pulumi-alicloud 3.51.0a1710157550__py3-none-any.whl → 3.73.0a1736832142__py3-none-any.whl

pulumi_alicloud/kms/key.py

@@ -4,9 +4,14 @@
 
 import copy
 import warnings
+import sys
 import pulumi
 import pulumi.runtime
 from typing import Any, Mapping, Optional, Sequence, Union, overload
+if sys.version_info >= (3, 11):
+    from typing import NotRequired, TypedDict, TypeAlias
+else:
+    from typing_extensions import NotRequired, TypedDict, TypeAlias
 from .. import _utilities
 
 __all__ = ['KeyArgs', 'Key']
@@ -15,6 +20,8 @@ __all__ = ['KeyArgs', 'Key']
 class KeyArgs:
     def __init__(__self__, *,
                  automatic_rotation: Optional[pulumi.Input[str]] = None,
+                 deletion_protection: Optional[pulumi.Input[str]] = None,
+                 deletion_protection_description: Optional[pulumi.Input[str]] = None,
                  deletion_window_in_days: Optional[pulumi.Input[int]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  dkms_instance_id: Optional[pulumi.Input[str]] = None,
@@ -24,45 +31,48 @@ class KeyArgs:
                  key_usage: Optional[pulumi.Input[str]] = None,
                  origin: Optional[pulumi.Input[str]] = None,
                  pending_window_in_days: Optional[pulumi.Input[int]] = None,
+                 policy: Optional[pulumi.Input[str]] = None,
                  protection_level: Optional[pulumi.Input[str]] = None,
                  rotation_interval: Optional[pulumi.Input[str]] = None,
                  status: Optional[pulumi.Input[str]] = None,
-                 tags: Optional[pulumi.Input[Mapping[str, Any]]] = None):
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None):
         """
         The set of arguments for constructing a Key resource.
-        :param pulumi.Input[str] automatic_rotation: Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values:
+        :param pulumi.Input[str] automatic_rotation: Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        :param pulumi.Input[str] deletion_protection: Specifies whether to enable deletion protection. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        :param pulumi.Input[str] deletion_protection_description: The description of deletion protection. **NOTE:** `deletion_protection_description` takes effect only if `deletion_protection` is set to `Enabled`.
         :param pulumi.Input[int] deletion_window_in_days: Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.
-        :param pulumi.Input[str] description: The description of the CMK. The description can be 0 to 8,192 characters in length.
-        :param pulumi.Input[str] dkms_instance_id: The instance ID of the exclusive KMS instance.
+        :param pulumi.Input[str] description: The description of the key.
+        :param pulumi.Input[str] dkms_instance_id: The ID of the KMS instance.
         :param pulumi.Input[bool] is_enabled: Field `is_enabled` has been deprecated from provider version 1.85.0. New field `status` instead.
-        :param pulumi.Input[str] key_spec: The type of the CMK. Default value: `Aliyun_AES_256`. Valid values: 
-               `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
-               Note: The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
-        :param pulumi.Input[str] key_state: Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
-        :param pulumi.Input[str] key_usage: The usage of the CMK. Default value: `ENCRYPT/DECRYPT`. Valid values:
-               - `ENCRYPT/DECRYPT`: encrypts or decrypts data.
-               - `SIGN/VERIFY`: generates or verifies a digital signature.
-        :param pulumi.Input[str] origin: The source of key material. Default value: `Aliyun_KMS`. Valid values:
-        :param pulumi.Input[int] pending_window_in_days: The number of days before the CMK is deleted. 
-               During this period, the CMK is in the PendingDeletion state.
-               After this period ends, you cannot cancel the deletion. Valid values: 7 to 366. Unit: days.
-               **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
-        :param pulumi.Input[str] protection_level: The protection level of the CMK. Default value: `SOFTWARE`. Valid values:
-        :param pulumi.Input[str] rotation_interval: The interval for automatic key rotation. Specify the value in the integer[unit] format.
-               The following units are supported: d (day), h (hour), m (minute), and s (second).
-               For example, you can use either 7d or 604800s to specify a seven-day interval.
-               The interval can range from 7 days to 730 days.
-               **NOTE**: It is Required when `automatic_rotation = "Enabled"`
+               
+               > **NOTE:** If you set the origin parameter to EXTERNAL or the key_spec parameter to an asymmetric CMK type, automatic key rotation is unavailable.
+               
+               > **NOTE:** The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
                
                > **NOTE:** When the pre-deletion days elapses, the key is permanently deleted and cannot be recovered.
-        :param pulumi.Input[str] status: The status of CMK. Default value: `Enabled`. Valid Values:
-        :param pulumi.Input[Mapping[str, Any]] tags: A mapping of tags to assign to the resource.
+        :param pulumi.Input[str] key_spec: The specification of the key. Default value: `Aliyun_AES_256`. Valid values: `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
+        :param pulumi.Input[str] key_state: Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
+        :param pulumi.Input[str] key_usage: The usage of the key. Default value: `ENCRYPT/DECRYPT`. Valid values:
+               - `ENCRYPT/DECRYPT`: Encrypts or decrypts data.
+               - `SIGN/VERIFY`: Generates or verifies a digital signature.
+        :param pulumi.Input[str] origin: The key material origin. Default value: `Aliyun_KMS`. Valid values: `Aliyun_KMS`, `EXTERNAL`.
+        :param pulumi.Input[int] pending_window_in_days: The number of days before the CMK is deleted. During this period, the CMK is in the PendingDeletion state. After this period ends, you cannot cancel the deletion. Unit: days. Valid values: `7` to `366`. **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
+        :param pulumi.Input[str] policy: The content of the key policy. The value is in the JSON format. The value can be up to 32,768 bytes in length. For more information, see [How to use it](https://www.alibabacloud.com/help/en/kms/developer-reference/api-setkeypolicy).
+        :param pulumi.Input[str] protection_level: The protection level of the key. Default value: `SOFTWARE`. Valid values: `SOFTWARE`, `HSM`.
+        :param pulumi.Input[str] rotation_interval: The period of automatic key rotation. The following units are supported: d (day), h (hour), m (minute), and s (second). For example, you can use either 7d or 604800s to specify a seven-day interval. **NOTE**: If `automatic_rotation` is set to `Enabled`, `rotation_interval` is required.
+        :param pulumi.Input[str] status: The status of key. Default value: `Enabled`. Valid values: `Enabled`, `Disabled`, `PendingDeletion`.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A mapping of tags to assign to the resource.
         """
         if automatic_rotation is not None:
             pulumi.set(__self__, "automatic_rotation", automatic_rotation)
+        if deletion_protection is not None:
+            pulumi.set(__self__, "deletion_protection", deletion_protection)
+        if deletion_protection_description is not None:
+            pulumi.set(__self__, "deletion_protection_description", deletion_protection_description)
         if deletion_window_in_days is not None:
-            warnings.warn("""Field 'deletion_window_in_days' has been deprecated from provider version 1.85.0. New field 'pending_window_in_days' instead.""", DeprecationWarning)
-            pulumi.log.warn("""deletion_window_in_days is deprecated: Field 'deletion_window_in_days' has been deprecated from provider version 1.85.0. New field 'pending_window_in_days' instead.""")
+            warnings.warn("""Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.""", DeprecationWarning)
+            pulumi.log.warn("""deletion_window_in_days is deprecated: Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.""")
         if deletion_window_in_days is not None:
             pulumi.set(__self__, "deletion_window_in_days", deletion_window_in_days)
         if description is not None:
@@ -70,15 +80,15 @@ class KeyArgs:
         if dkms_instance_id is not None:
             pulumi.set(__self__, "dkms_instance_id", dkms_instance_id)
         if is_enabled is not None:
-            warnings.warn("""Field 'is_enabled' has been deprecated from provider version 1.85.0. New field 'key_state' instead.""", DeprecationWarning)
-            pulumi.log.warn("""is_enabled is deprecated: Field 'is_enabled' has been deprecated from provider version 1.85.0. New field 'key_state' instead.""")
+            warnings.warn("""Field `is_enabled` has been deprecated from provider version 1.85.0. New field `key_state` instead.""", DeprecationWarning)
+            pulumi.log.warn("""is_enabled is deprecated: Field `is_enabled` has been deprecated from provider version 1.85.0. New field `key_state` instead.""")
         if is_enabled is not None:
             pulumi.set(__self__, "is_enabled", is_enabled)
         if key_spec is not None:
             pulumi.set(__self__, "key_spec", key_spec)
         if key_state is not None:
-            warnings.warn("""Field 'key_state' has been deprecated from provider version 1.123.1. New field 'status' instead.""", DeprecationWarning)
-            pulumi.log.warn("""key_state is deprecated: Field 'key_state' has been deprecated from provider version 1.123.1. New field 'status' instead.""")
+            warnings.warn("""Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.""", DeprecationWarning)
+            pulumi.log.warn("""key_state is deprecated: Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.""")
         if key_state is not None:
             pulumi.set(__self__, "key_state", key_state)
         if key_usage is not None:
@@ -87,6 +97,8 @@ class KeyArgs:
             pulumi.set(__self__, "origin", origin)
         if pending_window_in_days is not None:
             pulumi.set(__self__, "pending_window_in_days", pending_window_in_days)
+        if policy is not None:
+            pulumi.set(__self__, "policy", policy)
         if protection_level is not None:
             pulumi.set(__self__, "protection_level", protection_level)
         if rotation_interval is not None:
@@ -100,7 +112,7 @@ class KeyArgs:
     @pulumi.getter(name="automaticRotation")
     def automatic_rotation(self) -> Optional[pulumi.Input[str]]:
         """
-        Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values:
+        Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
         """
         return pulumi.get(self, "automatic_rotation")
 
