2014/11/11 - AWS Key Management Service - 25 new api methods
Retrieves a Boolean value that indicates whether key rotation is enabled for the specified key.
Request Syntax
client.get_key_rotation_status(
KeyId='string'
)
string
[REQUIRED]
Unique identifier of the key. This can be an ARN, an alias, or a globally unique identifier.
dict
Response Syntax
{
'KeyRotationEnabled': True|False
}
Response Structure
(dict) --
KeyRotationEnabled (boolean) -- A Boolean value that specifies whether key rotation is enabled.
Creates a display name for a customer master key. An alias can be used to identify a key and should be unique. The console enforces a one-to-one mapping between the alias and a key. An alias name can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-).
Request Syntax
client.create_alias(
AliasName='string',
TargetKeyId='string'
)
string
[REQUIRED]
String that contains the display name. Aliases that begin with AWS are reserved.
string
[REQUIRED]
An identifier of the key for which you are creating the alias. This value cannot be another alias.
None
Encrypts data on the server side with a new customer master key without exposing the plaintext of the data on the client side. The data is first decrypted and then encrypted. This operation can also be used to change the encryption context of a ciphertext.
Request Syntax
client.re_encrypt(
CiphertextBlob=b'bytes',
SourceEncryptionContext={
'string': 'string'
},
DestinationKeyId='string',
DestinationEncryptionContext={
'string': 'string'
},
GrantTokens=[
'string',
]
)
bytes
[REQUIRED]
Ciphertext of the data to re-encrypt.
dict
Encryption context used to encrypt and decrypt the data specified in the CiphertextBlob parameter.
(string) --
(string) --
string
[REQUIRED]
Key identifier of the key used to re-encrypt the data.
dict
Encryption context to be used when the data is re-encrypted.
(string) --
(string) --
list
Grant tokens that identify the grants that have permissions for the encryption and decryption process.
(string) --
dict
Response Syntax
{
'CiphertextBlob': b'bytes',
'SourceKeyId': 'string',
'KeyId': 'string'
}
Response Structure
(dict) --
CiphertextBlob (bytes) --
The re-encrypted data.
SourceKeyId (string) --
Unique identifier of the key used to originally encrypt the data.
KeyId (string) --
Unique identifier of the key used to re-encrypt the data.
Provides detailed information about the specified customer master key.
Request Syntax
client.describe_key(
KeyId='string'
)
string
[REQUIRED]
Unique identifier of the customer master key to be described. This can be an ARN, an alias, or a globally unique identifier.
dict
Response Syntax
{
'KeyMetadata': {
'AWSAccountId': 'string',
'KeyId': 'string',
'Arn': 'string',
'CreationDate': datetime(2015, 1, 1),
'Enabled': True|False,
'Description': 'string',
'KeyUsage': 'ENCRYPT_DECRYPT'
}
}
Response Structure
(dict) --
KeyMetadata (dict) --
Metadata associated with the key.
AWSAccountId (string) --
Account ID number.
KeyId (string) --
Unique identifier for the key.
Arn (string) --
Key ARN (Amazon Resource Name).
CreationDate (datetime) --
Date the key was created.
Enabled (boolean) --
Value that specifies whether the key is enabled.
Description (string) --
The description of the key.
KeyUsage (string) --
A value that specifies what operation(s) the key can perform.
Marks a key as enabled, thereby permitting its use. You can have up to 25 enabled keys at one time.
Request Syntax
client.enable_key(
KeyId='string'
)
string
[REQUIRED]
Unique identifier of the customer master key to be enabled. This can be an ARN, an alias, or a globally unique identifier.
None
Request Syntax
client.update_key_description(
KeyId='string',
Description='string'
)
string
[REQUIRED]
string
[REQUIRED]
None
Decrypts ciphertext. Ciphertext is plaintext that has been previously encrypted by using the Encrypt function.
Request Syntax
client.decrypt(
CiphertextBlob=b'bytes',
EncryptionContext={
'string': 'string'
},
GrantTokens=[
'string',
]
)
bytes
[REQUIRED]
Ciphertext including metadata.
dict
The encryption context. If this was specified in the Encrypt function, it must be specified here or the decryption operation will fail. For more information, see Encryption Context.
