com.amazonaws.services.kms.model

Class ImportKeyMaterialRequest

java.lang.Object

com.amazonaws.AmazonWebServiceRequest

com.amazonaws.services.kms.model.ImportKeyMaterialRequest

All Implemented Interfaces:

java.io.Serializable, java.lang.Cloneable

public class ImportKeyMaterialRequest
extends AmazonWebServiceRequest
implements java.io.Serializable

Imports key material into an existing symmetric AWS KMS customer master key (CMK) that was created without key material. After you successfully import key material into a CMK, you can reimport the same key material into that CMK, but you cannot import different key material.

You cannot perform this operation on an asymmetric CMK or on any CMK in a different AWS account. For more information about creating CMKs with no key material and then importing key material, see Importing Key Material in the AWS Key Management Service Developer Guide.

Before using this operation, call GetParametersForImport. Its response includes a public key and an import token. Use the public key to encrypt the key material. Then, submit the import token from the same GetParametersForImport response.

When calling this operation, you must specify the following values:

• The key ID or key ARN of a CMK with no key material. Its Origin must be EXTERNAL.

  To create a CMK with no key material, call CreateKey and set the value of its Origin parameter to EXTERNAL. To get the Origin of a CMK, call DescribeKey.)

• The encrypted key material. To get the public key to encrypt the key material, call GetParametersForImport.

• The import token that GetParametersForImport returned. You must use a public key and token from the same GetParametersForImport response.

• Whether the key material expires and if so, when. If you set an expiration date, AWS KMS deletes the key material from the CMK on the specified date, and the CMK becomes unusable. To use the CMK again, you must reimport the same key material. The only way to change an expiration date is by reimporting the same key material and specifying a new expiration date.

When this operation is successful, the key state of the CMK changes from PendingImport to Enabled, and you can use the CMK.

If this operation fails, use the exception to help determine the problem. If the error is related to the key material, the import token, or wrapping key, use GetParametersForImport to get a new public key and import token for the CMK and repeat the import procedure. For help, see How To Import Key Material in the AWS Key Management Service Developer Guide.

The CMK that you use for this operation must be in a compatible key state. For details, see How Key State Affects Use of a Customer Master Key in the AWS Key Management Service Developer Guide.

Cross-account use: No. You cannot perform this operation on a CMK in a different AWS account.

Required permissions: kms:ImportKeyMaterial (key policy)

Related operations:

• DeleteImportedKeyMaterial

• GetParametersForImport

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
ImportKeyMaterialRequest()

Method Summary

Modifier and Type	Method and Description
boolean	equals(java.lang.Object obj)
java.nio.ByteBuffer	getEncryptedKeyMaterial() The encrypted key material to import.
java.lang.String	getExpirationModel() Specifies whether the key material expires.
java.nio.ByteBuffer	getImportToken() The import token that you received in the response to a previous GetParametersForImport request.
java.lang.String	getKeyId() The identifier of the symmetric CMK that receives the imported key material.
java.util.Date	getValidTo() The time at which the imported key material expires.
int	hashCode()
void	setEncryptedKeyMaterial(java.nio.ByteBuffer encryptedKeyMaterial) The encrypted key material to import.
void	setExpirationModel(ExpirationModelType expirationModel) Specifies whether the key material expires.
void	setExpirationModel(java.lang.String expirationModel) Specifies whether the key material expires.
void	setImportToken(java.nio.ByteBuffer importToken) The import token that you received in the response to a previous GetParametersForImport request.
void	setKeyId(java.lang.String keyId) The identifier of the symmetric CMK that receives the imported key material.
void	setValidTo(java.util.Date validTo) The time at which the imported key material expires.
java.lang.String	toString() Returns a string representation of this object; useful for testing and debugging.
ImportKeyMaterialRequest	withEncryptedKeyMaterial(java.nio.ByteBuffer encryptedKeyMaterial) The encrypted key material to import.
ImportKeyMaterialRequest	withExpirationModel(ExpirationModelType expirationModel) Specifies whether the key material expires.
ImportKeyMaterialRequest	withExpirationModel(java.lang.String expirationModel) Specifies whether the key material expires.
ImportKeyMaterialRequest	withImportToken(java.nio.ByteBuffer importToken) The import token that you received in the response to a previous GetParametersForImport request.
ImportKeyMaterialRequest	withKeyId(java.lang.String keyId) The identifier of the symmetric CMK that receives the imported key material.
ImportKeyMaterialRequest	withValidTo(java.util.Date validTo) The time at which the imported key material expires.

