Limits and Quotas - KMS
Limits
Exoscale automatically provisions a default Key Management Service (KMS) key for all organizations. This key is fully managed by Exoscale and automatically replicated across all zones.
The following hard limitations apply to default keys:
They cannot be deleted.
Custom keys cannot use the reserved name of a default key.
Automatic key rotation for default keys cannot be disabled.
The number of manual key rotations permitted for any single KMS key is strictly limited to 10. This is a system limit and cannot be modified.
External Key Store
Private Preview
External Key Store (XKS) is currently available as a private preview. Review the service boundaries for current limitations and SLA status.
A key store belongs to a single zone. Create it in the zone where you want to use its keys.
The following restrictions apply to KMS keys in an external key store:
| Property | Supported value |
|---|---|
usage | encrypt-decrypt only |
key-spec | AES_256 only |
multi-zone | false only. These keys cannot be replicated to other zones. |
| Automatic rotation | Not configured for these keys |
Every cryptographic operation calls your proxy. The availability and latency of these operations depend on your proxy and your key manager.
Warning
Exoscale cannot decrypt without your external key. Operations fail while your proxy is unreachable, and data cannot be recovered if the external key is permanently lost.
Quotas
| Usage | Quota |
|---|---|
| Maximum number of keys per organization per zone | 1,000 |
Note
Key replicas within a replicated key set do not count toward your quota; only the primary key is counted.