Classes Reference


                    
                    
                    AWSKMSAliasListEntry

Contains information about an alias.

Declaration

Objective-C

@interface AWSKMSAliasListEntry

Swift

class AWSKMSAliasListEntry


                    
                    
                    AWSKMSCancelKeyDeletionRequest

Declaration

Objective-C

@interface AWSKMSCancelKeyDeletionRequest

Swift

class AWSKMSCancelKeyDeletionRequest


                    
                    
                    AWSKMSCancelKeyDeletionResponse

Declaration

Objective-C

@interface AWSKMSCancelKeyDeletionResponse

Swift

class AWSKMSCancelKeyDeletionResponse


                    
                    
                    AWSKMSConnectCustomKeyStoreRequest

Declaration

Objective-C

@interface AWSKMSConnectCustomKeyStoreRequest

Swift

class AWSKMSConnectCustomKeyStoreRequest


                    
                    
                    AWSKMSConnectCustomKeyStoreResponse

Declaration

Objective-C

@interface AWSKMSConnectCustomKeyStoreResponse

Swift

class AWSKMSConnectCustomKeyStoreResponse


                    
                    
                    AWSKMSCreateAliasRequest

Declaration

Objective-C

@interface AWSKMSCreateAliasRequest

Swift

class AWSKMSCreateAliasRequest


                    
                    
                    AWSKMSCreateCustomKeyStoreRequest

Declaration

Objective-C

@interface AWSKMSCreateCustomKeyStoreRequest

Swift

class AWSKMSCreateCustomKeyStoreRequest


                    
                    
                    AWSKMSCreateCustomKeyStoreResponse

Declaration

Objective-C

@interface AWSKMSCreateCustomKeyStoreResponse

Swift

class AWSKMSCreateCustomKeyStoreResponse


                    
                    
                    AWSKMSCreateGrantRequest

Declaration

Objective-C

@interface AWSKMSCreateGrantRequest

Swift

class AWSKMSCreateGrantRequest


                    
                    
                    AWSKMSCreateGrantResponse

Declaration

Objective-C

@interface AWSKMSCreateGrantResponse

Swift

class AWSKMSCreateGrantResponse


                    
                    
                    AWSKMSCreateKeyRequest

Declaration

Objective-C

@interface AWSKMSCreateKeyRequest

Swift

class AWSKMSCreateKeyRequest


                    
                    
                    AWSKMSCreateKeyResponse

Declaration

Objective-C

@interface AWSKMSCreateKeyResponse

Swift

class AWSKMSCreateKeyResponse


                    
                    
                    AWSKMSCustomKeyStoresListEntry

Contains information about each custom key store in the custom key store list.

Declaration

Objective-C

@interface AWSKMSCustomKeyStoresListEntry

Swift

class AWSKMSCustomKeyStoresListEntry


                    
                    
                    AWSKMSDecryptRequest

Declaration

Objective-C

@interface AWSKMSDecryptRequest

Swift

class AWSKMSDecryptRequest


                    
                    
                    AWSKMSDecryptResponse

Declaration

Objective-C

@interface AWSKMSDecryptResponse

Swift

class AWSKMSDecryptResponse


                    
                    
                    AWSKMSDeleteAliasRequest

Declaration

Objective-C

@interface AWSKMSDeleteAliasRequest

Swift

class AWSKMSDeleteAliasRequest


                    
                    
                    AWSKMSDeleteCustomKeyStoreRequest

Declaration

Objective-C

@interface AWSKMSDeleteCustomKeyStoreRequest

Swift

class AWSKMSDeleteCustomKeyStoreRequest


                    
                    
                    AWSKMSDeleteCustomKeyStoreResponse

Declaration

Objective-C

@interface AWSKMSDeleteCustomKeyStoreResponse

Swift

class AWSKMSDeleteCustomKeyStoreResponse


                    
                    
                    AWSKMSDeleteImportedKeyMaterialRequest

Declaration

Objective-C

@interface AWSKMSDeleteImportedKeyMaterialRequest

Swift

class AWSKMSDeleteImportedKeyMaterialRequest


                    
                    
