A Customer Master Key (CMK) is a Key Encryption Key (KEK) created by a user using KMS. It is used to encrypt and protect Data Encryption Keys (DEKs). One CMK can be used to encrypt one or multiple DEKs.
When a user uses KMS for encryption in a cloud service for the first time, the cloud service automatically creates a key with the alias suffix /default.
On the KMS console, you can query Default Master Keys, but can neither disable them nor schedule their deletion.
Alias |
Cloud Service |
|---|---|
obs/default |
Object Storage Service (OBS) |
evs/default |
Elastic Volume Service (EVS) |
ims/default |
Image Management Service (IMS) |
sfs/default |
Scalable File Service (SFS) |