# Key type reference
<a name="symm-asymm-compare"></a>

AWS KMS supports different features for different *types* of KMS keys. For example, you can only use [symmetric encryption KMS keys](symm-asymm-choose-key-spec.md#symmetric-cmks) to [generate symmetric data keys](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html) and [asymmetric data key pairs](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairs.html). Also, [importing key material](importing-keys.md) and [automatic key rotation](rotate-keys.md) are supported only for symmetric encryption KMS keys, and you can create only symmetric encryption KMS keys in a [custom key store](key-store-overview.md#custom-key-store-overview). 

This reference includes two tables. 
+ The [Key type table](#key-type-table) lists the AWS KMS operations that are valid for symmetric encryption KMS keys, asymmetric KMS keys, and HMAC KMS keys. 
+ The [Special features table](#special-features-table) lists the AWS KMS operations that are valid for multi-Region KMS keys, KMS keys with imported key material, and KMS keys in custom key stores.

## Key type table
<a name="key-type-table"></a>

You might need to scroll horizontally or vertically to see all of the data in this table.


| AWS KMS API operation | Symmetric encryption KMS keys | HMAC KMS keys | Asymmetric KMS keys (ENCRYPT\_DECRYPT) | Asymmetric KMS keys (SIGN\_VERIFY) | Asymmetric KMS keys (KEY\_AGREEMENT) | 
| --- | --- | --- | --- | --- | --- | 
| [CancelKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html) | Yes | Yes | Yes | Yes | Yes | 
| [CreateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html) | Yes | Yes | Yes | Yes | Yes | 
| [CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html) | Yes | Yes | Yes | Yes | Yes | 
| [CreateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html) | Yes | Yes | Yes | Yes | Yes | 
| [Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html) | Yes | No | Yes | No | No | 
| [DeleteAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html) | Yes | Yes | Yes | Yes | Yes | 
| [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html)<br />Valid only on KMS keys with imported key material (`Origin` is `EXTERNAL`). | Yes | Yes | Yes | Yes | Yes | 
| [DeriveSharedSecret](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeriveSharedSecret.html) | No | No | No | No | Yes | 
| [DescribeKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html) | Yes | Yes | Yes | Yes | Yes | 
| [DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html) | Yes | Yes | Yes | Yes | Yes | 
| [DisableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html) |  Yes Valid only on KMS keys with AWS KMS key material (`Origin` is `AWS_KMS`). | No | No | No | No | 
| [EnableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html) | Yes | Yes | Yes | Yes | Yes | 
| [EnableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html) | Yes<br />Valid only on KMS keys with AWS KMS key material (`Origin` is `AWS_KMS`). | No | No | No | No | 
| [Encrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html) | Yes | No | Yes | No | No | 
| [GenerateDataKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html) | Yes  | No | No | No | No | 
| [GenerateDataKeyPair](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html)<br />Generates an asymmetric data key pair that is protected by a symmetric encryption KMS key. | Yes Not valid on KMS keys in custom key stores. | No | No | No | No | 
| [GenerateDataKeyPairWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html)<br />Generates an asymmetric data key pair that is protected by a symmetric encryption KMS key. | Yes <br />Not valid on KMS keys in custom key stores. | No | No | No | No | 
| [GenerateDataKeyWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html) | Yes | No | No | No | No | 
| [GenerateMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateMac.html) | No | Yes | No | No | No | 
| [GetKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html) | Yes | Yes | Yes | Yes | Yes | 
| [GetKeyRotationStatus](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html) | Yes |  Yes (`KeyRotationEnabled` will always be `false`.) |  Yes (`KeyRotationEnabled` will always be `false`.) |  Yes (`KeyRotationEnabled` will always be `false`.) |  Yes (`KeyRotationEnabled` will always be `false`.) | 
| [GetParametersForImport](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html)<br />Valid only on KMS keys with imported key material (`Origin` is `EXTERNAL`). | Yes | Yes | Yes | Yes | Yes | 
| [GetPublicKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html) | No | No | Yes | Yes | Yes | 
| [ImportKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html)<br />Valid only on KMS keys with imported key material (`Origin` is `EXTERNAL`). | Yes | Yes | Yes | Yes | Yes | 
| [ListAliases](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html) | Yes | Yes | Yes | Yes | Yes | 
| [ListGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.html) | Yes | Yes | Yes | Yes | Yes | 
| [ListKeyPolicies](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.html) | Yes | Yes | Yes | Yes | Yes | 
| [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html) | Yes | Yes (The `Rotations` field will always be null or empty.) | Yes (The `Rotations` field will always be null or empty.) | Yes (The `Rotations` field will always be null or empty.) | Yes (The `Rotations` field will always be null or empty.) | 
| [ListResourceTags](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html) | Yes | Yes | Yes | Yes | Yes | 
| [ListRetirableGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.html) | Yes | Yes | Yes | Yes | Yes | 
| [PutKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html) | Yes | Yes | Yes | Yes | Yes | 
| [ReEncrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html) | Yes | No | Yes | No | No | 
| [ReplicateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html)<br />- Valid only on multi-Region keys | Yes | Yes | Yes | Yes | Yes | 
| [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html) | Yes | Yes | Yes | Yes | Yes | 
| [RevokeGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html) | Yes | Yes | Yes | Yes | Yes | 
| [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html) | Yes Valid only on customer-managed, symmetric encryption KMS keys with `AWS_KMS` or `EXTERNAL` origin. | No | No | No | No | 
| [ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html) | Yes | Yes | Yes | Yes | Yes | 
| [Sign](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html) | No | No | No | Yes | No | 
| [TagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html) | Yes | Yes | Yes | Yes | Yes | 
| [UntagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html) | Yes | Yes | Yes | Yes | Yes | 
| [UpdateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html)<br />The current KMS key and the new KMS key must be the same type (both symmetric or both asymmetric or both HMAC) and they must have the same [key usage](create-keys.md#key-usage). | Yes | Yes | Yes | Yes | Yes | 
| [UpdateKeyDescription](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html) | Yes | Yes | Yes | Yes | Yes | 
| [UpdateReplicaRegion](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateReplicaRegion.html)<br />- Valid only on multi-Region keys | Yes | Yes | Yes | Yes | Yes | 
| [Verify](https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html) | No | No | No | Yes | No | 
| [VerifyMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_VerifyMac.html) | No | Yes | No | No | No | 

