KMS
System Mode only — A system administrator (SysAdmin) views and manages the platform's internal system security assets (encryption keys, secrets, certificates).
KMS (Key Management Service) is the management layer that centrally stores Thaki Cloud's internal system security assets in encrypted form and provides status lookup and state changes. KMS is not the source-of-issuance system for these assets; the initial issuance is handled by each app or integrated system.
Access Required
KMS is a system app in Engineering Mode, accessible only to system administrators. No domain-administrator KMS app is provided. Personal security assets (Password, MFA, Access Key, etc.) are managed in IAM My Page.
Managed Assets
KMS manages three types of security assets from the left sidebar.
| Asset | Description | Examples |
|---|---|---|
| Encryption Keys | Keys that encrypt/decrypt resources | Volume encryption key, kubeconfig encryption key |
| Secrets | Private sensitive values used for authentication/access control | JWT signing secret, infrastructure credentials |
| Certificates | Certificates that prove the identity of a communication peer | Internal service-to-service mTLS workload certificate |
What KMS Does / Does Not Do
| Does | Does not |
|---|---|
| Store assets in encrypted form | Issue assets at the source (handled by each app/integrated system) |
| Provide list and status lookup | Re-issue assets directly (done in IAM/source app) |
| Enforce permission-based visibility | Directly manage personal user assets (handled by IAM) |
| Change state (rotate, archive, revoke) | Provide a direct API to regular apps |
Supported Algorithms
| Type | Algorithm | Primary Use |
|---|---|---|
| Symmetric | AES-256-GCM | Data encryption, Secret encryption |
| Asymmetric | RSA-2048 / RSA-4096 | Digital signatures, TLS certificate keys |
| Asymmetric | EC P-256 / P-384 | JWT signing, lightweight authentication |
Platform-Wide Management
Each key, secret, and certificate belongs to a domain (keyring), but the system KMS views and manages assets platform-wide in one screen rather than for a single domain.
| Item | Description |
|---|---|
| All-domain asset view | View keys, secrets, and certificates across all domains in one screen |
| State lifecycle management | Control state transitions such as rotation, archive, restore, and destroy |
| Audit trail | Record every state transition in the audit log with a reason |
WARNING
State changes (archive, delete, revoke, destroy) require confirmation and a reason. In particular, once a key is Destroyed (permanently), data encrypted with it cannot be decrypted, so verify usage before doing so.
Permission Model
Permissions are applied separately for list visibility · value/content access · state changes · re-issuance interface. The system KMS is exclusive to system administrators (SysAdmin).
| Subject | List view | Value/content access | State change | Re-issuance interface |
|---|---|---|---|---|
| User | Own assets only | Once at initial issuance | Limited, own assets only | IAM My Page |
| Domain Admin | Assets managed in IAM | No secret value | Only delegated assets (service accounts, etc.) | IAM |
| SysAdmin | System assets | Limited to the necessary scope | Allowed | System KMS |
A Domain Admin's state changes are limited to delegated managed assets and do not apply to personal user assets.
Audit Log
Every state transition (automatic and manual) is recorded in the audit log.
Required fields: timestamp · actor · resource_type · resource_id (UUID + version) · prev_state · next_state · reason · source_ip
Reason (reason) codes
| Value | Applies to | Description |
|---|---|---|
rotation | Secret / Key | Transition due to normal rotation |
ttl_expiry | Secret | Automatic transition on TTL expiry |
routine_archive | Key | Archive for operational cleanup |
suspected_compromise | Key | Emergency suspension on suspected compromise (both encrypt/decrypt blocked) |
confirmed_compromise | Secret / Key | Confirmed compromise. Only re-protection access allowed; general services blocked |
manual_delete | Secret / Key | Administrator's explicit deletion |
retention_expiry | Secret | Automatic Destroy on retention (30 days) expiry |
emergency_destroy | Key | Emergency permanent deletion on confirmed key leakage/damage |
NIST SP 800-57 Alignment
While keeping the existing state model, the reason value satisfies the Suspended/Compromised requirements of NIST SP 800-57. Even within the same state, access is branched by reason.
- Suspended — Active → Archived (
suspected_compromise). Both encrypt and decrypt are blocked. If suspicion is cleared, a new key is issued rather than reusing the key. - Compromised — Active → Deactivated (
confirmed_compromise). Only the re-protection pipeline may decrypt; general service access is blocked. After re-protection, it transitions to Destroyed.
| State | reason | Encrypt | Decrypt | Access |
|---|---|---|---|---|
| Deactivated | rotation | X | O | General services + admins |
| Deactivated | confirmed_compromise | X | O (limited) | Re-protection pipeline only |
| Archived | routine_archive | X | X | Admins only (recovery) |
| Archived | suspected_compromise | X | X | Admins only (investigation) |
Getting Started
- Quick Start — From entering KMS to managing each asset
- Introduction — Managed assets and highlights
Using KMS
Related Docs
- IAM — System Mode
- Audit — System Mode
- IAM My Page — Manage personal security assets (Password, MFA, Access Key)