                    AWSKMSDeriveSharedSecretRequest

Declaration

Objective-C

@interface AWSKMSDeriveSharedSecretRequest

Swift

class AWSKMSDeriveSharedSecretRequest


                    
                    
                    AWSKMSDeriveSharedSecretResponse

Declaration

Objective-C

@interface AWSKMSDeriveSharedSecretResponse

Swift

class AWSKMSDeriveSharedSecretResponse


                    
                    
                    AWSKMSDescribeCustomKeyStoresRequest

Declaration

Objective-C

@interface AWSKMSDescribeCustomKeyStoresRequest

Swift

class AWSKMSDescribeCustomKeyStoresRequest


                    
                    
                    AWSKMSDescribeCustomKeyStoresResponse

Declaration

Objective-C

@interface AWSKMSDescribeCustomKeyStoresResponse

Swift

class AWSKMSDescribeCustomKeyStoresResponse


                    
                    
                    AWSKMSDescribeKeyRequest

Declaration

Objective-C

@interface AWSKMSDescribeKeyRequest

Swift

class AWSKMSDescribeKeyRequest


                    
                    
                    AWSKMSDescribeKeyResponse

Declaration

Objective-C

@interface AWSKMSDescribeKeyResponse

Swift

class AWSKMSDescribeKeyResponse


                    
                    
                    AWSKMSDisableKeyRequest

Declaration

Objective-C

@interface AWSKMSDisableKeyRequest

Swift

class AWSKMSDisableKeyRequest


                    
                    
                    AWSKMSDisableKeyRotationRequest

Declaration

Objective-C

@interface AWSKMSDisableKeyRotationRequest

Swift

class AWSKMSDisableKeyRotationRequest


                    
                    
                    AWSKMSDisconnectCustomKeyStoreRequest

Declaration

Objective-C

@interface AWSKMSDisconnectCustomKeyStoreRequest

Swift

class AWSKMSDisconnectCustomKeyStoreRequest


                    
                    
                    AWSKMSDisconnectCustomKeyStoreResponse

Declaration

Objective-C

@interface AWSKMSDisconnectCustomKeyStoreResponse

Swift

class AWSKMSDisconnectCustomKeyStoreResponse


                    
                    
                    AWSKMSEnableKeyRequest

Declaration

Objective-C

@interface AWSKMSEnableKeyRequest

Swift

class AWSKMSEnableKeyRequest


                    
                    
                    AWSKMSEnableKeyRotationRequest

Declaration

Objective-C

@interface AWSKMSEnableKeyRotationRequest

Swift

class AWSKMSEnableKeyRotationRequest


                    
                    
                    AWSKMSEncryptRequest

Declaration

Objective-C

@interface AWSKMSEncryptRequest

Swift

class AWSKMSEncryptRequest


                    
                    
                    AWSKMSEncryptResponse

Declaration

Objective-C

@interface AWSKMSEncryptResponse

Swift

class AWSKMSEncryptResponse


                    
                    
                    AWSKMSGenerateDataKeyPairRequest

Declaration

Objective-C

@interface AWSKMSGenerateDataKeyPairRequest

Swift

class AWSKMSGenerateDataKeyPairRequest


                    
                    
                    AWSKMSGenerateDataKeyPairResponse

Declaration

Objective-C

@interface AWSKMSGenerateDataKeyPairResponse

Swift

class AWSKMSGenerateDataKeyPairResponse


                    
                    
                    AWSKMSGenerateDataKeyPairWithoutPlaintextRequest

Declaration

Objective-C

@interface AWSKMSGenerateDataKeyPairWithoutPlaintextRequest

Swift

class AWSKMSGenerateDataKeyPairWithoutPlaintextRequest


                    
                    
                    AWSKMSGenerateDataKeyPairWithoutPlaintextResponse

Declaration

Objective-C

@interface AWSKMSGenerateDataKeyPairWithoutPlaintextResponse

Swift

class AWSKMSGenerateDataKeyPairWithoutPlaintextResponse


                    
                    
                    AWSKMSGenerateDataKeyRequest

Declaration

Objective-C

@interface AWSKMSGenerateDataKeyRequest

Swift

class AWSKMSGenerateDataKeyRequest


                    
                    
