Data Encryption Service

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Data Encryption Service: the hardware-backed key store of Key Management Service. "What is a managed
3# HSM" states that managed HSM gives dedicated, certified hardware security modules on Alibaba Cloud,
4# that plaintext key material is processed and stored only inside HSMs and never crosses the hardware
5# security boundary, that the HSM hardware and firmware have passed FIPS 140-2 Level 3 validation and
6# run in FIPS Approved Level 3 mode, that Bring Your Own Key controls how key material is generated
7# and persisted, and that Alibaba Cloud handles hardware lifecycle, cluster management and availability.
8# "What is Key Management Service" adds that KMS offers shared virtual HSMs and dedicated HSMs and
9# supports automatic and manual key rotation; it states no default rotation state, so none is set here.
10schemaVersion: "1"
11type: "component"
12id: "alibaba-data-encryption-service"
13kind: "key-management"
14provider: "alibabacloud"
15docs: "https://www.alibabacloud.com/help/en/kms/key-management-service/support/overview-12"
16defaults:
17  managed: true
18  hsm: true
19properties:
20  hsmType:
21    type: "enum"
22    values: ["shared-virtual-hsm", "dedicated-hsm"]
23  fipsValidationLevel:
24    type: "enum"
25    values: ["fips-140-2-level-3"]
26    default: "fips-140-2-level-3"
27  bringYourOwnKey:
28    type: "boolean"
29    default: true