aws kms generate-data-key-without-plaintext

Returns a unique symmetric data key for use outside of KMS. AWS CLI reference

1 example 6 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To generate a 256-bit symmetric data key without a plaintext key

The following generate-data-key-without-plaintext example requests an encrypted copy of a 256-bit symmetric data key for use outside of AWS. You can call AWS KMS to decrypt the data key when you are ready to use it.

To request a 256-bit data key, use the key-spec parameter with a value of AES_256. To request a 128-bit data key, use the key-spec parameter with a value of AES_128. For all other data key lengths, use the number-of-bytes parameter.

The KMS key you specify must be a symmetric encryption KMS key, that is, a KMS key with a key spec value of SYMMETRIC_DEFAULT.

aws kms generate-data-key-without-plaintext --key-id "arn:aws:kms:us-west-2:123456789012:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" --key-spec AES_256

Identify

--key-idSpecifies the symmetric encryption KMS key that encrypts the data key.

--key-specThe length of the data key.

Its output

{
    "CiphertextBlob": "AQEDAHjRYf5WytIc0C857tFSnBaPn2F8DgfmThbJlGfR8P3WlwAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDEFogL",
    "KeyId": "arn:aws:kms:us-west-2:123456789012:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "KeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6"
}

The CiphertextBlob (encrypted data key) is returned in base64-encoded format.

For more information, see Data keys in the AWS Key Management Service Developer Guide.

Options

6 in the AWS CLI reference

--dry-runChecks if your request will succeed.

--encryption-contextSpecifies the encryption context that will be used when encrypting the data key.

--grant-tokensA list of grant tokens.

--key-idSpecifies the symmetric encryption KMS key that encrypts the data key.

--key-specThe length of the data key.

--number-of-bytesThe length of the data key in bytes.