                    AWSKMSGenerateDataKeyResponse

Declaration

Objective-C

@interface AWSKMSGenerateDataKeyResponse

Swift

class AWSKMSGenerateDataKeyResponse


                    
                    
                    AWSKMSGenerateDataKeyWithoutPlaintextRequest

Declaration

Objective-C

@interface AWSKMSGenerateDataKeyWithoutPlaintextRequest

Swift

class AWSKMSGenerateDataKeyWithoutPlaintextRequest


                    
                    
                    AWSKMSGenerateDataKeyWithoutPlaintextResponse

Declaration

Objective-C

@interface AWSKMSGenerateDataKeyWithoutPlaintextResponse

Swift

class AWSKMSGenerateDataKeyWithoutPlaintextResponse


                    
                    
                    AWSKMSGenerateMacRequest

Declaration

Objective-C

@interface AWSKMSGenerateMacRequest

Swift

class AWSKMSGenerateMacRequest


                    
                    
                    AWSKMSGenerateMacResponse

Declaration

Objective-C

@interface AWSKMSGenerateMacResponse

Swift

class AWSKMSGenerateMacResponse


                    
                    
                    AWSKMSGenerateRandomRequest

Declaration

Objective-C

@interface AWSKMSGenerateRandomRequest

Swift

class AWSKMSGenerateRandomRequest


                    
                    
                    AWSKMSGenerateRandomResponse

Declaration

Objective-C

@interface AWSKMSGenerateRandomResponse

Swift

class AWSKMSGenerateRandomResponse


                    
                    
                    AWSKMSGetKeyPolicyRequest

Declaration

Objective-C

@interface AWSKMSGetKeyPolicyRequest

Swift

class AWSKMSGetKeyPolicyRequest


                    
                    
                    AWSKMSGetKeyPolicyResponse

Declaration

Objective-C

@interface AWSKMSGetKeyPolicyResponse

Swift

class AWSKMSGetKeyPolicyResponse


                    
                    
                    AWSKMSGetKeyRotationStatusRequest

Declaration

Objective-C

@interface AWSKMSGetKeyRotationStatusRequest

Swift

class AWSKMSGetKeyRotationStatusRequest


                    
                    
                    AWSKMSGetKeyRotationStatusResponse

Declaration

Objective-C

@interface AWSKMSGetKeyRotationStatusResponse

Swift

class AWSKMSGetKeyRotationStatusResponse


                    
                    
                    AWSKMSGetParametersForImportRequest

Declaration

Objective-C

@interface AWSKMSGetParametersForImportRequest

Swift

class AWSKMSGetParametersForImportRequest


                    
                    
                    AWSKMSGetParametersForImportResponse

Declaration

Objective-C

@interface AWSKMSGetParametersForImportResponse

Swift

class AWSKMSGetParametersForImportResponse


                    
                    
                    AWSKMSGetPublicKeyRequest

Declaration

Objective-C

@interface AWSKMSGetPublicKeyRequest

Swift

class AWSKMSGetPublicKeyRequest


                    
                    
                    AWSKMSGetPublicKeyResponse

Declaration

Objective-C

@interface AWSKMSGetPublicKeyResponse

Swift

class AWSKMSGetPublicKeyResponse


                    
                    
                    AWSKMSGrantConstraints

Use this structure to allow cryptographic operations in the grant only when the operation request includes the specified encryption context.

KMS applies the grant constraints only to cryptographic operations that support an encryption context, that is, all cryptographic operations with a symmetric KMS key. Grant constraints are not applied to operations that do not support an encryption context, such as cryptographic operations with asymmetric KMS keys and management operations, such as DescribeKey or RetireGrant.

In a cryptographic operation, the encryption context in the decryption operation must be an exact, case-sensitive match for the keys and values in the encryption context of the encryption operation. Only the order of the pairs can vary.

However, in a grant constraint, the key in each key-value pair is not case sensitive, but the value is case sensitive.

