo@_^m6w?~V=~_O!27e=d^xu%0MuQ?7ls$kIOGb6(Slq)8d;*Sw2PTZWHxfm{5-k*jwTkajzZW^L&5!y7vYpo z$m4^3zVmk0`^>F;FDN@KoX z9Q1x#$0nHXtHSN~!n)gLP1Dn7^#!ZcP}iqzZMME~SsPe?!_GXSD5~!H%`U`(s=!-? zOEKW!P-z@SwpMo#t>y;=J2a~dY^|-^yzfo{(+2Q&L+Cg{`ikQ5X*e zg{>f0yrgqbua3{s>~@mI_hM&fH$FZ-KR;iJ#0j`cQ|4u_Eb#*>0r7=}RI^{#Bv)5f z5KCIklJi#b|FAPGvJ+7+!b7v|K)XJX=J((-MJ(CMup;66s_r1Us_kMM4Z7y|?z} zZ@%c`-i+y1m6cx<$}~7{J&q=EBrls!;#m&-Wy>q<`>MJz>2feU7Mrc*bWPa(3zwT3 zwgy#-yOvTHp{t>R9Uj&`z=X`c?%RE!2Z&XaaOWD2T#0#RX68F91X8!FxaHL zrRf9I`?l)p>iT+@qj`qJop5%NGYf)-;$rwmjQ;ze{Z*AY?K*cZwYk~ZVl~BTWgQ(I z6Mk(Vob3q3?RSUH-}w8&+9k;SLs7zV>dC~I@bm{ebdqa#NOHAJ_bYW_Dzx)-drLcg zExpSJh@v%0X_0F0*Q}-!1|`IANw)6;HuWMu&@HUka7wMxg$KGKXRjR^Faj1!;!9s= z+kDq0&zk+;6*`xP%zWb4tpw`5(j#5_wS!w4Lsm4R>Kd~PZC=avHG}kzJ}-FuJj&EU zfMEbleC4oAtE^=7#K5pV7xS{Wx0jWTq{YNlDhQ^!xj}w@zN4ZpN=w&8KtT8rye2^{ zkiNXUJU-5tN_SCQR9xI#cC^=Ez2IAkIE+_XSy_qVm`D&@+6R$tV`P+5Qi5Nmvhgsh|ED96gR3X#-J-IXrS+8%rF=MF;&(06MkY)Xfp)-q+S7cn=vGA=Vzx^&4OKQ={Nq zc+skz@EmkVX0~Q2`HQyJg;#Nc`~6hGR7jx)H&ge$v77i)tI3w{0C`;?lYS0vukLqK zF8Bpz7it(YY3Xnxa=uSYOeBPax}Ob}w~*^McXoD?1T-=uB8DFyA6MK@a~kkYLqbE9 ziClog%?(@+mmSsv(SkA3FU(~-Nd}Fh_WU1*GbMH3cksJREu zETOdLDv9q`mY1oE%)6^#6BuFgn`8jSgtQuKk~&hO_w7nQp3G7kuEob;F{Y#P0j)$6 z`+y{CYmjaU|KB@a)da|XlQ520YQH|=Zz5Lu*VF zczv$#Mf6Rr$*ELl(!2hO{wcFN)J%9SP0JD>>-xtGSQkNS-Da)Vc}6G z(=YZ*e-s-TP8KyTtage|3+GQyd@d|{95VD)4z=}|^s(+NntU~EAuk;NqI-sZnB(boACF#Z z-+l;zX7_4FB5&L-9KGW58xfXG!&hdANpWjWq=}PR)A%x*Q~R;RATdR3sTq*Ym5Gzn zW!GZ z>L~pT;yw}k(N+y~y5I!yD!6_E&jgCgPgPtak9grI4zEF6g0%@--09>3K1N25#kvkX zbAM(ucqq6bIPvDYcWA;VnB5Sug@g1A9QH3L<>=uxB-;G;E1eQ?pU8^mPN`t>t$#mW zi=_+4!&jhXaO(A}FTne4As0@LprC6E@&3pEwV)gv9cxNU zWnxfkEUm30C+cEvL_p2!yAIscMXjxSx0%JsOR^cyHa71h&nQ56D+{owvag9SaE+!% zH@Dqj3>&+|FF=HltLxx$Fyq8GF6J%V_2~L1VZUi)6G{FipH^~LC^om*;!YW$)E2_IU*kVswDc8n_?UC9 zae&l5`C+bN1EK`Vla2Fr*JoB#V~)ys$!YIhqpg2KYzvakmx9r#VjRiQ(owl^wZlg8 z{C9~Tq;E=lgHu{`_}{sS(vvN8IQSk#$C6}wKat8K_&w_F&@6>ma6v4bUtibXvB?03 z!ye`x>}Md|R7xH_k}M6+!NJkjzB)gT&(g;30i~^uu~Npy&abMZ$HDBeQB(2H{-Eyn z?~zsEX7amzH=v`>79ijZoH0~|z8Mi=J~4tgCX z3TCAOE#EIYT3EplyP-+Er*+Z zfHc*-HigZFV*0bQesZwJY&f+=F^xa920|uN9@?Xdaw!Oj`+>jE3B>$%uoIDEW4QgC zjtOG2)4aj36P)X(V@p%v?9DE!?bNsFIm{todIxV2CC1cWFvoqg1mQ~zHl(7QwO|Qj zUvkO$oPy@^FdG-|kEe1jqp0{|D>*!8AY$`Fy5_p(W-cz)&T4=L0Nrs1ufx%XwxXWr zPJ`s)jcLKJp`B`}W=${%EAr4cs;5gCLvUPHtxc8m!^3BEV)#ISW5CEH7*{cz_%8YQ zubHo?UiaS z1p#yTuGq{%+#0EW`N{Amw2Z8*TaO|sAj2mqDS3_P@C=RaxjT%lt{=22o9s*+GeA7A zX3^|kd|WMMfFMUG`ETEhl-^BzgzL$V*~SOr0$)s3^+;HV5AfORwYRbrA`gr2(*DAg zad}1avBy|d7>&Z)wg26pewLmf$#tH{F>`L}LZM)B{|NQ2(i>x%fsMcNRwUm*JM}rG z!iK_}X87|$USDS7@xrKFp2kiVurUQrO-=FgKl6RWqu#eZdy!`v9v<#~6*^clyBOnR zS~&OKKy!C%q+=+L5M}V&U|05RgO&!Q36-m620MNvaQ;GDDUx{ZUg-SG5-G$aV`+2R!MWdzjr5k| zxv1`xUQqQnD&zEj%2&Sb^Y)5<{PpAHM(ArAI$!leZ@^8d--bQwE%dE&tp4YO{gb1! z79bcN*$av6GH(1iQ+Oeh-&=zLMjkLTb#y?=Y&=d3m4utJ^mOVYBG}wa|0(@!K*khp zq;q<=J!{%8#LTSQmHN~C1qB#zi5yM#1IC+J zP)g)H-#)_5Sz_`W32u`hD<$Q;*_umG&>!$3Q~P22D}lI&dgjn>Mh2h?O&Flsz)58< z#i_iIh6}X!f9q@hXETg^Cs_X&(x3Ix#ZEL;zrpnuDjNQ_zz)*zXrLix;Hsk^cb!^l z$>)&tIA+HH`IoGu!s!IwDn4^2F6r4@`=2|Q`*~&(Qx;EmOTh;lNyGuNovcJuf*-F4 zBT4djz|Z2Rjj{8#`rZGGe?jSg#+p=A`}*nBdA)z1PwucM-nD%ulm@Sv`02Y{>Vc!0 zh~t|wU84@dXsgdge45dV#BtXE@AZal>P*7m>*T$_QtB8-N9rF@!0fVvfP^g(<$sv~ zS+f0$(^?P+^zz~t3tktBy}rF|ec!d(4W8z8Kc#K6ydKYK?sU|DB%$&-;SDm<_ccBH z9e9J>I??sd2Hy(-c~56cXXGk&dtF2nImD-*A8xn;9VgaI;W)Ac+n4_`zgWBCYd*rA z8d{(EaJ3DKd=G~m|A|T>0L0zPk}yR9ur)+^F*jm>N-lJ7mbkytmA-y?7V#&R=g0+l zGJg`plufb@mM+!>1saZ;8a`gNr8Q8K!5DrdyPx+gI;dYk@zN?Zk*;mV0ldm2~0}PU5NB17%aD2}t)OO5wm@bUYw^hn?7e-~f z!Or-OW@Fht!`p0j~*_LAnf2F^0ZD5c73CEeuSM66) zIO3@>b_|h0JjdCv?#(4AFc2GSyc&Sub2Fz2L~&=Gy5Zd<&f&y$e|0_Wv-99a2d+zd z88w{oic7)!J>A>r&)lSNhT6e?xHlnrn9dp+8v2F1;eGj=zzgH~VW=+7LMZ;t6FCor zL(Mxooa<5~wIk!=;4p8$=niQ&MVp{9yR-akLvp!7`NO%zpQI2s!ErDXf0b7f`(Ls@r5kK z2L}h|_GD#YX{jU$Q~LV?JY!^b5_c&20$M1J-U?RYGnijjf6@fj^my3^y!qG_f11?^ zsgAf!Nc5|Uqu%efm*R2KqXoVtq+(#ehy=o_3lo(rEWjQhDJ;7lZ2}{g{&v&S(>p#q zR8hB-BJnS)ld!$#nnVWQ?w)ea3%-4CXCBc9IXS)9rX2Lq}|E`>uHBCfPLl-(8^sITi>4x@pp@>yVCDcM z6m6f8t4d>jqLo4%qLe&*8cE9auI6FS?cg3+^_vAM>Lz~{*LQ(|?z#(WhP&5-u0{a( zJ5mbRSM*w_=Ei^l6C{aD{&oEw&sD#9e(o?k)*VC%Q#Cse2R>k>8ogfXl7r!uGgVb} zGwxe^fh#*EKtafOdE{%F?-3*rmyS)*``I+XP&xH6AN^(hlb?zNs-6b`Byg{dnl(AH zxT2yVM@Rk;A2S`d`4p&zbhnO|F=V=*A-l)Wli2CJD4bqq%Z66y@soaN zVWpVaTM$PDKD28Hq==;l;BIL7-EK~|#WFs3dL4A_TrM6Tj!r*b>MTBYe+xEZm99mA zfgFcdU$JE@afT>)iW zZ6~PYg8S!H@q<=_0n42g+ZrAt*}!>>e$RJAfH0yv4lmPK09#a8NJ~d|b$O{~jI0X3 zr$5L5ato(aNwvK&vTQCtv@#Q2S?onR5K5FQ2SU$w8uNWij8$*~0|+EM;_h?CTrawT z_f8z10sL8KhtzlppmarItsWru+XYC4@r1j&JybybJ{D9E(I$IG%#dxP?{%;`ofSAT zL8{M|-@28As_CiK=(Xart75Z;uG! zt%E=cxajvHK8%FMX8tFKz?u{%g zc@(_-RGWeLGg7z*Ab#$U!lwGEDWE{MhI9oao#^|3AQ%>{n{5|Hd3kU&heq^#W3xUy z-w<8Im{J@N75Kmrv}OI!Ip4g5iy8CZy@R&HZ&KQT7unu$0&*x|x`=i|11APdXgm+1cJ zc0GECWZ~u3nNxZ(yIXs>H-6C9u-hR2ml6bI%JE}y`j|=^J#a*wKwG$^+?LJZ3)1Ms zTHf7Ap9hKcMmic$eA(LSUk2!oNchFWlLG2l$kpbNQcXqQy=u32Hn-N)x7O4))-;m& z)0U7z0|`!8q#ypzM}`SiP{IHbB22%wOi>*03-l~MKNEL>y$Vjhc8R|faNHr_KYdBC zI0$kZ@&4Ws=tmrB9N|OIfBod{ob1$=&EDNl9yK3WPUMphHh%GAtNnHxQ*$A zum2@uWBPaSy7%Se-YZ9`yiLG|->xKK{oWF2EyPtR&agTTCMHmVNd*OzvwVVrg52EU zYzZMD@3Ipjr+MkAVHFMN`5bGS^BN0EN?P*kWD)cbpLtE1G)vrAXZFU|POTSK2-0;F zz9e@#<`(DF8vD3;8hiS>u6cejT{u_Z_U+-WJTYNb7>-uHA*JaaIH&0e7~_}Zc)jU1 z7k{OqKv95y(QA5`QZ=sx*x#%@djpiSY-s*2XDGpH=m9`ElvqMeGW=f(Au{-oKb9yH zEH3x&@eJ0TGrAK(dso~)!|o&9L#9D5gtYhW(wN4-xX;l6;bAyxjTe=+%b^*%I8WcS zsRe#wG>IP~Y+t_GiAL^cQ={)I7`w&}o~;po3IA6_)E>MEgn3O(^NC2FQ~}zdva+(K z=EC}V3>cvMygZLkeWvjs<2|!+>q<|KP|&02@ol;GG4QmLR=1OO%|b_O(b9@@&D~K` z5FfiaZR?r&;QmA`8N7@6#7~c*4b$rcto=u8&v@GdkqA;gf0rxSVpk9dT1!JCNoNrm=B4jM4ti1- z@G}zC-xa}aEjMg!;pk}Q;HbMzKfH;}`ibvboK20Q0@E^e^~n0OYz%XFs}8a+%E0TG zouJFlu&A*dnw#M#4&Q|XGIViJOiWA#U(4xWI%u2DT8}0r!Pc_tYU#n=fR;<#3E(9K zlZT~qMman|`DQhX=}`YFExEaU4v=(Vf6B}~cqH^KavuJ`A@Ru%njJ4(LyDSkiTnP? zJ8CAJy=21^l05e>71G$n95yg-S(~%42X!yA1XD3YTaVM?Z#d;Gk_;P*SlsUWA&C>e z#4R3@{0CZXSTI;3j~q4qzuVz|fNCLSE&f*dTl3y7muuR}W)NW28G)NEb8y_kjVxfg z5+S|h61Q>Dvy3t-ls%p{_lm~t3_dLCX|JScuiu{}j^QfeA505n&lX`WBY#XWo0-^S z@BJFZZlfmo{8GAHI0Xc;7U5g~e+lyN!lOkB45S59+HK^JJ6*Y7iR6)SGCI{PgUH!L z!Y%3$C%)h&Ei}5^^5Laxf5_Bs;pABHs(aP5J4j!uj#?zW+@tgv2H(4sP&3$|74>#U zltK5P{=w1Qp**Y1VgzRYqXF3~XH!yP>0K=|TnVfr1;ip{(!AJ$=+w2)Q(n9Q_j#Wz zR;QuV*6Uu`VAItB@t-s7NzB2{RM`Wqr$Theog;3n&P?jgIJ(YcOlyAdsxGW44QCBm0n(N z6~20|!lKU>IqYKoax!D7tM3aG&03Xt~%))v;hl`y-gn$H5wV9 zhmD*cJa-c{XE|2|fMo^LTUr_4!Rx_~(?^md^GJp$!A|pp?0f!YdA#6QErMQr8s6(H z1NW)M=>^%2J*Sfe+g_i;O=uFDyg|kUhTzTXYZp(?7A%XQffU@IC0&upSB!e&-gLaE zc}l@HkL};(41Cm_KE5y%F%*uBOQ8mRhQ52=HuQc@pkpvXu90m;qP zA(ws6cvpB(Vx&csiHTT-CAkxKA+;xoXyTzkUp2E`6}s2kOO8#FnqL-EogK|IS=U>b zv>ziP_8sM%n^``#F-`Vuk=5+N)wb9{h-fkOucD+P z%=!U1YBeX{RChEDec7j&&~K%yD~-PyE(PFRjN9^G+24U?LD8tiyLbo=2%)N7)TlF& z$0EC5q|EOpr7s35ZpU);dLUS9>grSvYS)AmkVQ~{Y9|)qPtag^sd}hu6H(Qx&A_d> z8~LE!xtr9Mhpnla#@m?X*2g?>JUD(j4?Nusj?as)1?9zegH?QR5`XOB;_U9?V&PzK zqrP4tMtmyB`2>U&vXh;!oG&lq;uF%7)01N%wpZJsbiD2S+!TmG^(`6cq2@X7vbchN2JPPORQ+!?CfCcl~mZbxcORnxqUTDq=K4D za)EmbPe3Y7Z$IUR@EIZbzTmCBzh5D^_$3eaNavcReVL-Dt&GeguBk5U#7)2eXu_l@ zWX;vp5ZHJFgDIp?+2}A_@?I>iPk1Vb9LUNexh9V9ydN6xoipz@-^YtFwJV_Z28{jP z$WhGL@4RaUsJZe#J64+8%qElxP66@(ODh*f_@FQNyT`!MkNaa~0@OJ2L>3z~$zbo8 zFx=W=(jBT=qbNPK7_MVwqLxd@Whqa09DOU0i=z0ks(SY9qFDn@{aBs(R;hxv2R`TkVz zvEq9KxNq*Kn^$`ky7yulxZ@LO9nM8{Wo7x>{WnLpwkId|LPBEw7fY+tpvlGA z*~PFbk&6%sv2?Vq%fvFxBSM11!z1*Pik{aHI?c*?y%vxd%xsjz_~`iX8L>ApGZa7p zHuh70xl8c&+1?&ECqR>JG3I{}NqY3bUMO-QWP<9JQ2fg9) zfl9iiI1J%z+#hU2S9I5(GNuI_8&!AKad7S9dFT%czB}t;xu{Z{RW`fGV!6#!zYARD z{SgxuWwBA143&e`-NJaGfm@JqhGD->3QeDNm~)NDNdqFSt6lC*m*9b#kF3?wzh!WI z!0|Qsk2B0}+@THD1EnF3)p^$JafkR_&l{fst`uR&2? zI_d#k)jhBBz`yL8U(n|8u#CQbrplKRAt0iysfpXUe0_a=f6wKzHVb5wyZYbpqs}-b zlIIOnghg#*-m=DoscV3^S{10ks%{^rD|&%cc50YnuNgWWIs(#%NcgClnsPDHvG1Rb zgvE5otsNcFZ%Ap7to;M_%+F46r0p@rk zCCpSbzz>q$JKBCiYqr*!J|~@RiV_R`6FY^6_(5Y{7B}HqF>)n#-z&BTHiEu6E! zQ@iZ5G(=PYWC4{LySuyh^c?VW+y+v=-;!cRPZjIjP6bMU<-ga)U%T)ANd(l_oHM~l zN=W21otGquijtedK>qCS!ui96c6r|HsJ!VNGm~E>;HcqqE#C@#TxUOZV#XEdI%kU? zxrL81%8umV2FYE3rC~KaIa$57R4XS`>eH|Z6sxm5sAk$O$|M3jq1Fuz0gVu8?ziF# zRd^H>l+%?ari`@|QZjhE=$Xv>m?_d=P`mbyDD}|MqXX{x1BTUqL1#s>=9-$Rl@-Db zQOKU(b7h);{`@H@N}K{pUe2Ft<~h`Y1&x?}7aZe$om@du(Z3Za#G)M^9|s|mMT5*mCo zMX-wQ#Yt=c@&jHQ76@K+4;^C;Kzr9QA_e+4Q+8EebRmmzdfTaJU|X17VzO3 zr9}hEOF(L~AVp$~YyqZ9f{A{My#Ml90JY!Q*%@Hj$ru;BapXUI_;7Xg_2Tkd@9)Yj zn9ILq<8gFBTke|sD90dS_A1DCn6*h432A<%BfvMS<;I9OO}>gw`9y@MOuTfIZ~gYUgh zui^)sGw;AGGoD{E`GN_DZ}V1%H#ai_LbfHrlLo%3?`v0wQ9qtUNmgGirr zssVCRXJ?jr4hc|zf#io<=-Jgof@wHhcsI!M6&iRaL?UQ^I^SG8(Mt^DY>F;+n>Y-e zb9>}#JIDTXn3fQR?sC|XkrDgV<}PC6?0=KP4-!M{sx?_S6_k|2zq!@O?PtNDE{F9kxi2Xl3mR=P>3zA1P0H|v=Hlu%V zE&iWo&MT_vERW-gNN4B}5JshUMtTz^(gF?yL`qY2gDvSfH!bZ(L=Tqlhu`hn<}-zR@oV&j_cm&Z0kQE|p|tmDV8XVj(4L*-ip|B< zH4)&ZaEdo&2d{L{;rLx&`0;%c4D8*?f!{d|t{Ulw_UTMX$?lGpkY^&pA~w`-NmR>$ z(qp+fHo+Q{wJU5mIB=U5QWUBWi@x-+l@>~%xY`eBf=99Ba84)CPeo7|}sW|iR&79>*b$RRiDJ&5fU_c67aWxrdh3?nz zKd5x+Z86Q#AYJLxAF4WwYft)sgtyHt`s~?KNh0`s@}MDUa&mHd8UcrA6%^FuBHXhs zf?XBmpH`C^!AMuGMsTL#)SkP$nw0w2*y|G%EFNxiE+g9;H*UTmuj-JO^D4jGY}c_| zXJ1V2ItwoEqFPebFuZBv1U|A^J#E$rRxGyr%qz;{>sYpfo9TszU=&F{xGwgBNCYZy zO?7o!J3I3cLGAwjejp!@i;KHvHnrd7%v?Xd)XL3@_A7~^Cm;dyWl{!LvOjDl=w6vW z!XL93{t?3yGtu6@F?fc|8p`|eOif?S(1=1@OVB7u?E-tDFWs|?{s)VBupLQX(lUHl zLrHr%H_i&TSR~;-#M6=T|qjf^V32Vr4Cb0)IuY|V)XadJ_%GLBSLet6Vw0JXAeJc`wBR-WTeMEElC z$PiB{R+xQ-2&>@Owa)=w$!qFe)KoWFgwxbVw}0qazt78@s9x9|ofWlnUckxP@q2X zHC&^{Lz!aO{vNyg8wRwOQG*i2}B>btc{@yovvd7`s&#Rr|SDEwM%5~l!usi~-2bNzjK9ESHIufY*P^ey+=B!@`4&X8a4u>NUDYIa|t%cpOb7WxprSrP5 z^gDV4;^8cag+hH@877~;5foV^oP6KD&&s_2Ufm$!YmVy2Q5*A}d#X)Z_EaLzEp3U{ zJGyg+KLO1-s-XX@1b4X#0jjq0nfwfdMAo^O4dA_h~V|(g^^y&b>`jQ`q`*+=BM~uZjyV2s~fq zH)JE91E-KpSq-J*=}zL0o-56u^f7QV5yh9to$H#!EDAI7bSn10FOF=q!dG`ec}X_&!F@4CYs@p( zeztg)PHB=h{K@h8uP{QKbWT$b6ZmK4p)+v)BfqGdwHreSYME+z>?Dm|pO5P&9KOg3 zu^UkJ@)dq%Yjq$$y}`8C4Z`;X(Hdpzhb4`i*JaZ)w0=xHrjN4l)C;$%A|}^IE}zVL zia$sv0PWXl@*8wmTg2p-;4s--M3(9nm4sS>zNM0?eo4T4xThV$=22hNXtYo1!4o~7 zb3earq#=TTe9R^wj9s=rRH-&_RnsWRB@Tv}xs$^XU>O`lt!3t&)$F2UNSKe;MjvKc z`f!vGdc~lrN$QW#zT^G-dy-l_XcwvaAJsLi*|W zV;y}WT$0|VkUb!s6;<>#L|bF;xo;Qe@daS`pXjbZN(RxcXsXalLSGYG-MnA@i}Ma9 zw!JQGT7}62eysH&-YG66*Kde9g8<-&2PZ|5To70?$wmakxx`ioGhij(%s!e4{f?A9 zq}Q$?E%UK-p5`?jLtf${A@jbMq`RD~zI3-|r}H(2qERT>UZyKIywtaCvRjr#0}VVD zUp`@B=_w;X%`0ONgS-gXF1uuabhkTpvf&$W0rkVYc12jxd@`gj_fXSd;* z%8O=3?0j6c`gkvT2;%AJ5Ntbl*oU__=4NS`d}4Ve4WZF*nEmvAJC|*D?W$Z|be+C+ zO@^)sI(Tgi)~(5WAvCzmRZ+&$mvF&y zENS6R3BH3PWtPj{ieZu1FAwWh1eBQq-BN-7W|_Frx|J zTB9Xnf*6{Y5!z4h;-uxQ&K}PuOQ5@2isSv3{(aey`DmJk9=6Ui4>_dPEG{*OaEd$B zSSuDV{zFyNhO--feV6+_NfKAAaapP8QT~3QBou728`cy?^3_|zg{MFqXA2X~Sa3t( z(GhK~rr|7{>~j=DiMoy?@d-RGqA`IuHPZBQZ877r;bgXVf^21TK*F6uXtjVt&0`Z~ z7@H|!t1Ty8ck#F3837}`DpUrx5Vjbk#$!axHv8s{xN?&Fcsu?9cu69_B9B8*+j*Uu z27_HRpEW8!Y(wXGo>(Osm{KId&w&#x+b6xOLY???;5-TaII;Ny6pK>gMt+(&G z{*m+5t!!;&Pt7&WzgJYV_aT_NSLT%d|qU^nIPp%z>Vua}^2yy`IZ1rlr1 zjQ30KdBE0LJ%nD-RydoW>BMN$(!#r@H|XhAPAVEPtM&{ScVB3jxVhRA&_rMJvD+FL z+O1kJC<|&m)Gp>$8k;Kd!1NrZSv(yzjSjM zB^X(!1*Pqn9SHAvtRZt0icU!rCjl!oji_8H=TJHkRd38@`l5C9wC`p;%DS=HPGzd2 z%WUIeta`IN0minsHkQl}E7Me9sMB#5bmcOtn=Gl=n8!QNQyUv+mS=N%V8*MMeps5g z8zAKeg_jE4hL$K{>PU{6TWy}rs=;!+cM2LB5tXZB&9Qs - -

