KeyMetadata - AWS Key Management Service

KeyMetadata

Contains metadata about a customer master key (CMK).

This data type is used as a response element for the CreateKey and DescribeKey operations.

Contents

Note

In the following list, the required parameters are described first.

KeyId

The globally unique identifier for the CMK.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 2048.

Required: Yes

Arn

The Amazon Resource Name (ARN) of the CMK. For examples, see AWS Key Management Service (AWS KMS) in the Example ARNs section of the AWS General Reference.

Type: String

Length Constraints: Minimum length of 20. Maximum length of 2048.

Required: No

AWSAccountId

The twelve-digit account ID of the AWS account that owns the CMK.

Type: String

Required: No

CloudHsmClusterId

The cluster ID of the AWS CloudHSM cluster that contains the key material for the CMK. When you create a CMK in a custom key store, AWS KMS creates the key material for the CMK in the associated AWS CloudHSM cluster. This value is present only when the CMK is created in a custom key store.

Type: String

Length Constraints: Minimum length of 19. Maximum length of 24.

Required: No

CreationDate

The date and time when the CMK was created.

Type: Timestamp

Required: No

CustomerMasterKeySpec

Describes the type of key material in the CMK.

Type: String

Valid Values: RSA_2048 | RSA_3072 | RSA_4096 | ECC_NIST_P256 | ECC_NIST_P384 | ECC_NIST_P521 | ECC_SECG_P256K1 | SYMMETRIC_DEFAULT

Required: No

CustomKeyStoreId

A unique identifier for the custom key store that contains the CMK. This value is present only when the CMK is created in a custom key store.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 64.

Required: No

DeletionDate

The date and time after which AWS KMS deletes this CMK. This value is present only when the CMK is scheduled for deletion, that is, when its KeyState is PendingDeletion.

When the primary key in a multi-Region key is scheduled for deletion but still has replica keys, its key state is PendingReplicaDeletion and the length of its waiting period is displayed in the PendingDeletionWindowInDays field.

Type: Timestamp

Required: No

Description

The description of the CMK.

Type: String

Length Constraints: Minimum length of 0. Maximum length of 8192.

Required: No

Enabled

Specifies whether the CMK is enabled. When KeyState is Enabled this value is true, otherwise it is false.

Type: Boolean

Required: No

EncryptionAlgorithms

The encryption algorithms that the CMK supports. You cannot use the CMK with other encryption algorithms within AWS KMS.

This value is present only when the KeyUsage of the CMK is ENCRYPT_DECRYPT.

Type: Array of strings

Valid Values: SYMMETRIC_DEFAULT | RSAES_OAEP_SHA_1 | RSAES_OAEP_SHA_256

Required: No

ExpirationModel

Specifies whether the CMK's key material expires. This value is present only when Origin is EXTERNAL, otherwise this value is omitted.

Type: String

Valid Values: KEY_MATERIAL_EXPIRES | KEY_MATERIAL_DOES_NOT_EXPIRE

Required: No

KeyManager

The manager of the CMK. CMKs in your AWS account are either customer managed or AWS managed. For more information about the difference, see Customer Master Keys in the AWS Key Management Service Developer Guide.

Type: String

Valid Values: AWS | CUSTOMER

Required: No

KeyState

The current status of the CMK.

For more information about how key state affects the use of a CMK, see Key state: Effect on your CMK in the AWS Key Management Service Developer Guide.

Type: String

Valid Values: Creating | Enabled | Disabled | PendingDeletion | PendingImport | PendingReplicaDeletion | Unavailable | Updating

Required: No

KeyUsage

The cryptographic operations for which you can use the CMK.

Type: String

Valid Values: SIGN_VERIFY | ENCRYPT_DECRYPT

Required: No

MultiRegion

Indicates whether the CMK is a multi-Region (True) or regional (False) key. This value is True for multi-Region primary and replica CMKs and False for regional CMKs.

For more information about multi-Region keys, see Using multi-Region keys in the AWS Key Management Service Developer Guide.

Type: Boolean

Required: No

MultiRegionConfiguration

Lists the primary and replica CMKs in same multi-Region CMK. This field is present only when the value of the MultiRegion field is True.

For more information about any listed CMK, use the DescribeKey operation.

  • MultiRegionKeyType indicates whether the CMK is a PRIMARY or REPLICA key.

  • PrimaryKey displays the key ARN and Region of the primary key. This field displays the current CMK if it is the primary key.

  • ReplicaKeys displays the key ARNs and Regions of all replica keys. This field includes the current CMK if it is a replica key.

Type: MultiRegionConfiguration object

Required: No

Origin

The source of the CMK's key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material. When this value is AWS_CLOUDHSM, the key material was created in the AWS CloudHSM cluster associated with a custom key store.

Type: String

Valid Values: AWS_KMS | EXTERNAL | AWS_CLOUDHSM

Required: No

PendingDeletionWindowInDays

The waiting period before the primary key in a multi-Region key is deleted. This waiting period begins when the last of its replica keys is deleted. This value is present only when the KeyState of the CMK is PendingReplicaDeletion. That indicates that the CMK is the primary key in a multi-Region key, it is scheduled for deletion, and it still has existing replica keys.

When a regional CMK or a replica key in a multi-Region key is scheduled for deletion, its deletion date is displayed in the DeletionDate field. However, when the primary key in a multi-Region key is scheduled for deletion, its waiting period doesn't begin until all of its replica keys are deleted. This value displays that waiting period. When the last replica key in the multi-Region key is deleted, the KeyState of the scheduled primary key changes from PendingReplicaDeletion to PendingDeletion and the deletion date appears in the DeletionDate field.

Type: Integer

Valid Range: Minimum value of 1. Maximum value of 365.

Required: No

SigningAlgorithms

The signing algorithms that the CMK supports. You cannot use the CMK with other signing algorithms within AWS KMS.

This field appears only when the KeyUsage of the CMK is SIGN_VERIFY.

Type: Array of strings

Valid Values: RSASSA_PSS_SHA_256 | RSASSA_PSS_SHA_384 | RSASSA_PSS_SHA_512 | RSASSA_PKCS1_V1_5_SHA_256 | RSASSA_PKCS1_V1_5_SHA_384 | RSASSA_PKCS1_V1_5_SHA_512 | ECDSA_SHA_256 | ECDSA_SHA_384 | ECDSA_SHA_512

Required: No

ValidTo

The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. This value is present only for CMKs whose Origin is EXTERNAL and whose ExpirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is omitted.

Type: Timestamp

Required: No

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: