[Yandex Cloud documentation](../../index.md) > [Yandex Key Management Service](../index.md) > [Step-by-step guides](index.md) > Symmetric encryption > Key

# Key management

You can use Key Management Service to create, rotate, and destroy symmetric encryption keys.

## Create a key {#create}

To create a key:

{% list tabs group=instructions %}

- Management console {#console}

  1. Log in to the [management console](https://console.yandex.cloud).
  1. Navigate to **Key Management Service**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/key.svg) **Symmetric keys**.
  1. Click **Create key** and set the key attributes:

     * Any name and optional description.
     * [Encryption algorithm](../concepts/key.md#parameters), e.g., `AES-256`.
     * [Rotation](../concepts/index.md#rotation) period (how often to change key versions).
     * (Optional) Enable deletion protection.

  1. Click **Create**.

  When creating a key, you create its first version; to open a page with its attributes, click the key in the list.

- CLI {#cli}

  Run this command:

  ```bash
  yc kms symmetric-key create \
    --name example-key \
    --default-algorithm aes-256 \
    --rotation-period 24h \
    --deletion-protection
  ```

  Where:

  * `--name`: Key name.
  * `--default-algorithm`: [Encryption algorithms](../concepts/key.md#parameters), such as `aes-128`, `aes-192`, `aes-256`, `aes-256-hsm`, or `gost-r-3412-2015-k`.
  * `--rotation-period`: Key rotation period. To create a key without automatic rotation, do not specify the `--rotation-period` parameter.
  * `--deletion-protection`: Key deletion protection. To create a key without deletion protection, do not specify the `--deletion-protection` parameter.

  When creating a key, you create its first version. It is specified in the `primary_version` field.

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a key:
  
  1. Specify the `yandex_kms_symmetric_key` resource properties in the configuration file:
  
     ```hcl
     resource "yandex_kms_symmetric_key" "key-a" {
       name                = "<key_name>"
       description         = "<key_description>"
       default_algorithm   = "AES_128"
       rotation_period     = "8760h"
       deletion_protection = true
       lifecycle {
         prevent_destroy = true
       }
     }
     ```
  
     Where:
  
     * `name`: Key name. The name format is as follows:
  
        * Length: between 3 and 63 characters.
        * It can only contain lowercase Latin letters, numbers, and hyphens.
        * It must start with a letter and cannot end with a hyphen.
  
     * `description`: Key description.
     * `default_algorithm`: Encryption algorithm. The possible values are `AES-128`, `AES-192`, or `AES-256`.
     * `rotation_period`: [Rotation](../concepts/version.md#rotate-key) period (how often to change key versions). To create a key without automatic rotation, do not specify the `rotation_period` parameter.
     * `deletion_protection`: Key deletion protection. To create a key without deletion protection, do not specify the `deletion_protection` parameter.
     * `lifecycle.prevent_destroy`: Key deletion protection when running Terraform commands. To create a key without such protection, do not specify the `lifecycle` section.
  
     {% note warning %}
  
     Deleting a KMS key destroys all data encrypted with that key: the data becomes unrecoverable after the key is deleted. The `deletion_protection` parameter and the `lifecycle` section are required to prevent the deletion of the key (e.g., with the `terraform destroy` command).
  
     {% endnote %}
  
     For more information about resource properties in Terraform, see [this provider guide](../../terraform/resources/kms_symmetric_key.md).
  
  1. Validate your configuration using this command:
  
     ```bash
     terraform validate
     ```
  
     If the configuration is valid, you will get this message:
  
     ```text
     Success! The configuration is valid.
     ```
  
  1. Run this command:
  
     ```bash
     terraform plan
     ```
  
     You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
  
  1. Apply the configuration changes:
  
     ```bash
     terraform apply
     ```
  
  1. Confirm the changes: type `yes` into the terminal and press **Enter**.
  
     This will create all the resources you need in the specified folder. You can check the new resources and their configuration using the [management console](https://console.yandex.cloud) or these [CLI](../../cli/quickstart.md) commands:
  
     ```bash
     yc kms symmetric-key list
     ```

- API {#api}

  Use the [create](../api-ref/SymmetricKey/create.md) REST API method for the [SymmetricKey](../api-ref/SymmetricKey/index.md) resource or the [SymmetricKeyService/Create](../api-ref/grpc/SymmetricKey/create.md) gRPC API call.

{% endlist %}

## Edit a key {#update}

After creating a key, you can change any of its attributes. If you change the encryption algorithm, the new algorithm is used starting with the next key version. To create a new version right away and make it the default one, [rotate the key](#rotate).