@@ -108,15 +120,37 @@ class KeyArgs:
     def automatic_rotation(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "automatic_rotation", value)
 
+    @property
+    @pulumi.getter(name="deletionProtection")
+    def deletion_protection(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies whether to enable deletion protection. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        """
+        return pulumi.get(self, "deletion_protection")
+
+    @deletion_protection.setter
+    def deletion_protection(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "deletion_protection", value)
+
+    @property
+    @pulumi.getter(name="deletionProtectionDescription")
+    def deletion_protection_description(self) -> Optional[pulumi.Input[str]]:
+        """
+        The description of deletion protection. **NOTE:** `deletion_protection_description` takes effect only if `deletion_protection` is set to `Enabled`.
+        """
+        return pulumi.get(self, "deletion_protection_description")
+
+    @deletion_protection_description.setter
+    def deletion_protection_description(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "deletion_protection_description", value)
+
     @property
     @pulumi.getter(name="deletionWindowInDays")
+    @_utilities.deprecated("""Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.""")
     def deletion_window_in_days(self) -> Optional[pulumi.Input[int]]:
         """
         Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.
         """
-        warnings.warn("""Field 'deletion_window_in_days' has been deprecated from provider version 1.85.0. New field 'pending_window_in_days' instead.""", DeprecationWarning)
-        pulumi.log.warn("""deletion_window_in_days is deprecated: Field 'deletion_window_in_days' has been deprecated from provider version 1.85.0. New field 'pending_window_in_days' instead.""")
-
         return pulumi.get(self, "deletion_window_in_days")
 
     @deletion_window_in_days.setter
@@ -127,7 +161,7 @@ class KeyArgs:
     @pulumi.getter
     def description(self) -> Optional[pulumi.Input[str]]:
         """
-        The description of the CMK. The description can be 0 to 8,192 characters in length.
+        The description of the key.
         """
         return pulumi.get(self, "description")
 
@@ -139,7 +173,7 @@ class KeyArgs:
     @pulumi.getter(name="dkmsInstanceId")
     def dkms_instance_id(self) -> Optional[pulumi.Input[str]]:
         """
-        The instance ID of the exclusive KMS instance.
+        The ID of the KMS instance.
         """
         return pulumi.get(self, "dkms_instance_id")
 
@@ -149,13 +183,17 @@ class KeyArgs:
 
     @property
     @pulumi.getter(name="isEnabled")
+    @_utilities.deprecated("""Field `is_enabled` has been deprecated from provider version 1.85.0. New field `key_state` instead.""")
     def is_enabled(self) -> Optional[pulumi.Input[bool]]:
         """
         Field `is_enabled` has been deprecated from provider version 1.85.0. New field `status` instead.
-        """
-        warnings.warn("""Field 'is_enabled' has been deprecated from provider version 1.85.0. New field 'key_state' instead.""", DeprecationWarning)
-        pulumi.log.warn("""is_enabled is deprecated: Field 'is_enabled' has been deprecated from provider version 1.85.0. New field 'key_state' instead.""")
 
+        > **NOTE:** If you set the origin parameter to EXTERNAL or the key_spec parameter to an asymmetric CMK type, automatic key rotation is unavailable.
+
+        > **NOTE:** The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
+
+        > **NOTE:** When the pre-deletion days elapses, the key is permanently deleted and cannot be recovered.
+        """
         return pulumi.get(self, "is_enabled")
 
     @is_enabled.setter
@@ -166,9 +204,7 @@ class KeyArgs:
     @pulumi.getter(name="keySpec")
     def key_spec(self) -> Optional[pulumi.Input[str]]:
         """
-        The type of the CMK. Default value: `Aliyun_AES_256`. Valid values: 
-        `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
-        Note: The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
+        The specification of the key. Default value: `Aliyun_AES_256`. Valid values: `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
         """
         return pulumi.get(self, "key_spec")
 
@@ -178,13 +214,11 @@ class KeyArgs:
 
     @property
     @pulumi.getter(name="keyState")
+    @_utilities.deprecated("""Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.""")
     def key_state(self) -> Optional[pulumi.Input[str]]:
         """
         Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
         """
-        warnings.warn("""Field 'key_state' has been deprecated from provider version 1.123.1. New field 'status' instead.""", DeprecationWarning)
-        pulumi.log.warn("""key_state is deprecated: Field 'key_state' has been deprecated from provider version 1.123.1. New field 'status' instead.""")
-
         return pulumi.get(self, "key_state")
 
     @key_state.setter
@@ -195,9 +229,9 @@ class KeyArgs:
     @pulumi.getter(name="keyUsage")
     def key_usage(self) -> Optional[pulumi.Input[str]]:
         """
-        The usage of the CMK. Default value: `ENCRYPT/DECRYPT`. Valid values:
-        - `ENCRYPT/DECRYPT`: encrypts or decrypts data.
-        - `SIGN/VERIFY`: generates or verifies a digital signature.
+        The usage of the key. Default value: `ENCRYPT/DECRYPT`. Valid values:
+        - `ENCRYPT/DECRYPT`: Encrypts or decrypts data.
+        - `SIGN/VERIFY`: Generates or verifies a digital signature.
         """
         return pulumi.get(self, "key_usage")
 
@@ -209,7 +243,7 @@ class KeyArgs:
     @pulumi.getter
     def origin(self) -> Optional[pulumi.Input[str]]:
         """
-        The source of key material. Default value: `Aliyun_KMS`. Valid values:
+        The key material origin. Default value: `Aliyun_KMS`. Valid values: `Aliyun_KMS`, `EXTERNAL`.
         """
         return pulumi.get(self, "origin")
 
@@ -221,10 +255,7 @@ class KeyArgs:
     @pulumi.getter(name="pendingWindowInDays")
     def pending_window_in_days(self) -> Optional[pulumi.Input[int]]:
         """
-        The number of days before the CMK is deleted. 
-        During this period, the CMK is in the PendingDeletion state.
-        After this period ends, you cannot cancel the deletion. Valid values: 7 to 366. Unit: days.
-        **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
+        The number of days before the CMK is deleted. During this period, the CMK is in the PendingDeletion state. After this period ends, you cannot cancel the deletion. Unit: days. Valid values: `7` to `366`. **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
         """
         return pulumi.get(self, "pending_window_in_days")
 
@@ -232,11 +263,23 @@ class KeyArgs:
     def pending_window_in_days(self, value: Optional[pulumi.Input[int]]):
         pulumi.set(self, "pending_window_in_days", value)
 
+    @property
+    @pulumi.getter
+    def policy(self) -> Optional[pulumi.Input[str]]:
+        """
+        The content of the key policy. The value is in the JSON format. The value can be up to 32,768 bytes in length. For more information, see [How to use it](https://www.alibabacloud.com/help/en/kms/developer-reference/api-setkeypolicy).
+        """
+        return pulumi.get(self, "policy")
+
+    @policy.setter
+    def policy(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "policy", value)
+
     @property
     @pulumi.getter(name="protectionLevel")
     def protection_level(self) -> Optional[pulumi.Input[str]]:
         """
-        The protection level of the CMK. Default value: `SOFTWARE`. Valid values:
+        The protection level of the key. Default value: `SOFTWARE`. Valid values: `SOFTWARE`, `HSM`.
         """
         return pulumi.get(self, "protection_level")
 
@@ -248,13 +291,7 @@ class KeyArgs:
     @pulumi.getter(name="rotationInterval")
     def rotation_interval(self) -> Optional[pulumi.Input[str]]:
         """
-        The interval for automatic key rotation. Specify the value in the integer[unit] format.
-        The following units are supported: d (day), h (hour), m (minute), and s (second).
-        For example, you can use either 7d or 604800s to specify a seven-day interval.
-        The interval can range from 7 days to 730 days.
-        **NOTE**: It is Required when `automatic_rotation = "Enabled"`
-
-        > **NOTE:** When the pre-deletion days elapses, the key is permanently deleted and cannot be recovered.
+        The period of automatic key rotation. The following units are supported: d (day), h (hour), m (minute), and s (second). For example, you can use either 7d or 604800s to specify a seven-day interval. **NOTE**: If `automatic_rotation` is set to `Enabled`, `rotation_interval` is required.
         """
         return pulumi.get(self, "rotation_interval")
 