(string) --
(string) --
list
A list of grant tokens that represent grants which can be used to provide long term permissions to perform decryption.
(string) --
dict
Response Syntax
{
'KeyId': 'string',
'Plaintext': b'bytes'
}
Response Structure
(dict) --
KeyId (string) --
Unique identifier created by the system for the key. This value is always returned as long as no errors are encountered during the operation.
Plaintext (bytes) --
Decrypted plaintext data. This value may not be returned if the customer master key is not available or if you didn't have permission to use it.
Creates a customer master key. Customer master keys can be used to encrypt small amounts of data (less than 4K) directly, but they are most commonly used to encrypt or envelope data keys that are then used to encrypt customer data. For more information about data keys, see GenerateDataKey and GenerateDataKeyWithoutPlaintext.
Request Syntax
client.create_key(
Policy='string',
Description='string',
KeyUsage='ENCRYPT_DECRYPT'
)
string
Policy to be attached to the key. This is required and delegates back to the account. The key is the root of trust.
string
Description of the key. We recommend that you choose a description that helps your customer decide whether the key is appropriate for a task.
string
Specifies the intended use of the key. Currently this defaults to ENCRYPT/DECRYPT, and only symmetric encryption and decryption are supported.
dict
Response Syntax
{
'KeyMetadata': {
'AWSAccountId': 'string',
'KeyId': 'string',
'Arn': 'string',
'CreationDate': datetime(2015, 1, 1),
'Enabled': True|False,
'Description': 'string',
'KeyUsage': 'ENCRYPT_DECRYPT'
}
}
Response Structure
(dict) --
KeyMetadata (dict) --
Metadata associated with the key.
AWSAccountId (string) --
Account ID number.
KeyId (string) --
Unique identifier for the key.
Arn (string) --
Key ARN (Amazon Resource Name).
CreationDate (datetime) --
Date the key was created.
Enabled (boolean) --
Value that specifies whether the key is enabled.
Description (string) --
The description of the key.
KeyUsage (string) --
A value that specifies what operation(s) the key can perform.
Lists all of the key aliases in the account.
Request Syntax
client.list_aliases(
Limit=123,
Marker='string'
)
integer
Specify this parameter when paginating results to indicate the maximum number of aliases you want in each response. If there are additional aliases beyond the maximum you specify, the Truncated response element will be set to true.
string
Use this parameter when paginating results, and only in a subsequent request after you've received a response where the results are truncated. Set it to the value of the NextMarker element in the response you just received.
dict
Response Syntax
{
'Aliases': [
{
'AliasName': 'string',
'AliasArn': 'string',
'TargetKeyId': 'string'
},
],
'NextMarker': 'string',
'Truncated': True|False
}
Response Structure
(dict) --
Aliases (list) --
A list of key aliases in the user's account.
(dict) -- Contains information about an alias.
AliasName (string) --
String that contains the alias.
AliasArn (string) --
String that contains the key ARN.
TargetKeyId (string) --
String that contains the key identifier pointed to by the alias.
NextMarker (string) --
If Truncated is true, this value is present and contains the value to use for the Marker request parameter in a subsequent pagination request.
Truncated (boolean) --
A flag that indicates whether there are more items in the list. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more aliases in the list.
Enables rotation of the specified customer master key.
Request Syntax
client.enable_key_rotation(
KeyId='string'
)
string
[REQUIRED]
Unique identifier of the customer master key for which rotation is to be enabled. This can be an ARN, an alias, or a globally unique identifier.
None
Generates an unpredictable byte string.
Request Syntax
client.generate_random(
NumberOfBytes=123
)
integer
Integer that contains the number of bytes to generate. Common values are 128, 256, 512, 1024 and so on. The current limit is 1024 bytes.
dict
Response Syntax
{
'Plaintext': b'bytes'
}
Response Structure
(dict) --
Plaintext (bytes) --
Plaintext that contains the unpredictable byte string.
Returns a key wrapped by a customer master key without the plaintext copy of that key. To retrieve the plaintext, see GenerateDataKey.