To edit a key:

{% list tabs group=instructions %}

- Management console {#console}

  1. Log in to the [management console](https://console.yandex.cloud).
  1. Navigate to **Key Management Service**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/key.svg) **Symmetric keys**.
  1. In the line with the key, click ![image](../../_assets/console-icons/ellipsis.svg) and select **Edit**.
  1. Change the key attributes and click **Save**.

- CLI {#cli}

  Run this command:

  ```bash
  yc kms symmetric-key update \
    --name example-key \
    --new-name example-key-2 \
    --default-algorithm aes-128 \
    --rotation-period 48h \
    --deletion-protection
  ```

  Where:

  * `--name`: Key name. If there are several keys of the same name in the folder, use the key ID.
  * `--new-name`: New key name.
  * `--default-algorithm`: [Encryption algorithms](../concepts/key.md#parameters), such as `aes-128`, `aes-192`, `aes-256`, `aes-256-hsm`, or `gost-r-3412-2015-k`.
  * `--rotation-period`: Key rotation period. To disable automatic rotation for an updated key, do not specify the `--rotation-period` parameter.
  * `--deletion-protection`: Key deletion protection. To disable deletion protection, specify the `--no-deletion-protection` parameter.

- Terraform {#tf}

  To edit a key:
  1. Open the Terraform configuration file and change the required parameters of the `yandex_kms_symmetric_key` resource.

     Here is an example of the configuration file structure:

     ```hcl
     ...
     resource "yandex_kms_symmetric_key" "key-a" {
       name                = "example-symmetric-key"
       description         = "description for key"
       default_algorithm   = "AES_128"
       rotation_period     = "8760h"
       deletion_protection = true
     }
     ...
     ```

     For more information about the `yandex_kms_symmetric_key` properties in Terraform, see [this provider guide](../../terraform/resources/kms_symmetric_key.md).
  1. Validate your configuration using this command:

     ```bash
     terraform validate
     ```

     If the configuration is valid, you will get this message:

     ```text
     Success! The configuration is valid.
     ```

  1. Run this command:

     ```bash
     terraform plan
     ```

     You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
  1. Apply the configuration changes:

     ```bash
     terraform apply
     ```

  1. Type `yes` and press **Enter** to confirm the changes.

     You can check the key update using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/quickstart.md) command:

     ```bash
     yc kms symmetric-key get <key_name>
     ```

- API {#api}

  Use the [update](../api-ref/SymmetricKey/update.md) REST API method for the [SymmetricKey](../api-ref/SymmetricKey/index.md) resource or the [SymmetricKeyService/Update](../api-ref/grpc/SymmetricKey/update.md) gRPC API call.

{% endlist %}

## Activating or deactivating a key {#active-inactive}

After creating a key, you can change its current [status](../concepts/key.md#parameters).

{% note info %}

Key deactivation (changing the key status from `Active` to `Inactive`) is an [eventually consistent](../concepts/consistency.md) operation. Changes caused by such operations take effect with a delay of up to three hours.

{% endnote %}

To change key status:

{% list tabs group=instructions %}

- Management console {#console}

  1. Log in to the [management console](https://console.yandex.cloud).
  1. Navigate to **Key Management Service**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/key.svg) **Symmetric keys**.
  1. To deactivate a key, click ![image](../../_assets/console-icons/ellipsis.svg) and select **Deactivate** next to an `Active` key.
  1. To activate a key, click ![image](../../_assets/console-icons/ellipsis.svg) and select **Activate** next to an `Inactive` key.

- CLI {#cli}

  Run this command:

  ```bash
  yc kms symmetric-key update \
    --name example-key \
    --status active
  ```

  Where:

  * `--name`: Key name. If there are several keys of the same name in the folder, use the key ID in the `--id` parameter.
  * `--status`: New key status. It can be either `active` or `inactive`.

- Terraform {#tf}

  1. Open the Terraform configuration file and add the `status` parameter set to `ACTIVE` or `INACTIVE` to the `yandex_kms_symmetric_key` resource's description.

     Here is an example of the configuration file structure:

     ```hcl
     ...
     resource "yandex_kms_symmetric_key" "key-a" {
       name                = "example-symmetric-key"
       description         = "description for key"
       ...
       status              = "INACTIVE"
     }
     ...
     ```

     For more information about the `yandex_kms_symmetric_key` properties in Terraform, see [this provider guide](../../terraform/resources/kms_symmetric_key.md).