Creating a Key

-

Scenario

This section describes how to create a CMK on the KMS management console. You can create up to 100 CMKs, excluding Default Master Keys.

-
The CMK is perfectly suited for but not limited to the following scenarios:
  • Server-side encryption on OBS
  • Encryption of data on EVS disks
  • Encryption of private images on IMS
  • File system encryption on SFS
  • Disk encryption for database instances in RDS
  • DEK encryption and decryption for user applications
-
-

Aliases of Default Master Keys end with /default. It is not allowed to use aliases ending with /default for your CMKs.

-
-
-

Prerequisites

You have obtained an account and its password for logging in to the management console.

-
-

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Choose Security > Key Management Service. The Key Management Service page is displayed.
  4. Click Create Key in the upper right corner of the page. In the dialog box that is displayed, enter the alias and description of the key.

    Figure 1 Create Key dialog box
    -
    • Alias is the alias of the CMK to be created.
    • (Optional) Description is the description of the CMK.
    -

  5. (Optional) Add tags as needed, and enter the tag key and tag value.

    • When a CMK has been created without any tag, you can add a tag to the CMK later as necessary. Click the alias of the CMK. The page with key details is displayed. Then you can add tags to the CMK.
    • The same tag (including tag key and tag value) can be used for different CMKs. However, under the same CMK, one tag key can have only one tag value.
    • A maximum of 10 tags can be added for one CMK.
    • If you want to delete a tag to be added when adding multiple tags, you can click Delete in the row where the tag to be added is located to delete the tag.
    -
    -

  6. Click OK.

    In the CMK list, you can view created CMKs. The default status of a CMK is Enabled.

    -

-
-

Related Operations

  • For details about how to upload objects with server-side encryption, see section Uploading a File with Server-Side Encryption in the Object Storage Service User Guide.
  • For details about how to encrypt data on EVS disks, see section Creating an EVS Disk in the Elastic Volume Service User Guide.
  • For details about how to encrypt private images, see section Encrypting an Image in the Image Management Service User Guide.
  • For details about how to encrypt the file system on SFS, see section Creating a File System in the Scalable File Service User Guide.
  • For details about how to encrypt disks for a database instance in RDS, see section Creating an RDS MySQL DB Instance in the Relational Database Service User Guide.
  • For details about how to create a DEK and a plaintext-free DEK, see sections Creating a DEK and Creating a Plaintext-Free DEK in the Key Management Service API Reference.
  • For details about how to encrypt and decrypt a DEK for a user application, see sections Encrypting a DEK and Decrypting a DEK in the Key Management Service API Reference.
-
-
-
-
-
Parent topic: Management
-
-
- - - \ No newline at end of file diff --git a/docs/kms/umn/kms_01_0003.html b/docs/kms/umn/kms_01_0003.html index 2ebcdf15..c1f32b65 100644 --- a/docs/kms/umn/kms_01_0003.html +++ b/docs/kms/umn/kms_01_0003.html @@ -23,7 +23,7 @@
-
Parent topic: About KMS
+
Parent topic: Key Management
diff --git a/docs/kms/umn/kms_01_0005.html b/docs/kms/umn/kms_01_0005.html index 1ef74d58..5448ae42 100644 --- a/docs/kms/umn/kms_01_0005.html +++ b/docs/kms/umn/kms_01_0005.html @@ -2,6 +2,7 @@

CMK

A Customer Master Key (CMK) is a Key Encryption Key (KEK) created by a user using KMS. It is used to encrypt and protect Data Encryption Keys (DEKs). One CMK can be used to encrypt one or multiple DEKs.

+

CMKs are categorized into custom keys and default keys.

diff --git a/docs/kms/umn/kms_01_0008.html b/docs/kms/umn/kms_01_0008.html index 0ad73456..833c416d 100644 --- a/docs/kms/umn/kms_01_0008.html +++ b/docs/kms/umn/kms_01_0008.html @@ -1,7 +1,7 @@

HSM

-

A hardware security module (HSM) is a hardware device that securely produces, stores, manages, and uses CMKs. In addition, it provides encryption processing services.

+

A Hardware Security Module (HSM) securely produces, stores, manages, and uses keys and provides encryption services.

diff --git a/docs/kms/umn/kms_01_0013.html b/docs/kms/umn/kms_01_0013.html index 1a96aae8..9a066da2 100644 --- a/docs/kms/umn/kms_01_0013.html +++ b/docs/kms/umn/kms_01_0013.html @@ -8,16 +8,10 @@
  • How to Use KMS
    • -
  • Related Services
    -
    • -
  • User Permissions
    -
    • -
  • KMS Permissions Management
    -
    • -
    Parent topic: About KMS
    +
    Parent topic: Key Management
    diff --git a/docs/kms/umn/kms_01_0014.html b/docs/kms/umn/kms_01_0014.html index 5a7c4dc1..421f3d9c 100644 --- a/docs/kms/umn/kms_01_0014.html +++ b/docs/kms/umn/kms_01_0014.html @@ -1,9 +1,10 @@

    How to Access KMS

    -

    The public cloud provides a web-based service management platform. You can access KMS using HTTPS-compliant APIs or the management console.

    -
    • Management console

      If you have registered with the public cloud, you can log in to the management console directly. In the upper left corner of the console, click . Select a region or project. Choose Security > Key Management Service.

      -
    • API

      You can access KMS using APIs. For details, see the Key Management Service API Reference.

      +

      The cloud service provides a web-based service management platform. You can access KMS using HTTPS-compliant APIs or the management console.

      +
      • Management console

        If you have registered with the cloud service, you can log in to the management console directly. In the upper left corner of the console, click . Select a region or project. Choose Security > Key Management Service.

        +

        +
      • API

        You can access KMS using APIs. For details, see .

      diff --git a/docs/kms/umn/kms_01_0016.html b/docs/kms/umn/kms_01_0016.html index 0e47d43f..57b1afb5 100644 --- a/docs/kms/umn/kms_01_0016.html +++ b/docs/kms/umn/kms_01_0016.html @@ -1,211 +1,27 @@

      Related Services

      -

      OBS

      KMS provides central management and control capabilities of CMKs for Object Storage Service (OBS). It is used for server-side encryption with KMS-managed keys (SSE-KMS) function of OBS.

