/AWS1/CL_KMSKEYMETADATA¶
Contains metadata about a KMS key.
This data type is used as a response element for the CreateKey, DescribeKey, and ReplicateKey operations.
CONSTRUCTOR¶
IMPORTING¶
Required arguments:¶
iv_keyid TYPE /AWS1/KMSKEYIDTYPE /AWS1/KMSKEYIDTYPE¶
The globally unique identifier for the KMS key.
Optional arguments:¶
iv_awsaccountid TYPE /AWS1/KMSAWSACCOUNTIDTYPE /AWS1/KMSAWSACCOUNTIDTYPE¶
The twelve-digit account ID of the Amazon Web Services account that owns the KMS key.
iv_arn TYPE /AWS1/KMSARNTYPE /AWS1/KMSARNTYPE¶
The Amazon Resource Name (ARN) of the KMS key. For examples, see Key Management Service (KMS) in the Example ARNs section of the Amazon Web Services General Reference.
iv_creationdate TYPE /AWS1/KMSDATETYPE /AWS1/KMSDATETYPE¶
The date and time when the KMS key was created.
iv_enabled TYPE /AWS1/KMSBOOLEANTYPE /AWS1/KMSBOOLEANTYPE¶
Specifies whether the KMS key is enabled. When
KeyStateisEnabledthis value is true, otherwise it is false.
iv_description TYPE /AWS1/KMSDESCRIPTIONTYPE /AWS1/KMSDESCRIPTIONTYPE¶
The description of the KMS key.
iv_keyusage TYPE /AWS1/KMSKEYUSAGETYPE /AWS1/KMSKEYUSAGETYPE¶
The cryptographic operations for which you can use the KMS key.
iv_keystate TYPE /AWS1/KMSKEYSTATE /AWS1/KMSKEYSTATE¶
The current status of the KMS key.
For more information about how key state affects the use of a KMS key, see Key states of KMS keys in the Key Management Service Developer Guide.
iv_deletiondate TYPE /AWS1/KMSDATETYPE /AWS1/KMSDATETYPE¶
The date and time after which KMS deletes this KMS key. This value is present only when the KMS key is scheduled for deletion, that is, when its
KeyStateisPendingDeletion.When the primary key in a multi-Region key is scheduled for deletion but still has replica keys, its key state is
PendingReplicaDeletionand the length of its waiting period is displayed in thePendingDeletionWindowInDaysfield.
iv_validto TYPE /AWS1/KMSDATETYPE /AWS1/KMSDATETYPE¶
The earliest time at which any imported key material permanently associated with this KMS key expires. When a key material expires, KMS deletes the key material and the KMS key becomes unusable. This value is present only for KMS keys whose
OriginisEXTERNALand theExpirationModelisKEY_MATERIAL_EXPIRES, otherwise this value is omitted.
iv_origin TYPE /AWS1/KMSORIGINTYPE /AWS1/KMSORIGINTYPE¶
The source of the key material for the KMS key. When this value is
AWS_KMS, KMS created the key material. When this value isEXTERNAL, the key material was imported or the KMS key doesn't have any key material. When this value isAWS_CLOUDHSM, the key material was created in the CloudHSM cluster associated with a custom key store.
iv_customkeystoreid TYPE /AWS1/KMSCUSTOMKEYSTOREIDTYPE /AWS1/KMSCUSTOMKEYSTOREIDTYPE¶
A unique identifier for the custom key store that contains the KMS key. This field is present only when the KMS key is created in a custom key store.
iv_cloudhsmclusterid TYPE /AWS1/KMSCLOUDHSMCLUSTERIDTYPE /AWS1/KMSCLOUDHSMCLUSTERIDTYPE¶
The cluster ID of the CloudHSM cluster that contains the key material for the KMS key. When you create a KMS key in an CloudHSM custom key store, KMS creates the key material for the KMS key in the associated CloudHSM cluster. This field is present only when the KMS key is created in an CloudHSM key store.
iv_expirationmodel TYPE /AWS1/KMSEXPIRATIONMODELTYPE /AWS1/KMSEXPIRATIONMODELTYPE¶
Specifies whether the KMS key's key material expires. This value is present only when
OriginisEXTERNAL, otherwise this value is omitted.
iv_keymanager TYPE /AWS1/KMSKEYMANAGERTYPE /AWS1/KMSKEYMANAGERTYPE¶
The manager of the KMS key. KMS keys in your Amazon Web Services account are either customer managed or Amazon Web Services managed. For more information about the difference, see KMS keys in the Key Management Service Developer Guide.
