How to create keys in Key Management Service

You can create symmetric and asymmetric keys in Key Management Service (KMS):

Create a symmetric key if you need to encrypt and decrypt data with the same key material or generate data keys for envelope encryption.
Create an asymmetric key if you need a public-private key pair.

Prerequisites

Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

Install and configure the Nebius AI Cloud CLI.
Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

Install and configure the Nebius AI Cloud provider for Terraform.
Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

Install and initialize the Nebius SDK for Go.
Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

Install and initialize the Nebius SDK for Python.
Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

Install and initialize the Nebius SDK for JavaScript.
Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

How to create a symmetric key

In the web console, go to Cryptography → KMS.
Click Create key.
Specify a unique key name.
In the Type field, select Symmetric key.
(Optional) In Rotation period, set how often KMS should automatically rotate the key material. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. You can set the rotation period in days, months or years. The Algorithm value is set automatically to AES-256-GCM.
(Optional) Add a description.
Click Create key.

The key appears in the list of symmetric keys.

Create a symmetric key:

nebius kms symmetric-key create \
   --name <key_name> \
   --description "<key_description>" \
   --algorithm aes_256 \
   --rotation-period <period>

The command contains the following parameters:

--name: Name of the key.
--description (optional): Description of the key.
--algorithm: Key encryption algorithm. You can only specify the algorithm when you create a key. You can’t update it later. The only supported value is aes_256.
--rotation-period (optional): Period after which KMS automatically rotates the key material. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. Specify the value in the NhNmNs format, for example, 24h or 48h30m10s. The minimum value is 86400s (one day) and the maximum value is 315360000s (3650 days). The default value is 7776000s (90 days).

Create the following configuration file:
resource "nebius_kms_v1_symmetric_key" "my_symmetric_key" { name = "<key_name>" description = "<key_description>" parent_id = "<project_ID>" algorithm = "AES_256" rotation_period = "<period>" }
In the configuration, specify:
- name: Name of the key.
- description (optional): Description of the key.
- parent_id: Project ID.
- algorithm: Key encryption algorithm. You can only specify the algorithm when you create a key. You can’t update it later. The only supported value is AES_256.
- rotation_period (optional): Period after which KMS automatically rotates the key material. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. Specify the value in the NhNmNs format, for example, 24h or 48h30m10s. The minimum value is 86400s (one day) and the maximum value is 315360000s (3650 days). The default value is 7776000s (90 days).
Check that the configuration is correct:
terraform validate
Apply the changes:
terraform apply

Create a symmetric key:

symCreatePeriod, err := time.ParseDuration(
    "<period>",
)
if err != nil {
    return fmt.Errorf("parse rotation period: %w", err)
}
symCreateService := sdk.Services().KMS().V1().
    SymmetricKey()
symCreateOperation, err := symCreateService.Create(
    ctx,
    &kms.CreateSymmetricKeyRequest{
        Metadata: &common.ResourceMetadata{
            Name: "<key_name>",
        },
        Spec: &kms.SymmetricKeySpec{
            Description: "<key_description>",
            Algorithm: kms.SymmetricAlgorithm_AES_256,
            RotationPeriod: durationpb.New(symCreatePeriod),
        },
    },
)
if err != nil {
    return fmt.Errorf("create symmetric key: %w", err)
}
symCreateOperation, err = symCreateOperation.Wait(ctx)
if err != nil {
    return fmt.Errorf("wait for operation: %w", err)
}
symCreateResult, err := symCreateService.Get(
    ctx,
    &kms.GetSymmetricKeyRequest{
        Id: symCreateOperation.ResourceID(),
    },
)
if err != nil {
    return fmt.Errorf("get key: %w", err)
}
fmt.Println(symCreateResult)

In the code, specify:

Metadata.Name: Name of the key.
Spec.Description (optional): Description of the key.
Spec.Algorithm: Key encryption algorithm. You can only specify the algorithm when you create a key. You can’t update it later. The only supported value is kms.SymmetricAlgorithm_AES_256.
Spec.RotationPeriod (optional): Period after which KMS automatically rotates the key material. The code parses the <period> value with time.ParseDuration. To use the default period, remove the time.ParseDuration call and the RotationPeriod line. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. Specify the value in the NhNmNs format, for example, 24h or 48h30m10s. The minimum value is 86400s (one day) and the maximum value is 315360000s (3650 days). The default value is 7776000s (90 days).