      +

      OBS

      Object Storage Service (OBS) is a scalable service that provides secure, reliable, and cost-effective cloud storage for massive amounts of data. KMS provides central management and control capabilities of CMKs for OBS. It is used for server-side encryption with KMS-managed keys (SSE-KMS) on OBS.

      -

      EVS

      KMS provides central management and control capabilities of CMKs for Elastic Volume Service (EVS). It is applied to the encryption function of EVS.

      +

      EVS

      Elastic Volume Service (EVS) offers scalable block storage for cloud servers. With high reliability, high performance, and rich specifications, EVS disks can be used for distributed file systems, development and test environments, data warehouse applications, and high-performance computing (HPC) scenarios to meet diverse service requirements. KMS provides central management and control capabilities of CMKs for EVS. It is used for encryption in EVS.

      -

      IMS

      KMS provides central management and control capabilities of CMKs for Image Management Service (IMS). It is applied to the private image encryption function of IMS.

      +

      IMS

      Image Management Service (IMS) allows you to manage the entire lifecycle of your images. KMS provides central management and control capabilities of CMKs for Image Management Service (IMS). It is used for private image encryption in IMS.

      -

      SFS

      KMS provides central management and control capabilities of CMKs for Scalable File Service (SFS). It is applied to the file system encryption function of SFS.

      +

      SFS

      Scalable File Service (SFS) provides high-performance file storage (NAS) that can be expanded on demand. KMS provides central management and control capabilities of CMKs for SFS. It is used for file system encryption in SFS.

      -

      RDS

      KMS provides central management and control capabilities of CMKs for Relational Database Service (RDS). It is applied to the disk encryption of database instances in RDS.

      +

      RDS

      Relational Database Service (RDS) is a relational database that is reliable, scalable, easy to manage, and immediately ready for use. KMS provides central management and control capabilities of CMKs for RDS. It is used for disk encryption in relational databases.

      -

      CTS

      Cloud Trace Service (CTS) provides you with a history of KMS operations. After enabling CTS, you can view all generated traces to review and audit performed KMS operations. For details, see the Cloud Trace Service User Guide.

      - -
      - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Table 1 KMS operations supported by CTS

      Operation

      -

      Resource Type

      -

      Trace Name

      -

      Creating a CMK

      -

      cmk

      -

      createKey

      -

      Creating a DEK

      -

      cmk

      -

      createDataKey

      -

      Creating a plaintext-free DEK

      -

      cmk

      -

      createDataKeyWithoutPlaintext

      -

      Enabling a CMK

      -

      cmk

      -

      enableKey

      -

      Disabling a CMK

      -

      cmk

      -

      disableKey

      -

      Encrypting a DEK

      -

      cmk

      -

      encryptDataKey

      -

      Decrypting a DEK

      -

      cmk

      -

      decryptDataKey

      -

      Scheduling the deletion of a CMK

      -

      cmk

      -

      scheduleKeyDeletion

      -

      Canceling the scheduled deletion of a CMK

      -

      cmk

      -

      cancelKeyDeletion

      -

      Generating random numbers

      -

      rng

      -

      genRandom

      -

      Changing the alias of a CMK

      -

      cmk

      -

      updateKeyAlias

      -

      Changing the description of a CMK

      -

      cmk

      -

      updateKeyDescription

      -

      Prompting risks about CMK deletion

      -

      cmk

      -

      deleteKeyRiskTips

      -

      Importing key material

      -

      cmk

      -

      importKeyMaterial

      -

      Deleting key material

      -

      cmk

      -

      deleteImportedKeyMaterial

      -

      Creating a grant

      -

      cmk

      -

      createGrant

      -

      Retiring a grant

      -

      cmk

      -

      retireGrant

      -

      Revoking a grant

      -

      cmk

      -

      revokeGrant

      -

      Adding a tag

      -

      cmk

      -

      createKeyTag

      -

      Deleting a tag

      -

      cmk

      -

      deleteKeyTag

      -

      Batch creating tags

      -

      cmk

      -

      batchCreateKeyTags

      -

      Batch deleting tags

      -

      cmk

      -

      batchDeleteKeyTags

      -

      Enabling key rotation

      -

      cmk

      -

      enableKeyRotation

      -

      Modifying the rotation interval

      -

      cmk

      -

      updateKeyRotationInterval

      -

      Disabling key rotation

      -

      cmk

      -

      disableKeyRotation

      -
      +

      ECS

      An ECS is a basic computing component that consists of CPUs, memory, OS, and elastic volume service (EVS). After creating an ECS, you can use it like your local computer or physical server.

      +

      Dedicated HSM can encrypt sensitive data in the service systems on your ECS. You can control the generation, storage, and access authorization of keys to ensure the integrity and confidentiality of data during transmission and storage.

      -
      -

      IAM

      Identity and Access Management (IAM) provides the permission management function for KMS. Only users who have KMS Administrator permissions can use KMS. To apply for KMS Administrator permissions, contact a user with Security Administrator permissions. For details, see the Identity and Access Management User Guide.

      +

      IAM

      Identity and Access Management (IAM) provides the permission management function for .

      +

      Only users who have KMS Administrator permissions can use .

      +

      To apply for permissions, contact a user with Security Administrator permissions. For details, see the .

      -
      Parent topic: Accessing and Using KMS
      +
      Parent topic: Service Overview
      diff --git a/docs/kms/umn/kms_01_0017.html b/docs/kms/umn/kms_01_0017.html index 4ecf89b2..869ac03e 100644 --- a/docs/kms/umn/kms_01_0017.html +++ b/docs/kms/umn/kms_01_0017.html @@ -1,12 +1,12 @@

      User Permissions

      -

      The public cloud system provides two types of permissions by default: user management and resource management. User management refers to the management of users, user groups, and user groups' rights. Resource management refers to the control of operations that can be performed by users on cloud service resources.

      +

      The system provides two types of permissions by default: user management and resource management. User management refers to the management of users, user groups, and user groups' rights. Resource management refers to the control of operations that can be performed by users on cloud service resources.

      For further details, see Permissions.

      -
      Parent topic: Accessing and Using KMS
      +
      Parent topic: Service Overview
      diff --git a/docs/kms/umn/kms_01_0018.html b/docs/kms/umn/kms_01_0018.html index 438b05c9..de872852 100644 --- a/docs/kms/umn/kms_01_0018.html +++ b/docs/kms/umn/kms_01_0018.html @@ -1,27 +1,29 @@ -

      Management

      +

      Key Management

      diff --git a/docs/kms/umn/kms_01_0019.html b/docs/kms/umn/kms_01_0019.html index 746a6e0f..26b0cdeb 100644 --- a/docs/kms/umn/kms_01_0019.html +++ b/docs/kms/umn/kms_01_0019.html @@ -6,14 +6,14 @@
      -
      Parent topic: Management
      +
      Parent topic: Key Management
      diff --git a/docs/kms/umn/kms_01_0020.html b/docs/kms/umn/kms_01_0020.html index a60e44fa..7993ac6d 100644 --- a/docs/kms/umn/kms_01_0020.html +++ b/docs/kms/umn/kms_01_0020.html @@ -1,14 +1,14 @@ -

      Deleting Key Material

      +

      Deleting a Key Material

      Scenario

      When importing key material, you can specify the expiration time. After the key material expires, KMS deletes it, and the status of the CMK changes to Pending import. You can manually delete the key material as needed. The effect of expiration of the key material is the same as that of manual deletion of the key material.

      This section describes how to delete imported key material on the management console.

      -
      • After the key material is deleted, if you need to re-import the key material, the key material to be imported must be the same as that has been deleted.
      • After the same key material is re-imported, you can use the CMK to decrypt all data encrypted using this key before deletion.
      +
      • After the key material is deleted, if you need to re-import the key material, the key material to be imported must be the same as that has been deleted.
      • After the same key material is re-imported, you can use the CMK to decrypt all data encrypted using this key before deletion.
      • After the deletion, the CMK will become unavailable and its status will change to Pending import.
      -

      Prerequisites

      • You have obtained an account and its password for logging in to the management console.
      • You have imported the key material for a CMK.
      • The material source of the CMK is External.
      • The CMK status is Enabled or Disabled.
      +

      Prerequisites

      • You have imported the key material for a CMK.
      • The material source of the CMK is External.
      • The CMK status is Enabled or Disabled.
      -

      Procedure

      1. Log in to the management console.
      2. Click in the upper left corner of the management console and select a region or project.
      3. Choose Security > Key Management Service. The Key Management Service page is displayed.
      4. In the row containing the desired CMK, click Delete Key Material.
      5. In the dialog box that is displayed, click OK.

        After the deletion, the CMK will become unavailable and its status changes to Pending import.

        +

        Procedure

        1. Log in to the management console.
        2. Click in the upper left corner of the management console and select a region or project.
        3. Choose Security > Key Management Service . The key management page is displayed.
        4. In the row containing the desired CMK, click Delete Key Material.
        5. In the dialog box that is displayed, click OK.

          After the deletion, the CMK will become unavailable and its status changes to Pending import.

      diff --git a/docs/kms/umn/kms_01_0021.html b/docs/kms/umn/kms_01_0021.html index f919cc8f..ada0c023 100644 --- a/docs/kms/umn/kms_01_0021.html +++ b/docs/kms/umn/kms_01_0021.html @@ -4,9 +4,9 @@

      Scenario

      This section describes how to configure the Simple Message Notification (SMN) function on the Cloud Trace Service (CTS) console.

      Decryption will fail if the CMK used has been scheduled for deletion. You will receive messages about the decryption failure on terminals (SMS, email, HTTP, or HTTPS) if the SMN function has been configured in CTS.

      -

      Prerequisites

      • You have obtained an account and its password for logging in to the management console.
      • CTS has been enabled.
      • You have subscribed to SMN.
      +

      Prerequisites

      • CTS has been enabled.
      • You have subscribed to SMN.
      -

      Procedure

      1. Log in to the management console.
      2. Click in the upper left corner of the management console and select a region or project.
      3. Choose Management & Deployment > Cloud Trace Service to go to the CTS console.
      4. In the navigation tree on the left, click Tracker.
      5. If the desired tracker is not enabled, click Enable. In the dialog box that is displayed, click OK to enable the tracker. If the tracker is already enabled, skip this step.
      6. In the navigation tree on the left, click Key Event Notifications. The Key Event Notifications page is displayed.
      7. Click Create Key Event Notification at the upper right corner of the page. The creation page is displayed.
      8. In the Basic Information area, enter a notification name. See Figure 1 for details.

        Figure 1 Configuring basic information
        +

        Procedure

        1. Log in to the management console.
        2. Click in the upper left corner of the management console and select a region or project.
        3. Choose Management & Deployment > Cloud Trace Service to go to the CTS console.
        4. In the navigation tree on the left, click Tracker.
        5. If the desired tracker is not enabled, click Enable. In the dialog box that is displayed, click OK to enable the tracker. If the tracker is already enabled, skip this step.
        6. In the navigation tree on the left, click Key Event Notifications. The Key Event Notifications page is displayed.
        7. Click Create Key Event Notification at the upper right corner of the page. The creation page is displayed.
        8. In the Basic Information area, enter a notification name. See Figure 1 for details.

          Figure 1 Configuring basic information

        9. Select operation types in the Operation area. See Figure 2 for details.

          Figure 2 Selecting operation types

          @@ -35,7 +35,7 @@
          - @@ -65,7 +65,7 @@
          -
          Parent topic: Management
          +
          Parent topic: Key Management
          diff --git a/docs/kms/umn/kms_01_0023.html b/docs/kms/umn/kms_01_0023.html index 638c3c5b..b9b1e508 100644 --- a/docs/kms/umn/kms_01_0023.html +++ b/docs/kms/umn/kms_01_0023.html @@ -6,7 +6,7 @@
          -
          Parent topic: Management
          +
          Parent topic: Key Management
          diff --git a/docs/kms/umn/kms_01_0024.html b/docs/kms/umn/kms_01_0024.html index 802d4649..e5dc4b32 100644 --- a/docs/kms/umn/kms_01_0024.html +++ b/docs/kms/umn/kms_01_0024.html @@ -2,45 +2,42 @@

          Adding a Tag

          Scenario

          Tags are used to identify CMKs. You can add tags to CMKs so that you can classify CMKs, trace them, and collect their usage status according to the tags.

          -

          KMS does not support adding tags to Default Master Keys.

          -
          -

          Prerequisites

          You have obtained an account and its password for logging in to the management console.

          +

          Constraints

          Tags cannot be added to default keys.

          -

          Procedure

          1. Log in to the management console.
          2. Click in the upper left corner of the management console and select a region or project.
          3. Choose Security > Key Management Service. The Key Management Service page is displayed.
          4. Click the alias of the desired CMK to view its details.
          5. Click Tags to go to the tag management page.

            Figure 1 Managing tags
            +

            Procedure

            1. Log in to the management console.
            2. Click in the upper left corner of the management console and select a region or project.
            3. Choose Security > Key Management Service . The key management page is displayed.
            4. Click the alias of the desired CMK to view its details.
            5. Click Tags to go to the tag management page.

              Figure 1 Managing tags

            6. Click Add Tag. In the Add Tag dialog box, enter the tag key and tag value. Table 1 describes the parameters.

              Figure 2 Adding a tag

              If you want to delete a tag to be added when adding multiple tags, you can click Delete in the row where the tag to be added is located to delete the tag.

              -

              -
          Table 2 Parameters for configuring the SMN notification

          Parameter

          Description

          +

          Description

          Configuration
          Table 1 Tag parameters

          Parameter

          +
          - - - - - - - - - - - diff --git a/docs/kms/umn/kms_01_0025.html b/docs/kms/umn/kms_01_0025.html index 949330a9..6c35b88f 100644 --- a/docs/kms/umn/kms_01_0025.html +++ b/docs/kms/umn/kms_01_0025.html @@ -1,11 +1,11 @@ -

          Searching for Tags

          +

          Searching for a CMK by Tag

          Scenario

          This section describes how to search for tags through KMS. You can search for tags of all CMKs that meet the search criteria in the current project.

          -

          Prerequisites

          • You have obtained an account and its password for logging in to the management console.
          • Tags have been added.
          +

          Prerequisites

          Tags have been added.

          -

          Procedure

          1. Log in to the management console.
          2. Click in the upper left corner of the management console and select a region or project.
          3. Choose Security > Key Management Service. The Key Management Service page is displayed.
          4. Click Search by Tag to show the search box.

            Figure 1 Searching for tags
            +

            Procedure

            1. Log in to the management console.
            2. Click in the upper left corner of the management console and select a region or project.
            3. Choose Security > Key Management Service . The key management page is displayed.
            4. Click Search by Tag to show the search box.

              Figure 1 Searching for tags

            5. In the search box, enter the tag key and tag value.
            6. Click to add the input to the search criteria, and click Search. The list displays the CMKs that meet the search criteria.

              Figure 2 Search results
              • Multiple tags can be added at one search. A maximum of 20 tags can be added for one search. If multiple tags are searched for at one time, only CMKs meet the combined search criteria will be displayed in the search result.
              • If you want to delete an added tag from the search criteria, click next to the tag.
              • You can click Reset to reset the search criteria.
              diff --git a/docs/kms/umn/kms_01_0026.html b/docs/kms/umn/kms_01_0026.html index 7856a606..1ec47985 100644 --- a/docs/kms/umn/kms_01_0026.html +++ b/docs/kms/umn/kms_01_0026.html @@ -3,9 +3,7 @@

              Modifying Tag Values

              Scenario

              This section describes how to modify tag values on the KMS management console.

              -

              Prerequisites

              You have obtained an account and its password for logging in to the management console.

              -
              -

              Procedure

              1. Log in to the management console.
              2. Click in the upper left corner of the management console and select a region or project.
              3. Choose Security > Key Management Service. The Key Management Service page is displayed.
              4. Click the alias of the desired CMK to view its details.
              5. Click Tags to go to the tag management page.

