AwsKmsKeyDetails
Contains metadata about an AWS KMS key.
Contents
- AWSAccountId
-
The twelve-digit account ID of the AWS account that owns the KMS key.
Type: String
Pattern:
.*\S.*Required: No
- CreationDate
-
Indicates when the KMS key was created.
This field accepts only the specified formats. Timestamps can end with
Zor("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats that you can send to Security Hub:-
YYYY-MM-DDTHH:MM:SSZ(for example,2019-01-31T23:00:00Z) -
YYYY-MM-DDTHH:MM:SS.mmmmmmmmmZ(for example,2019-01-31T23:00:00.123456789Z) -
YYYY-MM-DDTHH:MM:SS+HH:MM(for example,2024-01-04T15:25:10+17:59) -
YYYY-MM-DDTHH:MM:SS-HHMM(for example,2024-01-04T15:25:10-1759) -
YYYY-MM-DDTHH:MM:SS.mmmmmmmmm+HH:MM(for example,2024-01-04T15:25:10.123456789+17:59)
If a finding provider sends a finding to Security Hub that contains a timestamp in nanoseconds, we round it to milliseconds. For example, we round
2024-10-31T23:00:00.123456789Zto2024-10-31T23:00:00.123Z.Type: Double
Required: No
-
- Description
-
A description of the KMS key.
Type: String
Pattern:
.*\S.*Required: No
- KeyId
-
The globally unique identifier for the KMS key.
Type: String
Pattern:
.*\S.*Required: No
- KeyManager
-
The manager of the KMS key. KMS keys in your AWS account are either customer managed or AWS managed.
Type: String
Pattern:
.*\S.*Required: No
- KeyRotationStatus
-
Whether the key has key rotation enabled.
Type: Boolean
Required: No
- KeyState
-
The state of the KMS key. Valid values are as follows:
-
Disabled -
Enabled -
PendingDeletion -
PendingImport -
Unavailable
Type: String
Pattern:
.*\S.*Required: No
-
- Origin
-
The source of the KMS key material.
When this value is
AWS_KMS, AWS KMS created the key material.When this value is
EXTERNAL, the key material was imported from your existing key management infrastructure or the KMS key lacks key material.When this value is
AWS_CLOUDHSM, the key material was created in the AWS CloudHSM cluster associated with a custom key store.Type: String
Pattern:
.*\S.*Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
