Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Key management

Written by
Improved by
Updated at September 21, 2026
View in Markdown

You can use Key Management Service to create, rotate, and delete symmetric encryption keys.

Creating a key

To create a new key:

  1. In the management console, select the folder.

  2. Navigate to Key Management Service.

  3. In the left-hand panel, select Symmetric keys.

  4. Click Create key and set the following key attributes:

    • Custom name and optional description.
    • Encryption algorithm, e.g., AES-256.
    • Rotation period (how often to change key versions).
    • Optionally, enable deletion protection.

  5. Click Create.

When you create a key, its first version is created automatically. Click the key in the list to open the page with its attributes.

Run this command:

yc kms symmetric-key create \
  --name example-key \
  --default-algorithm aes-256 \
  --rotation-period 24h \
  --deletion-protection

Where:

  • --name: Key name.
  • --default-algorithm: Encryption algorithm, such as aes-128, aes-192, aes-256, aes-256-hsm, or gost-r-3412-2015-k.
  • --rotation-period: Key rotation period. To create a key without automatic rotation, do not specify --rotation-period.
  • --deletion-protection: Key deletion protection. To create a key without deletion protection, do not specify --deletion-protection.

When you create a key, its first version is created automatically. It is specified in the primary_version field.

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the guides on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To create a new key:

  1. Specify the yandex_kms_symmetric_key resource properties in the configuration file:

    resource "yandex_kms_symmetric_key" "key-a" {
  name                = "<key_name>"
  description         = "<key_description>"
  default_algorithm   = "AES_128"
  rotation_period     = "8760h"
  deletion_protection = true
  lifecycle {
    prevent_destroy = true
  }
}

    Where:

    • name: Key name. The name format is as follows:

      • Length: between 3 and 63 characters.
      • It can only contain lowercase Latin letters, numbers, and hyphens.
      • It must start with a letter and cannot end with a hyphen.

    • description: Key description.

    • default_algorithm: Encryption algorithm. The possible values are AES-128, AES-192, or AES-256.

    • rotation_period: Rotation period (how often to change key versions). To create a key without automatic rotation, do not specify rotation_period.

    • deletion_protection: Key deletion protection. To create a key without deletion protection, do not specify deletion_protection.

    • lifecycle.prevent_destroy: Key deletion protection when running Terraform commands. To create a key without such protection, do not specify the lifecycle section.

    Warning

    Deleting a KMS key destroys all data encrypted with that key: the data becomes unrecoverable after the key is deleted. The deletion_protection parameter and the lifecycle section are required to prevent key deletion, e.g., with the terraform destroy command.

    For more information about resource properties in Terraform, see this provider guide.

  2. Validate your configuration using this command:

    terraform validate

    If the configuration is valid, you will get this message:

    Success! The configuration is valid.

  3. Run this command:

    terraform plan

    You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors detected in the configuration.

  4. Apply the configuration changes:

    terraform apply

  5. Type yes and press Enter to confirm the changes.

    This will create all the resources you need in the specified folder. You can check the new resources and their settings using the management console or these CLI commands:

    yc kms symmetric-key list

Use the create REST API method for the SymmetricKey resource or the SymmetricKeyService/Create gRPC API call.

Updating a key

After creating a key, you can change any of its attributes. If you change the encryption algorithm, the new algorithm will be used starting with the next key version. To create a new version right away and make it the default one, rotate the key.

To update a key:

  1. In the management console, select the folder.
  2. Navigate to Key Management Service.
  3. In the left-hand panel, select Symmetric keys.
  4. In the key row, click and select Edit.
  5. Change the key attributes and click Save.

Run this command:

yc kms symmetric-key update \
  --name example-key \
  --new-name example-key-2 \
  --default-algorithm aes-128 \
  --rotation-period 48h \
  --deletion-protection

Where:

  • --name: Key name. If there are several keys with the same name within the folder, use the key ID.
  • --new-name: New key name.
  • --default-algorithm: Encryption algorithm, such as aes-128, aes-192, aes-256, aes-256-hsm, or gost-r-3412-2015-k.
  • --rotation-period: Key rotation period. To disable automatic rotation for the updated key, do not specify --rotation-period.
  • --deletion-protection: Key deletion protection. To disable deletion protection, specify the --no-deletion-protection parameter.

To update a key:

  1. Open the Terraform configuration file and change the properties of the yandex_kms_symmetric_key resource as needed.

    Here is an example of the configuration file structure:

    ...
resource "yandex_kms_symmetric_key" "key-a" {
  name                = "example-symmetric-key"
  description         = "description for key"
  default_algorithm   = "AES_128"
  rotation_period     = "8760h"
  deletion_protection = true
}
...

    For more on the properties of the yandex_kms_symmetric_key resource, see this provider guide.