@@ -266,7 +303,7 @@ class KeyArgs:
     @pulumi.getter
     def status(self) -> Optional[pulumi.Input[str]]:
         """
-        The status of CMK. Default value: `Enabled`. Valid Values:
+        The status of key. Default value: `Enabled`. Valid values: `Enabled`, `Disabled`, `PendingDeletion`.
         """
         return pulumi.get(self, "status")
 
@@ -276,14 +313,14 @@ class KeyArgs:
 
     @property
     @pulumi.getter
-    def tags(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A mapping of tags to assign to the resource.
         """
         return pulumi.get(self, "tags")
 
     @tags.setter
-    def tags(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "tags", value)
 
 
@@ -295,6 +332,8 @@ class _KeyState:
                  creation_date: Optional[pulumi.Input[str]] = None,
                  creator: Optional[pulumi.Input[str]] = None,
                  delete_date: Optional[pulumi.Input[str]] = None,
+                 deletion_protection: Optional[pulumi.Input[str]] = None,
+                 deletion_protection_description: Optional[pulumi.Input[str]] = None,
                  deletion_window_in_days: Optional[pulumi.Input[int]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  dkms_instance_id: Optional[pulumi.Input[str]] = None,
@@ -307,48 +346,47 @@ class _KeyState:
                  next_rotation_date: Optional[pulumi.Input[str]] = None,
                  origin: Optional[pulumi.Input[str]] = None,
                  pending_window_in_days: Optional[pulumi.Input[int]] = None,
+                 policy: Optional[pulumi.Input[str]] = None,
                  primary_key_version: Optional[pulumi.Input[str]] = None,
                  protection_level: Optional[pulumi.Input[str]] = None,
                  rotation_interval: Optional[pulumi.Input[str]] = None,
                  status: Optional[pulumi.Input[str]] = None,
-                 tags: Optional[pulumi.Input[Mapping[str, Any]]] = None):
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None):
         """
         Input properties used for looking up and filtering Key resources.
-        :param pulumi.Input[str] arn: The Alicloud Resource Name (ARN) of the key.
-        :param pulumi.Input[str] automatic_rotation: Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values:
-        :param pulumi.Input[str] creation_date: The date and time when the CMK was created. The time is displayed in UTC.
+        :param pulumi.Input[str] arn: The ARN of the key.
+        :param pulumi.Input[str] automatic_rotation: Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        :param pulumi.Input[str] creation_date: The time when the CMK was created.
         :param pulumi.Input[str] creator: The creator of the CMK.
-        :param pulumi.Input[str] delete_date: The scheduled date to delete CMK. The time is displayed in UTC. This value is returned only when the KeyState value is PendingDeletion.
+        :param pulumi.Input[str] delete_date: The time at which the CMK is scheduled for deletion.
+        :param pulumi.Input[str] deletion_protection: Specifies whether to enable deletion protection. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        :param pulumi.Input[str] deletion_protection_description: The description of deletion protection. **NOTE:** `deletion_protection_description` takes effect only if `deletion_protection` is set to `Enabled`.
         :param pulumi.Input[int] deletion_window_in_days: Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.
-        :param pulumi.Input[str] description: The description of the CMK. The description can be 0 to 8,192 characters in length.
-        :param pulumi.Input[str] dkms_instance_id: The instance ID of the exclusive KMS instance.
+        :param pulumi.Input[str] description: The description of the key.
+        :param pulumi.Input[str] dkms_instance_id: The ID of the KMS instance.
         :param pulumi.Input[bool] is_enabled: Field `is_enabled` has been deprecated from provider version 1.85.0. New field `status` instead.
-        :param pulumi.Input[str] key_spec: The type of the CMK. Default value: `Aliyun_AES_256`. Valid values: 
-               `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
-               Note: The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
-        :param pulumi.Input[str] key_state: Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
-        :param pulumi.Input[str] key_usage: The usage of the CMK. Default value: `ENCRYPT/DECRYPT`. Valid values:
-               - `ENCRYPT/DECRYPT`: encrypts or decrypts data.
-               - `SIGN/VERIFY`: generates or verifies a digital signature.
-        :param pulumi.Input[str] last_rotation_date: The date and time the last rotation was performed. The time is displayed in UTC.
-        :param pulumi.Input[str] material_expire_time: The time and date the key material for the CMK expires. The time is displayed in UTC. If the value is empty, the key material for the CMK does not expire.
-        :param pulumi.Input[str] next_rotation_date: The time the next rotation is scheduled for execution.
-        :param pulumi.Input[str] origin: The source of key material. Default value: `Aliyun_KMS`. Valid values:
-        :param pulumi.Input[int] pending_window_in_days: The number of days before the CMK is deleted. 
-               During this period, the CMK is in the PendingDeletion state.
-               After this period ends, you cannot cancel the deletion. Valid values: 7 to 366. Unit: days.
-               **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
-        :param pulumi.Input[str] primary_key_version: The ID of the current primary key version of the symmetric CMK.
-        :param pulumi.Input[str] protection_level: The protection level of the CMK. Default value: `SOFTWARE`. Valid values:
-        :param pulumi.Input[str] rotation_interval: The interval for automatic key rotation. Specify the value in the integer[unit] format.
-               The following units are supported: d (day), h (hour), m (minute), and s (second).
-               For example, you can use either 7d or 604800s to specify a seven-day interval.
-               The interval can range from 7 days to 730 days.
-               **NOTE**: It is Required when `automatic_rotation = "Enabled"`
+               
+               > **NOTE:** If you set the origin parameter to EXTERNAL or the key_spec parameter to an asymmetric CMK type, automatic key rotation is unavailable.
+               
+               > **NOTE:** The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
                
                > **NOTE:** When the pre-deletion days elapses, the key is permanently deleted and cannot be recovered.
-        :param pulumi.Input[str] status: The status of CMK. Default value: `Enabled`. Valid Values:
-        :param pulumi.Input[Mapping[str, Any]] tags: A mapping of tags to assign to the resource.
+        :param pulumi.Input[str] key_spec: The specification of the key. Default value: `Aliyun_AES_256`. Valid values: `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
+        :param pulumi.Input[str] key_state: Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
+        :param pulumi.Input[str] key_usage: The usage of the key. Default value: `ENCRYPT/DECRYPT`. Valid values:
+               - `ENCRYPT/DECRYPT`: Encrypts or decrypts data.
+               - `SIGN/VERIFY`: Generates or verifies a digital signature.
+        :param pulumi.Input[str] last_rotation_date: The time when the last rotation was performed.
+        :param pulumi.Input[str] material_expire_time: The time when the key material expires.
+        :param pulumi.Input[str] next_rotation_date: The time when the next rotation will be performed.
+        :param pulumi.Input[str] origin: The key material origin. Default value: `Aliyun_KMS`. Valid values: `Aliyun_KMS`, `EXTERNAL`.
+        :param pulumi.Input[int] pending_window_in_days: The number of days before the CMK is deleted. During this period, the CMK is in the PendingDeletion state. After this period ends, you cannot cancel the deletion. Unit: days. Valid values: `7` to `366`. **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
+        :param pulumi.Input[str] policy: The content of the key policy. The value is in the JSON format. The value can be up to 32,768 bytes in length. For more information, see [How to use it](https://www.alibabacloud.com/help/en/kms/developer-reference/api-setkeypolicy).
+        :param pulumi.Input[str] primary_key_version: The ID of the current primary key version of the symmetric CMK.
+        :param pulumi.Input[str] protection_level: The protection level of the key. Default value: `SOFTWARE`. Valid values: `SOFTWARE`, `HSM`.
+        :param pulumi.Input[str] rotation_interval: The period of automatic key rotation. The following units are supported: d (day), h (hour), m (minute), and s (second). For example, you can use either 7d or 604800s to specify a seven-day interval. **NOTE**: If `automatic_rotation` is set to `Enabled`, `rotation_interval` is required.
+        :param pulumi.Input[str] status: The status of key. Default value: `Enabled`. Valid values: `Enabled`, `Disabled`, `PendingDeletion`.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A mapping of tags to assign to the resource.
         """
         if arn is not None:
             pulumi.set(__self__, "arn", arn)
@@ -360,9 +398,13 @@ class _KeyState:
             pulumi.set(__self__, "creator", creator)
         if delete_date is not None:
             pulumi.set(__self__, "delete_date", delete_date)
+        if deletion_protection is not None:
+            pulumi.set(__self__, "deletion_protection", deletion_protection)
+        if deletion_protection_description is not None:
+            pulumi.set(__self__, "deletion_protection_description", deletion_protection_description)
         if deletion_window_in_days is not None:
-            warnings.warn("""Field 'deletion_window_in_days' has been deprecated from provider version 1.85.0. New field 'pending_window_in_days' instead.""", DeprecationWarning)
-            pulumi.log.warn("""deletion_window_in_days is deprecated: Field 'deletion_window_in_days' has been deprecated from provider version 1.85.0. New field 'pending_window_in_days' instead.""")
+            warnings.warn("""Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.""", DeprecationWarning)
+            pulumi.log.warn("""deletion_window_in_days is deprecated: Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.""")
         if deletion_window_in_days is not None:
             pulumi.set(__self__, "deletion_window_in_days", deletion_window_in_days)
         if description is not None:
@@ -370,15 +412,15 @@ class _KeyState:
         if dkms_instance_id is not None:
             pulumi.set(__self__, "dkms_instance_id", dkms_instance_id)
         if is_enabled is not None:
-            warnings.warn("""Field 'is_enabled' has been deprecated from provider version 1.85.0. New field 'key_state' instead.""", DeprecationWarning)
-            pulumi.log.warn("""is_enabled is deprecated: Field 'is_enabled' has been deprecated from provider version 1.85.0. New field 'key_state' instead.""")
+            warnings.warn("""Field `is_enabled` has been deprecated from provider version 1.85.0. New field `key_state` instead.""", DeprecationWarning)
+            pulumi.log.warn("""is_enabled is deprecated: Field `is_enabled` has been deprecated from provider version 1.85.0. New field `key_state` instead.""")
         if is_enabled is not None:
             pulumi.set(__self__, "is_enabled", is_enabled)
         if key_spec is not None:
             pulumi.set(__self__, "key_spec", key_spec)
         if key_state is not None:
-            warnings.warn("""Field 'key_state' has been deprecated from provider version 1.123.1. New field 'status' instead.""", DeprecationWarning)
-            pulumi.log.warn("""key_state is deprecated: Field 'key_state' has been deprecated from provider version 1.123.1. New field 'status' instead.""")
+            warnings.warn("""Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.""", DeprecationWarning)
+            pulumi.log.warn("""key_state is deprecated: Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.""")
         if key_state is not None:
             pulumi.set(__self__, "key_state", key_state)
         if key_usage is not None:
@@ -393,6 +435,8 @@ class _KeyState:
             pulumi.set(__self__, "origin", origin)
         if pending_window_in_days is not None:
             pulumi.set(__self__, "pending_window_in_days", pending_window_in_days)
+        if policy is not None:
+            pulumi.set(__self__, "policy", policy)
         if primary_key_version is not None:
             pulumi.set(__self__, "primary_key_version", primary_key_version)
         if protection_level is not None:
@@ -408,7 +452,7 @@ class _KeyState:
     @pulumi.getter
     def arn(self) -> Optional[pulumi.Input[str]]:
         """
-        The Alicloud Resource Name (ARN) of the key.
+        The ARN of the key.
         """
         return pulumi.get(self, "arn")
 