Request Syntax
client.generate_data_key_without_plaintext(
KeyId='string',
EncryptionContext={
'string': 'string'
},
KeySpec='AES_256'|'AES_128',
NumberOfBytes=123,
GrantTokens=[
'string',
]
)
string
[REQUIRED]
Unique identifier of the key. This can be an ARN, an alias, or a globally unique identifier.
dict
Name:value pair that contains additional data to be authenticated during the encryption and decryption processes.
(string) --
(string) --
string
Value that identifies the encryption algorithm and key size. Currently this can be AES_128 or AES_256.
integer
Integer that contains the number of bytes to generate. Common values are 128, 256, 512, 1024 and so on.
list
A list of grant tokens that represent grants which can be used to provide long term permissions to generate a key.
(string) --
dict
Response Syntax
{
'CiphertextBlob': b'bytes',
'KeyId': 'string'
}
Response Structure
(dict) --
CiphertextBlob (bytes) --
Ciphertext that contains the wrapped key. You must store the blob and encryption context so that the key can be used in a future operation.
KeyId (string) --
System generated unique identifier for the key.
List the grants for a specified key.
Request Syntax
client.list_grants(
KeyId='string',
Limit=123,
Marker='string'
)
string
[REQUIRED]
Unique identifier of the key. This can be an ARN, an alias, or a globally unique identifier.
integer
Specify this parameter only when paginating results to indicate the maximum number of grants you want listed in the response. If there are additional grants beyond the maximum you specify, the Truncated response element will be set to true.
string
Use this parameter only when paginating results, and only in a subsequent request after you've received a response where the results are truncated. Set it to the value of the NextMarker in the response you just received.
dict
Response Syntax
{
'Grants': [
{
'GrantId': 'string',
'GranteePrincipal': 'string',
'RetiringPrincipal': 'string',
'IssuingAccount': 'string',
'Operations': [
'Decrypt'|'Encrypt'|'GenerateDataKey'|'GenerateDataKeyWithoutPlaintext'|'ReEncryptFrom'|'ReEncryptTo'|'CreateGrant'|'RetireGrant',
],
'Constraints': {
'EncryptionContextSubset': {
'string': 'string'
},
'EncryptionContextEquals': {
'string': 'string'
}
}
},
],
'NextMarker': 'string',
'Truncated': True|False
}
Response Structure
(dict) --
Grants (list) --
A list of grants.
(dict) --
Contains information about each entry in the grant list.
GrantId (string) --
Unique grant identifier.
GranteePrincipal (string) --
The principal that receives the grant permission.
RetiringPrincipal (string) --
The principal that can retire the account.
IssuingAccount (string) --
The account under which the grant was issued.
Operations (list) --
List of operations permitted by the grant. This can be any combination of one or more of the following values:
Decrypt
Encrypt
GenerateDataKey
GenerateDataKeyWithoutPlaintext
ReEncryptFrom
ReEncryptTo
CreateGrant
(string) --
Constraints (dict) --
Specifies the conditions under which the actions specified by the Operations parameter are allowed.
EncryptionContextSubset (dict) -- The constraint equals the full encryption context.
(string) --
(string) --
EncryptionContextEquals (dict) -- The constraint contains additional key/value pairs that serve to further limit the grant.
(string) --
(string) --
NextMarker (string) --
If Truncated is true, this value is present and contains the value to use for the Marker request parameter in a subsequent pagination request.
Truncated (boolean) --
A flag that indicates whether there are more items in the list. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more grants in the list.
Marks a key as disabled, thereby preventing its use.
Request Syntax
client.disable_key(
KeyId='string'
)
string
[REQUIRED]
Unique identifier of the customer master key to be disabled. This can be an ARN, an alias, or a globally unique identifier.
None
Retires a grant. You can retire a grant when you're done using it to clean up. You should revoke a grant when you intend to actively deny operations that depend on it.
Request Syntax
client.retire_grant(
GrantToken='string'
)
string
[REQUIRED]
Token that identifies the grant to be retired.
None
Generates a secure data key. Data keys are used to encrypt and decrypt data. They are wrapped by customer master keys.