  2. Validate your configuration using this command:

    terraform validate

    If the configuration is valid, you will get this message:

    Success! The configuration is valid.

  3. Run this command:

    terraform plan

    You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors detected in the configuration.

  4. Apply the configuration changes:

    terraform apply

  5. Type yes and press Enter to confirm the changes.

    You can check the key update using the management console or this CLI command:

    yc kms symmetric-key get <key_name>

Use the update REST API method for the SymmetricKey resource or the SymmetricKeyService/Update gRPC API call.

Activating or deactivating a key

After creating a key, you can change its current status.

Note

Key deactivation (changing the key status from Active to Inactive) is an eventually consistent operation. Changes resulting from such operations take effect with a delay of up to three hours.

To change a key status:

  1. In the management console, select the folder.
  2. Navigate to Key Management Service.
  3. In the left-hand panel, select Symmetric keys.
  4. To deactivate a key, click and select Deactivate next to the relevant Active key.
  5. To activate a key, click and select Activate next to the relevant Inactive key.

Run this command:

yc kms symmetric-key update \
  --name example-key \
  --status active

Where:

  • --name: Key name. If there are several keys with the same name within the folder, use the key ID in the --id parameter.
  • --status: New key status. It can be either active or inactive.

  1. Open the Terraform configuration file and add the status parameter set to ACTIVE or INACTIVE to the yandex_kms_symmetric_key resource description.

    Here is an example of the configuration file structure:

    ...
resource "yandex_kms_symmetric_key" "key-a" {
  name                = "example-symmetric-key"
  description         = "description for key"
  ...
  status              = "INACTIVE"
}
...

    For more on the properties of the yandex_kms_symmetric_key resource, see this provider guide.

  2. Validate your configuration using this command:

    terraform validate

    If the configuration is valid, you will get this message:

    Success! The configuration is valid.

  3. Run this command:

    terraform plan

    You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors detected in the configuration.

  4. Apply the configuration changes:

    terraform apply

  5. Type yes and press Enter to confirm the changes.

You can check the key status update using the management console or this CLI command:

yc kms symmetric-key get <key_name>

Use the update REST API method for the SymmetricKey resource or the SymmetricKeyService/Update gRPC API call.

Rotating a key

When a key is rotated, a new version is generated and immediately set as the default version. You can setup automatic key rotation on a regular schedule, but you can also rotate the key manually at any time.

Note

Key rotation is an eventually consistent operation. Changes resulting from such operations take effect with a delay of up to three hours.

To rotate a key:

  1. In the management console, select the folder.
  2. Navigate to Key Management Service.
  3. In the left-hand panel, select Symmetric keys.
  4. In the key row, click and select Rotate.
  5. Confirm the rotation (make sure that changing the default version will not affect your work).

Run the following command, specifying the key ID or name:

yc kms symmetric-key rotate example-key

Use the rotate REST API method for the SymmetricKey resource or the SymmetricKeyService/Rotate gRPC API call.

Deleting a key

Deleting a key also deletes all its versions. You cannot delete a key right away. When a key is marked for deletion, its versions remain in the Scheduled For Destruction status for three days. The key versions remain billable during this period. Within these three days, you can contact support to restore the key along with its versions.

Alert

Three days after you request the deletion of a key, the key and all its versions are permanently deleted. If you still have any data encrypted with this key, you will not be able to decrypt it.

If key deletion protection is enabled, disable it first.

To delete a key:

  1. In the management console, select the folder.
  2. Navigate to Key Management Service.
  3. In the left-hand panel, select Symmetric keys.
  4. In the key row, click and select Delete.
  5. In the window that opens, click Delete.

Run the following command, specifying the key ID or name:

yc kms symmetric-key delete example-key

To delete a key created with Terraform:

  1. Open the Terraform configuration file and delete the section with the key description.

    Here is an example of a key description in the Terraform configuration:

    ...
resource "yandex_kms_symmetric_key" "key-a" {
  name              = "example-symmetric-key"
  description       = "description for key"
  default_algorithm = "AES_128"
  rotation_period   = "8760h"
}
...

  2. In the command line, go to the directory with the Terraform configuration file.

  3. Validate your configuration using this command:

    terraform validate

    If the configuration is valid, you will get this message:

    Success! The configuration is valid.

  4. Run this command:

    terraform plan

    You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors detected in the configuration.

  5. Apply the configuration changes:

    terraform apply

  6. Type yes and press Enter to confirm the changes.

    You can check the update using the management console or this CLI command:

    yc kms symmetric-key list

Use the delete REST API method for the SymmetricKey resource or the SymmetricKeyService/Delete gRPC API call.

Note

Deleting a key is an eventually consistent operation. Changes resulting from such operations take effect with a delay of up to three hours.

Useful links

Managing Key Management Service keys with Terraform

Previous
All guides
Next
Key version