  1. Validate your configuration using this command:

     ```bash
     terraform validate
     ```

     If the configuration is valid, you will get this message:

     ```text
     Success! The configuration is valid.
     ```

  1. Run this command:

     ```bash
     terraform plan
     ```

     You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
  1. Apply the configuration changes:

     ```bash
     terraform apply
     ```

  1. Type `yes` and press **Enter** to confirm the changes.

  You can check the key status update using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/quickstart.md) command:

     ```bash
     yc kms symmetric-key get <key_name>
     ```

- API {#api}

  Use the [update](../api-ref/SymmetricKey/update.md) REST API method for the [SymmetricKey](../api-ref/SymmetricKey/index.md) resource or the [SymmetricKeyService/Update](../api-ref/grpc/SymmetricKey/update.md) gRPC API call.

{% endlist %}

## Rotate a key {#rotate}

When a key is rotated, a new version is generated and immediately set as the default version. You can set up automatic rotation, but you can also rotate a key manually at any time.

{% note info %}

Key rotation is an [eventually consistent](../concepts/consistency.md) operation. Changes caused by such operations take effect with a delay of up to three hours.

{% endnote %}

To rotate a key:

{% list tabs group=instructions %}

- Management console {#console}

  1. Log in to the [management console](https://console.yandex.cloud).
  1. Navigate to **Key Management Service**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/key.svg) **Symmetric keys**.
  1. In the line with the key, click ![image](../../_assets/console-icons/ellipsis.svg) and select **Rotate**.
  1. Confirm the rotation (make sure that changing the default version will not affect your work).

- CLI {#cli}

  Run the command with the key ID or name specified:

  ```bash
  yc kms symmetric-key rotate example-key
  ```

- API {#api}

  Use the [rotate](../api-ref/SymmetricKey/rotate.md) REST API method for the [SymmetricKey](../api-ref/SymmetricKey/index.md) resource or the [SymmetricKeyService/Rotate](../api-ref/grpc/SymmetricKey/rotate.md) gRPC API call.

{% endlist %}

## Destroy a key {#delete}

By destroying a key you also destroy all its versions. You cannot delete a key right away: the versions of a key marked for deletion change their status to `Scheduled For Destruction` for 3 days. During this time, your account will continue [to be charged](../pricing.md) for these key versions. Before the 3 days expire, you can request technical support to restore a key and its versions.

{% note alert %}

3 days after the key is requested to be destroyed, the key and its versions are permanently destroyed: if you still have any data encrypted with this key, you cannot decrypt the data.

{% endnote %}

If key deletion protection is enabled, [disable](#update) it first.

To destroy a key:

{% list tabs group=instructions %}

- Management console {#console}

  1. Log in to the [management console](https://console.yandex.cloud).
  1. Navigate to **Key Management Service**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/key.svg) **Symmetric keys**.
  1. In the line with the key, click ![image](../../_assets/console-icons/ellipsis.svg) and select **Delete**.
  1. In the window that opens, click **Delete**.

- CLI {#cli}

  Run the command with the key ID or name specified:

  ```bash
  yc kms symmetric-key delete example-key
  ```

- Terraform {#tf}

  To delete a key created with Terraform:
  1. Open the Terraform configuration file and delete the fragment with the key description.

     Example key description in the Terraform configuration:

     ```hcl
     ...
     resource "yandex_kms_symmetric_key" "key-a" {
       name              = "example-symmetric-key"
       description       = "description for key"
       default_algorithm = "AES_128"
       rotation_period   = "8760h"
     }
     ...
     ```

  1. In the command line, go to the directory with the Terraform configuration file.
  1. Check the configuration using this command:

     ```bash
     terraform validate
     ```

     If the configuration is valid, you will get this message:

     ```bash
     Success! The configuration is valid.
     ```

  1. Run this command:

     ```bash
     terraform plan
     ```

     You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
  1. Apply the configuration changes:

     ```bash
     terraform apply
     ```

  1. Type `yes` and press **Enter** to confirm changes.

     You can check the update using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/quickstart.md) command:

     ```bash
     yc kms symmetric-key list
     ```

- API {#api}

  Use the [delete](../api-ref/SymmetricKey/delete.md) REST API method for the [SymmetricKey](../api-ref/SymmetricKey/index.md) resource or the [SymmetricKeyService/Delete](../api-ref/grpc/SymmetricKey/delete.md) gRPC API call.

{% endlist %}

{% note info %}

Deleting a key is an [eventually consistent](../concepts/consistency.md) operation. Changes caused by such operations take effect with a delay of up to three hours.

{% endnote %}

## Useful links {#see-also}

* [Managing Key Management Service keys with Terraform](../tutorials/terraform-key.md)