                Figure 1 Managing tags
                +

                Procedure

                1. Log in to the management console.
                2. Click in the upper left corner of the management console and select a region or project.
                3. Choose Security > Key Management Service . The key management page is displayed.
                4. Click the alias of the desired CMK to view its details.
                5. Click Tags to go to the tag management page.

                  Figure 1 Managing tags

                6. Click Edit of the target tag, and the Edit Tag dialog box is displayed.

                  Figure 2 Editing a tag

                7. In the Edit Tag dialog box, enter a tag value, and click OK to complete the editing.
                diff --git a/docs/kms/umn/kms_01_0027.html b/docs/kms/umn/kms_01_0027.html index a46bc68b..9f648fdd 100644 --- a/docs/kms/umn/kms_01_0027.html +++ b/docs/kms/umn/kms_01_0027.html @@ -3,9 +3,7 @@

                Deleting Tags

                Scenario

                This section describes how to delete tags on the KMS management console.

                -

                Prerequisites

                You have obtained an account and its password for logging in to the management console.

                -
                -

                Procedure

                1. Log in to the management console.
                2. Click in the upper left corner of the management console and select a region or project.
                3. Choose Security > Key Management Service. The Key Management Service page is displayed.
                4. Click the alias of the desired CMK to view its details.
                5. Click Tags to go to the tag management page.

                  Figure 1 Managing tags
                  +

                  Procedure

                  1. Log in to the management console.
                  2. Click in the upper left corner of the management console and select a region or project.
                  3. Choose Security > Key Management Service . The key management page is displayed.
                  4. Click the alias of the desired CMK to view its details.
                  5. Click Tags to go to the tag management page.

                    Figure 1 Managing tags

                  6. Click Delete of the target tag, and the Delete Tag dialog box is displayed.
                  7. In the Delete Tag dialog box, click Yes to complete the deletion.
                @@ -15,3 +13,10 @@
              + + \ No newline at end of file diff --git a/docs/kms/umn/kms_01_0028.html b/docs/kms/umn/kms_01_0028.html index 30e24c0c..76851bbe 100644 --- a/docs/kms/umn/kms_01_0028.html +++ b/docs/kms/umn/kms_01_0028.html @@ -13,7 +13,7 @@
              -
              Parent topic: Management
              +
              Parent topic: Key Management
              diff --git a/docs/kms/umn/kms_01_0029.html b/docs/kms/umn/kms_01_0029.html index ab7a5366..7166f638 100644 --- a/docs/kms/umn/kms_01_0029.html +++ b/docs/kms/umn/kms_01_0029.html @@ -4,14 +4,14 @@

              Scenario

              You can create grants for other users to use the CMK. You can create a maximum of 100 grants for a CMK.

              The owner of a CMK can create a grant for the CMK on the KMS management console or by making the API calls. A user, who has been granted with the grant creation permission by the owner of the CMK, can create grants for the CMK only by making the API calls.

              -

              Prerequisites

              • You have obtained an account and its password for logging in to the management console.
              • You have obtained the user ID of the grantee (user to whom permissions are to be authorized).
              • The desired CMK is in Enabled status.
              +

              Prerequisites

              • You have obtained the user ID of the grantee (user to whom permissions are to be authorized).
              • The desired CMK is in Enabled status.
              -

              Procedure

              1. Log in to the management console.
              2. Click in the upper left corner of the management console and select a region or project.
              3. Choose Security > Key Management Service. The Key Management Service page is displayed.
              4. Click the alias of the desired CMK to go to the page displaying its details. You can create grants on the Grants tab page.

                Figure 1 Grants tab
                +

                Procedure

                1. Log in to the management console.
                2. Click in the upper left corner of the management console and select a region or project.
                3. Choose Security > Key Management Service . The key management page is displayed.
                4. Click the alias of the desired CMK to go to the page displaying its details. You can create grants on the Grants tab page.

                  Figure 1 Grants tab

                5. Click Create Grant. The Create Grant dialog box is displayed.

                  Figure 2 Creating a grant

                6. In the dialog box that is displayed, enter the ID of the user to be authorized and select permissions to be granted.

                  A grantee can perform the authorized operations only by calling the necessary API. For details, see the Key Management Service API Reference.

                  -
          Table 1 Tag parameters

          Parameter

          Description

          +

          Description

          Value

          +

          Value

          Example Value

          +

          Example Value

          Tag key

          +

          Tag key

          Name of a tag.

          +

          Name of a tag.

          The same tag (including tag key and tag value) can be used for different CMKs. However, under the same CMK, one tag key can have only one tag value.

          A maximum of 20 tags can be added for one CMK.

          • Mandatory.
          • Each tag key must be unique under the same CMK.
          • Contains a maximum of 36 characters.
          • Only digits, letters, underscores (_), and hyphens (-) are allowed.
          +
          • Mandatory.
          • Each tag key must be unique under the same CMK.
          • Contains a maximum of 36 characters.
          • Only digits, letters, underscores (_), and hyphens (-) are allowed.

          cost

          +

          cost

          Tag value

          +

          Tag value

          Value of the tag

          +

          Value of the tag

          • This parameter can be empty.
          • Can contain a maximum of 43 characters.
          • Only digits, letters, underscores (_), and hyphens (-) are allowed.
          +
          • This parameter can be empty.
          • Can contain a maximum of 43 characters.
          • Only digits, letters, underscores (_), and hyphens (-) are allowed.

          100

          +

          100
          Table 1 Parameter description

          Parameter

          +
          diff --git a/docs/kms/umn/kms_01_0030.html b/docs/kms/umn/kms_01_0030.html index a600799e..9e6039f9 100644 --- a/docs/kms/umn/kms_01_0030.html +++ b/docs/kms/umn/kms_01_0030.html @@ -3,12 +3,12 @@

          Querying a Grant

          Scenario

          This section describes how to view the details about a grant, such as the grant ID, grantee user ID, granted operation, and creation time.

          -

          Prerequisites

          • You have obtained an account and its password for logging in to the management console.
          • You have created a grant.
          +

          Prerequisites

          You have created a grant.

          -

          Procedure

          1. Log in to the management console.
          2. Click in the upper left corner of the management console and select a region or project.
          3. Choose Security > Key Management Service. The Key Management Service page is displayed.
          4. Click the alias of the desired CMK to view its details.
          5. Information about the CMK and grants created on it are displayed, Figure 1 shows example grant information.

            Figure 1 Querying a grant
            +

            Procedure

            1. Log in to the management console.
            2. Click in the upper left corner of the management console and select a region or project.
            3. Choose Security > Key Management Service . The key management page is displayed.
            4. Click the alias of the desired CMK to view its details.
            5. Information about the CMK and grants created on it are displayed, Figure 1 shows example grant information.

              Figure 1 Querying a grant

              Table 1 provides more details.

              -
          Table 1 Parameter description

          Parameter

          Description
          - + + +
          Table 1 Parameter description

          Parameter

          +
          @@ -34,6 +34,11 @@ + + +
          Table 1 Parameter description

          Parameter

          Description

          Creation time of the grant

          Operation

          +

          Operations that can be performed on a grant. For example, you can revoke a grant.

          +
          diff --git a/docs/kms/umn/kms_01_0031.html b/docs/kms/umn/kms_01_0031.html index a3571260..9c5528e5 100644 --- a/docs/kms/umn/kms_01_0031.html +++ b/docs/kms/umn/kms_01_0031.html @@ -3,12 +3,12 @@

          Revoking a Grant

          Scenario

          You can revoke a grant in either of the following scenarios:

          • A grantee does not need the grant. (The grantee can either tell the user who has created the grant to revoke the grant or call the necessary API to revoke the grant directly.)
          • You do not want the grantee to have the grant.
          -

          When a grant is revoked, the grantee does not have the corresponding permission any more. However, if the grantee has created the same grant to another user, permission of that user will not be affected.

          +

          When a grant is revoked, the grantee does not have the corresponding permission anymore. However, if the grantee has created the same grant to another user, permission of that user will not be affected.

          This section describes how to revoke a grant.

          -

          Prerequisites

          • You have obtained an account and its password for logging in to the management console.
          • You have created a grant.
          +

          Prerequisites

          You have created a grant.

          -

          Procedure

          1. Log in to the management console.
          2. Click in the upper left corner of the management console and select a region or project.
          3. Choose Security > Key Management Service. The Key Management Service page is displayed.
          4. Click the alias of the desired CMK to view its details.
          5. In the row containing the desired grantee, click Revoke Grant in the Operation column.
          6. In the dialog box that is displayed, click Yes. When Grant grant_ID revoked successfully is displayed in the upper right corner, the grant has been revoked.
          +

          Procedure

          1. Log in to the management console.
          2. Click in the upper left corner of the management console and select a region or project.
          3. Choose Security > Key Management Service . The key management page is displayed.
          4. Click the alias of the desired CMK to view its details.
          5. In the row containing the desired grantee, click Revoke Grant in the Operation column.
          6. In the dialog box that is displayed, click Yes. When Grant grant_ID revoked successfully is displayed in the upper right corner, the grant has been revoked.
          diff --git a/docs/kms/umn/kms_01_0032.html b/docs/kms/umn/kms_01_0032.html index 0f3b9b5d..5d8fafc9 100644 --- a/docs/kms/umn/kms_01_0032.html +++ b/docs/kms/umn/kms_01_0032.html @@ -12,12 +12,14 @@
        10. Disabling One or Multiple CMKs
          11. +
        11. Deleting One or More CMKs
          +
        12. Canceling the Scheduled Deletion of One or Multiple CMKs
          13. -
          Parent topic: Management
          +
          Parent topic: Key Management
          diff --git a/docs/kms/umn/kms_01_0033.html b/docs/kms/umn/kms_01_0033.html index c4b7cf78..3aa65df1 100644 --- a/docs/kms/umn/kms_01_0033.html +++ b/docs/kms/umn/kms_01_0033.html @@ -6,9 +6,9 @@
          • A Default Master Key (the alias suffix of which is /default) does not allow alias and description changes.
          • The alias and description of a CMK cannot be changed if the CMK is in Pending deletion status.
          -

          Prerequisites

          • You have obtained an account and its password for logging in to the management console.
          • The CMK is in Enabled, Disabled, or Pending import status.
          +

          Prerequisites

          • The CMK is in Enabled, Disabled, or Pending import status.
          -

          Procedure

          1. Log in to the management console.
          2. Click in the upper left corner of the management console and select a region or project.
          3. Choose Security > Key Management Service. The Key Management Service page is displayed.
          4. Click the alias of the desired CMK. Details about the CMK are displayed.
          5. To change the alias or description of the CMK, click next to the value of Alias or Description.

            Figure 1 CMK details
            +

            Procedure

            1. Log in to the management console.
            2. Click in the upper left corner of the management console and select a region or project.
            3. Choose Security > Key Management Service . The key management page is displayed.
            4. Click the alias of the desired CMK. Details about the CMK are displayed.
            5. To change the alias or description of the CMK, click next to the value of Alias or Description.

              Figure 1 CMK details
              • The alias must be 1 to 255 characters in length. Only digits, letters, underscores (_), hyphens (-), colons (:), and forward slashes (/) are allowed.
              • Length of the description cannot exceed 255 characters.

            6. Click to save the changes.
            diff --git a/docs/kms/umn/kms_01_0034.html b/docs/kms/umn/kms_01_0034.html index 201fa63f..ece3b756 100644 --- a/docs/kms/umn/kms_01_0034.html +++ b/docs/kms/umn/kms_01_0034.html @@ -3,10 +3,10 @@

            Enabling One or Multiple CMKs

            Scenario

            This section describes how to use the management console to enable one or multiple CMKs. Only enabled CMKs can be used to encrypt/decrypt data. A new CMK is in the Enabled state by default.

            -

            Prerequisites

            • You have obtained an account and its password for logging in to the management console.
            • The CMK you want to enable is in Disabled status.
            +

            Prerequisites

            The CMK you want to enable is in Disabled status.

            -

            Procedure

            1. Log in to the management console.
            2. Click in the upper left corner of the management console and select a region or project.
            3. Choose Security > Key Management Service. The Key Management Service page is displayed.
            4. In the row containing the desired CMK, click Enable.

              Figure 1 Enabling one CMK
              -

            5. In the dialog box that is displayed, click Yes to enable the CMK.

              To enable multiple CMKs at a time, select them and click Enable in the upper left corner of the list.

              +

              Procedure

              1. Log in to the management console.
              2. Click in the upper left corner of the management console and select a region or project.
              3. Choose Security > Key Management Service . The key management page is displayed.
              4. In the row containing the desired CMK, click Enable.

                Figure 1 Enabling one CMK
                +

              5. In the dialog box that is displayed, click Yes to enable the CMK.

                To enable multiple CMKs at a time, select them and click Enable in the upper left corner of the list.

              diff --git a/docs/kms/umn/kms_01_0035.html b/docs/kms/umn/kms_01_0035.html index 11f6e795..6a31b302 100644 --- a/docs/kms/umn/kms_01_0035.html +++ b/docs/kms/umn/kms_01_0035.html @@ -6,9 +6,9 @@

              Default Master Keys created by KMS cannot be disabled.

              -

              Prerequisites

              • You have obtained an account and its password for logging in to the management console.
              • The CMK you want to disable is in Enabled status.
              +

              Prerequisites

              The CMK you want to disable is in Enabled status.

              -

              Procedure

              1. Log in to the management console.
              2. Click in the upper left corner of the management console and select a region or project.
              3. Choose Security > Key Management Service. The Key Management Service page is displayed.
              4. In the row containing the desired CMK, click Disable.

                Figure 1 Disabling one CMK
                +

                Procedure

                1. Log in to the management console.
                2. Click in the upper left corner of the management console and select a region or project.
                3. Choose Security > Key Management Service . The key management page is displayed.
                4. In the row containing the desired CMK, click Disable.

                  Figure 1 Disabling one CMK

              diff --git a/docs/kms/umn/kms_01_0036.html b/docs/kms/umn/kms_01_0036.html index a22f0edb..b5f9a8da 100644 --- a/docs/kms/umn/kms_01_0036.html +++ b/docs/kms/umn/kms_01_0036.html @@ -3,10 +3,10 @@

              Canceling the Scheduled Deletion of One or Multiple CMKs

              Scenario

              This section describes how to use the management console to cancel the scheduled deletion of one or multiple CMKs prior to deletion execution.

              -

              Prerequisites

              • You have obtained an account and its password for logging in to the management console.
              • The CMK for which you want to cancel the scheduled deletion is in Pending deletion status.
              +

              Prerequisites

              The CMK for which you want to cancel the scheduled deletion is in Pending deletion status.

              -

              Procedure

              1. Log in to the management console.
              2. Click in the upper left corner of the management console and select a region or project.
              3. Choose Security > Key Management Service. The Key Management Service page is displayed.
              4. In the row containing the desired CMK, click Cancel Deletion.

                Figure 1 Canceling the scheduled deletion of one CMK
                -

              5. In the displayed dialog box, click OK to cancel the scheduled deletion for the CMK.

                • If the CMK is created using imported material, its status becomes Disabled after the cancelation. To enable the CMK, see Enabling One or Multiple CMKs.
                • If the CMK is created using imported material and no key material has been imported for it, its status becomes Pending import after the cancelation. To use the CMK, perform Creating CMKs Using Imported Key Material.
                +

                Procedure

                1. Log in to the management console.
                2. Click in the upper left corner of the management console and select a region or project.
                3. Choose Security > Key Management Service . The key management page is displayed.
                4. In the row containing the desired CMK, click Cancel Deletion.

                  Figure 1 Canceling the scheduled deletion of one CMK
                  +

                5. In the displayed dialog box, click Yes to cancel the scheduled deletion for the CMK.

                  • If the CMK is created using KMS generated material, its status becomes Disabled after the cancelation. To enable the CMK, see Enabling One or Multiple CMKs.
                  • If the CMK is created using imported material, its status becomes Disabled after the cancelation. To enable the CMK, see Enabling One or Multiple CMKs.
                  • If the CMK is created using imported material and no key material has been imported for it, its status becomes Pending import after the cancelation. To use the CMK, perform Creating CMKs Using Imported Key Material.