Methods inherited from class com.amazonaws.AmazonWebServiceRequest

clone, getCloneRoot, getCloneSource, getGeneralProgressListener, getRequestClientOptions, getRequestCredentials, getRequestMetricCollector, setGeneralProgressListener, setRequestCredentials, setRequestMetricCollector, withGeneralProgressListener, withRequestMetricCollector

Methods inherited from class java.lang.Object

getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

ImportKeyMaterialRequest

public ImportKeyMaterialRequest()

Method Detail

getKeyId

public java.lang.String getKeyId()

The identifier of the symmetric CMK that receives the imported key material. The CMK's Origin must be EXTERNAL. This must be the same CMK specified in the KeyID parameter of the corresponding GetParametersForImport request.

Specify the key ID or the Amazon Resource Name (ARN) of the CMK.

For example:

• Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab

• Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.

Constraints:
Length: 1 - 2048

Returns:

The identifier of the symmetric CMK that receives the imported key material. The CMK's Origin must be EXTERNAL. This must be the same CMK specified in the KeyID parameter of the corresponding GetParametersForImport request.

Specify the key ID or the Amazon Resource Name (ARN) of the CMK.

For example:

• Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab

• Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.

setKeyId

public void setKeyId(java.lang.String keyId)

The identifier of the symmetric CMK that receives the imported key material. The CMK's Origin must be EXTERNAL. This must be the same CMK specified in the KeyID parameter of the corresponding GetParametersForImport request.

Specify the key ID or the Amazon Resource Name (ARN) of the CMK.

For example:

• Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab

• Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.

Constraints:
Length: 1 - 2048

Parameters:

keyId -

The identifier of the symmetric CMK that receives the imported key material. The CMK's Origin must be EXTERNAL. This must be the same CMK specified in the KeyID parameter of the corresponding GetParametersForImport request.

Specify the key ID or the Amazon Resource Name (ARN) of the CMK.

For example:

• Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab

• Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.

withKeyId

public ImportKeyMaterialRequest withKeyId(java.lang.String keyId)

The identifier of the symmetric CMK that receives the imported key material. The CMK's Origin must be EXTERNAL. This must be the same CMK specified in the KeyID parameter of the corresponding GetParametersForImport request.

Specify the key ID or the Amazon Resource Name (ARN) of the CMK.

For example:

• Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab

• Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.

Returns a reference to this object so that method calls can be chained together.

Constraints:
Length: 1 - 2048

Parameters:

keyId -

The identifier of the symmetric CMK that receives the imported key material. The CMK's Origin must be EXTERNAL. This must be the same CMK specified in the KeyID parameter of the corresponding GetParametersForImport request.

Specify the key ID or the Amazon Resource Name (ARN) of the CMK.

For example:

• Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab

• Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.

Returns:

A reference to this updated object so that method calls can be chained together.

getImportToken

public java.nio.ByteBuffer getImportToken()

The import token that you received in the response to a previous GetParametersForImport request. It must be from the same response that contained the public key that you used to encrypt the key material.

Constraints:
Length: 1 - 6144

Returns:

The import token that you received in the response to a previous GetParametersForImport request. It must be from the same response that contained the public key that you used to encrypt the key material.

setImportToken

public void setImportToken(java.nio.ByteBuffer importToken)

The import token that you received in the response to a previous GetParametersForImport request. It must be from the same response that contained the public key that you used to encrypt the key material.

Constraints:
Length: 1 - 6144

Parameters:

importToken -

The import token that you received in the response to a previous GetParametersForImport request. It must be from the same response that contained the public key that you used to encrypt the key material.

withImportToken

public ImportKeyMaterialRequest withImportToken(java.nio.ByteBuffer importToken)

The import token that you received in the response to a previous GetParametersForImport request. It must be from the same response that contained the public key that you used to encrypt the key material.

Returns a reference to this object so that method calls can be chained together.

Constraints:
Length: 1 - 6144

Parameters:

importToken -

The import token that you received in the response to a previous GetParametersForImport request. It must be from the same response that contained the public key that you used to encrypt the key material.

Returns:

A reference to this updated object so that method calls can be chained together.

getEncryptedKeyMaterial

public java.nio.ByteBuffer getEncryptedKeyMaterial()

The encrypted key material to import. The key material must be encrypted with the public wrapping key that GetParametersForImport returned, using the wrapping algorithm that you specified in the same GetParametersForImport request.

Constraints:
Length: 1 - 6144

Returns:

The encrypted key material to import. The key material must be encrypted with the public wrapping key that GetParametersForImport returned, using the wrapping algorithm that you specified in the same GetParametersForImport request.

setEncryptedKeyMaterial

public void setEncryptedKeyMaterial(java.nio.ByteBuffer encryptedKeyMaterial)

The encrypted key material to import. The key material must be encrypted with the public wrapping key that GetParametersForImport returned, using the wrapping algorithm that you specified in the same GetParametersForImport request.