@@ -420,7 +464,7 @@ class _KeyState:
     @pulumi.getter(name="automaticRotation")
     def automatic_rotation(self) -> Optional[pulumi.Input[str]]:
         """
-        Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values:
+        Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
         """
         return pulumi.get(self, "automatic_rotation")
 
@@ -432,7 +476,7 @@ class _KeyState:
     @pulumi.getter(name="creationDate")
     def creation_date(self) -> Optional[pulumi.Input[str]]:
         """
-        The date and time when the CMK was created. The time is displayed in UTC.
+        The time when the CMK was created.
         """
         return pulumi.get(self, "creation_date")
 
@@ -456,7 +500,7 @@ class _KeyState:
     @pulumi.getter(name="deleteDate")
     def delete_date(self) -> Optional[pulumi.Input[str]]:
         """
-        The scheduled date to delete CMK. The time is displayed in UTC. This value is returned only when the KeyState value is PendingDeletion.
+        The time at which the CMK is scheduled for deletion.
         """
         return pulumi.get(self, "delete_date")
 
@@ -464,15 +508,37 @@ class _KeyState:
     def delete_date(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "delete_date", value)
 
+    @property
+    @pulumi.getter(name="deletionProtection")
+    def deletion_protection(self) -> Optional[pulumi.Input[str]]:
+        """
+        Specifies whether to enable deletion protection. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        """
+        return pulumi.get(self, "deletion_protection")
+
+    @deletion_protection.setter
+    def deletion_protection(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "deletion_protection", value)
+
+    @property
+    @pulumi.getter(name="deletionProtectionDescription")
+    def deletion_protection_description(self) -> Optional[pulumi.Input[str]]:
+        """
+        The description of deletion protection. **NOTE:** `deletion_protection_description` takes effect only if `deletion_protection` is set to `Enabled`.
+        """
+        return pulumi.get(self, "deletion_protection_description")
+
+    @deletion_protection_description.setter
+    def deletion_protection_description(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "deletion_protection_description", value)
+
     @property
     @pulumi.getter(name="deletionWindowInDays")
+    @_utilities.deprecated("""Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.""")
     def deletion_window_in_days(self) -> Optional[pulumi.Input[int]]:
         """
         Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.
         """
-        warnings.warn("""Field 'deletion_window_in_days' has been deprecated from provider version 1.85.0. New field 'pending_window_in_days' instead.""", DeprecationWarning)
-        pulumi.log.warn("""deletion_window_in_days is deprecated: Field 'deletion_window_in_days' has been deprecated from provider version 1.85.0. New field 'pending_window_in_days' instead.""")
-
         return pulumi.get(self, "deletion_window_in_days")
 
     @deletion_window_in_days.setter
@@ -483,7 +549,7 @@ class _KeyState:
     @pulumi.getter
     def description(self) -> Optional[pulumi.Input[str]]:
         """
-        The description of the CMK. The description can be 0 to 8,192 characters in length.
+        The description of the key.
         """
         return pulumi.get(self, "description")
 
@@ -495,7 +561,7 @@ class _KeyState:
     @pulumi.getter(name="dkmsInstanceId")
     def dkms_instance_id(self) -> Optional[pulumi.Input[str]]:
         """
-        The instance ID of the exclusive KMS instance.
+        The ID of the KMS instance.
         """
         return pulumi.get(self, "dkms_instance_id")
 
@@ -505,13 +571,17 @@ class _KeyState:
 
     @property
     @pulumi.getter(name="isEnabled")
+    @_utilities.deprecated("""Field `is_enabled` has been deprecated from provider version 1.85.0. New field `key_state` instead.""")
     def is_enabled(self) -> Optional[pulumi.Input[bool]]:
         """
         Field `is_enabled` has been deprecated from provider version 1.85.0. New field `status` instead.
-        """
-        warnings.warn("""Field 'is_enabled' has been deprecated from provider version 1.85.0. New field 'key_state' instead.""", DeprecationWarning)
-        pulumi.log.warn("""is_enabled is deprecated: Field 'is_enabled' has been deprecated from provider version 1.85.0. New field 'key_state' instead.""")
 
+        > **NOTE:** If you set the origin parameter to EXTERNAL or the key_spec parameter to an asymmetric CMK type, automatic key rotation is unavailable.
+
+        > **NOTE:** The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
+
+        > **NOTE:** When the pre-deletion days elapses, the key is permanently deleted and cannot be recovered.
+        """
         return pulumi.get(self, "is_enabled")
 
     @is_enabled.setter
@@ -522,9 +592,7 @@ class _KeyState:
     @pulumi.getter(name="keySpec")
     def key_spec(self) -> Optional[pulumi.Input[str]]:
         """
-        The type of the CMK. Default value: `Aliyun_AES_256`. Valid values: 
-        `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
-        Note: The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
+        The specification of the key. Default value: `Aliyun_AES_256`. Valid values: `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
         """
         return pulumi.get(self, "key_spec")
 
@@ -534,13 +602,11 @@ class _KeyState:
 
     @property
     @pulumi.getter(name="keyState")
+    @_utilities.deprecated("""Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.""")
     def key_state(self) -> Optional[pulumi.Input[str]]:
         """
         Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
         """
-        warnings.warn("""Field 'key_state' has been deprecated from provider version 1.123.1. New field 'status' instead.""", DeprecationWarning)
-        pulumi.log.warn("""key_state is deprecated: Field 'key_state' has been deprecated from provider version 1.123.1. New field 'status' instead.""")
-
         return pulumi.get(self, "key_state")
 
     @key_state.setter
@@ -551,9 +617,9 @@ class _KeyState:
     @pulumi.getter(name="keyUsage")
     def key_usage(self) -> Optional[pulumi.Input[str]]:
         """
-        The usage of the CMK. Default value: `ENCRYPT/DECRYPT`. Valid values:
-        - `ENCRYPT/DECRYPT`: encrypts or decrypts data.
-        - `SIGN/VERIFY`: generates or verifies a digital signature.
+        The usage of the key. Default value: `ENCRYPT/DECRYPT`. Valid values:
+        - `ENCRYPT/DECRYPT`: Encrypts or decrypts data.
+        - `SIGN/VERIFY`: Generates or verifies a digital signature.
         """
         return pulumi.get(self, "key_usage")
 