iv_customermasterkeyspec TYPE /AWS1/KMSCUSTOMERMASTERKEYSPEC /AWS1/KMSCUSTOMERMASTERKEYSPEC¶
Instead, use the
KeySpecfield.The
KeySpecandCustomerMasterKeySpecfields have the same value. We recommend that you use theKeySpecfield in your code. However, to avoid breaking changes, KMS supports both fields.
iv_keyspec TYPE /AWS1/KMSKEYSPEC /AWS1/KMSKEYSPEC¶
Describes the type of key material in the KMS key.
it_encryptionalgorithms TYPE /AWS1/CL_KMSENCALGSPECLIST_W=>TT_ENCRYPTIONALGORITHMSPECLIST TT_ENCRYPTIONALGORITHMSPECLIST¶
The encryption algorithms that the KMS key supports. You cannot use the KMS key with other encryption algorithms within KMS.
This value is present only when the
KeyUsageof the KMS key isENCRYPT_DECRYPT.
it_signingalgorithms TYPE /AWS1/CL_KMSSIGNINGALGSPECLS00=>TT_SIGNINGALGORITHMSPECLIST TT_SIGNINGALGORITHMSPECLIST¶
The signing algorithms that the KMS key supports. You cannot use the KMS key with other signing algorithms within KMS.
This field appears only when the
KeyUsageof the KMS key isSIGN_VERIFY.
it_keyagreementalgorithms TYPE /AWS1/CL_KMSKEYAGREEMENTALGS00=>TT_KEYAGREEMENTALGSPECLIST TT_KEYAGREEMENTALGSPECLIST¶
The key agreement algorithm used to derive a shared secret.
iv_multiregion TYPE /AWS1/KMSNULLABLEBOOLEANTYPE /AWS1/KMSNULLABLEBOOLEANTYPE¶
Indicates whether the KMS key is a multi-Region (
True) or regional (False) key. This value isTruefor multi-Region primary and replica keys andFalsefor regional KMS keys.For more information about multi-Region keys, see Multi-Region keys in KMS in the Key Management Service Developer Guide.
io_multiregionconfiguration TYPE REF TO /AWS1/CL_KMSMULTIREGIONCONF /AWS1/CL_KMSMULTIREGIONCONF¶
Lists the primary and replica keys in same multi-Region key. This field is present only when the value of the
MultiRegionfield isTrue.For more information about any listed KMS key, use the DescribeKey operation.
MultiRegionKeyTypeindicates whether the KMS key is aPRIMARYorREPLICAkey.
PrimaryKeydisplays the key ARN and Region of the primary key. This field displays the current KMS key if it is the primary key.
ReplicaKeysdisplays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.
iv_pendingdeletionwindowin00 TYPE /AWS1/KMSPENDINGWINDOWINDAYS00 /AWS1/KMSPENDINGWINDOWINDAYS00¶
The waiting period before the primary key in a multi-Region key is deleted. This waiting period begins when the last of its replica keys is deleted. This value is present only when the
KeyStateof the KMS key isPendingReplicaDeletion. That indicates that the KMS key is the primary key in a multi-Region key, it is scheduled for deletion, and it still has existing replica keys.When a single-Region KMS key or a multi-Region replica key is scheduled for deletion, its deletion date is displayed in the
DeletionDatefield. However, when the primary key in a multi-Region key is scheduled for deletion, its waiting period doesn't begin until all of its replica keys are deleted. This value displays that waiting period. When the last replica key in the multi-Region key is deleted, theKeyStateof the scheduled primary key changes fromPendingReplicaDeletiontoPendingDeletionand the deletion date appears in theDeletionDatefield.
it_macalgorithms TYPE /AWS1/CL_KMSMACALGSPECLIST_W=>TT_MACALGORITHMSPECLIST TT_MACALGORITHMSPECLIST¶
The message authentication code (MAC) algorithm that the HMAC KMS key supports.
This value is present only when the
KeyUsageof the KMS key isGENERATE_VERIFY_MAC.
io_xkskeyconfiguration TYPE REF TO /AWS1/CL_KMSXKSKEYCONFTYPE /AWS1/CL_KMSXKSKEYCONFTYPE¶
Information about the external key that is associated with a KMS key in an external key store.
