aws kms get-parameters-for-import

Returns the public key and an import token you need to import or reimport key material for a KMS key. AWS CLI reference

1 example 3 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To get the items required to import key material into a KMS key

The following get-parameters-for-import example gets the public key and import token that you need to import key material into a KMS key. When you use the import-key-material command, be sure to use the import token and key material encrypted by the public key that were returned in the same get-parameters-for-import command. Also, the wrapping algorithm that you specify in this command must be one that you use to encrypt the key material with the public key.

To specify the KMS key, use the key-id parameter. This example uses an key ID, but you can use a key ID or key ARN in this command.

aws kms get-parameters-for-import --key-id a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 --wrapping-algorithm RSAES_OAEP_SHA_256 --wrapping-key-spec RSA_2048

Identify

--key-idThe identifier of the KMS key that will be associated with the imported key material.

--wrapping-algorithmThe algorithm you will use with the RSA public key (PublicKey) in the response to protect your key material during import.

--wrapping-key-specThe type of RSA public key to return in the response.

Its output

{
    "KeyId": "arn:aws:kms:us-west-2:123456789012:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "PublicKey": "<public key base64 encoded data>",
    "ImportToken": "<import token base64 encoded data>",
    "ParametersValidTo": 1593893322.32
}

For more information, see Download the public key and import token in the AWS Key Management Service Developer Guide.

Options

3 in the AWS CLI reference

--key-idThe identifier of the KMS key that will be associated with the imported key material.

--wrapping-algorithmThe algorithm you will use with the RSA public key (PublicKey) in the response to protect your key material during import.

--wrapping-key-specThe type of RSA public key to return in the response.