@@ -565,7 +631,7 @@ class _KeyState:
     @pulumi.getter(name="lastRotationDate")
     def last_rotation_date(self) -> Optional[pulumi.Input[str]]:
         """
-        The date and time the last rotation was performed. The time is displayed in UTC.
+        The time when the last rotation was performed.
         """
         return pulumi.get(self, "last_rotation_date")
 
@@ -577,7 +643,7 @@ class _KeyState:
     @pulumi.getter(name="materialExpireTime")
     def material_expire_time(self) -> Optional[pulumi.Input[str]]:
         """
-        The time and date the key material for the CMK expires. The time is displayed in UTC. If the value is empty, the key material for the CMK does not expire.
+        The time when the key material expires.
         """
         return pulumi.get(self, "material_expire_time")
 
@@ -589,7 +655,7 @@ class _KeyState:
     @pulumi.getter(name="nextRotationDate")
     def next_rotation_date(self) -> Optional[pulumi.Input[str]]:
         """
-        The time the next rotation is scheduled for execution.
+        The time when the next rotation will be performed.
         """
         return pulumi.get(self, "next_rotation_date")
 
@@ -601,7 +667,7 @@ class _KeyState:
     @pulumi.getter
     def origin(self) -> Optional[pulumi.Input[str]]:
         """
-        The source of key material. Default value: `Aliyun_KMS`. Valid values:
+        The key material origin. Default value: `Aliyun_KMS`. Valid values: `Aliyun_KMS`, `EXTERNAL`.
         """
         return pulumi.get(self, "origin")
 
@@ -613,10 +679,7 @@ class _KeyState:
     @pulumi.getter(name="pendingWindowInDays")
     def pending_window_in_days(self) -> Optional[pulumi.Input[int]]:
         """
-        The number of days before the CMK is deleted. 
-        During this period, the CMK is in the PendingDeletion state.
-        After this period ends, you cannot cancel the deletion. Valid values: 7 to 366. Unit: days.
-        **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
+        The number of days before the CMK is deleted. During this period, the CMK is in the PendingDeletion state. After this period ends, you cannot cancel the deletion. Unit: days. Valid values: `7` to `366`. **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
         """
         return pulumi.get(self, "pending_window_in_days")
 
@@ -624,6 +687,18 @@ class _KeyState:
     def pending_window_in_days(self, value: Optional[pulumi.Input[int]]):
         pulumi.set(self, "pending_window_in_days", value)
 
+    @property
+    @pulumi.getter
+    def policy(self) -> Optional[pulumi.Input[str]]:
+        """
+        The content of the key policy. The value is in the JSON format. The value can be up to 32,768 bytes in length. For more information, see [How to use it](https://www.alibabacloud.com/help/en/kms/developer-reference/api-setkeypolicy).
+        """
+        return pulumi.get(self, "policy")
+
+    @policy.setter
+    def policy(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "policy", value)
+
     @property
     @pulumi.getter(name="primaryKeyVersion")
     def primary_key_version(self) -> Optional[pulumi.Input[str]]:
@@ -640,7 +715,7 @@ class _KeyState:
     @pulumi.getter(name="protectionLevel")
     def protection_level(self) -> Optional[pulumi.Input[str]]:
         """
-        The protection level of the CMK. Default value: `SOFTWARE`. Valid values:
+        The protection level of the key. Default value: `SOFTWARE`. Valid values: `SOFTWARE`, `HSM`.
         """
         return pulumi.get(self, "protection_level")
 
@@ -652,13 +727,7 @@ class _KeyState:
     @pulumi.getter(name="rotationInterval")
     def rotation_interval(self) -> Optional[pulumi.Input[str]]:
         """
-        The interval for automatic key rotation. Specify the value in the integer[unit] format.
-        The following units are supported: d (day), h (hour), m (minute), and s (second).
-        For example, you can use either 7d or 604800s to specify a seven-day interval.
-        The interval can range from 7 days to 730 days.
-        **NOTE**: It is Required when `automatic_rotation = "Enabled"`
-
-        > **NOTE:** When the pre-deletion days elapses, the key is permanently deleted and cannot be recovered.
+        The period of automatic key rotation. The following units are supported: d (day), h (hour), m (minute), and s (second). For example, you can use either 7d or 604800s to specify a seven-day interval. **NOTE**: If `automatic_rotation` is set to `Enabled`, `rotation_interval` is required.
         """
         return pulumi.get(self, "rotation_interval")
 
@@ -670,7 +739,7 @@ class _KeyState:
     @pulumi.getter
     def status(self) -> Optional[pulumi.Input[str]]:
         """
-        The status of CMK. Default value: `Enabled`. Valid Values:
+        The status of key. Default value: `Enabled`. Valid values: `Enabled`, `Disabled`, `PendingDeletion`.
         """
         return pulumi.get(self, "status")
 
@@ -680,14 +749,14 @@ class _KeyState:
 
     @property
     @pulumi.getter
-    def tags(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A mapping of tags to assign to the resource.
         """
         return pulumi.get(self, "tags")
 
     @tags.setter
-    def tags(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "tags", value)
 
 
@@ -697,6 +766,8 @@ class Key(pulumi.CustomResource):
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  automatic_rotation: Optional[pulumi.Input[str]] = None,
+                 deletion_protection: Optional[pulumi.Input[str]] = None,
+                 deletion_protection_description: Optional[pulumi.Input[str]] = None,
                  deletion_window_in_days: Optional[pulumi.Input[int]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  dkms_instance_id: Optional[pulumi.Input[str]] = None,
@@ -706,13 +777,16 @@ class Key(pulumi.CustomResource):
                  key_usage: Optional[pulumi.Input[str]] = None,
                  origin: Optional[pulumi.Input[str]] = None,
                  pending_window_in_days: Optional[pulumi.Input[int]] = None,
+                 policy: Optional[pulumi.Input[str]] = None,
                  protection_level: Optional[pulumi.Input[str]] = None,
                  rotation_interval: Optional[pulumi.Input[str]] = None,
                  status: Optional[pulumi.Input[str]] = None,
-                 tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  __props__=None):
         """
-        A kms key can help user to protect data security in the transmission process. For information about Alikms Key and how to use it, see [What is Resource Alikms Key](https://www.alibabacloud.com/help/doc-detail/28947.htm).
+        Provides a KMS Key resource.
+
+        For information about KMS Key and how to use it, see [What is Key](https://www.alibabacloud.com/help/en/kms/developer-reference/api-createkey).
 
         > **NOTE:** Available since v1.85.0.
 
@@ -720,21 +794,19 @@ class Key(pulumi.CustomResource):
 
         Basic Usage
 
-        <!--Start PulumiCodeChooser -->
         ```python
         import pulumi
         import pulumi_alicloud as alicloud
 
-        key = alicloud.kms.Key("key",
+        default = alicloud.kms.Key("default",
             description="Hello KMS",
-            pending_window_in_days=7,
-            status="Enabled")
+            status="Enabled",
+            pending_window_in_days=7)
         ```
-        <!--End PulumiCodeChooser -->
 
         ## Import
 
-        Alikms key can be imported using the id, e.g.
+        KMS Key can be imported using the id, e.g.
 
         ```sh
         $ pulumi import alicloud:kms/key:Key example <id>
@@ -742,33 +814,31 @@ class Key(pulumi.CustomResource):
 
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[str] automatic_rotation: Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values:
+        :param pulumi.Input[str] automatic_rotation: Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        :param pulumi.Input[str] deletion_protection: Specifies whether to enable deletion protection. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        :param pulumi.Input[str] deletion_protection_description: The description of deletion protection. **NOTE:** `deletion_protection_description` takes effect only if `deletion_protection` is set to `Enabled`.
         :param pulumi.Input[int] deletion_window_in_days: Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.
-        :param pulumi.Input[str] description: The description of the CMK. The description can be 0 to 8,192 characters in length.
-        :param pulumi.Input[str] dkms_instance_id: The instance ID of the exclusive KMS instance.
+        :param pulumi.Input[str] description: The description of the key.
+        :param pulumi.Input[str] dkms_instance_id: The ID of the KMS instance.
         :param pulumi.Input[bool] is_enabled: Field `is_enabled` has been deprecated from provider version 1.85.0. New field `status` instead.
-        :param pulumi.Input[str] key_spec: The type of the CMK. Default value: `Aliyun_AES_256`. Valid values: 
-               `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
-               Note: The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
-        :param pulumi.Input[str] key_state: Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
-        :param pulumi.Input[str] key_usage: The usage of the CMK. Default value: `ENCRYPT/DECRYPT`. Valid values:
-               - `ENCRYPT/DECRYPT`: encrypts or decrypts data.
-               - `SIGN/VERIFY`: generates or verifies a digital signature.
-        :param pulumi.Input[str] origin: The source of key material. Default value: `Aliyun_KMS`. Valid values:
-        :param pulumi.Input[int] pending_window_in_days: The number of days before the CMK is deleted. 
-               During this period, the CMK is in the PendingDeletion state.
-               After this period ends, you cannot cancel the deletion. Valid values: 7 to 366. Unit: days.
-               **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
-        :param pulumi.Input[str] protection_level: The protection level of the CMK. Default value: `SOFTWARE`. Valid values:
-        :param pulumi.Input[str] rotation_interval: The interval for automatic key rotation. Specify the value in the integer[unit] format.
-               The following units are supported: d (day), h (hour), m (minute), and s (second).
-               For example, you can use either 7d or 604800s to specify a seven-day interval.
-               The interval can range from 7 days to 730 days.
-               **NOTE**: It is Required when `automatic_rotation = "Enabled"`
+               
+               > **NOTE:** If you set the origin parameter to EXTERNAL or the key_spec parameter to an asymmetric CMK type, automatic key rotation is unavailable.
+               
+               > **NOTE:** The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
                