For more information, see External key in the Key Management Service Developer Guide.
iv_currentkeymaterialid TYPE /AWS1/KMSBACKINGKEYIDTYPE /AWS1/KMSBACKINGKEYIDTYPE¶
Identifies the current key material. This value is present for symmetric encryption keys with
AWS_KMSorigin and single-Region, symmetric encryption keys withEXTERNALorigin. These KMS keys support automatic or on-demand key rotation and can have multiple key materials associated with them. KMS uses the current key material for both encryption and decryption, and the non-current key material for decryption operations only.
Queryable Attributes¶
AWSAccountId¶
The twelve-digit account ID of the Amazon Web Services account that owns the KMS key.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_AWSACCOUNTID() |
Getter for AWSACCOUNTID, with configurable default |
ASK_AWSACCOUNTID() |
Getter for AWSACCOUNTID w/ exceptions if field has no value |
HAS_AWSACCOUNTID() |
Determine if AWSACCOUNTID has a value |
KeyId¶
The globally unique identifier for the KMS key.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_KEYID() |
Getter for KEYID, with configurable default |
ASK_KEYID() |
Getter for KEYID w/ exceptions if field has no value |
HAS_KEYID() |
Determine if KEYID has a value |
Arn¶
The Amazon Resource Name (ARN) of the KMS key. For examples, see Key Management Service (KMS) in the Example ARNs section of the Amazon Web Services General Reference.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_ARN() |
Getter for ARN, with configurable default |
ASK_ARN() |
Getter for ARN w/ exceptions if field has no value |
HAS_ARN() |
Determine if ARN has a value |
CreationDate¶
The date and time when the KMS key was created.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_CREATIONDATE() |
Getter for CREATIONDATE, with configurable default |
ASK_CREATIONDATE() |
Getter for CREATIONDATE w/ exceptions if field has no value |
HAS_CREATIONDATE() |
Determine if CREATIONDATE has a value |
Enabled¶
Specifies whether the KMS key is enabled. When
KeyStateisEnabledthis value is true, otherwise it is false.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_ENABLED() |
Getter for ENABLED |
Description¶
The description of the KMS key.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_DESCRIPTION() |
Getter for DESCRIPTION, with configurable default |
ASK_DESCRIPTION() |
Getter for DESCRIPTION w/ exceptions if field has no value |
HAS_DESCRIPTION() |
Determine if DESCRIPTION has a value |
KeyUsage¶
The cryptographic operations for which you can use the KMS key.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_KEYUSAGE() |
Getter for KEYUSAGE, with configurable default |
ASK_KEYUSAGE() |
Getter for KEYUSAGE w/ exceptions if field has no value |
HAS_KEYUSAGE() |
Determine if KEYUSAGE has a value |
KeyState¶
The current status of the KMS key.
For more information about how key state affects the use of a KMS key, see Key states of KMS keys in the Key Management Service Developer Guide.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_KEYSTATE() |
Getter for KEYSTATE, with configurable default |
ASK_KEYSTATE() |
Getter for KEYSTATE w/ exceptions if field has no value |
HAS_KEYSTATE() |
Determine if KEYSTATE has a value |
DeletionDate¶
The date and time after which KMS deletes this KMS key. This value is present only when the KMS key is scheduled for deletion, that is, when its
KeyStateisPendingDeletion.When the primary key in a multi-Region key is scheduled for deletion but still has replica keys, its key state is
PendingReplicaDeletionand the length of its waiting period is displayed in thePendingDeletionWindowInDaysfield.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_DELETIONDATE() |
Getter for DELETIONDATE, with configurable default |
ASK_DELETIONDATE() |
Getter for DELETIONDATE w/ exceptions if field has no value |
HAS_DELETIONDATE() |
Determine if DELETIONDATE has a value |
ValidTo¶
The earliest time at which any imported key material permanently associated with this KMS key expires. When a key material expires, KMS deletes the key material and the KMS key becomes unusable. This value is present only for KMS keys whose
OriginisEXTERNALand theExpirationModelisKEY_MATERIAL_EXPIRES, otherwise this value is omitted.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_VALIDTO() |
