aws kms
Key Management Service (KMS) is an encryption and key management web service. AWS CLI reference
56 commands Its page in the AWS CLI reference
Commands
cancel-key-deletionCancels the deletion of a KMS key.connect-custom-key-storeConnects or reconnects a custom key store to its backing key store.create-aliasCreates a friendly name for a KMS key.create-custom-key-storeCreates a custom key store backed by a key store that you own and manage.create-grantAdds a grant to a KMS key.create-keyCreates a unique customer managed KMS key in your Amazon Web Services account and Region.decapsulateRecovers the shared secret that was encapsulated with the public key of an ML-KEM KMS key.decryptDecrypts ciphertext that was encrypted by a KMS key using any of the following operations: Encrypt GenerateDataKey GenerateDataKeyPair GenerateDataKeyWithoutPlaintext GenerateDataKeyPairWithoutPlaintext You can use this operation to decrypt ciphertext that was encrypted under a symmetric encryption KMS key or an asymmetric encryption KMS key.delete-aliasDeletes the specified alias.delete-custom-key-storeDeletes a custom key store.delete-imported-key-materialDeletes key material that was previously imported.derive-shared-secretDerives a shared secret using a key agreement algorithm.describe-custom-key-storesGets information about custom key stores in the account and Region.describe-keyProvides detailed information about a KMS key.disable-keySets the state of a KMS key to disabled.disable-key-rotationDisables automatic rotation of the key material of the specified symmetric encryption KMS key.disconnect-custom-key-storeDisconnects the custom key store from its backing key store.enable-keySets the key state of a KMS key to enabled.enable-key-rotationEnables automatic rotation of the key material of the specified symmetric encryption KMS key.encapsulateGenerates a shared secret and its encapsulated (ciphertext) form using the public key of an ML-KEM KMS key pair.encryptEncrypts plaintext of up to 4,096 bytes using a KMS key.generate-data-keyReturns a unique symmetric data key for use outside of KMS.generate-data-key-pairReturns a unique asymmetric data key pair for use outside of KMS.generate-data-key-pair-without-plaintextReturns a unique asymmetric data key pair for use outside of KMS.generate-data-key-without-plaintextReturns a unique symmetric data key for use outside of KMS.generate-macGenerates a hash-based message authentication code (HMAC) for a message using an HMAC KMS key and a MAC algorithm that the key supports.generate-randomReturns a random byte string that is cryptographically secure.get-key-last-usageReturns usage information about the last successful cryptographic operation performed with a specified KMS key, including the operation type, timestamp, and associated CloudTrail event ID.get-key-policyGets a key policy attached to the specified KMS key.get-key-rotation-statusProvides detailed information about the rotation status for a KMS key, including whether automatic rotation of the key material is enabled for the specified KMS key, the rotation period, and the next scheduled rotation date.get-parameters-for-importReturns the public key and an import token you need to import or reimport key material for a KMS key.get-public-keyReturns the public key of an asymmetric KMS key.import-key-materialImports or reimports key material into an existing KMS key that was created without key material.list-aliasesGets a list of aliases in the caller's Amazon Web Services account and region.list-grantsGets a list of all grants for the specified KMS key.list-key-policiesGets the names of the key policies that are attached to a KMS key.list-key-rotationsReturns information about the key materials associated with the specified KMS key.list-keysGets a list of all KMS keys in the caller's Amazon Web Services account and Region.list-resource-tagsReturns all tags on the specified KMS key.list-retirable-grantsReturns information about all grants in the Amazon Web Services account and Region that have the specified retiring principal or retiring service principal.put-key-policyAttaches a key policy to the specified KMS key.re-encryptDecrypts ciphertext and then reencrypts it entirely within KMS.replicate-keyReplicates a multi-Region key into the specified Region.retire-grantDeletes a grant.revoke-grantDeletes the specified grant.rotate-key-on-demandImmediately initiates rotation of the key material of the specified symmetric encryption KMS key.schedule-key-deletionSchedules the deletion of a KMS key.signCreates a digital signature for a message or message digest by using the private key in an asymmetric signing KMS key.tag-resourceAdds or edits tags on a customer managed key.untag-resourceDeletes tags from a customer managed key.update-aliasAssociates an existing KMS alias with a different KMS key.update-custom-key-storeChanges the properties of a custom key store.update-key-descriptionUpdates the description of a KMS key.update-primary-regionChanges the primary key of a multi-Region key.verifyVerifies a digital signature that was generated by the Sign operation.verify-macVerifies the hash-based message authentication code (HMAC) for a specified message, HMAC KMS key, and MAC algorithm.