                > **NOTE:** When the pre-deletion days elapses, the key is permanently deleted and cannot be recovered.
-        :param pulumi.Input[str] status: The status of CMK. Default value: `Enabled`. Valid Values:
-        :param pulumi.Input[Mapping[str, Any]] tags: A mapping of tags to assign to the resource.
+        :param pulumi.Input[str] key_spec: The specification of the key. Default value: `Aliyun_AES_256`. Valid values: `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
+        :param pulumi.Input[str] key_state: Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
+        :param pulumi.Input[str] key_usage: The usage of the key. Default value: `ENCRYPT/DECRYPT`. Valid values:
+               - `ENCRYPT/DECRYPT`: Encrypts or decrypts data.
+               - `SIGN/VERIFY`: Generates or verifies a digital signature.
+        :param pulumi.Input[str] origin: The key material origin. Default value: `Aliyun_KMS`. Valid values: `Aliyun_KMS`, `EXTERNAL`.
+        :param pulumi.Input[int] pending_window_in_days: The number of days before the CMK is deleted. During this period, the CMK is in the PendingDeletion state. After this period ends, you cannot cancel the deletion. Unit: days. Valid values: `7` to `366`. **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
+        :param pulumi.Input[str] policy: The content of the key policy. The value is in the JSON format. The value can be up to 32,768 bytes in length. For more information, see [How to use it](https://www.alibabacloud.com/help/en/kms/developer-reference/api-setkeypolicy).
+        :param pulumi.Input[str] protection_level: The protection level of the key. Default value: `SOFTWARE`. Valid values: `SOFTWARE`, `HSM`.
+        :param pulumi.Input[str] rotation_interval: The period of automatic key rotation. The following units are supported: d (day), h (hour), m (minute), and s (second). For example, you can use either 7d or 604800s to specify a seven-day interval. **NOTE**: If `automatic_rotation` is set to `Enabled`, `rotation_interval` is required.
+        :param pulumi.Input[str] status: The status of key. Default value: `Enabled`. Valid values: `Enabled`, `Disabled`, `PendingDeletion`.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A mapping of tags to assign to the resource.
         """
         ...
     @overload
@@ -777,7 +847,9 @@ class Key(pulumi.CustomResource):
                  args: Optional[KeyArgs] = None,
                  opts: Optional[pulumi.ResourceOptions] = None):
         """
-        A kms key can help user to protect data security in the transmission process. For information about Alikms Key and how to use it, see [What is Resource Alikms Key](https://www.alibabacloud.com/help/doc-detail/28947.htm).
+        Provides a KMS Key resource.
+
+        For information about KMS Key and how to use it, see [What is Key](https://www.alibabacloud.com/help/en/kms/developer-reference/api-createkey).
 
         > **NOTE:** Available since v1.85.0.
 
@@ -785,21 +857,19 @@ class Key(pulumi.CustomResource):
 
         Basic Usage
 
-        <!--Start PulumiCodeChooser -->
         ```python
         import pulumi
         import pulumi_alicloud as alicloud
 
-        key = alicloud.kms.Key("key",
+        default = alicloud.kms.Key("default",
             description="Hello KMS",
-            pending_window_in_days=7,
-            status="Enabled")
+            status="Enabled",
+            pending_window_in_days=7)
         ```
-        <!--End PulumiCodeChooser -->
 
         ## Import
 
-        Alikms key can be imported using the id, e.g.
+        KMS Key can be imported using the id, e.g.
 
         ```sh
         $ pulumi import alicloud:kms/key:Key example <id>
@@ -821,6 +891,8 @@ class Key(pulumi.CustomResource):
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  automatic_rotation: Optional[pulumi.Input[str]] = None,
+                 deletion_protection: Optional[pulumi.Input[str]] = None,
+                 deletion_protection_description: Optional[pulumi.Input[str]] = None,
                  deletion_window_in_days: Optional[pulumi.Input[int]] = None,
                  description: Optional[pulumi.Input[str]] = None,
                  dkms_instance_id: Optional[pulumi.Input[str]] = None,
@@ -830,10 +902,11 @@ class Key(pulumi.CustomResource):
                  key_usage: Optional[pulumi.Input[str]] = None,
                  origin: Optional[pulumi.Input[str]] = None,
                  pending_window_in_days: Optional[pulumi.Input[int]] = None,
+                 policy: Optional[pulumi.Input[str]] = None,
                  protection_level: Optional[pulumi.Input[str]] = None,
                  rotation_interval: Optional[pulumi.Input[str]] = None,
                  status: Optional[pulumi.Input[str]] = None,
-                 tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  __props__=None):
         opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
         if not isinstance(opts, pulumi.ResourceOptions):
@@ -844,6 +917,8 @@ class Key(pulumi.CustomResource):
             __props__ = KeyArgs.__new__(KeyArgs)
 
             __props__.__dict__["automatic_rotation"] = automatic_rotation
+            __props__.__dict__["deletion_protection"] = deletion_protection
+            __props__.__dict__["deletion_protection_description"] = deletion_protection_description
             __props__.__dict__["deletion_window_in_days"] = deletion_window_in_days
             __props__.__dict__["description"] = description
             __props__.__dict__["dkms_instance_id"] = dkms_instance_id
@@ -853,6 +928,7 @@ class Key(pulumi.CustomResource):
             __props__.__dict__["key_usage"] = key_usage
             __props__.__dict__["origin"] = origin
             __props__.__dict__["pending_window_in_days"] = pending_window_in_days
+            __props__.__dict__["policy"] = policy
             __props__.__dict__["protection_level"] = protection_level
             __props__.__dict__["rotation_interval"] = rotation_interval
             __props__.__dict__["status"] = status
@@ -880,6 +956,8 @@ class Key(pulumi.CustomResource):
             creation_date: Optional[pulumi.Input[str]] = None,
             creator: Optional[pulumi.Input[str]] = None,
             delete_date: Optional[pulumi.Input[str]] = None,
+            deletion_protection: Optional[pulumi.Input[str]] = None,
+            deletion_protection_description: Optional[pulumi.Input[str]] = None,
             deletion_window_in_days: Optional[pulumi.Input[int]] = None,
             description: Optional[pulumi.Input[str]] = None,
             dkms_instance_id: Optional[pulumi.Input[str]] = None,
@@ -892,11 +970,12 @@ class Key(pulumi.CustomResource):
             next_rotation_date: Optional[pulumi.Input[str]] = None,
             origin: Optional[pulumi.Input[str]] = None,
             pending_window_in_days: Optional[pulumi.Input[int]] = None,
+            policy: Optional[pulumi.Input[str]] = None,
             primary_key_version: Optional[pulumi.Input[str]] = None,
             protection_level: Optional[pulumi.Input[str]] = None,
             rotation_interval: Optional[pulumi.Input[str]] = None,
             status: Optional[pulumi.Input[str]] = None,
-            tags: Optional[pulumi.Input[Mapping[str, Any]]] = None) -> 'Key':
+            tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None) -> 'Key':
         """
         Get an existing Key resource's state with the given name, id, and optional extra
         properties used to qualify the lookup.
@@ -904,41 +983,39 @@ class Key(pulumi.CustomResource):
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[str] arn: The Alicloud Resource Name (ARN) of the key.
-        :param pulumi.Input[str] automatic_rotation: Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values:
-        :param pulumi.Input[str] creation_date: The date and time when the CMK was created. The time is displayed in UTC.
+        :param pulumi.Input[str] arn: The ARN of the key.
+        :param pulumi.Input[str] automatic_rotation: Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        :param pulumi.Input[str] creation_date: The time when the CMK was created.
         :param pulumi.Input[str] creator: The creator of the CMK.
-        :param pulumi.Input[str] delete_date: The scheduled date to delete CMK. The time is displayed in UTC. This value is returned only when the KeyState value is PendingDeletion.
+        :param pulumi.Input[str] delete_date: The time at which the CMK is scheduled for deletion.
+        :param pulumi.Input[str] deletion_protection: Specifies whether to enable deletion protection. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        :param pulumi.Input[str] deletion_protection_description: The description of deletion protection. **NOTE:** `deletion_protection_description` takes effect only if `deletion_protection` is set to `Enabled`.
         :param pulumi.Input[int] deletion_window_in_days: Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.
-        :param pulumi.Input[str] description: The description of the CMK. The description can be 0 to 8,192 characters in length.
-        :param pulumi.Input[str] dkms_instance_id: The instance ID of the exclusive KMS instance.
+        :param pulumi.Input[str] description: The description of the key.
+        :param pulumi.Input[str] dkms_instance_id: The ID of the KMS instance.
         :param pulumi.Input[bool] is_enabled: Field `is_enabled` has been deprecated from provider version 1.85.0. New field `status` instead.
-        :param pulumi.Input[str] key_spec: The type of the CMK. Default value: `Aliyun_AES_256`. Valid values: 
-               `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
-               Note: The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
-        :param pulumi.Input[str] key_state: Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
-        :param pulumi.Input[str] key_usage: The usage of the CMK. Default value: `ENCRYPT/DECRYPT`. Valid values:
-               - `ENCRYPT/DECRYPT`: encrypts or decrypts data.
-               - `SIGN/VERIFY`: generates or verifies a digital signature.
-        :param pulumi.Input[str] last_rotation_date: The date and time the last rotation was performed. The time is displayed in UTC.
-        :param pulumi.Input[str] material_expire_time: The time and date the key material for the CMK expires. The time is displayed in UTC. If the value is empty, the key material for the CMK does not expire.
-        :param pulumi.Input[str] next_rotation_date: The time the next rotation is scheduled for execution.
-        :param pulumi.Input[str] origin: The source of key material. Default value: `Aliyun_KMS`. Valid values:
-        :param pulumi.Input[int] pending_window_in_days: The number of days before the CMK is deleted. 
-               During this period, the CMK is in the PendingDeletion state.
-               After this period ends, you cannot cancel the deletion. Valid values: 7 to 366. Unit: days.
-               **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
-        :param pulumi.Input[str] primary_key_version: The ID of the current primary key version of the symmetric CMK.
-        :param pulumi.Input[str] protection_level: The protection level of the CMK. Default value: `SOFTWARE`. Valid values:
-        :param pulumi.Input[str] rotation_interval: The interval for automatic key rotation. Specify the value in the integer[unit] format.
-               The following units are supported: d (day), h (hour), m (minute), and s (second).
-               For example, you can use either 7d or 604800s to specify a seven-day interval.
-               The interval can range from 7 days to 730 days.
-               **NOTE**: It is Required when `automatic_rotation = "Enabled"`
+               
+               > **NOTE:** If you set the origin parameter to EXTERNAL or the key_spec parameter to an asymmetric CMK type, automatic key rotation is unavailable.
+               
+               > **NOTE:** The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
                