                  To cancel the deletion of multiple CMKs at a time, select them and click Cancel Deletion in the upper left corner of the list.

                  diff --git a/docs/kms/umn/kms_01_0037.html b/docs/kms/umn/kms_01_0037.html index 90ef207f..673e1744 100644 --- a/docs/kms/umn/kms_01_0037.html +++ b/docs/kms/umn/kms_01_0037.html @@ -8,14 +8,28 @@
                6. What Is a Customer Master Key?
                  7. -
                7. What Is a Data Encryption Key?
                  +
                8. What Are the Differences Between a Custom Key and a Default Key?
                  9. -
                9. Why Cannot I Delete a CMK Immediately?
                  +
                10. What Is a Data Encryption Key?
                11. Which Cloud Services Can Use KMS for Encryption?
                12. Will a CMK Be Charged After It Is Scheduled to Delete?
                  13. +
                13. Why Can't I Delete a CMK Immediately?
                  +
                  14. +
                14. Is There a Limit on the Number of CMKs That I Can Create on KMS?
                  +
                  15. +
                15. What Are the Benefits of Envelope Encryption?
                  +
                  16. +
                16. Can I Export a CMK from KMS?
                  +
                  17. +
                17. How Do I Use the Online Tool to Encrypt or Decrypt Small Volumes of Data?
                  +
                  18. +
                18. Can I Update CMKs Created by KMS-Generated Key Materials?
                  +
                  19. +
                19. How Does KMS Protect My Keys?
                  +
                diff --git a/docs/kms/umn/kms_01_0039.html b/docs/kms/umn/kms_01_0039.html index 9630a672..9c0082cf 100644 --- a/docs/kms/umn/kms_01_0039.html +++ b/docs/kms/umn/kms_01_0039.html @@ -1,6 +1,6 @@ -

                Why Cannot I Delete a CMK Immediately?

                +

                Why Can't I Delete a CMK Immediately?

                The decision to delete a CMK should be taken with caution. Before deletion, confirm that the CMK's encrypted data has all been migrated. Once the CMK is deleted, you will not be able to decrypt data with it. Therefore, KMS offers a waiting period of 7 to 1096 days for the deletion to finally take effect. On the scheduled day of deletion, the CMK will be permanently deleted. However, prior to the scheduled day, you can still cancel the deletion.

                diff --git a/docs/kms/umn/kms_01_0043.html b/docs/kms/umn/kms_01_0043.html index 7e26690c..4156184a 100644 --- a/docs/kms/umn/kms_01_0043.html +++ b/docs/kms/umn/kms_01_0043.html @@ -8,7 +8,13 @@

          2022-09-30

          +

          2023-06-15

          +

          This is the nineteenth official release.

          +

          Added section "How Does KMS Protect My Keys?"

          +

          2022-09-30

          This issue is the eighteenth official release.

          Optimized the content in section "Creating a Custom KMS Policy".

          diff --git a/docs/kms/umn/kms_01_0045.html b/docs/kms/umn/kms_01_0045.html index 50744973..95788eb9 100644 --- a/docs/kms/umn/kms_01_0045.html +++ b/docs/kms/umn/kms_01_0045.html @@ -1,17 +1,23 @@ -

          About KMS

          +

          Key Management

          diff --git a/docs/kms/umn/kms_01_0046.html b/docs/kms/umn/kms_01_0046.html index 46b34740..9642d908 100644 --- a/docs/kms/umn/kms_01_0046.html +++ b/docs/kms/umn/kms_01_0046.html @@ -4,11 +4,11 @@

          KMS can manage CMKs used for data encryption and decryption in Object Storage Service (OBS), Elastic Volume Service (EVS), Image Management Service (IMS), Scalable File Service (SFS), Relational Database Service (RDS), and user applications.

          • For OBS, KMS applies to object encryption on OBS.

            OBS is an object-based storage service that provides customers with massive, secure, reliable, and cost-effective data storage capabilities, including but not limited to bucket creation, modification, deletion, and management, as well as object upload, download, deletion, and general management. OBS can store all file types, and is suitable for individual subscribers, websites, enterprises, and developers. For more information about OBS, see Object Storage Service User Guide.

            -
          • For EVS, KMS applies to data encryption in EVS disks.

            Based on a distributed architecture, an EVS disk is a virtual block storage device that can be elastically scaled up and down. EVS disks can be operated online. Using them is the same as using common server hard disks. Compared with traditional hard disks, EVS disks have higher data reliability and I/O throughput and are easier to use. EVS disks can be used in file systems, databases, and system software applications that require block storage devices. For more information about EVS, see the Elastic Volume Service User Guide.

            +
          • For EVS, KMS applies to data encryption in EVS disks.

            Based on a distributed architecture, an EVS disk is a virtual block storage device that can be elastically scaled up and down. EVS disks can be operated online. Using them is the same as using common server hard disks. Compared with traditional hard disks, EVS disks have higher data reliability and I/O throughput and are easier to use. EVS disks can be used in file systems, databases, and system software applications that require block storage devices. For more information about EVS, see the Elastic Volume Service User Guide.

            -
          • For IMS, KMS applies to the creation of encrypted private images.

            IMS provides easy-to-use self-service image management functions. You can apply for a cloud server using either a private image or a public image. You can also create a private image using an existing ECS or an external image file. For more information about IMS, see the Image Management Service User Guide.

            +
          • For IMS, KMS applies to the creation of encrypted private images.

            IMS provides easy-to-use self-service image management functions. You can apply for a cloud server using either a private image or a public image. You can also create a private image using an existing ECS or an external image file. For more information about IMS, see the Image Management Service User Guide.

            -
          • For SFS, KMS applies to data encryption for files in SFS.

            SFS provides high-performance file storage that is scalable on demand. It can be shared with multiple cloud servers. For more information, see the Scalable File Service User Guide.

            +
          • For SFS, KMS applies to data encryption for files in SFS.

            SFS provides high-performance file storage that is scalable on demand. It can be shared with multiple cloud servers. For more information, see the Scalable File Service User Guide.

          • For RDS, KMS applies to disk encryption in RDS database instances.

            RDS is an online relational database service based on the cloud computing platform. RDS is out-of-box, reliable, scalable, and easy to manage. For more information about RDS, see the Relational Database Service User Guide.

            @@ -19,7 +19,7 @@
          -
          Parent topic: About KMS
          +
          Parent topic: Key Management
          diff --git a/docs/kms/umn/kms_01_0047.html b/docs/kms/umn/kms_01_0047.html index 1d41a589..f1a0eb44 100644 --- a/docs/kms/umn/kms_01_0047.html +++ b/docs/kms/umn/kms_01_0047.html @@ -2,16 +2,16 @@

          Functions

          KMS provides the following functions:

          -
          • Manages CMKs.
            Using the KMS console or APIs, you can perform the following operations on CMKs:
            • Creating, querying, enabling, disabling, scheduling the deletion of, and canceling the deletion of CMKs
            • Importing CMKs and deleting CMK material
            • Modifying the aliases and description of CMKs
            • Creating, querying, and revoking a grant
            • Adding, searching for, editing, and deleting tags
            • Enabling key rotation
            +
            • Manages CMKs.
              Using the KMS console or APIs, you can perform the following operations on CMKs:
              • Creating, querying, enabling, disabling, scheduling the deletion of, and canceling the deletion of CMKs
              • Importing CMKs and deleting CMK material
              • Modifying the aliases and description of CMKs
            • Creates, encrypts, and decrypts DEKs, and retires a grant on a CMK.

              By calling APIs, you can create, encrypt, and decrypt DEKs, and retire a grant on a CMK. For details, see the Key Management Service API Reference.

              -
            • Generates hardware true random numbers.

              You can generate 512-bit hardware true random numbers using a KMS API. The 512-bit hardware true random numbers can be used as or serve as basis for keys and encryption parameters. For details, see the Key Management Service API Reference.

              +
            • Generates hardware true random numbers.

              You can generate 512-bit hardware true random numbers using a KMS API. The 512-bit hardware true random numbers can be used as or serve as basis for keys and encryption parameters. For details, see the .

            -
            Parent topic: About KMS
            +
            Parent topic: Key Management
            diff --git a/docs/kms/umn/kms_01_0054.html b/docs/kms/umn/kms_01_0054.html index 630e15e9..3242040c 100644 --- a/docs/kms/umn/kms_01_0054.html +++ b/docs/kms/umn/kms_01_0054.html @@ -1,34 +1,34 @@

            Overview

            -

            A CMK contains key metadata (key ID, key alias, description, key status, and creation date) and the key material used for encrypting and decrypting data.

            -
            • When a user uses the KMS Console to create a CMK, the KMS automatically generates a key material for the CMK.
            • If you want to use your own key material, you can use the key import function on KMS Console to create a CMK whose key material is empty, and import the key material to the CMK.
            -

            Important Notes

            • Security

              You need to ensure that random sources meet your security requirements when using them to generate key material. When using the import key function, you need to be responsible for the security of your key material. Save the original backup of the key material so that the backup key material can be imported to the KMS in time when the key material is deleted accidentally.

              -
            • Availability and Durability

              Before importing the key material into KMS, you need to ensure the availability and durability of the key material.

              -

              Differences between the imported key material and the key material generated by KMS are shown in Table 1.

              +
              A custom key contains key metadata (key ID, key alias, description, key status, and creation date) and key materials used for encrypting and decrypting data.
              • When a user uses the KMS console to create a custom key, the KMS automatically generates a key material for the custom key.
              • If you want to use your own key material, you can use the key import function on the KMS console to create a custom key whose key material is empty, and import the key material to the custom key.
              +
              +

              Important Notes

              • Security

                You need to ensure that random sources meet your security requirements when using them to generate key materials. When using the import key function, you need to be responsible for the security of your key materials. Save the original backup of the key material so that the backup key material can be imported to the KMS in time when the key material is deleted accidentally.

                +
              • Availability and Durability

                Before importing the key material into KMS, you need to ensure the availability and durability of the key material.

                +

                Differences between the imported key material and the key material generated by KMS are shown in Table 1.

                -
                Table 1 Differences between the imported key material and the key material generated by KMS

                Key Material Source

                +
                - - - - -
                Table 1 Differences between the imported key material and the key material generated by KMS

                Key Material Source

                Difference

                +

                Difference

                CMKs using the imported key material

                +

                Imported keys

                • You can delete the key material, but cannot delete the CMK and its metadata.
                • When importing the key material, you can set the expiration time of the key material. After the key material expires, the KMS automatically deletes the key material within 24 hours, but does not delete the CMK and its metadata.

                  It is recommended that you save a copy of the material on your local device because it may be used for re-import in cases of invalid key material or unintended deletion of key material.

                  +
                • You can delete the key material, but cannot delete the custom key and its metadata.
                • Such keys cannot be rotated.
                • When importing the key material, you can set the expiration time of the key material. After the key material expires, the KMS automatically deletes the key material within 24 hours, but does not delete the custom key and its metadata.

                  It is recommended that you save a copy of the material on your local device because it may be used for re-import in cases of invalid key materials or key material mis-deletion.

                CMKs using KMS generated key material

                +

                Keys created in KMS

                • The key material cannot be manually deleted.
                • You cannot set the expiration time for key material.
                +
                • The key material cannot be manually deleted.
                • Symmetric keys can be rotated.
                • You cannot set the expiration time for key material.
                -
              • Association

                When a key material is imported to a CMK, the CMK is permanently associated with the key material. Other key material cannot be imported into the CMK.

                -
              • Uniqueness

                If you use the CMK created using the imported key material to encrypt data, the encrypted data can be decrypted only by the CMK that has been used to encrypt the data, because the metadata and key material of the CMK must be consistent.

                +
              • Association

                When a key material is imported to a custom key, the custom key is permanently associated with the key material. Other key materials cannot be imported into the custom key.

                +
              • Uniqueness

                If you use the custom key created using the imported key material to encrypt data, the encrypted data can be decrypted only by the custom key that has been used to encrypt the data, because the metadata and key material of the custom key must be consistent.

                • diff --git a/docs/kms/umn/kms_01_0055.html b/docs/kms/umn/kms_01_0055.html index b5f89c2e..425a8e8a 100644 --- a/docs/kms/umn/kms_01_0055.html +++ b/docs/kms/umn/kms_01_0055.html @@ -1,50 +1,55 @@ -

                Importing Key Material

                +

                Importing a Key Material

                Scenario

                If you want to use your own key material instead of the KMS-generated material, you can use the console to import your key material to KMS. CMKs created using imported material and KMS-generated material are managed together by KMS.

                This section describes how to import key material through KMS Console.

                • A CMK with imported material works in the same way as one using KMS-generated material, that is, you enable and disable them as well as schedule their deletion and cancel their scheduled deletion in the same way.
                • You can only import 256-bit symmetric keys.
                -

                Prerequisites

                • You have obtained an account and its password for logging in to the management console.
                • You have prepared the key material to be imported.
                +

                Prerequisites

                • You have prepared the key material to be imported.
                -

                Procedure

                1. Log in to the management console.
                2. Click in the upper left corner of the management console and select a region or project.
                3. Choose Security > Key Management Service. The Key Management Service page is displayed.
                4. In the upper right corner, click Import Key.
                5. In the Import Key dialog box, set the alias and description of the key.

                  Figure 1 Creating a CMK
                  -

                6. (Optional) Add tags as needed, and enter the tag key and tag value.

                  • When a CMK has been created without any tag, you can add a tag to the CMK later as necessary. Click the alias of the CMK. The page with key details is displayed. Then you can add tags to the CMK.
                  • The same tag (including tag key and tag value) can be used for different CMKs. However, under the same CMK, one tag key can have only one tag value.
                  • A maximum of 10 tags can be added for one CMK.
                  • If you want to delete a tag to be added when adding multiple tags, you can click Delete in the row where the tag to be added is located to delete the tag.
                  +

                  Procedure

                  1. Log in to the management console.
                  2. Click in the upper left corner of the management console and select a region or project.
                  3. Choose Security > Key Management Service . The key management page is displayed.
                  4. In the upper right corner, click Import Key.
                  5. In the Import Key dialog box, set the alias and description of the key.

                    Figure 1 Creating a CMK
                    +
                    • Alias is the alias of the key to be created.
                      • You can enter digits, letters, underscores (_), hyphens (-), colons (:), and slashes (/).
                      • You can enter up to 255 characters.
                      +
                    • (Optional) Description is the description of the custom key.
                    • (Optional) Add tags as needed, and enter the tag key and tag value.
                      • When a CMK has been created without any tag, you can add a tag to the CMK later as necessary. Click the alias of the CMK. The page with key details is displayed. Then you can add tags to the CMK.
                      • The same tag (including tag key and tag value) can be used for different CMKs. However, under the same CMK, one tag key can have only one tag value.
                      • A maximum of 10 tags can be added for one CMK.
                      • If you want to delete a tag to be added when adding multiple tags, you can click Delete in the row where the tag to be added is located to delete the tag.
                      +
                      +

                  6. Click security and durability to read and confirm information regarding the security and durability of the imported key.
                  7. Select I understand the security and durability of using an imported key, and create a CMK whose key material is empty.
                  8. Click Next to go to the Download the Import Items step. Select a key-wrapping algorithm according to Table 1.

                    Figure 2 Obtaining the wrapping key and import token
                    -
                    Table 1 Key wrapping algorithms

                    Algorithm

                    +
                    - - - - - - - - -
                    Table 1 Key wrapping algorithms

                    Algorithm

                    Description

                    +

                    Description

                    Configuration

                    +

                    Configuration

                    RSAES_OAEP_SHA_256

                    +

                    RSAES_OAEP_SHA_256

                    RSA encryption algorithm that uses OAEP and has the SHA-256 hash function

                    +

                    RSA encryption algorithm that uses OAEP and has the SHA-256 hash function

                    Choose an algorithm from the drop-down list box.