Constraints:
Length: 1 - 6144

Parameters:

encryptedKeyMaterial -

The encrypted key material to import. The key material must be encrypted with the public wrapping key that GetParametersForImport returned, using the wrapping algorithm that you specified in the same GetParametersForImport request.

withEncryptedKeyMaterial

public ImportKeyMaterialRequest withEncryptedKeyMaterial(java.nio.ByteBuffer encryptedKeyMaterial)

The encrypted key material to import. The key material must be encrypted with the public wrapping key that GetParametersForImport returned, using the wrapping algorithm that you specified in the same GetParametersForImport request.

Returns a reference to this object so that method calls can be chained together.

Constraints:
Length: 1 - 6144

Parameters:

encryptedKeyMaterial -

The encrypted key material to import. The key material must be encrypted with the public wrapping key that GetParametersForImport returned, using the wrapping algorithm that you specified in the same GetParametersForImport request.

Returns:

A reference to this updated object so that method calls can be chained together.

getValidTo

public java.util.Date getValidTo()

The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. You must omit this parameter when the ExpirationModel parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE. Otherwise it is required.

Returns:

The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. You must omit this parameter when the ExpirationModel parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE. Otherwise it is required.

setValidTo

public void setValidTo(java.util.Date validTo)

The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. You must omit this parameter when the ExpirationModel parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE. Otherwise it is required.

Parameters:

validTo -

The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. You must omit this parameter when the ExpirationModel parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE. Otherwise it is required.

withValidTo

public ImportKeyMaterialRequest withValidTo(java.util.Date validTo)

The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. You must omit this parameter when the ExpirationModel parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE. Otherwise it is required.

Returns a reference to this object so that method calls can be chained together.

Parameters:

validTo -

The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. You must omit this parameter when the ExpirationModel parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE. Otherwise it is required.

Returns:

A reference to this updated object so that method calls can be chained together.

getExpirationModel

public java.lang.String getExpirationModel()

Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES, in which case you must include the ValidTo parameter. When this parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.

Constraints:
Allowed Values: KEY_MATERIAL_EXPIRES, KEY_MATERIAL_DOES_NOT_EXPIRE

Returns:

Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES, in which case you must include the ValidTo parameter. When this parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.

See Also:

ExpirationModelType

setExpirationModel

public void setExpirationModel(java.lang.String expirationModel)

Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES, in which case you must include the ValidTo parameter. When this parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.

Constraints:
Allowed Values: KEY_MATERIAL_EXPIRES, KEY_MATERIAL_DOES_NOT_EXPIRE

Parameters:

expirationModel -

Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES, in which case you must include the ValidTo parameter. When this parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.

See Also:

ExpirationModelType

withExpirationModel

public ImportKeyMaterialRequest withExpirationModel(java.lang.String expirationModel)

Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES, in which case you must include the ValidTo parameter. When this parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.

Returns a reference to this object so that method calls can be chained together.

Constraints:
Allowed Values: KEY_MATERIAL_EXPIRES, KEY_MATERIAL_DOES_NOT_EXPIRE

Parameters:

expirationModel -

Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES, in which case you must include the ValidTo parameter. When this parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.

Returns:

A reference to this updated object so that method calls can be chained together.

See Also:

ExpirationModelType

setExpirationModel

public void setExpirationModel(ExpirationModelType expirationModel)

Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES, in which case you must include the ValidTo parameter. When this parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.

Constraints:
Allowed Values: KEY_MATERIAL_EXPIRES, KEY_MATERIAL_DOES_NOT_EXPIRE

Parameters:

expirationModel -

Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES, in which case you must include the ValidTo parameter. When this parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.

See Also:

ExpirationModelType

withExpirationModel

public ImportKeyMaterialRequest withExpirationModel(ExpirationModelType expirationModel)

Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES, in which case you must include the ValidTo parameter. When this parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.

Returns a reference to this object so that method calls can be chained together.

Constraints:
Allowed Values: KEY_MATERIAL_EXPIRES, KEY_MATERIAL_DOES_NOT_EXPIRE

Parameters:

expirationModel -

Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES, in which case you must include the ValidTo parameter. When this parameter is set to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.

Returns:

A reference to this updated object so that method calls can be chained together.

See Also:

ExpirationModelType

toString

public java.lang.String toString()

Returns a string representation of this object; useful for testing and debugging.

Overrides:

toString in class java.lang.Object

Returns:

A string representation of this object.

See Also:

Object.toString()

hashCode

public int hashCode()

Overrides:

hashCode in class java.lang.Object

equals

public boolean equals(java.lang.Object obj)

Overrides:

equals in class java.lang.Object