                > **NOTE:** When the pre-deletion days elapses, the key is permanently deleted and cannot be recovered.
-        :param pulumi.Input[str] status: The status of CMK. Default value: `Enabled`. Valid Values:
-        :param pulumi.Input[Mapping[str, Any]] tags: A mapping of tags to assign to the resource.
+        :param pulumi.Input[str] key_spec: The specification of the key. Default value: `Aliyun_AES_256`. Valid values: `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
+        :param pulumi.Input[str] key_state: Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
+        :param pulumi.Input[str] key_usage: The usage of the key. Default value: `ENCRYPT/DECRYPT`. Valid values:
+               - `ENCRYPT/DECRYPT`: Encrypts or decrypts data.
+               - `SIGN/VERIFY`: Generates or verifies a digital signature.
+        :param pulumi.Input[str] last_rotation_date: The time when the last rotation was performed.
+        :param pulumi.Input[str] material_expire_time: The time when the key material expires.
+        :param pulumi.Input[str] next_rotation_date: The time when the next rotation will be performed.
+        :param pulumi.Input[str] origin: The key material origin. Default value: `Aliyun_KMS`. Valid values: `Aliyun_KMS`, `EXTERNAL`.
+        :param pulumi.Input[int] pending_window_in_days: The number of days before the CMK is deleted. During this period, the CMK is in the PendingDeletion state. After this period ends, you cannot cancel the deletion. Unit: days. Valid values: `7` to `366`. **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
+        :param pulumi.Input[str] policy: The content of the key policy. The value is in the JSON format. The value can be up to 32,768 bytes in length. For more information, see [How to use it](https://www.alibabacloud.com/help/en/kms/developer-reference/api-setkeypolicy).
+        :param pulumi.Input[str] primary_key_version: The ID of the current primary key version of the symmetric CMK.
+        :param pulumi.Input[str] protection_level: The protection level of the key. Default value: `SOFTWARE`. Valid values: `SOFTWARE`, `HSM`.
+        :param pulumi.Input[str] rotation_interval: The period of automatic key rotation. The following units are supported: d (day), h (hour), m (minute), and s (second). For example, you can use either 7d or 604800s to specify a seven-day interval. **NOTE**: If `automatic_rotation` is set to `Enabled`, `rotation_interval` is required.
+        :param pulumi.Input[str] status: The status of key. Default value: `Enabled`. Valid values: `Enabled`, `Disabled`, `PendingDeletion`.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] tags: A mapping of tags to assign to the resource.
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
 
@@ -949,6 +1026,8 @@ class Key(pulumi.CustomResource):
         __props__.__dict__["creation_date"] = creation_date
         __props__.__dict__["creator"] = creator
         __props__.__dict__["delete_date"] = delete_date
+        __props__.__dict__["deletion_protection"] = deletion_protection
+        __props__.__dict__["deletion_protection_description"] = deletion_protection_description
         __props__.__dict__["deletion_window_in_days"] = deletion_window_in_days
         __props__.__dict__["description"] = description
         __props__.__dict__["dkms_instance_id"] = dkms_instance_id
@@ -961,6 +1040,7 @@ class Key(pulumi.CustomResource):
         __props__.__dict__["next_rotation_date"] = next_rotation_date
         __props__.__dict__["origin"] = origin
         __props__.__dict__["pending_window_in_days"] = pending_window_in_days
+        __props__.__dict__["policy"] = policy
         __props__.__dict__["primary_key_version"] = primary_key_version
         __props__.__dict__["protection_level"] = protection_level
         __props__.__dict__["rotation_interval"] = rotation_interval
@@ -972,7 +1052,7 @@ class Key(pulumi.CustomResource):
     @pulumi.getter
     def arn(self) -> pulumi.Output[str]:
         """
-        The Alicloud Resource Name (ARN) of the key.
+        The ARN of the key.
         """
         return pulumi.get(self, "arn")
 
@@ -980,7 +1060,7 @@ class Key(pulumi.CustomResource):
     @pulumi.getter(name="automaticRotation")
     def automatic_rotation(self) -> pulumi.Output[str]:
         """
-        Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values:
+        Specifies whether to enable automatic key rotation. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
         """
         return pulumi.get(self, "automatic_rotation")
 
@@ -988,7 +1068,7 @@ class Key(pulumi.CustomResource):
     @pulumi.getter(name="creationDate")
     def creation_date(self) -> pulumi.Output[str]:
         """
-        The date and time when the CMK was created. The time is displayed in UTC.
+        The time when the CMK was created.
         """
         return pulumi.get(self, "creation_date")
 
@@ -1004,76 +1084,90 @@ class Key(pulumi.CustomResource):
     @pulumi.getter(name="deleteDate")
     def delete_date(self) -> pulumi.Output[str]:
         """
-        The scheduled date to delete CMK. The time is displayed in UTC. This value is returned only when the KeyState value is PendingDeletion.
+        The time at which the CMK is scheduled for deletion.
         """
         return pulumi.get(self, "delete_date")
 
+    @property
+    @pulumi.getter(name="deletionProtection")
+    def deletion_protection(self) -> pulumi.Output[str]:
+        """
+        Specifies whether to enable deletion protection. Default value: `Disabled`. Valid values: `Enabled`, `Disabled`.
+        """
+        return pulumi.get(self, "deletion_protection")
+
+    @property
+    @pulumi.getter(name="deletionProtectionDescription")
+    def deletion_protection_description(self) -> pulumi.Output[Optional[str]]:
+        """
+        The description of deletion protection. **NOTE:** `deletion_protection_description` takes effect only if `deletion_protection` is set to `Enabled`.
+        """
+        return pulumi.get(self, "deletion_protection_description")
+
     @property
     @pulumi.getter(name="deletionWindowInDays")
-    def deletion_window_in_days(self) -> pulumi.Output[int]:
+    @_utilities.deprecated("""Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.""")
+    def deletion_window_in_days(self) -> pulumi.Output[Optional[int]]:
         """
         Field `deletion_window_in_days` has been deprecated from provider version 1.85.0. New field `pending_window_in_days` instead.
         """
-        warnings.warn("""Field 'deletion_window_in_days' has been deprecated from provider version 1.85.0. New field 'pending_window_in_days' instead.""", DeprecationWarning)
-        pulumi.log.warn("""deletion_window_in_days is deprecated: Field 'deletion_window_in_days' has been deprecated from provider version 1.85.0. New field 'pending_window_in_days' instead.""")
-
         return pulumi.get(self, "deletion_window_in_days")
 