                    +

                    Choose an algorithm from the drop-down list box.

                    1. If the HSMs support the RSAES_OAEP_SHA_256 algorithm, use RSAES_OAEP_SHA_256 to encrypt the key material.
                    2. If the HSMs do not support OAEP, use RSAES_PKCS1_V1_5 to encrypt the key material.
                    NOTICE:

                    The RSAES_OAEP_SHA_1 encryption algorithm is no longer secure. Exercise caution when performing this operation.

                    RSAES_PKCS1_V1_5

                    +

                    RSAES_PKCS1_V1_5

                    RSA encryption algorithm (v1.5) of Public-Key Cryptography Standards number 1 (PKCS #1)

                    +

                    RSA encryption algorithm (v1.5) of Public-Key Cryptography Standards number 1 (PKCS #1)

                    RSAES_OAEP_SHA_1

                    +

                    RSAES_OAEP_SHA_1

                    RSA encryption algorithm that uses Optimal Asymmetric Encryption Padding (OAEP) and has the SHA-1 hash function

                    +

                    RSA encryption algorithm that uses Optimal Asymmetric Encryption Padding (OAEP) and has the SHA-1 hash function
                    -

                  9. Click Download. The following files are downloaded: wrappingKey, importToken, and README. These are displayed in Figure 3.

                    Figure 3 Downloaded files
                    +

                    If you stop a key material import process and want to try again, click Import Key Material in the row of the required CMK, and import key material in the dialog box that is displayed.

                    +
                    +

                  10. Click Download. The following files are downloaded: wrappingKey, importToken, and README. These are displayed in Figure 3.

                    Figure 3 Downloaded files
                    • wrappingKey_CMK ID_download time is a wrapping key used to encrypt the key material.
                    • importToken_CMK ID_download time is an import token used to import key material to KMS.
                    • README_CMK ID_download time is a description file recording information such as a CMK's serial number, wrapping algorithm, wrapping key name, token file name, and the expiration time of the token file and wrapping key.

                      The wrapping key and import token expire within 24 hours of creation. If they have expired, download them again.

                    @@ -66,20 +71,20 @@
                  11. Save the import token, copy the content of the import_token token, paste it to a .txt file, and save the file as ImportToken.b64.
                    12. -

                  12. You use the downloaded wrappingKey file to encrypt the key material to be imported.

                    • Method 1: Use the downloaded wrapping key to encrypt the key material on your HSM. For details, see the operation guide of your HSM.
                    • Method 2: Use OpenSSL to encrypt the key material.

                      If you need to run the openssl pkeyutl command, the OpenSSL version must be 1.0.2 or later.

                      +

                    • You use the downloaded wrappingKey file to encrypt the key material to be imported.

                      • Method 1: Use the downloaded wrapping key to encrypt the key material on your HSM. For details, see the operation guide of your HSM.
                      • Method 2: Use OpenSSL to encrypt a key material and use the downloaded wrapping key to encrypt the key material.

                        If you need to run the openssl pkeyutl command, the OpenSSL version must be 1.0.2 or later.

                        The following example describes how to use the downloaded wrapping key to encrypt the generated key material (256-bit symmetric key). The procedure is as follows:
                        1. Run the following command to generate the key material (256-bit symmetric key) and save the generated key material as PlaintextKeyMaterial.bin:

                          openssl rand -out PlaintextKeyMaterial.bin 32

                          -
                        2. Use the downloaded wrapping key to encrypt the key material and save the encrypted key material as EncryptedKeyMaterial.bin.

                          Replace PublicKey.bin in the command with the name of the wrapping key wrappingKey_key ID_download time downloaded in 10.

                          +
                        3. Use the downloaded wrapping key to encrypt the key material and save the encrypted key material as EncryptedKeyMaterial.bin.

                          Replace PublicKey.bin in the command with the name of the wrapping key wrappingKey_key ID_download time downloaded in 9.

                          -
                          Table 2 Encrypting the generated key material using the downloaded wrapping key

                          Wrapping Key Algorithm

                          +
                          - - - - - - -
                          Table 2 Encrypting the generated key material using the downloaded wrapping key

                          Wrapping Key Algorithm

                          Key Materials Encryption

                          +

                          Key Materials Encryption

                          RSAES_OAEP_SHA_256

                          +

                          RSAES_OAEP_SHA_256

                          openssl pkeyutl

                          +

                          openssl pkeyutl

                          -in PlaintextKeyMaterial.bin

                          -inkey PublicKey.bin

                          -out EncryptedKeyMaterial.bin

                          @@ -88,9 +93,9 @@

                          -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256

                          RSAES_PKCS1_V1_5

                          +

                          RSAES_PKCS1_V1_5

                          openssl rsautl -encrypt

                          +

                          openssl rsautl -encrypt

                          -in PlaintextKeyMaterial.bin

                          -pkcs

                          -inkey PublicKey.bin

                          @@ -99,9 +104,9 @@

                          -out EncryptedKeyMaterial.bin

                          RSAES_OAEP_SHA_1

                          +

                          RSAES_OAEP_SHA_1

                          openssl pkeyutl

                          +

                          openssl pkeyutl

                          -in PlaintextKeyMaterial.bin

                          -inkey PublicKey.bin

                          -out EncryptedKeyMaterial.bin

                          @@ -116,48 +121,48 @@ -

                        4. Click Next to go to the Import Key Material step. Configure the parameters as described in Table 3.

                          Figure 4 Importing key material
                          +

                        5. Click Next. Go to the Import Key Material step. Configure the parameters as described in Table 3.

                          Figure 4 Importing key material
                          -
                          Table 3 Parameters for importing key material

                          Parameter

                          +
                          - - - - -
                          Table 3 Parameters for importing key material

                          Parameter

                          Description

                          +

                          Description

                          Key ID

                          +

                          Key ID

                          Random ID of a CMK generated during the CMK creation

                          +

                          Random ID of a CMK generated during the CMK creation

                          Key material

                          +

                          Key material

                          1. Use the key material encrypted by the wrappingKey file downloaded in 10.
                          2. Click Import to import the key material.
                          +
                          1. Use the key material encrypted by the wrappingKey file downloaded in 9.
                          2. Click Import to import the key material.
                          -

                        6. Click Next to go to the Import Key Token step. Configure the parameters as described in Table 4.

                          Figure 5 Importing a key token
                          +

                        7. Click Next to go to the Import Key Token step. Configure the parameters as described in Table 4.

                          Figure 5 Importing a key token
                          -
                          Table 4 Parameters for importing a key token

                          Parameter

                          +
                          - - - - - - - diff --git a/docs/kms/umn/kms_01_0072.html b/docs/kms/umn/kms_01_0072.html index 8d52f043..0657b83c 100644 --- a/docs/kms/umn/kms_01_0072.html +++ b/docs/kms/umn/kms_01_0072.html @@ -1,25 +1,25 @@ -

                          Scheduling the Deletion of One or Multiple CMKs

                          +

                          Deleting One or More CMKs

                          Scenario

                          This section describes how to use the management console to schedule the deletion of one or multiple unwanted CMKs.

                          If deletion is scheduled for a CMK, the deletion will not take effect immediately. Instead, it will take effect after a waiting period of 7 to 1096 days. Before the specified deletion date, you can cancel the deletion if you want to use the CMK. Once the scheduled deletion has taken effect, the CMK will be deleted permanently and you will not be able to decrypt data encrypted by it. Therefore, you are advised to exercise caution when performing this operation.

                          Before deleting the CMK, confirm that it is not in use and will not be used.

                          -
                          • You can configure the SMN notification function to receive notifications when OBS fails to use the CMK to decrypt data before the deletion date. If you want to use the CMK again, cancel its deletion on the console. For SMN configuration instructions, see Configuring SMN.
                          • You can choose Storage > Elastic Volume Service to go to the EVS page. In the search bar, select KMS key ID and enter the CMK ID to check whether the CMK to be deleted is being used by EVS.
                          • You can choose Computing > Image Management Service to go to the IMS page. Select the Private Image tab. In the search bar, select KMS key ID and enter the CMK ID to check whether the CMK to be deleted is being used by IMS.
                          • You can choose Storage > Scalable File Service to go to the SFS page. In the search bar, select KMS key ID and enter the CMK ID to check whether the CMK to be deleted is being used by SFS.
                          • You can choose Database > Relational Database Service to view the database instance list, and click the name of the target database instance. On the details page of the database instance, check whether the key to be deleted is in use.
                          +
                          • You can configure the SMN notification function to receive notifications when OBS fails to use the CMK to decrypt data before the deletion date. If you want to use the CMK again, cancel its deletion on the console. For SMN configuration instructions, see Configuring SMN.
                          • You can choose Storage > Elastic Volume Service to go to the EVS page. In the search bar, select KMS key ID and enter the CMK ID to check whether the CMK to be deleted is being used by EVS.
                          • You can choose Computing > Image Management Service to go to the IMS page. Select the Private Image tab. In the search bar, select KMS key ID and enter the CMK ID to check whether the CMK to be deleted is being used by IMS.
                          • You can choose Storage > Scalable File Service to go to the SFS page. In the search bar, select KMS key ID and enter the CMK ID to check whether the CMK to be deleted is being used by SFS.
                          • You can choose Database > Relational Database Service to view the database instance list, and click the name of the target database instance. On the details page of the database instance, check whether the key to be deleted is in use.

                          Default Master Keys created by KMS cannot be scheduled for deletion.

                          -

                          Prerequisites

                          • You have obtained an account and its password for logging in to the management console.
                          • The CMK to be deleted is in Enabled, Disabled, or Pending Import status.
                          +

                          Prerequisites

                          • The CMK to be deleted is in Enabled, Disabled, or Pending Import status.
                          -

                          Procedure

                          1. Log in to the management console.
                          2. Click in the upper left corner of the management console and select a region or project.
                          3. Choose Security > Key Management Service. The Key Management Service page is displayed.
                          4. In the row containing the desired CMK, click Delete.

                            Figure 1 Scheduling the deletion for one CMK
                            +

                            Procedure

                            1. Log in to the management console.
                            2. Click in the upper left corner of the management console and select a region or project.
                            3. Choose Security > Key Management Service . The key management page is displayed.
                            4. In the row containing the desired CMK, click Delete.

                              Figure 1 Scheduling the deletion for one CMK

                            5. In the dialog box that is displayed, enter the number of days after which you want the deletion to take effect.

                              Figure 2 Scheduling a deletion time
                              -

                            6. Click Yes to schedule the deletion.

                              To delete multiple CMKs at a time, select them and click Delete in the upper left corner of the list.

                              +

                            7. Click Yes to schedule the deletion.

                              To delete multiple CMKs at a time, select them and click Delete in the upper left corner of the list.

                          -
                          Parent topic: Management
                          +
                          Parent topic: Managing CMKs
                          diff --git a/docs/kms/umn/kms_01_0074.html b/docs/kms/umn/kms_01_0074.html index 4f61f6e4..2e83146c 100644 --- a/docs/kms/umn/kms_01_0074.html +++ b/docs/kms/umn/kms_01_0074.html @@ -2,6 +2,41 @@

                          What Is a Customer Master Key?

                          A Customer Master Key (CMK) is a Key Encryption Key (KEK) created by a user using KMS. It is used to encrypt and protect Data Encryption Keys (DEKs). One CMK can be used to encrypt one or multiple DEKs.

                          +
                          CMKs are categorized into custom keys and default keys.
                          • Custom keys

                            Keys created or imported by users on the KMS console.

                            +
                          • Default keys

                            When a user uses KMS for encryption in a cloud service for the first time, the cloud service automatically creates a key with the alias suffix /default.

                            +

                            On the KMS console, you can query Default Master Keys, but can neither disable them nor schedule their deletion.

                            + +
                          Table 4 Parameters for importing a key token

                          Parameter

                          Description

                          +

                          Description

                          Key ID

                          +

                          Key ID

                          Random ID of a CMK generated during the CMK creation

                          +

                          Random ID of a CMK generated during the CMK creation

                          Token

                          +

                          Token

                          Select the importToken downloaded in 10.

                          +

                          Select the importToken downloaded in 9.

                          Key material expiration mode

                          +

                          Key material expiration mode

                          • Key material will never expire: This option specifies that key material will not expire after import.
                          • Key material expires on: This option specifies the expiration time of the key material. By default, the key material expires in 24 hours after import.

                            When the key material expires, KMS will delete them in 24 hours, making the CMK unusable and the CMK status Pending import.

                            +
                          • Key material will never expire: This option specifies that key material will not expire after import.
                          • Key material expires on: This option specifies the expiration time of the key material. By default, the key material expires in 24 hours after import.

                            When the key material expires, KMS will delete them in 24 hours, making the CMK unusable and the CMK status Pending import.
                          + + + + + + + + + + + + + + + + +
                          Table 1 Default Master Keys

                          Alias

                          +

                          Cloud Service

                          +

                          obs/default

                          +

                          Object Storage Service (OBS)

                          +

                          evs/default

                          +

                          Elastic Volume Service (EVS)

                          +

                          ims/default

                          +

                          Image Management Service (IMS)

                          +

                          sfs/default

                          +

                          Scalable File Service (SFS)

                          +
                          +
                          + +
                          diff --git a/docs/kms/umn/kms_01_0094.html b/docs/kms/umn/kms_01_0094.html index b81e4b0f..cf93d351 100644 --- a/docs/kms/umn/kms_01_0094.html +++ b/docs/kms/umn/kms_01_0094.html @@ -1,48 +1,68 @@ -

                          Context

                          -

                          Security risks exist when a DEK is extensively and repeatedly used. For security purposes, you can configure KMS to create new key materials for the CMK.

                          -

                          New key materials can be created in two methods:

                          -
                          • Manual key rotation
                            Create a CMK on the KMS management console to replace the original CMK.

                            If cloud services (such as OBS) use a CMK to encrypt and decrypt data, you need to create a new CMK on the KMS management console and replace the original one used for KMS encryption on OBS Console.

                            +

                            Key Rotation Overview

                            +

                            Purpose of Key Rotation

                            Keys that are widely or repeatedly used are insecure. To enhance the security of encryption keys, you are advised to periodically rotate keys and change their key materials.

                            +

                            The purposes of key rotation are:

                            +
                            • To reduce the amount of data encrypted by each key.

                              A key will be insecure if it is used to encrypt a huge number of data. The amount of data encrypted a key refers to the total number of bytes or messages encrypted using the key.

                              +
                            • To enhance the capability of responding to security events.

                              In your initial system security design, you shall design the key rotation function and use it for routine O&M, so that it will be at hand when an emergency occurs.

                              +
                            • To enhance the data isolation capability.

                              The ciphertext data generated before and after key rotation will be isolated. You can identify the impact scope of a security event based on the key involved and take actions accordingly.

                              +
                            +
                            +

                            Key Rotation Methods

                            You can use either of the following key rotation methods:

                            +
                            • Manual key rotation

                              Replace the key in use with a new key. For example, if key A is in use, you can create key B using a new encryption material, and replace key A with key B. This achieves the same outcome as changing the key material of key A.

                              +

                              +

                              Take OBS as an example. To manually rotate a key, create a new custom key on the KMS console. Replace the old custom key with the new one on the OBS console.

                              +
                              Figure 1 Manual key rotation
                              +
                            • Automatic key rotation

                              KMS automatically rotates keys based on the configured rotation period (365 days by default). The system automatically generates a new key to replace the key in use. Automatic key rotation only changes the key material of a CMK. The logical attributes of the key will not change, including its key ID, alias, description, and permissions.

                              +

                              Automatic key rotation has the following characteristics:

                              +
                              1. Enable rotation for an existing custom key. KMS will automatically generate new key materials for the custom key.
                              2. Data is not re-encrypted in an automatic key rotation. The DEK generated using the CMK is not automatically rotated, and data that has been encrypted using the CMK will not be encrypted again. If a DEK has been leaked, automatic rotation cannot contain the impact of the leakage.
                              +
                              Figure 2 Key rotation
                              +
                            +
                            KMS retains all versions of a custom key, so that you can decrypt any ciphertext encrypted using the custom key.
                            • KMS uses the latest version of the custom key to encrypt data.
                            • When decrypting data, KMS uses the custom key version that was used to encrypt the data.
                            +
                            -
                          • Automatic key rotation

                            Enable rotation for an existing CMK so that KMS automatically generates new key material for the CMK.