Getter for VALIDTO, with configurable default |
ASK_VALIDTO() |
Getter for VALIDTO w/ exceptions if field has no value |
HAS_VALIDTO() |
Determine if VALIDTO has a value |
Origin¶
The source of the key material for the KMS key. When this value is
AWS_KMS, KMS created the key material. When this value isEXTERNAL, the key material was imported or the KMS key doesn't have any key material. When this value isAWS_CLOUDHSM, the key material was created in the CloudHSM cluster associated with a custom key store.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_ORIGIN() |
Getter for ORIGIN, with configurable default |
ASK_ORIGIN() |
Getter for ORIGIN w/ exceptions if field has no value |
HAS_ORIGIN() |
Determine if ORIGIN has a value |
CustomKeyStoreId¶
A unique identifier for the custom key store that contains the KMS key. This field is present only when the KMS key is created in a custom key store.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_CUSTOMKEYSTOREID() |
Getter for CUSTOMKEYSTOREID, with configurable default |
ASK_CUSTOMKEYSTOREID() |
Getter for CUSTOMKEYSTOREID w/ exceptions if field has no va |
HAS_CUSTOMKEYSTOREID() |
Determine if CUSTOMKEYSTOREID has a value |
CloudHsmClusterId¶
The cluster ID of the CloudHSM cluster that contains the key material for the KMS key. When you create a KMS key in an CloudHSM custom key store, KMS creates the key material for the KMS key in the associated CloudHSM cluster. This field is present only when the KMS key is created in an CloudHSM key store.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_CLOUDHSMCLUSTERID() |
Getter for CLOUDHSMCLUSTERID, with configurable default |
ASK_CLOUDHSMCLUSTERID() |
Getter for CLOUDHSMCLUSTERID w/ exceptions if field has no v |
HAS_CLOUDHSMCLUSTERID() |
Determine if CLOUDHSMCLUSTERID has a value |
ExpirationModel¶
Specifies whether the KMS key's key material expires. This value is present only when
OriginisEXTERNAL, otherwise this value is omitted.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_EXPIRATIONMODEL() |
Getter for EXPIRATIONMODEL, with configurable default |
ASK_EXPIRATIONMODEL() |
Getter for EXPIRATIONMODEL w/ exceptions if field has no val |
HAS_EXPIRATIONMODEL() |
Determine if EXPIRATIONMODEL has a value |
KeyManager¶
The manager of the KMS key. KMS keys in your Amazon Web Services account are either customer managed or Amazon Web Services managed. For more information about the difference, see KMS keys in the Key Management Service Developer Guide.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_KEYMANAGER() |
Getter for KEYMANAGER, with configurable default |
ASK_KEYMANAGER() |
Getter for KEYMANAGER w/ exceptions if field has no value |
HAS_KEYMANAGER() |
Determine if KEYMANAGER has a value |
CustomerMasterKeySpec¶
Instead, use the
KeySpecfield.The
KeySpecandCustomerMasterKeySpecfields have the same value. We recommend that you use theKeySpecfield in your code. However, to avoid breaking changes, KMS supports both fields.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_CUSTOMERMASTERKEYSPEC() |
Getter for CUSTOMERMASTERKEYSPEC, with configurable default |
ASK_CUSTOMERMASTERKEYSPEC() |
Getter for CUSTOMERMASTERKEYSPEC w/ exceptions if field has |
HAS_CUSTOMERMASTERKEYSPEC() |
Determine if CUSTOMERMASTERKEYSPEC has a value |
KeySpec¶
Describes the type of key material in the KMS key.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_KEYSPEC() |
Getter for KEYSPEC, with configurable default |
ASK_KEYSPEC() |
Getter for KEYSPEC w/ exceptions if field has no value |
HAS_KEYSPEC() |
Determine if KEYSPEC has a value |
EncryptionAlgorithms¶
The encryption algorithms that the KMS key supports. You cannot use the KMS key with other encryption algorithms within KMS.
This value is present only when the
KeyUsageof the KMS key isENCRYPT_DECRYPT.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_ENCRYPTIONALGORITHMS() |
Getter for ENCRYPTIONALGORITHMS, with configurable default |
ASK_ENCRYPTIONALGORITHMS() |
Getter for ENCRYPTIONALGORITHMS w/ exceptions if field has n |
HAS_ENCRYPTIONALGORITHMS() |
Determine if ENCRYPTIONALGORITHMS has a value |
SigningAlgorithms¶
The signing algorithms that the KMS key supports. You cannot use the KMS key with other signing algorithms within KMS.