     @property
     @pulumi.getter
     def description(self) -> pulumi.Output[Optional[str]]:
         """
-        The description of the CMK. The description can be 0 to 8,192 characters in length.
+        The description of the key.
         """
         return pulumi.get(self, "description")
 
     @property
     @pulumi.getter(name="dkmsInstanceId")
-    def dkms_instance_id(self) -> pulumi.Output[Optional[str]]:
+    def dkms_instance_id(self) -> pulumi.Output[str]:
         """
-        The instance ID of the exclusive KMS instance.
+        The ID of the KMS instance.
         """
         return pulumi.get(self, "dkms_instance_id")
 
     @property
     @pulumi.getter(name="isEnabled")
-    def is_enabled(self) -> pulumi.Output[Optional[bool]]:
+    @_utilities.deprecated("""Field `is_enabled` has been deprecated from provider version 1.85.0. New field `key_state` instead.""")
+    def is_enabled(self) -> pulumi.Output[bool]:
         """
         Field `is_enabled` has been deprecated from provider version 1.85.0. New field `status` instead.
-        """
-        warnings.warn("""Field 'is_enabled' has been deprecated from provider version 1.85.0. New field 'key_state' instead.""", DeprecationWarning)
-        pulumi.log.warn("""is_enabled is deprecated: Field 'is_enabled' has been deprecated from provider version 1.85.0. New field 'key_state' instead.""")
 
+        > **NOTE:** If you set the origin parameter to EXTERNAL or the key_spec parameter to an asymmetric CMK type, automatic key rotation is unavailable.
+
+        > **NOTE:** The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
+
+        > **NOTE:** When the pre-deletion days elapses, the key is permanently deleted and cannot be recovered.
+        """
         return pulumi.get(self, "is_enabled")
 
     @property
     @pulumi.getter(name="keySpec")
     def key_spec(self) -> pulumi.Output[str]:
         """
-        The type of the CMK. Default value: `Aliyun_AES_256`. Valid values: 
-        `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
-        Note: The default type of the CMK is `Aliyun_AES_256`. Only Dedicated KMS supports `Aliyun_AES_128` and `Aliyun_AES_192`.
+        The specification of the key. Default value: `Aliyun_AES_256`. Valid values: `Aliyun_AES_256`, `Aliyun_AES_128`, `Aliyun_AES_192`, `Aliyun_SM4`, `RSA_2048`, `RSA_3072`, `EC_P256`, `EC_P256K`, `EC_SM2`.
         """
         return pulumi.get(self, "key_spec")
 
     @property
     @pulumi.getter(name="keyState")
+    @_utilities.deprecated("""Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.""")
     def key_state(self) -> pulumi.Output[str]:
         """
         Field `key_state` has been deprecated from provider version 1.123.1. New field `status` instead.
         """
-        warnings.warn("""Field 'key_state' has been deprecated from provider version 1.123.1. New field 'status' instead.""", DeprecationWarning)
-        pulumi.log.warn("""key_state is deprecated: Field 'key_state' has been deprecated from provider version 1.123.1. New field 'status' instead.""")
-
         return pulumi.get(self, "key_state")
 
     @property
     @pulumi.getter(name="keyUsage")
     def key_usage(self) -> pulumi.Output[str]:
         """
-        The usage of the CMK. Default value: `ENCRYPT/DECRYPT`. Valid values:
-        - `ENCRYPT/DECRYPT`: encrypts or decrypts data.
-        - `SIGN/VERIFY`: generates or verifies a digital signature.
+        The usage of the key. Default value: `ENCRYPT/DECRYPT`. Valid values:
+        - `ENCRYPT/DECRYPT`: Encrypts or decrypts data.
+        - `SIGN/VERIFY`: Generates or verifies a digital signature.
         """
         return pulumi.get(self, "key_usage")
 
@@ -1081,7 +1175,7 @@ class Key(pulumi.CustomResource):
     @pulumi.getter(name="lastRotationDate")
     def last_rotation_date(self) -> pulumi.Output[str]:
         """
-        The date and time the last rotation was performed. The time is displayed in UTC.
+        The time when the last rotation was performed.
         """
         return pulumi.get(self, "last_rotation_date")
 
@@ -1089,7 +1183,7 @@ class Key(pulumi.CustomResource):
     @pulumi.getter(name="materialExpireTime")
     def material_expire_time(self) -> pulumi.Output[str]:
         """
-        The time and date the key material for the CMK expires. The time is displayed in UTC. If the value is empty, the key material for the CMK does not expire.
+        The time when the key material expires.
         """
         return pulumi.get(self, "material_expire_time")
 
@@ -1097,7 +1191,7 @@ class Key(pulumi.CustomResource):
     @pulumi.getter(name="nextRotationDate")
     def next_rotation_date(self) -> pulumi.Output[str]:
         """
-        The time the next rotation is scheduled for execution.
+        The time when the next rotation will be performed.
         """
         return pulumi.get(self, "next_rotation_date")
 
@@ -1105,21 +1199,26 @@ class Key(pulumi.CustomResource):
     @pulumi.getter
     def origin(self) -> pulumi.Output[str]:
         """
-        The source of key material. Default value: `Aliyun_KMS`. Valid values:
+        The key material origin. Default value: `Aliyun_KMS`. Valid values: `Aliyun_KMS`, `EXTERNAL`.
         """
         return pulumi.get(self, "origin")
 
     @property
     @pulumi.getter(name="pendingWindowInDays")
-    def pending_window_in_days(self) -> pulumi.Output[int]:
+    def pending_window_in_days(self) -> pulumi.Output[Optional[int]]:
         """
-        The number of days before the CMK is deleted. 
-        During this period, the CMK is in the PendingDeletion state.
-        After this period ends, you cannot cancel the deletion. Valid values: 7 to 366. Unit: days.
-        **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
+        The number of days before the CMK is deleted. During this period, the CMK is in the PendingDeletion state. After this period ends, you cannot cancel the deletion. Unit: days. Valid values: `7` to `366`. **NOTE:** From version 1.184.0, `pending_window_in_days` can be set to `366`.
         """
         return pulumi.get(self, "pending_window_in_days")
 
+    @property
+    @pulumi.getter
+    def policy(self) -> pulumi.Output[str]:
+        """
+        The content of the key policy. The value is in the JSON format. The value can be up to 32,768 bytes in length. For more information, see [How to use it](https://www.alibabacloud.com/help/en/kms/developer-reference/api-setkeypolicy).
+        """
+        return pulumi.get(self, "policy")
+
     @property
     @pulumi.getter(name="primaryKeyVersion")
     def primary_key_version(self) -> pulumi.Output[str]:
@@ -1132,7 +1231,7 @@ class Key(pulumi.CustomResource):
     @pulumi.getter(name="protectionLevel")
     def protection_level(self) -> pulumi.Output[Optional[str]]:
         """
-        The protection level of the CMK. Default value: `SOFTWARE`. Valid values:
+        The protection level of the key. Default value: `SOFTWARE`. Valid values: `SOFTWARE`, `HSM`.
         """
         return pulumi.get(self, "protection_level")
 
@@ -1140,13 +1239,7 @@ class Key(pulumi.CustomResource):
     @pulumi.getter(name="rotationInterval")
     def rotation_interval(self) -> pulumi.Output[Optional[str]]:
         """
-        The interval for automatic key rotation. Specify the value in the integer[unit] format.
-        The following units are supported: d (day), h (hour), m (minute), and s (second).
-        For example, you can use either 7d or 604800s to specify a seven-day interval.
-        The interval can range from 7 days to 730 days.
-        **NOTE**: It is Required when `automatic_rotation = "Enabled"`
-
-        > **NOTE:** When the pre-deletion days elapses, the key is permanently deleted and cannot be recovered.
+        The period of automatic key rotation. The following units are supported: d (day), h (hour), m (minute), and s (second). For example, you can use either 7d or 604800s to specify a seven-day interval. **NOTE**: If `automatic_rotation` is set to `Enabled`, `rotation_interval` is required.
         """
         return pulumi.get(self, "rotation_interval")
 
@@ -1154,13 +1247,13 @@ class Key(pulumi.CustomResource):
     @pulumi.getter
     def status(self) -> pulumi.Output[str]:
         """
-        The status of CMK. Default value: `Enabled`. Valid Values:
+        The status of key. Default value: `Enabled`. Valid values: `Enabled`, `Disabled`, `PendingDeletion`.
         """
         return pulumi.get(self, "status")
 
     @property
     @pulumi.getter
-    def tags(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         A mapping of tags to assign to the resource.
         """