How to create keys in Key Management Service

You can create symmetric and asymmetric keys in Key Management Service (KMS):

Create a symmetric key if you need to encrypt and decrypt data with the same key material or generate data keys for envelope encryption.
Create an asymmetric key if you need a public-private key pair.

Prerequisites

Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

How to create a symmetric key

Web console
CLI

In the web console, go to Cryptography → KMS.
Click Create key.
Specify a unique key name.
In the Type field, select Symmetric key.
(Optional) In Rotation period, set how often KMS should automatically rotate the key material. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. You can set the rotation period in days, months or years. The Algorithm value is set automatically to AES-256-GCM.
(Optional) Add a description.
Click Create key.

The key appears in the list of symmetric keys.

Create a symmetric key:

nebius kms symmetric-key create \
   --name <key_name> \
   --description "<key_description>" \
   --algorithm aes_256 \
   --rotation-period <period>

The command contains the following parameters:

--name: Name of the key.
--description (optional): Description of the key.
--algorithm: Key encryption algorithm. You can only specify the algorithm when you create a key. You can’t update it later. The only supported value is aes_256.
--rotation-period (optional): Period after which KMS automatically rotates the key material. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. Specify the value in the NhNmNs format, for example, 24h or 48h30m10s. The minimum value is 86400s (one day) and the maximum value is 315360000s (3650 days). The default value is 7776000s (90 days).

How to create an asymmetric key

Web console
CLI

In the web console, go to Cryptography → KMS.
Click Create key.
Specify a unique key name.
In the Type field, select Asymmetric key.
In the Algorithm field, select RSA-4096 or ECC (P-256).
(Optional) Add a description.
Click Create key.

The key appears in the list of asymmetric keys.

Create an asymmetric key:

nebius kms asymmetric-key create \
   --name <key_name> \
   --description "<key_description>" \
   --algorithm <asymmetric_key_algorithm>

The command contains the following parameters:

--name: Name of the key.
--description (optional): Description of the key.
--algorithm: Cryptographic algorithm to use with the key. You can only specify the algorithm when you create a key. You can’t update it later. The supported values are:
- ecdsa_nist_p256_sha_256
- ecdsa_nist_p384_sha_384
- rsa_4096_enc_oaep_sha_256
For the description of the supported algorithms, see Encryption algorithms.

Security

Audit Logs

Key Management Service

SecretStash (formerly MysteryBox)

How to create keys in Key Management Service

Prerequisites

How to create a symmetric key

How to create an asymmetric key

See also

​Prerequisites

​How to create a symmetric key

​How to create an asymmetric key

​See also

Prerequisites

How to create a symmetric key

How to create an asymmetric key

See also