AWS SDK Version 3 for .NET
API Reference

AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.

Returns a data encryption key encrypted under a customer master key (CMK). This operation is identical to GenerateDataKey but returns only the encrypted copy of the data key.

To perform this operation on a CMK in a different AWS account, specify the key ARN or alias ARN in the value of the KeyId parameter.

This operation is useful in a system that has multiple components with different degrees of trust. For example, consider a system that stores encrypted data in containers. Each container stores the encrypted data and an encrypted copy of the data key. One component of the system, called the control plane, creates new containers. When it creates a new container, it uses this operation (GenerateDataKeyWithoutPlaintext) to get an encrypted data key and then stores it in the container. Later, a different component of the system, called the data plane, puts encrypted data into the containers. To do this, it passes the encrypted data key to the Decrypt operation, then uses the returned plaintext data key to encrypt data, and finally stores the encrypted data in the container. In this system, the control plane never sees the plaintext data key.


For .NET Core and PCL this operation is only available in asynchronous form. Please refer to GenerateDataKeyWithoutPlaintextAsync.

Namespace: Amazon.KeyManagementService
Assembly: AWSSDK.KeyManagementService.dll
Version: 3.x.y.z


public abstract GenerateDataKeyWithoutPlaintextResponse GenerateDataKeyWithoutPlaintext(
         GenerateDataKeyWithoutPlaintextRequest request
Type: Amazon.KeyManagementService.Model.GenerateDataKeyWithoutPlaintextRequest

Container for the necessary parameters to execute the GenerateDataKeyWithoutPlaintext service method.

Return Value
The response from the GenerateDataKeyWithoutPlaintext service method, as returned by KeyManagementService.


DependencyTimeoutException The system timed out while trying to fulfill the request. The request can be retried.
DisabledException The request was rejected because the specified CMK is not enabled.
InvalidGrantTokenException The request was rejected because the specified grant token is not valid.
InvalidKeyUsageException The request was rejected because the specified KeySpec value is not valid.
KeyUnavailableException The request was rejected because the specified CMK was not available. The request can be retried.
KMSInternalException The request was rejected because an internal exception occurred. The request can be retried.
KMSInvalidStateException The request was rejected because the state of the specified resource is not valid for this request. For more information about how key state affects the use of a CMK, see How Key State Affects Use of a Customer Master Key in the AWS Key Management Service Developer Guide.
NotFoundException The request was rejected because the specified entity or resource could not be found.


The following example generates an encrypted copy of a 256-bit symmetric data encryption key (data key). The data key is encrypted with the specified customer master key (CMK).

To generate an encrypted data key

var response = client.GenerateDataKeyWithoutPlaintext(new GenerateDataKeyWithoutPlaintextRequest 
    KeyId = "alias/ExampleAlias", // The identifier of the CMK to use to encrypt the data key. You can use the key ID or Amazon Resource Name (ARN) of the CMK, or the name or ARN of an alias that refers to the CMK.
    KeySpec = "AES_256" // Specifies the type of data key to return.

MemoryStream ciphertextBlob = response.CiphertextBlob; // The encrypted data key.
string keyId = response.KeyId; // The ARN of the CMK that was used to encrypt the data key.


Version Information

.NET Framework:
Supported in: 4.5, 4.0, 3.5

Portable Class Library:
Supported in: Windows Store Apps
Supported in: Windows Phone 8.1
Supported in: Xamarin Android
Supported in: Xamarin iOS (Unified)
Supported in: Xamarin.Forms

See Also