Create a symmetric key:

service = kms.SymmetricKeyServiceClient(sdk)
operation = await service.create(
    kms.CreateSymmetricKeyRequest(
        metadata=ResourceMetadata(name="<key_name>"),
        spec=kms.SymmetricKeySpec(
            description="<key_description>",
            algorithm=kms.SymmetricAlgorithm.AES_256,
            rotation_period=timedelta(hours=720),
        ),
    ),
)
await operation.wait()
result = await service.get(
    kms.GetSymmetricKeyRequest(id=operation.resource_id),
)
print(result)

In the code, specify:

metadata.name: Name of the key.
spec.description (optional): Description of the key.
spec.algorithm: Key encryption algorithm. You can only specify the algorithm when you create a key. You can’t update it later. The only supported value is kms.SymmetricAlgorithm.AES_256.
spec.rotation_period (optional): Period, as a timedelta, after which KMS automatically rotates the key material. The example sets 720 hours. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. The minimum value is one day and the maximum value is 3650 days. The default value is 90 days.

Create a symmetric key:

const symCreateService = new kms.SymmetricKeyService(sdk);
dayjs.extend(duration);
const symCreateOperation = await symCreateService.create(
  kms.CreateSymmetricKeyRequest.create({
    metadata: { name: "<key_name>" },
    spec: {
      description: "<key_description>",
      algorithm: kms.SymmetricAlgorithm.AES_256,
      rotationPeriod: dayjs.duration(720, "hours"),
    },
  }),
).result;
await symCreateOperation.wait();
const symCreateResult = await symCreateService.get(
  kms.GetSymmetricKeyRequest.create({
    id: symCreateOperation.resourceId(),
  }),
).result;
console.log(symCreateResult);

In the code, specify:

metadata.name: Name of the key.
spec.description (optional): Description of the key.
spec.algorithm: Key encryption algorithm. You can only specify the algorithm when you create a key. You can’t update it later. The only supported value is kms.SymmetricAlgorithm.AES_256.
spec.rotationPeriod (optional): Period, as a Day.js duration, after which KMS automatically rotates the key material. The example sets 720 hours. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. The minimum value is one day and the maximum value is 3650 days. The default value is 90 days.

How to create an asymmetric key

In the web console, go to Cryptography → KMS.
Click Create key.
Specify a unique key name.
In the Type field, select Asymmetric key.
In the Algorithm field, select RSA-4096 or ECC (P-256).
(Optional) Add a description.
Click Create key.

The key appears in the list of asymmetric keys.

Create an asymmetric key:

nebius kms asymmetric-key create \
   --name <key_name> \
   --description "<key_description>" \
   --algorithm <asymmetric_key_algorithm>

The command contains the following parameters:

--name: Name of the key.
--description (optional): Description of the key.
--algorithm: Cryptographic algorithm to use with the key. You can only specify the algorithm when you create a key. You can’t update it later. The supported values are:
- ecdsa_nist_p256_sha_256
- ecdsa_nist_p384_sha_384
- rsa_4096_enc_oaep_sha_256

Create the following configuration:
resource "nebius_kms_v1_asymmetric_key" "my_asymmetric_key" { name = "<key_name>" description = "<key_description>" parent_id = "<project_ID>" algorithm = "<asymmetric_key_algorithm>" }
In the configuration, specify:
- name: Name of the key.
- description (optional): Description of the key.
- parent_id: Project ID.
- algorithm: Cryptographic algorithm to use with the key. You can only specify the algorithm when you create a key. You can’t update it later. The supported values are:
  - ECDSA_NIST_P256_SHA_256
  - ECDSA_NIST_P384_SHA_384
  - RSA_4096_ENC_OAEP_SHA_256
Check that the configuration is correct:
terraform validate
Apply the changes:
terraform apply

