aws kms generate-data-key-pair-without-plaintext

Returns a unique asymmetric data key pair for use outside of KMS. AWS CLI reference

1 example 5 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To generate an ECC NIST P384 asymmetric data key pair

The following generate-data-key-pair-without-plaintext example requests an ECC NIST P384 key pair for use outside of AWS.

The command returns a plaintext public key and a copy of the private key encrypted under the specified KMS key. It does not return a plaintext private key. You can safely store the encrypted private key with the encrypted data, and call AWS KMS to decrypt the private key when you need to use it.

To request an ECC NIST P384 asymmetric data key pair, use the key-pair-spec parameter with a value of ECC_NIST_P384.

The KMS key you specify must be a symmetric encryption KMS key, that is, a KMS key with a KeySpec value of SYMMETRIC_DEFAULT.

NOTE: The values in the output of this example are truncated for display.

aws kms generate-data-key-pair-without-plaintext --key-id a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 --key-pair-spec ECC_NIST_P384

Identify

--key-idSpecifies the symmetric encryption KMS key that encrypts the private key in the data key pair.

--key-pair-specDetermines the type of data key pair that is generated.

Its output

{
    "PrivateKeyCiphertextBlob": "AQIDAHi6LtupRpdKl2aJTzkK6FbhOtQkMlQJJH3PdtHvS/y+hAFFxmiD134doUDzMGmfCEtcAAAHaTCCB2UGCSqGSIb3DQEHBqCCB1...",
    "PublicKey": "MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA3A3eGMyPrvSn7+LdlJE1oUoQV5HpEuHAVbdOyND+NmYDH/mL1OSIEuLrcdZ5hrMH4pk83r40l...",
    "KeyId": "arn:aws:kms:us-west-2:123456789012:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "KeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
    "KeyPairSpec": "ECC_NIST_P384"
}

The PublicKey and PrivateKeyCiphertextBlob are returned in base64-encoded format.

For more information, see Data key pairs in the AWS Key Management Service Developer Guide.

Options

5 in the AWS CLI reference

--dry-runChecks if your request will succeed.

--encryption-contextSpecifies the encryption context that will be used when encrypting the private key in the data key pair.

--grant-tokensA list of grant tokens.

--key-idSpecifies the symmetric encryption KMS key that encrypts the private key in the data key pair.

--key-pair-specDetermines the type of data key pair that is generated.