Request Syntax
client.generate_data_key(
KeyId='string',
EncryptionContext={
'string': 'string'
},
NumberOfBytes=123,
KeySpec='AES_256'|'AES_128',
GrantTokens=[
'string',
]
)
string
[REQUIRED]
Unique identifier of the key. This can be an ARN, an alias, or a globally unique identifier.
dict
Name/value pair that contains additional data to be authenticated during the encryption and decryption processes that use the key. This value is logged by AWS CloudTrail to provide context around the data encrypted by the key.
(string) --
(string) --
integer
Integer that contains the number of bytes to generate. Common values are 128, 256, 512, 1024 and so on. 1024 is the current limit.
string
Value that identifies the encryption algorithm and key size to generate a data key for. Currently this can be AES_128 or AES_256.
list
A list of grant tokens that represent grants which can be used to provide long term permissions to generate a key.
(string) --
dict
Response Syntax
{
'CiphertextBlob': b'bytes',
'Plaintext': b'bytes',
'KeyId': 'string'
}
Response Structure
(dict) --
CiphertextBlob (bytes) --
Ciphertext that contains the wrapped key. You must store the blob and encryption context so that the ciphertext can be decrypted. You must provide both the ciphertext blob and the encryption context.
Plaintext (bytes) --
Plaintext that contains the unwrapped key. Use this for encryption and decryption and then remove it from memory as soon as possible.
KeyId (string) --
System generated unique identifier for the key.
Lists the customer master keys.
Request Syntax
client.list_keys(
Limit=123,
Marker='string'
)
integer
Specify this parameter only when paginating results to indicate the maximum number of keys you want listed in the response. If there are additional keys beyond the maximum you specify, the Truncated response element will be set to true.
string
Use this parameter only when paginating results, and only in a subsequent request after you've received a response where the results are truncated. Set it to the value of the NextMarker in the response you just received.
dict
Response Syntax
{
'Keys': [
{
'KeyId': 'string',
'KeyArn': 'string'
},
],
'NextMarker': 'string',
'Truncated': True|False
}
Response Structure
(dict) --
Keys (list) --
A list of keys.
(dict) --
Contains information about each entry in the key list.
KeyId (string) --
Unique identifier of the key.
KeyArn (string) --
ARN of the key.
NextMarker (string) --
If Truncated is true, this value is present and contains the value to use for the Marker request parameter in a subsequent pagination request.
Truncated (boolean) --
A flag that indicates whether there are more items in the list. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more keys in the list.
Encrypts plaintext into ciphertext by using a customer master key.
Request Syntax
client.encrypt(
KeyId='string',
Plaintext=b'bytes',
EncryptionContext={
'string': 'string'
},
GrantTokens=[
'string',
]
)
string
[REQUIRED]
Unique identifier of the customer master. This can be an ARN, an alias, or the Key ID.
bytes
[REQUIRED]
Data to be encrypted.
dict
Name:value pair that specifies the encryption context to be used for authenticated encryption. For more information, see Authenticated Encryption.
(string) --
(string) --
list
A list of grant tokens that represent grants which can be used to provide long term permissions to perform encryption.
(string) --
dict
Response Syntax
{
'CiphertextBlob': b'bytes',
'KeyId': 'string'
}
Response Structure
(dict) --
CiphertextBlob (bytes) --
The encrypted plaintext.
KeyId (string) --
The ID of the key used during encryption.
Retrieves a list of policies attached to a key.
Request Syntax
client.list_key_policies(
KeyId='string',
Limit=123,
Marker='string'
)
string
[REQUIRED]
Unique identifier of the key. This can be an ARN, an alias, or a globally unique identifier.
integer
Specify this parameter only when paginating results to indicate the maximum number of policies you want listed in the response. If there are additional policies beyond the maximum you specify, the Truncated response element will be set to true.
string
Use this parameter only when paginating results, and only in a subsequent request after you've received a response where the results are truncated. Set it to the value of the NextMarker in the response you just received.
dict
Response Syntax
{
'PolicyNames': [
'string',
],
'NextMarker': 'string',
'Truncated': True|False
}
Response Structure
(dict) --
PolicyNames (list) --
A list of policy names. Currently, there is only one policy and it is named "Default".
