KMS Key
Key Management Service (KMS) Key
Resource Type
AWS.KMS.KeyResource ID Format
For KMS Keys, the resource ID is the ARN.
arn:aws:kms:us-west-2:123456789012:key/1Background
KMS is a service to create and manage encryption keys for across a wide range of AWS services and within your applications.
Fields
Field
Type
Description
KeyRotationEnabledBoolIf key rotation is enabled for this KMS key
PolicyStringA JSON policy document indicating what has access to this key
Example
1
{
2
"AccountId": "123456789012",
3
"Arn": "arn:aws:kms:us-west-2:123456789012:key/1",
4
"CloudHsmClusterId": null,
5
"CustomKeyStoreId": null,
6
"DeletionDate": null,
7
"Description": "Default master key that protects my ACM private keys when no other key is defined",
8
"Enabled": true,
9
"ExpirationModel": null,
10
"Id": "1",
11
"KeyManager": "AWS",
12
"KeyRotationEnabled": null,
13
"KeyState": "Enabled",
14
"KeyUsage": "ENCRYPT_DECRYPT",
15
"Origin": "AWS_KMS",
16
"Policy": "{\n \"Version\" : \"2012-10-17\",\n \"Id\" : \"auto-acm-3\",\n \"Statement\" : [ {\n \"Sid\" : \"Allow creation of decryption grants\",\n \"Effect\" : \"Allow\",\n \"Principal\" : {\n \"AWS\" : \"*\"\n },\n \"Action\" : \"kms:CreateGrant\",\n \"Resource\" : \"*\",\n \"Condition\" : {\n \"StringEquals\" : {\n \"kms:CallerAccount\" : \"123456789012\",\n \"kms:ViaService\" : \"acm.us-east-1.amazonaws.com\"\n },\n \"ForAllValues:StringEquals\" : {\n \"kms:GrantOperations\" : \"Decrypt\"\n },\n \"Bool\" : {\n \"kms:GrantIsForAWSResource\" : \"true\"\n }\n }\n }, {\n \"Sid\" : \"Allow creation of encryption grant\",\n \"Effect\" : \"Allow\",\n \"Principal\" : {\n \"AWS\" : \"*\"\n },\n \"Action\" : \"kms:CreateGrant\",\n \"Resource\" : \"*\",\n \"Condition\" : {\n \"StringEquals\" : {\n \"kms:CallerAccount\" : \"123456789012\",\n \"kms:ViaService\" : \"acm.us-east-1.amazonaws.com\"\n },\n \"ForAllValues:StringEquals\" : {\n \"kms:GrantOperations\" : [ \"Encrypt\", \"ReEncryptFrom\", \"ReEncryptTo\" ]\n },\n \"Bool\" : {\n \"kms:GrantIsForAWSResource\" : \"true\"\n }\n }\n }, {\n \"Sid\" : \"Allowed operations for the key owner\",\n \"Effect\" : \"Allow\",\n \"Principal\" : {\n \"AWS\" : \"*\"\n },\n \"Action\" : [ \"kms:DescribeKey\", \"kms:ListGrants\", \"kms:RevokeGrant\", \"kms:GetKeyPolicy\" ],\n \"Resource\" : \"*\",\n \"Condition\" : {\n \"StringEquals\" : {\n \"kms:CallerAccount\" : \"123456789012\"\n }\n }\n }, {\n \"Sid\" : \"Deny re-encryption to any other key\",\n \"Effect\" : \"Deny\",\n \"Principal\" : {\n \"AWS\" : \"*\"\n },\n \"Action\" : \"kms:ReEncrypt*\",\n \"Resource\" : \"*\",\n \"Condition\" : {\n \"Bool\" : {\n \"kms:ReEncryptOnSameKey\" : \"false\"\n }\n }\n } ]\n}",
17
"Region": "us-west-2",
18
"ResourceId": "arn:aws:kms:us-west-2:123456789012:key/1",
19
"ResourceType": "AWS.KMS.Key",
20
"Tags": null,
21
"TimeCreated": "2019-01-01T00:00:00.000Z",
22
"ValidTo": null
23
}
Copied!
Last modified 1yr ago
Copy link