Prerequisites
- Web console
- CLI
- Go SDK
- Python SDK
- JavaScript SDK
Make sure you are in a group that has at least the
editor role within your tenant or project; for example, the default editors group. Alternatively, you can have an access permit with the editor role assigned to the required key. To check your access rights, go to the Administration → IAM section in the web console.- Install and configure the Nebius AI Cloud CLI.
- Make sure you are in a group that has at least the
editorrole within your tenant or project; for example, the defaulteditorsgroup. Alternatively, you can have an access permit with theeditorrole assigned to the required key. To check your access rights, go to the Administration → IAM section in the web console.
- Install and initialize the Nebius SDK for Go.
- Make sure you are in a group that has at least the
editorrole within your tenant or project; for example, the defaulteditorsgroup. Alternatively, you can have an access permit with theeditorrole assigned to the required key. To check your access rights, go to the Administration → IAM section in the web console.
- Install and initialize the Nebius SDK for Python.
- Make sure you are in a group that has at least the
editorrole within your tenant or project; for example, the defaulteditorsgroup. Alternatively, you can have an access permit with theeditorrole assigned to the required key. To check your access rights, go to the Administration → IAM section in the web console.
- Install and initialize the Nebius SDK for JavaScript.
- Make sure you are in a group that has at least the
editorrole within your tenant or project; for example, the defaulteditorsgroup. Alternatively, you can have an access permit with theeditorrole assigned to the required key. To check your access rights, go to the Administration → IAM section in the web console.
Terraform does not support updating keys. If you use Terraform to update a key, Terraform replaces the key with a new one.
How to update a symmetric key
- Web console
- CLI
- Go SDK
- Python SDK
- JavaScript SDK
-
In the web console, go to
Cryptography → KMS.
- Make sure that Symmetric keys and Active are selected in the filters.
-
In the line of the required key, click
→ Settings.
-
Update the key settings:
- Name: New key name.
- Rotation period: New period after which KMS automatically rotates the key material. When a key is rotated, KMS generates a new key version and immediately sets it as the default version.
- Description: New key description.
- Click Save changes.
-
List symmetric keys:
In the output, copy the ID of the required symmetric key.
nebius kms symmetric-key list -
Update the key:
The command contains the following parameters:
nebius kms symmetric-key update \ --id <symmetric_key_ID> \ --name <new_key_name> \ --description "<new_key_description>" \ --rotation-period <new_period>-
--id: ID of the symmetric key that you update. -
--name(optional): New name of the key. -
--description(optional): New description of the key. -
--rotation-period(optional): New period after which KMS automatically rotates the key material. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. Specify the value in theNhNmNsformat, for example,24hor48h30m10s. The minimum value is86400s(one day) and the maximum value is315360000s(3650 days). The default value is7776000s(90 days).
-
-
List symmetric keys:
In the output, copy the ID of the required symmetric key.
symListService := sdk.Services().KMS().V1(). SymmetricKey() symListResponse, err := symListService.List( ctx, &kms.ListSymmetricKeysRequest{}, ) if err != nil { return fmt.Errorf("list symmetric keys: %w", err) } fmt.Println(symListResponse) -
Update the key:
The code gets the current key settings, replaces the ones that you specify and sends them back to KMS. In the code, specify:
symUpdateService := sdk.Services().KMS().V1(). SymmetricKey() symUpdateKey, err := symUpdateService.Get( ctx, &kms.GetSymmetricKeyRequest{Id: "<symmetric_key_ID>"}, ) if err != nil { return fmt.Errorf("get key: %w", err) } symUpdateKey.Metadata.Name = "<new_key_name>" symUpdateKey.Spec.Description = "<new_key_description>" symUpdatePeriod, err := time.ParseDuration("<new_period>") if err != nil { return fmt.Errorf("parse rotation period: %w", err) } symUpdateKey.Spec.RotationPeriod = durationpb.New( symUpdatePeriod, ) symUpdateOperation, err := symUpdateService.Update( ctx, &kms.UpdateSymmetricKeyRequest{ Metadata: symUpdateKey.Metadata, Spec: symUpdateKey.Spec, }, ) if err != nil { return fmt.Errorf("update symmetric key: %w", err) } symUpdateOperation, err = symUpdateOperation.Wait(ctx) if err != nil { return fmt.Errorf("wait for operation: %w", err) } symUpdateResult, err := symUpdateService.Get( ctx, &kms.GetSymmetricKeyRequest{ Id: symUpdateOperation.ResourceID(), }, ) if err != nil { return fmt.Errorf("get key: %w", err) } fmt.Println(symUpdateResult)-
IdinGetSymmetricKeyRequest: ID of the symmetric key that you update. -
Metadata.Name(optional): New name of the key. -
Spec.Description(optional): New description of the key. -
Spec.RotationPeriod(optional): New period after which KMS automatically rotates the key material. The code parses the<new_period>value withtime.ParseDuration. To keep the current period, remove thetime.ParseDurationcall and theRotationPeriodassignment. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. Specify the value in theNhNmNsformat, for example,24hor48h30m10s. The minimum value is86400s(one day) and the maximum value is315360000s(3650 days). The default value is7776000s(90 days).