(string) --
NextMarker (string) --
If Truncated is true, this value is present and contains the value to use for the Marker request parameter in a subsequent pagination request.
Truncated (boolean) --
A flag that indicates whether there are more items in the list. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more policies in the list.
Disables rotation of the specified key.
Request Syntax
client.disable_key_rotation(
KeyId='string'
)
string
[REQUIRED]
Unique identifier of the customer master key for which rotation is to be disabled. This can be an ARN, an alias, or a globally unique identifier.
None
Deletes the specified alias.
Request Syntax
client.delete_alias(
AliasName='string'
)
string
[REQUIRED]
The alias to be deleted.
None
Attaches a policy to the specified key.
Request Syntax
client.put_key_policy(
KeyId='string',
PolicyName='string',
Policy='string'
)
string
[REQUIRED]
Unique identifier of the key. This can be an ARN, an alias, or a globally unique identifier.
string
[REQUIRED]
Name of the policy to be attached. Currently, the only supported name is "default".
string
[REQUIRED]
The policy, in JSON format, to be attached to the key.
None
Retrieves a policy attached to the specified key.
Request Syntax
client.get_key_policy(
KeyId='string',
PolicyName='string'
)
string
[REQUIRED]
Unique identifier of the key. This can be an ARN, an alias, or a globally unique identifier.
string
[REQUIRED]
String that contains the name of the policy. Currently, this must be "default". Policy names can be discovered by calling ListKeyPolicies.
dict
Response Syntax
{
'Policy': 'string'
}
Response Structure
(dict) --
Policy (string) --
A policy document in JSON format.
Adds a grant to a key to specify who can access the key and under what conditions. Grants are alternate permission mechanisms to key policies. If absent, access to the key is evaluated based on IAM policies attached to the user. By default, grants do not expire. Grants can be listed, retired, or revoked as indicated by the following APIs. Typically, when you are finished using a grant, you retire it. When you want to end a grant immediately, revoke it. For more information about grants, see Grants.
ListGrants
RetireGrant
RevokeGrant
Request Syntax
client.create_grant(
KeyId='string',
GranteePrincipal='string',
RetiringPrincipal='string',
Operations=[
'Decrypt'|'Encrypt'|'GenerateDataKey'|'GenerateDataKeyWithoutPlaintext'|'ReEncryptFrom'|'ReEncryptTo'|'CreateGrant'|'RetireGrant',
],
Constraints={
'EncryptionContextSubset': {
'string': 'string'
},
'EncryptionContextEquals': {
'string': 'string'
}
},
GrantTokens=[
'string',
]
)
string
[REQUIRED]
A unique key identifier for a customer master key. This value can be a globally unique identifier, an ARN, or an alias.
string
[REQUIRED]
Principal given permission by the grant to use the key identified by the keyId parameter.
string
Principal given permission to retire the grant. For more information, see RetireGrant.
list
List of operations permitted by the grant. This can be any combination of one or more of the following values:
Decrypt
Encrypt
GenerateDataKey
GenerateDataKeyWithoutPlaintext
ReEncryptFrom
ReEncryptTo
CreateGrant
(string) --
dict
Specifies the conditions under which the actions specified by the Operations parameter are allowed.
EncryptionContextSubset (dict) -- The constraint equals the full encryption context.
(string) --
(string) --
EncryptionContextEquals (dict) -- The constraint contains additional key/value pairs that serve to further limit the grant.
(string) --
(string) --
list
List of grant tokens.
(string) --
dict
Response Syntax
{
'GrantToken': 'string',
'GrantId': 'string'
}
Response Structure
(dict) --
GrantToken (string) --
The grant token. A grant token is a string that identifies a grant and which can be used to make a grant take effect immediately. A token contains all of the information necessary to create a grant.
GrantId (string) --
Unique grant identifier. You can use the GrantId value to revoke a grant.
Revokes a grant. You can revoke a grant to actively deny operations that depend on it.
Request Syntax
client.revoke_grant(
KeyId='string',
GrantId='string'
)
string
[REQUIRED]
Unique identifier of the key associated with the grant.
string
[REQUIRED]
Identifier of the grant to be revoked.
None