This field appears only when the
KeyUsageof the KMS key isSIGN_VERIFY.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_SIGNINGALGORITHMS() |
Getter for SIGNINGALGORITHMS, with configurable default |
ASK_SIGNINGALGORITHMS() |
Getter for SIGNINGALGORITHMS w/ exceptions if field has no v |
HAS_SIGNINGALGORITHMS() |
Determine if SIGNINGALGORITHMS has a value |
KeyAgreementAlgorithms¶
The key agreement algorithm used to derive a shared secret.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_KEYAGREEMENTALGORITHMS() |
Getter for KEYAGREEMENTALGORITHMS, with configurable default |
ASK_KEYAGREEMENTALGORITHMS() |
Getter for KEYAGREEMENTALGORITHMS w/ exceptions if field has |
HAS_KEYAGREEMENTALGORITHMS() |
Determine if KEYAGREEMENTALGORITHMS has a value |
MultiRegion¶
Indicates whether the KMS key is a multi-Region (
True) or regional (False) key. This value isTruefor multi-Region primary and replica keys andFalsefor regional KMS keys.For more information about multi-Region keys, see Multi-Region keys in KMS in the Key Management Service Developer Guide.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_MULTIREGION() |
Getter for MULTIREGION, with configurable default |
ASK_MULTIREGION() |
Getter for MULTIREGION w/ exceptions if field has no value |
HAS_MULTIREGION() |
Determine if MULTIREGION has a value |
MultiRegionConfiguration¶
Lists the primary and replica keys in same multi-Region key. This field is present only when the value of the
MultiRegionfield isTrue.For more information about any listed KMS key, use the DescribeKey operation.
MultiRegionKeyTypeindicates whether the KMS key is aPRIMARYorREPLICAkey.
PrimaryKeydisplays the key ARN and Region of the primary key. This field displays the current KMS key if it is the primary key.
ReplicaKeysdisplays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_MULTIREGIONCONFIGURATION() |
Getter for MULTIREGIONCONFIGURATION |
PendingDeletionWindowInDays¶
The waiting period before the primary key in a multi-Region key is deleted. This waiting period begins when the last of its replica keys is deleted. This value is present only when the
KeyStateof the KMS key isPendingReplicaDeletion. That indicates that the KMS key is the primary key in a multi-Region key, it is scheduled for deletion, and it still has existing replica keys.When a single-Region KMS key or a multi-Region replica key is scheduled for deletion, its deletion date is displayed in the
DeletionDatefield. However, when the primary key in a multi-Region key is scheduled for deletion, its waiting period doesn't begin until all of its replica keys are deleted. This value displays that waiting period. When the last replica key in the multi-Region key is deleted, theKeyStateof the scheduled primary key changes fromPendingReplicaDeletiontoPendingDeletionand the deletion date appears in theDeletionDatefield.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_PENDINGDELETIONWINDOWI00() |
Getter for PENDINGDELETIONWINDOWINDAYS, with configurable de |
ASK_PENDINGDELETIONWINDOWI00() |
Getter for PENDINGDELETIONWINDOWINDAYS w/ exceptions if fiel |
HAS_PENDINGDELETIONWINDOWI00() |
Determine if PENDINGDELETIONWINDOWINDAYS has a value |
MacAlgorithms¶
The message authentication code (MAC) algorithm that the HMAC KMS key supports.
This value is present only when the
KeyUsageof the KMS key isGENERATE_VERIFY_MAC.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_MACALGORITHMS() |
Getter for MACALGORITHMS, with configurable default |
ASK_MACALGORITHMS() |
Getter for MACALGORITHMS w/ exceptions if field has no value |
HAS_MACALGORITHMS() |
Determine if MACALGORITHMS has a value |
XksKeyConfiguration¶
Information about the external key that is associated with a KMS key in an external key store.
For more information, see External key in the Key Management Service Developer Guide.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_XKSKEYCONFIGURATION() |
Getter for XKSKEYCONFIGURATION |
CurrentKeyMaterialId¶
Identifies the current key material. This value is present for symmetric encryption keys with
AWS_KMSorigin and single-Region, symmetric encryption keys withEXTERNALorigin. These KMS keys support automatic or on-demand key rotation and can have multiple key materials associated with them. KMS uses the current key material for both encryption and decryption, and the non-current key material for decryption operations only.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_CURRENTKEYMATERIALID() |
Getter for CURRENTKEYMATERIALID, with configurable default |
ASK_CURRENTKEYMATERIALID() |
Getter for CURRENTKEYMATERIALID w/ exceptions if field has n |
HAS_CURRENTKEYMATERIALID() |
Determine if CURRENTKEYMATERIALID has a value |