                            -

                            Key rotation only changes the key material of a CMK. The CMK's attributes (such as ID, alias, description, and permissions settings) remain unchanged.

                            -

                            The key rotation function enables KMS to automatically rotate CMKs according to the specified rotation interval (365 days by default). For a CMK with the key rotation function enabled, a new version is generated upon each rotation. See Figure 1 for details.

                            -
                            Figure 1 Working principle of key rotation
                            -

                            KMS retains all versions associated of the CMK, so that you can decrypt any ciphertext encrypted using the CMK.

                            -
                            • KMS uses the latest version of the CMK to encrypt data.
                            • KMS uses the same version of the CMK to decrypt data as that used to encrypt the data.
                            - -
                            Table 1 Key rotation modes

                            Key Type

                            +

                            Rotation Modes

                            +
                            - - - - - - - - - + + +
                            Table 1 Key rotation modes

                            Key Type

                            Support for Key Rotation

                            +

                            Rotation Mode

                            Default Master Key

                            +

                            Default master key

                            Keys cannot be rotated.

                            +

                            Cannot be rotated.

                            Imported CMK

                            +

                            User-defined key (imported CMK)

                            Keys can only be rotated manually.

                            +

                            Can only be manually rotated.

                            +

                            For more information about user-defined keys, see CMK Overview.

                            Disabled CMK

                            +

                            Symmetric key

                            KMS does not rotate disabled CMKs and keeps their rotation status unchanged. After a CMK is enabled, if the backup CMK has been used for longer than the rotation period, KMS will immediately rotate keys. If the backup CMK has been used for shorter than the rotation period, KMS will implement the original rotation plan.

                            +

                            Can be automatically or manually rotated.

                            CMK in pending deletion status

                            +

                            Disabled CMK

                            KMS does not rotate CMKs in pending deletion status. After you cancel the deletion of a CMK, the previous key rotation status will be restored. If the backup CMK has been used for longer than the rotation period, KMS will immediately rotate keys. If the backup CMK has been used for shorter than the rotation period, KMS will implement the original rotation plan.

                            +

                            Disabled CMKs are not rotated. KMS keeps their rotation status unchanged. After a CMK is enabled, if it has been used for longer than the rotation period, KMS will immediately rotate keys. If the CMK has been used for shorter than the rotation period, KMS will implement the original rotation plan.

                            +

                            For more information, see Disabling One or More CMKs.

                            +

                            CMKs in pending deletion state

                            +

                            Disabled CMKs are not rotated. KMS keeps their rotation status unchanged. After a CMK is enabled, if it has been used for longer than the rotation period, KMS will immediately rotate keys. If the CMK has been used for shorter than the rotation period, KMS will implement the original rotation plan.

                            +

                            For more information, see Scheduling the Deletion of One or More Keys.
                            - +

                            You can check the rotation details on the Rotation Policy page, including the last rotation time and number of rotations.

                            +
                            +
                            diff --git a/docs/kms/umn/kms_01_0095.html b/docs/kms/umn/kms_01_0095.html index 04a58b4d..d05e2252 100644 --- a/docs/kms/umn/kms_01_0095.html +++ b/docs/kms/umn/kms_01_0095.html @@ -3,9 +3,9 @@

                            Disabling Key Rotation

                            Scenario

                            This section describes how to disable rotation for a key on the KMS console.

                            -

                            Prerequisites

                            • You have obtained an account and its password for logging in to the management console.
                            • The CMK is in Enabled status.
                            • The Origin of the CMK is KMS.
                            • Key rotation has been enabled.
                            +

                            Prerequisites

                            • The CMK is in Enabled status.
                            • The Origin of the CMK is KMS.
                            • Key rotation has been enabled.
                            -

                            Procedure

                            1. Log in to the management console.
                            2. Click in the upper left corner of the management console and select a region or project.
                            3. Choose Security > Key Management Service. The Key Management Service page is displayed.
                            4. Click the alias of the desired CMK to view its details.
                            5. Click Rotation Policy. The dialog box is displayed, as shown in Figure 1.

                              Figure 1 CMK rotation details
                              +

                              Procedure

                              1. Log in to the management console.
                              2. Click in the upper left corner of the management console and select a region or project.
                              3. Choose Security > Key Management Service . The key management page is displayed.
                              4. Click the alias of the desired CMK to view its details.
                              5. Click Rotation Policy. The dialog box is displayed, as shown in Figure 1.

                                Figure 1 CMK rotation details

                              6. Click to disable key rotation.
                              7. In the displayed Disable Rotation Policy dialog box, click Yes.

                                Figure 2 Disabling key rotation

                              8. Check the rotation status, as shown in Figure 3.

                                Figure 3 Key rotation

                              diff --git a/docs/kms/umn/kms_01_0096.html b/docs/kms/umn/kms_01_0096.html index c492df0c..da14f566 100644 --- a/docs/kms/umn/kms_01_0096.html +++ b/docs/kms/umn/kms_01_0096.html @@ -1,29 +1,27 @@

                              Querying a CMK

                              -

                              Scenario

                              This section describes how to use the management console to view the information about a CMK, such as its alias, status, ID, and creation time. The status of a CMK can be Enabled, Disabled, Pending deletion, or Pending import.

                              +

                              Scenario

                              This section describes how to use the management console to view the information about a CMK, such as its alias, status, ID, and creation time. The status of a CMK can be Enabled, Disabled, Pending deletion, or Pending import.

                              -

                              Prerequisites

                              You have obtained an account and its password for logging in to the management console.

                              -
                              -

                              Procedure

                              1. Log in to the management console.
                              2. Click in the upper left corner of the management console and select a region or project.
                              3. Choose Security > Key Management Service. The Key Management Service page is displayed.
                              4. In the CMK list you can view details about the CMKs.

                                Figure 1 CMK list
                                +

                                Procedure

                                1. Log in to the management console.
                                2. Click in the upper left corner of the management console and select a region or project.
                                3. Choose Security > Key Management Service . The key management page is displayed.
                                4. In the CMK list you can view details about the CMKs.

                                  Figure 1 CMK list
                                  • Select the CMK status from the drop-down list of All statuses. Then the CMK list displays only the CMKs in the corresponding state.
                                  • Enter the alias of a CMK in the search box on top of the CMK list. Click or press Enter to search for the specified CMK.
                                  • You can click Search Tag to search for the CMK that meets the search criteria.
                                  • You can click at the upper right corner on top of the CMK list to show or hide columns of the CMK list.

                                  Table 1 describes the parameters of a CMK list.

                                  -
                                  Table 1 CMK list parameters

                                  Parameter

                                  +
                                  - - - - - - - - - - - - -
                                  Table 1 CMK list parameters

                                  Parameter

                                  Description

                                  +

                                  Description

                                  Alias

                                  +

                                  Alias

                                  Alias of a CMK

                                  +

                                  Alias of a CMK

                                  Status

                                  +

                                  Status

                                  Status of a CMK, which can be one of the following:

                                  +

                                  Status of a CMK, which can be one of the following:

                                  • Enabled

                                    The CMK is enabled.

                                  • Disabled

                                    The CMK is disabled.

                                  • Pending deletion

                                    The CMK is scheduled for deletion.

                                    @@ -31,24 +29,24 @@

                                  ID

                                  +

                                  ID

                                  Random ID of a CMK generated during the CMK creation

                                  +

                                  Random ID of a CMK generated during the CMK creation

                                  Creation Time

                                  +

                                  Creation Time

                                  Creation time of the CMK

                                  +

                                  Creation time of the CMK

                                  Expiration Time

                                  +

                                  Expiration Time

                                  Expiration time of the key material. When the material expires, the CMK becomes an empty CMK.

                                  +

                                  Expiration time of the key material. When the material expires, the CMK becomes an empty CMK.

                                  Origin

                                  +

                                  Origin

                                  Source of key material, which can be one of the following:

                                  +

                                  Source of key material, which can be one of the following:

                                  • External

                                    You import the key material for the CMK.

                                  • Key Management Service

                                    The CMK uses KMS-generated material.

                                  diff --git a/docs/kms/umn/kms_01_0100.html b/docs/kms/umn/kms_01_0100.html new file mode 100644 index 00000000..51105985 --- /dev/null +++ b/docs/kms/umn/kms_01_0100.html @@ -0,0 +1,12 @@ + + +

                                  Product Advantages

                                  +
                                  • Extensive Service Integration

                                    KMS can be integrated with Object Storage Service (OBS), Elastic Volume Service (EVS), and Image Management Service (IMS), to manage keys of these services on the KMS console, and encrypt and decrypt your local data by making the KMS API calls.

                                    +
                                  • Regulatory Compliance
                                  +
                                  +
                                  +
                                  +
                                  Parent topic: Key Management
                                  +
                                  +
                                  + diff --git a/docs/kms/umn/kms_01_0101.html b/docs/kms/umn/kms_01_0101.html new file mode 100644 index 00000000..7d5221c7 --- /dev/null +++ b/docs/kms/umn/kms_01_0101.html @@ -0,0 +1,39 @@ + + +

                                  What Are the Differences Between a Custom Key and a Default Key?

                                  +

                                  The following table describes the differences between a custom key and a default key.

                                  + +
                                  + + + + + + + + + + + + + +
                                  Table 1 Differences between a custom key and a default key

                                  Item

                                  +

                                  Definition

                                  +

                                  Difference

                                  +

                                  Custom key

                                  +

                                  A Key Encryption Key (KEK) created using KMS. The key is used to encrypt and protect DEKs.

                                  +

                                  A custom key can be used to encrypt multiple DEKs.

                                  +
                                  • It can be disabled and scheduled for deletion.
                                  • It is billed per use after the being created or imported.
                                  +

                                  Default key

                                  +

                                  Automatically generated by the system when you use KMS to encrypt data in another cloud service for the first time. The suffix of the key is /default.

                                  +

                                  Example: evs/default

                                  +
                                  • It cannot be disabled or scheduled for deletion.
                                  • You are not charged when you use the cloud service automatically generated by the system. If the number of API requests exceeds 20,000, you will be billed.
                                  +
                                  +
                                  +
                                  +
                                  +
                                  +
                                  Parent topic: FAQs
                                  +
                                  +
                                  + diff --git a/docs/kms/umn/kms_01_0102.html b/docs/kms/umn/kms_01_0102.html new file mode 100644 index 00000000..8727239a --- /dev/null +++ b/docs/kms/umn/kms_01_0102.html @@ -0,0 +1,12 @@ + + +

                                  Can I Export a CMK from KMS?

                                  +

                                  No.

                                  +

                                  To ensure CMK security, users can only create and use CMKs in KMS.

                                  +
                                  +
                                  +
                                  +
                                  Parent topic: FAQs
                                  +
                                  +
                                  + diff --git a/docs/kms/umn/kms_01_0106.html b/docs/kms/umn/kms_01_0106.html new file mode 100644 index 00000000..32a95500 --- /dev/null +++ b/docs/kms/umn/kms_01_0106.html @@ -0,0 +1,23 @@ + + +

                                  What Are the Benefits of Envelope Encryption?

                                  +

                                  Envelope encryption is the practice of encrypting data with a DEK and then encrypting the DEK with a root key that you can fully manage. In this case, CMKs are not required for encryption or decryption.

                                  +

                                  Benefits:

                                  +
                                  • Advantages over CMK encryption in KMS

                                    Users can use CMKs to encrypt and decrypt data on the KMS console or by calling KMS APIs.

                                    +

                                    A CMK can encrypt and decrypt data no more than 4 KB. An envelope can encrypt and decrypt larger volumes of data.

                                    +

                                    Data encrypted using envelopes does not need to be transferred. Only the DEKs need to be transferred to the KMS server.

                                    +
                                  • Advantages over encryption by using cloud services
                                    • Security

                                      Data transferred to the cloud for encryption is exposed to risks such as interception and phishing.

                                      +

                                      During envelope encryption, KMS uses Hardware Security Modules (HSMs) to protect keys. All CMKs are protected by root keys in HSMs to avoid key leakage.

                                      +
                                    • Trustworthiness

                                      You will worry about data security on the cloud. It is also difficult for cloud services to prove that they never misuse or disclose such data.

                                      +

                                      If you choose envelope encryption, KMS will control access to keys and record all usages of and operations on keys with traceable logs, meeting your audit and regulatory compliance requirements.

                                      +
                                    • Performance and cost

                                      To encrypt or decrypt data using a cloud service, you have to send the data to the encryption server and receive the processed data. This process seriously affects your service performance and incurs high costs.

                                      +

                                      Envelope encryption allows you to generate DEKs online by calling KMS cryptographic algorithm APIs, and to encrypt a large amount of local data with the DEKs.

                                      +
                                    +
                                  +
                                  +
                                  +
                                  +
                                  Parent topic: FAQs
                                  +
                                  +
                                  + diff --git a/docs/kms/umn/kms_01_0107.html b/docs/kms/umn/kms_01_0107.html new file mode 100644 index 00000000..6e8931ee --- /dev/null +++ b/docs/kms/umn/kms_01_0107.html @@ -0,0 +1,21 @@ + + +

                                  How Do I Use the Online Tool to Encrypt or Decrypt Small Volumes of Data?

                                  +

                                  You can use the online tool to encrypt or decrypt data in the following procedures:

                                  +

                                  Encrypting Data

                                  1. Log in to the management console.
                                  2. Click in the upper left corner of the management console and select a region or project.
                                  3. Choose Security > Key Management Service . The key management page is displayed.
                                  4. Click the alias of the desired CMK to view its details on the online data encryption page.
                                  5. Click Encrypt. In the text box on the left, enter the data to be encrypted.
                                  6. Click Execute. The data encryption result is displayed in the text box on the right.

                                    • The key you clicked is used for encryption.
                                    • To clear your input, click Clear.
                                    • To copy the encrypted data, click Copy to Clipboard. You can then paste and save it to a local file.
                                    +
                                    +

                                  +
                                  +

                                  Decrypting Data

                                  1. Log in to the management console.
                                  2. Click in the upper left corner of the management console and select a region or project.
                                  3. Choose Security > Key Management Service . The key management page is displayed.
                                  4. Click the alias of an enabled key (excepting Default Master Keys) to open the online tool page.
                                  5. Click Decrypt. In the text box on the left, enter the data to be decrypted.

                                    • The online tool automatically identifies the key used for data encryption, and uses it to decrypt data.
                                    • If the key has been deleted, the decryption will fail.
                                    +
                                    +

                                  6. Click Execute. The data decryption result is displayed in plaintext in the text box on the right.

                                    To copy the decrypted data, click Copy to Clipboard. You can then paste and save it to a local file.

                                    +
                                    +

                                  +
                                  +
                                  +
                                  +
                                  +
                                  Parent topic: FAQs
                                  +
                                  +
                                  + diff --git a/docs/kms/umn/kms_01_0109.html b/docs/kms/umn/kms_01_0109.html new file mode 100644 index 00000000..17d9aac5 --- /dev/null +++ b/docs/kms/umn/kms_01_0109.html @@ -0,0 +1,17 @@ + + +

                                  Service Overview

                                  +
                                  + + diff --git a/docs/kms/umn/kms_01_0114.html b/docs/kms/umn/kms_01_0114.html new file mode 100644 index 00000000..b6766e4d --- /dev/null +++ b/docs/kms/umn/kms_01_0114.html @@ -0,0 +1,12 @@ + + +

                                  Can I Update CMKs Created by KMS-Generated Key Materials?

                                  +

                                  No.

                                  +

                                  Keys created using KMS-generated materials cannot be updated. You can only use KMS to create new CMKs to encrypt and decrypt data.