-
-
List symmetric keys:
In the output, copy the ID of the required symmetric key.
service = kms.SymmetricKeyServiceClient(sdk) response = await service.list( kms.ListSymmetricKeysRequest(), ) print(response) -
Update the key:
The code gets the current key settings, replaces the ones that you specify and sends them back to KMS. In the code, specify:
service = kms.SymmetricKeyServiceClient(sdk) key = await service.get( kms.GetSymmetricKeyRequest(id="<symmetric_key_ID>"), ) key.metadata.name = "<new_key_name>" key.spec.description = "<new_key_description>" key.spec.rotation_period = timedelta(hours=8760) operation = await service.update( kms.UpdateSymmetricKeyRequest( metadata=key.metadata, spec=key.spec, ), ) await operation.wait() result = await service.get( kms.GetSymmetricKeyRequest(id=operation.resource_id), ) print(result)idinGetSymmetricKeyRequest: ID of the symmetric key that you update.metadata.name(optional): New name of the key.spec.description(optional): New description of the key.spec.rotation_period(optional): New period, as atimedelta, after which KMS automatically rotates the key material. The example sets 8760 hours. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. The minimum value is one day and the maximum value is 3650 days.
-
List symmetric keys:
In the output, copy the ID of the required symmetric key.
const symListService = new kms.SymmetricKeyService(sdk); const symListResponse = await symListService.list( kms.ListSymmetricKeysRequest.create({}), ).result; console.log(symListResponse); -
Update the key:
The code gets the current key settings, replaces the ones that you specify and sends them back to KMS. In the code, specify:
const symUpdateService = new kms.SymmetricKeyService(sdk); const symUpdateKey = await symUpdateService.get( kms.GetSymmetricKeyRequest.create({ id: "<symmetric_key_ID>" }), ).result; symUpdateKey.metadata.name = "<new_key_name>"; symUpdateKey.spec.description = "<new_key_description>"; dayjs.extend(duration); symUpdateKey.spec.rotationPeriod = dayjs.duration( 8760, "hours", ); const symUpdateOperation = await symUpdateService.update( kms.UpdateSymmetricKeyRequest.create({ metadata: symUpdateKey.metadata, spec: symUpdateKey.spec, }), ).result; await symUpdateOperation.wait(); const symUpdateResult = await symUpdateService.get( kms.GetSymmetricKeyRequest.create({ id: symUpdateOperation.resourceId(), }), ).result; console.log(symUpdateResult);idinGetSymmetricKeyRequest: ID of the symmetric key that you update.metadata.name(optional): New name of the key.spec.description(optional): New description of the key.spec.rotationPeriod(optional): New period, as a Day.js duration, after which KMS automatically rotates the key material. The example sets 8760 hours. When a key is rotated, KMS generates a new key version and immediately sets it as the default version. The minimum value is one day and the maximum value is 3650 days.
How to update an asymmetric key
- Web console
- CLI
- Go SDK
- Python SDK
- JavaScript SDK
-
In the web console, go to
Cryptography → KMS.
- Make sure that Asymmetric keys and Active are selected in the filters.
-
In the line of the required key, click
→ Settings.
-
Update the key settings:
- Name: New key name.
- Description: New key description.
- Click Save changes.
-
List asymmetric keys:
In the output, copy the ID of the required asymmetric key.
nebius kms asymmetric-key list -
Update the key:
The command contains the following parameters:
nebius kms asymmetric-key update \ --id <asymmetric_key_ID> \ --name <new_key_name> \ --description "<new_key_description>"--id: ID of the asymmetric key that you update.--name(optional): New name of the key.--description(optional): New description of the key.