## Special features table
<a name="special-features-table"></a>

This table shows the AWS KMS API operations that are supported on each type of *special-purpose key*. 

While reading this table, be aware of the following interactions:
+ [Multi-Region keys](multi-region-keys-overview.md): 
  + Multi-Region keys can be symmetric encryption KMS keys, asymmetric KMS keys, HMAC KMS keys, and KMS keys with imported key material.
  + You cannot create multi-Region keys in a custom key store.
+ [Imported key material](importing-keys.md)
  + You can import key material for symmetric encryption KMS keys, asymmetric KMS keys, and HMAC KMS keys.
  + You can create [multi-Region keys with imported key material](multi-region-keys-overview.md).
  + You cannot create keys with imported key material in a custom key store. 
  + Automatic key rotation (`EnableKeyRotation`, `DisableKeyRotation`) is not supported for KMS keys with imported key material.
  + On-demand key rotation (`RotateKeyOnDemand`) is supported for symmetric encryption KMS keys with imported key material.
+ [Custom key stores](key-store-overview.md#custom-key-store-overview)
  + Custom key stores support only symmetric encryption KMS keys.
  + Symmetric operations on asymmetric key pairs (`GenerateDataKeyPair`, `GenerateDataKeyPairWithoutPlaintext`) are not supported on KMS keys in custom key stores.
  + Automatic key rotation (`EnableKeyRotation`, `DisableKeyRotation`) is not supported on KMS keys in custom key stores.
  + You cannot create multi-Region keys in custom key stores.

You might need to scroll horizontally or vertically to see all of the data in this table.


| AWS KMS API operation | Multi-Region keys | Imported key material | KMS keys in a custom key store | 
| --- | --- | --- | --- | 
| [CancelKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [CreateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [ CreateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html)You can use `CreateKey` to create a multi-Region primary key, a KMS key with imported key material, or a KMS key in a custom key store. To create a multi-Region replica key, use `ReplicateKey`. | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) <br />Valid only when `KeyUsage` is `ENCRYPT_DECRYPT` | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [DeleteAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only for keys with imported key material (`Origin` is `EXTERNAL`) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [DeriveSharedSecret](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeriveSharedSecret.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only when `KeyUsage` is `KEY_AGREEMENT`) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only when `KeyUsage` is `KEY_AGREEMENT`) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [DescribeKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [DisableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)Valid only on symmetric encryption keys with AWS KMS key material (`Origin` is `AWS_KMS`). | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [EnableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only on symmetric encryption KMS keys | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [EnableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only on symmetric encryption keys with AWS KMS key material (`Origin` is `AWS_KMS`). | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [Encrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only when `KeyUsage` is `ENCRYPT_DECRYPT` | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [GenerateDataKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) <br />Valid only on symmetric encryption KMS keys | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [GenerateDataKeyPair](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only on symmetric encryption KMS keys | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [GenerateDataKeyPairWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only on symmetric encryption KMS keys | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [GenerateDataKeyWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only on symmetric encryption KMS keys | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [GenerateMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateMac.html)Valid only on HMAC KMS keys |  ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [GetKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [GetKeyRotationStatus](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)(`KeyRotationEnabled` will always be `false`.) |  ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
| [GetParametersForImport](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only for keys with imported key material (`Origin` is `EXTERNAL`). | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [GetPublicKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html)<br />Valid only for [asymmetric KMS keys](symmetric-asymmetric.md). | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [ImportKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only for keys with imported key material (`Origin` is `EXTERNAL`). | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [ListAliases](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [ListGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [ListKeyPolicies](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only on symmetric encryption keys with `AWS_KMS` or `EXTERNAL` origin. | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only on symmetric encryption keys. | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [ListResourceTags](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [ListRetirableGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [PutKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [ReEncrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only when `KeyUsage` is `ENCRYPT_DECRYPT` | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [ReplicateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only on multi-Region primary keys. | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)Valid only on multi-Region primary keys. | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [RevokeGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only on symmetric encryption keys with `AWS_KMS` or `EXTERNAL` origin. | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)<br />Valid only on symmetric encryption keys. | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [Sign](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html)<br />Valid only on when `KeyUsage` is `SIGN_VERIFY`. | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [TagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [UntagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [UpdateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html)<br />- The current KMS key and the new KMS key must be the same type (both symmetric or both asymmetric or both HMAC) and they must have the same [key usage](create-keys.md#key-usage). | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [UpdateKeyDescription](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
| [UpdateReplicaRegion](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateReplicaRegion.html) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)Valid only on multi-Region keys. | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [Verify](https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html)<br />Valid only when `KeyUsage` is `SIGN_VERIFY`. | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
| [VerifyMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_VerifyMac.html) Valid only on HMAC KMS keys |  ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) |