                                  +
                                  +
                                  +
                                  +
                                  Parent topic: FAQs
                                  +
                                  +
                                  + diff --git a/docs/kms/umn/kms_01_0138.html b/docs/kms/umn/kms_01_0138.html index 9f8c5684..b32acc6b 100644 --- a/docs/kms/umn/kms_01_0138.html +++ b/docs/kms/umn/kms_01_0138.html @@ -1,11 +1,10 @@

                                  Rotating CMKs

                                  -

                                  -
                                  +
                                  -
                                  Parent topic: Management
                                  +
                                  Parent topic: Key Management
                                  diff --git a/docs/kms/umn/kms_01_0139.html b/docs/kms/umn/kms_01_0139.html index 0d6b9adc..61039c45 100644 --- a/docs/kms/umn/kms_01_0139.html +++ b/docs/kms/umn/kms_01_0139.html @@ -4,9 +4,9 @@

                                  Scenario

                                  This section describes how to enable rotation for a key on the KMS console.

                                  By default, automatic key rotation is disabled for a CMK. Every time you enable key rotation, KMS automatically rotates CMKs based on the rotation period you set.

                                  -

                                  Prerequisites

                                  • You have obtained an account and its password for logging in to the management console.
                                  • The CMK is in Enabled status.
                                  • The Origin of the CMK is KMS.
                                  +

                                  Prerequisites

                                  • The CMK is in Enabled status.
                                  • The Origin of the CMK is KMS.
                                  -

                                  Procedure

                                  1. Log in to the management console.
                                  2. Click in the upper left corner of the management console and select a region or project.
                                  3. Choose Security > Key Management Service. The Key Management Service page is displayed.
                                  4. Click the alias of the desired CMK to view its details.
                                  5. Click Rotation Policy.

                                    Figure 1 Key rotation
                                    +

                                    Procedure

                                    1. Log in to the management console.
                                    2. Click in the upper left corner of the management console and select a region or project.
                                    3. Choose Security > Key Management Service . The key management page is displayed.
                                    4. Click the alias of the desired CMK to view its details.
                                    5. Click Rotation Policy.

                                      Figure 1 Key rotation

                                    6. Click to enable key rotation.
                                    7. In the Enable Rotation Policy dialog box, set the rotation period and click OK.

                                      Figure 2 Setting the rotation period

                                      Set the rotation period (unit: day) to an integer in the range 30 to 365. The default value is 365.

                                      After the setting takes effect, the new rotation period starts.

                                      diff --git a/docs/kms/umn/kms_01_0193.html b/docs/kms/umn/kms_01_0193.html new file mode 100644 index 00000000..f20ab6cc --- /dev/null +++ b/docs/kms/umn/kms_01_0193.html @@ -0,0 +1,11 @@ + + +

                                      How Does KMS Protect My Keys?

                                      +

                                      The mechanism of KMS prevents anyone from accessing your keys in plaintext. KMS relies on hardware security modules (HSMs) that safeguard the confidentiality and integrity of your keys. Plaintext KMS keys are always encrypted by HSMs and are never stored on any disk. These keys are only utilized within the volatile memory of the HSMs for as long as necessary to perform the cryptographic operation you have requested.

                                      +
                                      +
                                      +
                                      +
                                      Parent topic: FAQs
                                      +
                                      +
                                      + diff --git a/docs/kms/umn/kms_01_0196.html b/docs/kms/umn/kms_01_0196.html new file mode 100644 index 00000000..9cf67c1a --- /dev/null +++ b/docs/kms/umn/kms_01_0196.html @@ -0,0 +1,11 @@ + + +

                                      User Guide

                                      +
                                      +
                                      + +
                                      + diff --git a/docs/kms/umn/kms_01_0198.html b/docs/kms/umn/kms_01_0198.html new file mode 100644 index 00000000..ff440fa8 --- /dev/null +++ b/docs/kms/umn/kms_01_0198.html @@ -0,0 +1,11 @@ + + +

                                      Is There a Limit on the Number of CMKs That I Can Create on KMS?

                                      +

                                      Yes.

                                      +
                                      +
                                      +
                                      +
                                      Parent topic: FAQs
                                      +
                                      +
                                      + diff --git a/docs/kms/umn/kms_01_194.html b/docs/kms/umn/kms_01_194.html new file mode 100644 index 00000000..67823b2d --- /dev/null +++ b/docs/kms/umn/kms_01_194.html @@ -0,0 +1,32 @@ + + +

                                      Creating a Key

                                      +

                                      Scenario

                                      This section describes how to create a CMK on the KMS management console. You can create up to 100 CMKs, excluding Default Master Keys.

                                      +
                                      The CMK is perfectly suited for but not limited to the following scenarios:
                                      • Server-side encryption on OBS
                                      • Encryption of data on EVS disks
                                      • Encryption of private images on IMS
                                      • File system encryption on SFS
                                      • Disk encryption for database instances in RDS
                                      • DEK encryption and decryption for user applications
                                      +
                                      +

                                      Aliases of Default Master Keys end with /default. It is not allowed to use aliases ending with /default for your CMKs.

                                      +
                                      +
                                      +

                                      Procedure

                                      1. Log in to the management console.
                                      2. Click in the upper left corner of the management console and select a region or project.
                                      3. Choose Security > Key Management Service . The key management page is displayed.
                                      4. Click Create Key in the upper right corner of the page. In the dialog box that is displayed, enter the alias and description of the key.

                                        Figure 1 Create Key dialog box
                                        +
                                        • Alias is the alias of the CMK to be created.
                                        • (Optional) Description is the description of the CMK.
                                        +

                                      5. (Optional) Add tags as needed, and enter the tag key and tag value.

                                        • When a CMK has been created without any tag, you can add a tag to the CMK later as necessary. Click the alias of the CMK. The page with key details is displayed. Then you can add tags to the CMK.
                                        • The same tag (including tag key and tag value) can be used for different CMKs. However, under the same CMK, one tag key can have only one tag value.
                                        • A maximum of 10 tags can be added for one CMK.
                                        • If you want to delete a tag to be added when adding multiple tags, you can click Delete in the row where the tag to be added is located to delete the tag.
                                        +
                                        +

                                      6. Click OK.

                                        In the CMK list, you can view created CMKs. The default status of a CMK is Enabled.

                                        +

                                      +
                                      +

                                      Related Operations

                                      • For details about how to upload objects with server-side encryption, see section Uploading a File with Server-Side Encryption in the Object Storage Service User Guide.
                                      • For details about how to encrypt data on EVS disks, see section Creating an EVS Disk in the Elastic Volume Service User Guide.
                                      • For details about how to encrypt private images, see section Encrypting an Image in the Image Management Service User Guide.
                                      • For details about how to encrypt the file system on SFS, see section Creating a File System in the Scalable File Service User Guide.
                                      • For details about how to encrypt disks for a database instance in RDS, see section Creating an RDS MySQL DB Instance in the Relational Database Service User Guide.
                                      • For details about how to create a DEK and a plaintext-free DEK, see sections Creating a DEK and Creating a Plaintext-Free DEK in .
                                      • For details about how to encrypt and decrypt a DEK for a user application, see sections Encrypting a DEK and Decrypting a DEK in .
                                      +
                                      +
                                      +
                                      +
                                      +
                                      Parent topic: Key Management
                                      +
                                      +
                                      + + + \ No newline at end of file diff --git a/docs/kms/umn/kms_01_9997.html b/docs/kms/umn/kms_01_9997.html index 1a086c73..a76acefe 100644 --- a/docs/kms/umn/kms_01_9997.html +++ b/docs/kms/umn/kms_01_9997.html @@ -5,34 +5,28 @@
                                      • Create IAM users for employees based on the organizational structure of your enterprise. Each IAM user has its own security credentials to access KMS resources.
                                      • Grant users only the permissions required to perform a task.
                                      • Entrust an account or cloud service to perform efficient O&M on your KMS resources.

                                      If your account does not need individual IAM users, you may skip over this chapter.

                                      This section describes the procedure for granting permissions (see Figure 1).

                                      -

                                      Prerequisites

                                      Before authorizing permissions to a user group, you need to know which KMS permissions can be added to the user group. Table 1 lists the KMS system policies.

                                      +

                                      Prerequisites

                                      Before authorizing permissions to a user group, you need to know which KMS permissions can be added to the user group. System-defined roles and policies supported by DEW describes the KMS system policies.

                                      -
                                      Table 1 KMS permissions

                                      Role/Policy Name

                                      +
                                      - - - - - - - - - - - @@ -42,6 +36,7 @@

                                      Authorization Process

                                      Figure 1 Authorizing the KMS access permission to a user

                                      1. Create a user group on the IAM console and grant the user group the KMS CMKFullAccess permission (indicating full permissions for keys).

                                      2. Create a user on the IAM console and add the user to the user group created in 1.

                                        +

                                      3. Log in to the console as newly created user, and verify that the user only has read permissions for DEW.

                                      diff --git a/docs/kms/umn/kms_01_9998.html b/docs/kms/umn/kms_01_9998.html index cb191021..6dec60fa 100644 --- a/docs/kms/umn/kms_01_9998.html +++ b/docs/kms/umn/kms_01_9998.html @@ -11,7 +11,7 @@
                                      -
                                      Parent topic: Management
                                      +
                                      Parent topic: Key Management
                                      diff --git a/docs/kms/umn/kms_01_9999.html b/docs/kms/umn/kms_01_9999.html index 770987e8..1a9c9179 100644 --- a/docs/kms/umn/kms_01_9999.html +++ b/docs/kms/umn/kms_01_9999.html @@ -1,7 +1,7 @@ -

                                      KMS Permissions Management

                                      -

                                      If you want to assign different access permissions to employees in an enterprise for the KMS resources purchased on the cloud platform, you can use Identity and Access Management (IAM) to perform refined permission management. IAM provides identity authentication, permissions management, and access control, helping you secure the access to your cloud resources.

                                      +

                                      Permissions Management

                                      +

                                      If you want to assign different access permissions to employees in an enterprise for the KMS resources purchased on the cloud platform, you can use Identity and Access Management (IAM) to perform refined permission management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your resources.

                                      With IAM, you can use your account to create IAM users for your employees, and assign permissions to control their access to specific resource types. For example, if you have software developers and you want to assign them the permission to access KMS but not to delete KMS or its resources, then you can create an IAM policy to assign the developers the permission to access KMS but prevent them from deleting KMS related data.

                                      If the system account has met your requirements and you do not need to create an independent IAM user for permission control, then you can skip this section. This will not affect other functions of KMS.

                                      KMS Permissions

                                      By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles to these groups. Users inherit permissions from the groups they are added to and can perform specified operations on cloud services based on the permissions.

                                      @@ -10,40 +10,34 @@
                                      • Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you must also assign other roles that the permissions depend on to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.
                                      • Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, you can grant KMS users only the permissions for managing a certain type of cloud servers. Most policies contain permissions for specific APIs, and permissions are defined using API actions.

                                      For more information, see Table 1.

                                      -
                                      Table 1 KMS permissions

                                      Role/Policy Name

                                      Description

                                      +

                                      Description

                                      Type

                                      -

                                      Dependency

                                      +

                                      Type

                                      KMS Administrator

                                      +

                                      KMS Administrator

                                      Administrator permissions for the encryption key

                                      +

                                      Administrator permissions for the encryption key

                                      System role

                                      -

                                      None

                                      +

                                      System role

                                      KMS CMKFullAccess

                                      +

                                      KMS CMKFullAccess

                                      All permissions for the encryption key

                                      +

                                      All permissions for the encryption keys

                                      System policy

                                      -

                                      None

                                      +

                                      System policy
                                      Table 1 KMS permissions

                                      Role/Policy Name

                                      +
                                      - - - - - - - - - - -
                                      Table 1 KMS permissions

                                      Role/Policy Name

                                      Description

                                      +

                                      Description

                                      Type

                                      -

                                      Dependency

                                      +

                                      Type

                                      KMS Administrator

                                      +

                                      KMS Administrator

                                      Administrator permissions for the encryption key

                                      +

                                      Administrator permissions for the encryption key

                                      System role

                                      -

                                      None

                                      +

                                      System role

                                      KMS CMKFullAccess

                                      +

                                      KMS CMKFullAccess

                                      All permissions for the encryption key

                                      +

                                      All permissions for the encryption keys

                                      System policy

                                      -

                                      None

                                      +

                                      System policy
                                      -

                                      Table 2 lists the common operations supported by each system-defined permission of KMS. Select the permissions as needed.

                                      +

                                      The following table describes the common operations supported by each system-defined permission of KMS. Select the permissions as needed.

                                      -
                                      Table 2 Common operations supported by each system-defined policy or role

                                      Operation

                                      +
                                      @@ -310,7 +304,7 @@
                                      -
                                      Parent topic: Accessing and Using KMS
                                      +
                                      Parent topic: Service Overview
                                      diff --git a/docs/kms/umn/public_sys-resources/icon-arrowdn.gif b/docs/kms/umn/public_sys-resources/icon-arrowdn.gif index 84eec9be2f2ce458e888f8a9b803f9387247726a..379428032932289326e52c2772bd90ba3d88b906 100644 GIT binary patch literal 1887 zcmZ?wbhEHbCgqow z*eU^C3h_d20o>TUVm+{T^pf*)^(zt!^bPe4Kwg3=^!3HBG&dKny0|1L72#g21{a4^ z7NqJ2r55Lx7A2Jm>Ih`8X1|p zSh~8p7&*iAy5uL9=BDPA!1Sgd^t#~G3rY&P1wfl!Qj0RnQd8WD@^clyUbf1_?G{Iz z=0WwQ;C71>PQCg-$LND17Ac}(Lcr7mV#1RxkONQnsd>QEUIa|mjQ{`r{qy_R&mZ5v zef{$J)5j0*-@SeF`qj%9&!0Vg^7zri2lwyYy>t84%^TORUA=Po(!~qs&z(JU`qar2 z$B!L7a`@1}1N-;w-Lrew&K=vgZQZhY)5ZeMTG_VdAT{+S(zE> zX{jm6Nr?&Zaj`McQIQehVWA3>*p!%p5Wn0u7E$th{n6D>ft^YU5&dnB%c=(a~-RV>2EO25SIA CZ-yWM literal 68 zcmZ?wbhEHbzkByxQ$u Mo$o?7J5~m305MV#!~g&Q diff --git a/docs/kms/umn/public_sys-resources/icon-arrowrt.gif b/docs/kms/umn/public_sys-resources/icon-arrowrt.gif index 39583d168d6db303b366b5b8c1780698a6bb6017..6aaaa11c23e919c4798d7dcd2b1ae98dd35dd316 100644 GIT binary patch literal 1890 zcmZ?wbhEHb7yetOgf{ zR2HP_2c;J0mlh?b0+lO+tSYc_E=o--$uA1Y&(DE{Vn9ZINq%ugeu08>u$h8JcxGNo zetEGbSiP^Wm1kaYNn&1ds;7&s63_&_%*+%k11Cod14Ab>6ALqQLqk^=3j-5FHzP|& zBUd9gQwvj9m|mCsATTyHM;rzL?XHK6w zdE)r7qel)OI(T6JzP)>P@7lRz`?jrHHgDRvVg0(bYgVsXxnlXUrArnsTDV~Tyt#8` z&zd=7`n0K2CQq6;p}()Ur@O1OqrI)QrMaoGp}wxRrn;)KqP(oMq`0WCAU`iRCp#-M zBRwrOB{?ZEAwDiPCORrIB0MZKBseHAz~9f;$J@)(!`;o*#o5Wx!QRf+#@fo#!raW% z#MsEtKwnQ+M_Wr%LtRZ(MOjHvL0(Q)Mp{ZzLR?H#L|8~rfS-?-hntI&gPo0)g_((w zfkE*n3y@@B&;b#k`jUY|nSq%>!ec`MLnAA%oR7zc2TpB#@>)|YCO&lN;uMU!b7Eqm H1A{dHTIz>f literal 70 zcmZ?wbhEHb
                                      Table 2 Common operations supported by each system-defined policy or role

                                      Operation

                                      KMS Administrator