-
List asymmetric keys:
In the output, copy the ID of the required asymmetric key.
asymListService := sdk.Services().KMS().V1(). AsymmetricKey() asymListResponse, err := asymListService.List( ctx, &kms.ListAsymmetricKeysRequest{}, ) if err != nil { return fmt.Errorf("list asymmetric keys: %w", err) } fmt.Println(asymListResponse) -
Update the key:
The code gets the current key settings, replaces the ones that you specify and sends them back to KMS. In the code, specify:
asymUpdateService := sdk.Services().KMS().V1(). AsymmetricKey() asymUpdateKey, err := asymUpdateService.Get( ctx, &kms.GetAsymmetricKeyRequest{Id: "<asymmetric_key_ID>"}, ) if err != nil { return fmt.Errorf("get key: %w", err) } asymUpdateKey.Metadata.Name = "<new_key_name>" asymUpdateKey.Spec.Description = "<new_key_description>" asymUpdateOperation, err := asymUpdateService.Update( ctx, &kms.UpdateAsymmetricKeyRequest{ Metadata: asymUpdateKey.Metadata, Spec: asymUpdateKey.Spec, }, ) if err != nil { return fmt.Errorf("update asymmetric key: %w", err) } asymUpdateOperation, err = asymUpdateOperation.Wait(ctx) if err != nil { return fmt.Errorf("wait for operation: %w", err) } asymUpdateResult, err := asymUpdateService.Get( ctx, &kms.GetAsymmetricKeyRequest{ Id: asymUpdateOperation.ResourceID(), }, ) if err != nil { return fmt.Errorf("get key: %w", err) } fmt.Println(asymUpdateResult)IdinGetAsymmetricKeyRequest: ID of the asymmetric key that you update.Metadata.Name(optional): New name of the key.Spec.Description(optional): New description of the key.
-
List asymmetric keys:
In the output, copy the ID of the required asymmetric key.
service = kms.AsymmetricKeyServiceClient(sdk) response = await service.list( kms.ListAsymmetricKeysRequest(), ) print(response) -
Update the key:
The code gets the current key settings, replaces the ones that you specify and sends them back to KMS. In the code, specify:
service = kms.AsymmetricKeyServiceClient(sdk) key = await service.get( kms.GetAsymmetricKeyRequest(id="<asymmetric_key_ID>"), ) key.metadata.name = "<new_key_name>" key.spec.description = "<new_key_description>" operation = await service.update( kms.UpdateAsymmetricKeyRequest( metadata=key.metadata, spec=key.spec, ), ) await operation.wait() result = await service.get( kms.GetAsymmetricKeyRequest(id=operation.resource_id), ) print(result)idinGetAsymmetricKeyRequest: ID of the asymmetric key that you update.metadata.name(optional): New name of the key.spec.description(optional): New description of the key.
-
List asymmetric keys:
In the output, copy the ID of the required asymmetric key.
const asymListService = new kms.AsymmetricKeyService(sdk); const asymListResponse = await asymListService.list( kms.ListAsymmetricKeysRequest.create({}), ).result; console.log(asymListResponse); -
Update the key:
The code gets the current key settings, replaces the ones that you specify and sends them back to KMS. In the code, specify:
const asymUpdateService = new kms.AsymmetricKeyService(sdk); const asymUpdateKey = await asymUpdateService.get( kms.GetAsymmetricKeyRequest.create({ id: "<asymmetric_key_ID>" }), ).result; asymUpdateKey.metadata.name = "<new_key_name>"; asymUpdateKey.spec.description = "<new_key_description>"; const asymUpdateOperation = await asymUpdateService.update( kms.UpdateAsymmetricKeyRequest.create({ metadata: asymUpdateKey.metadata, spec: asymUpdateKey.spec, }), ).result; await asymUpdateOperation.wait(); const asymUpdateResult = await asymUpdateService.get( kms.GetAsymmetricKeyRequest.create({ id: asymUpdateOperation.resourceId(), }), ).result; console.log(asymUpdateResult);idinGetAsymmetricKeyRequest: ID of the asymmetric key that you update.metadata.name(optional): New name of the key.spec.description(optional): New description of the key.