Create an asymmetric key:

asymCreateService := sdk.Services().KMS().V1().
    AsymmetricKey()
asymCreateOperation, err := asymCreateService.Create(
    ctx,
    &kms.CreateAsymmetricKeyRequest{
        Metadata: &common.ResourceMetadata{
            Name: "<key_name>",
        },
        Spec: &kms.AsymmetricKeySpec{
            Description: "<key_description>",
            Algorithm: kms.AsymmetricAlgorithm_ECDSA_NIST_P256_SHA_256,
        },
    },
)
if err != nil {
    return fmt.Errorf("create asymmetric key: %w", err)
}
asymCreateOperation, err = asymCreateOperation.Wait(ctx)
if err != nil {
    return fmt.Errorf("wait for operation: %w", err)
}
asymCreateResult, err := asymCreateService.Get(
    ctx,
    &kms.GetAsymmetricKeyRequest{
        Id: asymCreateOperation.ResourceID(),
    },
)
if err != nil {
    return fmt.Errorf("get key: %w", err)
}
fmt.Println(asymCreateResult)

In the code, specify:

Metadata.Name: Name of the key.
Spec.Description (optional): Description of the key.
Spec.Algorithm: Cryptographic algorithm to use with the key. You can only specify the algorithm when you create a key. You can’t update it later. The supported values are:
- kms.AsymmetricAlgorithm_ECDSA_NIST_P256_SHA_256
- kms.AsymmetricAlgorithm_ECDSA_NIST_P384_SHA_384
- kms.AsymmetricAlgorithm_RSA_4096_ENC_OAEP_SHA_256

Create an asymmetric key:

service = kms.AsymmetricKeyServiceClient(sdk)
operation = await service.create(
    kms.CreateAsymmetricKeyRequest(
        metadata=ResourceMetadata(name="<key_name>"),
        spec=kms.AsymmetricKeySpec(
            description="<key_description>",
            algorithm=kms.AsymmetricAlgorithm.ECDSA_NIST_P256_SHA_256,
        ),
    ),
)
await operation.wait()
result = await service.get(
    kms.GetAsymmetricKeyRequest(id=operation.resource_id),
)
print(result)

In the code, specify:

metadata.name: Name of the key.
spec.description (optional): Description of the key.
spec.algorithm: Cryptographic algorithm to use with the key. You can only specify the algorithm when you create a key. You can’t update it later. The supported values are:
- kms.AsymmetricAlgorithm.ECDSA_NIST_P256_SHA_256
- kms.AsymmetricAlgorithm.ECDSA_NIST_P384_SHA_384
- kms.AsymmetricAlgorithm.RSA_4096_ENC_OAEP_SHA_256

Create an asymmetric key:

const asymCreateService = new kms.AsymmetricKeyService(sdk);
const asymCreateOperation = await asymCreateService.create(
  kms.CreateAsymmetricKeyRequest.create({
    metadata: { name: "<key_name>" },
    spec: {
      description: "<key_description>",
      algorithm: kms.AsymmetricAlgorithm.ECDSA_NIST_P256_SHA_256,
    },
  }),
).result;
await asymCreateOperation.wait();
const asymCreateResult = await asymCreateService.get(
  kms.GetAsymmetricKeyRequest.create({
    id: asymCreateOperation.resourceId(),
  }),
).result;
console.log(asymCreateResult);

In the code, specify:

metadata.name: Name of the key.
spec.description (optional): Description of the key.
spec.algorithm: Cryptographic algorithm to use with the key. You can only specify the algorithm when you create a key. You can’t update it later. The supported values are:
- kms.AsymmetricAlgorithm.ECDSA_NIST_P256_SHA_256
- kms.AsymmetricAlgorithm.ECDSA_NIST_P384_SHA_384
- kms.AsymmetricAlgorithm.RSA_4096_ENC_OAEP_SHA_256

Security

Audit Logs

Key Management Service

SecretStash (formerly MysteryBox)

How to create keys in Key Management Service

Prerequisites

How to create a symmetric key

How to create an asymmetric key

See also

​Prerequisites

​How to create a symmetric key

​How to create an asymmetric key

​See also

Prerequisites

How to create a symmetric key

How to create an asymmetric key

See also