# Supported Java key attributes for AWS CloudHSM Client SDK 5
<a name="java-lib-attributes_5"></a>

This topic provides information about supported Java key attributes for AWS CloudHSM Client SDK 5. This topic describes how to use a proprietary extension for the JCE provider to set key attributes. Use this extension to set supported key attributes and their values during these operations:
+ Key generation
+ Key import

For examples of how to use key attributes, see [Code samples for the AWS CloudHSM software library for Java for Client SDK 5](java-samples.md).

**Topics**
+ [Understanding attributes](#java-understanding-attributes_5)
+ [Supported attributes](#java-attributes_5)
+ [Setting attributes for a key](#java-setting-attributes_5)

## Understanding attributes
<a name="java-understanding-attributes_5"></a>

Use key attributes to specify what actions are permitted on key objects, including public, private or secret keys. Key attributes and values are defined during key object creation operations. 

The Java Cryptography Extension (JCE) does not specify how you should set values on key attributes, so most actions were permitted by default. In contrast, the PKCS\# 11 standard defines a comprehensive set of attributes with more restrictive defaults. Starting with the JCE provider 3.1, AWS CloudHSM provides a proprietary extension that enables you to set more restrictive values for commonly used attributes. 

## Supported attributes
<a name="java-attributes_5"></a>

You can set values for the attributes listed in the following table. As a best practice, only set values for attributes you wish to make restrictive. If you don’t specify a value, AWS CloudHSM uses the default value specified in the table below. An empty cell in the Default Value columns indicates that there is no specific default value assigned to the attribute.


****  
[See the AWS documentation website for more details](http://docs.aws.amazon.com/cloudhsm/latest/userguide/java-lib-attributes_5.html)

**Note**  
You get broader support for attributes in the PKCS\#11 library. For more information, see [Supported PKCS \#11 Attributes](pkcs11-attributes.md).

## Setting attributes for a key
<a name="java-setting-attributes_5"></a>

`KeyAttributesMap` is a Java Map-like object, which you can use to set attribute values for key objects. The methods for `KeyAttributesMap` function similar to the methods used for Java map manipulation. 

To set custom values on attributes, you have two options:
+ Use the methods listed in the following table
+ Use builder patterns demonstrated later in this document

Attribute map objects support the following methods to set attributes:


****  

| Operation | Return Value | `KeyAttributesMap` method | 
| --- | --- | --- | 
| Get the value of a key attribute for an existing key | Object (containing the value) or null | **get**(keyAttribute) | 
| Populate the value of one key attribute  | The previous value associated with key attribute, or null if there was no mapping for a key attribute | **put**(keyAttribute, value) | 
| Populate values for multiple key attributes | N/A | **putAll**(keyAttributesMap) | 
| Remove a key-value pair from the attribute map | The previous value associated with key attribute, or *null* if there was no mapping for a key attribute | **remove**(keyAttribute) | 

**Note**  
Any attributes you do not explicitly specify are set to the defaults listed in the preceding table in [Supported attributes](#java-attributes_5). 

### Setting attributes for a key pair
<a name="java-setting-attributes-key-pair"></a>

Use the Java class `KeyPairAttributesMap` to handle key attributes for a key pair. `KeyPairAttributesMap` encapsulates two `KeyAttributesMap` objects; one for a public key and one for a private key.

To set individual attributes for the public key and private key separately, you can use the `put()` method on corresponding `KeyAttributes` map object for that key. Use the `getPublic()` method to retrieve the attribute map for the public key, and use `getPrivate()` to retrieve the attribute map for the private key. Populate the value of multiple key attributes together for both public and private key pairs using the `putAll()` with a key pair attributes map as its argument.