Aliyun Python SDK KMS

aliyun-python-sdk-kms is the Alibaba Cloud Key Management Service (KMS) module of the Aliyun V1.0 Python SDK. It provides typed request classes for calling every KMS OpenAPI action from Python, letting you create and manage customer master keys, encrypt and decrypt data, generate data keys, and handle secrets and key rotation.

The package depends on aliyun-python-sdk-core, which supplies the shared AcsClient, credential handling, and request signing; this module adds the KMS-specific request definitions on top. It is part of the larger aliyun-openapi-python-sdk monorepo and, like the rest of the V1.0 SDK, is now in basic security-maintenance mode with the V2.0 SDK recommended for new projects.

What You Get

• Typed request classes for the full Alibaba Cloud KMS OpenAPI surface
• Key lifecycle operations: create, describe, enable, disable, schedule deletion, and rotate keys
• Encrypt, Decrypt, and GenerateDataKey operations for envelope encryption
• Secrets-management request classes for KMS-backed secrets
• Integration with the shared AcsClient for signing, credentials, and endpoints

Common Use Cases

• Encrypting and decrypting sensitive data via Alibaba Cloud KMS from Python
• Managing customer master keys and their rotation programmatically
• Generating data keys for client-side envelope encryption
• Storing and retrieving secrets backed by Alibaba Cloud KMS

Under The Hood

Architecture — The module ships an aliyunsdkkms package containing one request class per KMS OpenAPI action (Encrypt, Decrypt, GenerateDataKey, CreateKey, and so on). These are RPC-style request objects defined against the shared base classes in aliyun-python-sdk-core; the caller passes them to an AcsClient, which attaches credentials, signs the request, resolves the regional KMS endpoint, and returns the parsed response.

Tech Stack — Pure Python built on aliyun-python-sdk-core as its sole SDK dependency. It supports a very wide range of interpreter versions (documented from Python 2.6.5 upward) and lives inside the aliyun-openapi-python-sdk monorepo, which uses GitHub Actions CI and Codecov.

Code Quality — The package is thin and generated-style: the value is in complete, up-to-date coverage of the KMS API rather than hand-written logic. The parent repository is mature and heavily adopted (~1.79M weekly downloads for this module), though the V1.0 SDK is now in security-maintenance mode with no new features planned.

API Design — Following the V1.0 SDK pattern, you build a request object, set parameters, and execute it through AcsClient. This is more verbose than the newer V2.0 SDK, but consistent with every other Aliyun product module, so knowledge transfers directly across services.