To avoid confusion, do not use multiple encryption context pairs that differ only by case. To require a fully case-sensitive encryption context, use the kms:EncryptionContext: and kms:EncryptionContextKeys conditions in an IAM or key policy. For details, see kms:EncryptionContext: in the Key Management Service Developer Guide.

Declaration

Objective-C

@interface AWSKMSGrantConstraints

Swift

class AWSKMSGrantConstraints


                    
                    
                    AWSKMSGrantListEntry

Contains information about a grant.

Declaration

Objective-C

@interface AWSKMSGrantListEntry

Swift

class AWSKMSGrantListEntry


                    
                    
                    AWSKMSImportKeyMaterialRequest

Declaration

Objective-C

@interface AWSKMSImportKeyMaterialRequest

Swift

class AWSKMSImportKeyMaterialRequest


                    
                    
                    AWSKMSImportKeyMaterialResponse

Declaration

Objective-C

@interface AWSKMSImportKeyMaterialResponse

Swift

class AWSKMSImportKeyMaterialResponse


                    
                    
                    AWSKMSKeyListEntry

Contains information about each entry in the key list.

Declaration

Objective-C

@interface AWSKMSKeyListEntry

Swift

class AWSKMSKeyListEntry


                    
                    
                    AWSKMSKeyMetadata

Contains metadata about a KMS key.

This data type is used as a response element for the CreateKey, DescribeKey, and ReplicateKey operations.

Required parameters: [KeyId]

Declaration

Objective-C

@interface AWSKMSKeyMetadata

Swift

class AWSKMSKeyMetadata


                    
                    
                    AWSKMSListAliasesRequest

Declaration

Objective-C

@interface AWSKMSListAliasesRequest

Swift

class AWSKMSListAliasesRequest


                    
                    
                    AWSKMSListAliasesResponse

Declaration

Objective-C

@interface AWSKMSListAliasesResponse

Swift

class AWSKMSListAliasesResponse


                    
                    
                    AWSKMSListGrantsRequest

Declaration

Objective-C

@interface AWSKMSListGrantsRequest

Swift

class AWSKMSListGrantsRequest


                    
                    
                    AWSKMSListGrantsResponse

Declaration

Objective-C

@interface AWSKMSListGrantsResponse

Swift

class AWSKMSListGrantsResponse


                    
                    
                    AWSKMSListKeyPoliciesRequest

Declaration

Objective-C

@interface AWSKMSListKeyPoliciesRequest

Swift

class AWSKMSListKeyPoliciesRequest


                    
                    
                    AWSKMSListKeyPoliciesResponse

Declaration

Objective-C

@interface AWSKMSListKeyPoliciesResponse

Swift

class AWSKMSListKeyPoliciesResponse


                    
                    
                    AWSKMSListKeyRotationsRequest

Declaration

Objective-C

@interface AWSKMSListKeyRotationsRequest

Swift

class AWSKMSListKeyRotationsRequest


                    
                    
                    AWSKMSListKeyRotationsResponse

Declaration

Objective-C

@interface AWSKMSListKeyRotationsResponse

Swift

class AWSKMSListKeyRotationsResponse


                    
                    
                    AWSKMSListKeysRequest

Declaration

Objective-C

@interface AWSKMSListKeysRequest

Swift

class AWSKMSListKeysRequest


                    
                    
                    AWSKMSListKeysResponse

Declaration

Objective-C

@interface AWSKMSListKeysResponse

Swift

class AWSKMSListKeysResponse


                    
                    
                    AWSKMSListResourceTagsRequest

Declaration

Objective-C

@interface AWSKMSListResourceTagsRequest

Swift

class AWSKMSListResourceTagsRequest


                    
                    
                    AWSKMSListResourceTagsResponse

Declaration

Objective-C

@interface AWSKMSListResourceTagsResponse

Swift

class AWSKMSListResourceTagsResponse


                    
                    
                    AWSKMSListRetirableGrantsRequest

Declaration

Objective-C

@interface AWSKMSListRetirableGrantsRequest

Swift

class AWSKMSListRetirableGrantsRequest


                    
                    
                    AWSKMSMultiRegionConfiguration

Describes the configuration of this multi-Region key. This field appears only when the KMS key is a primary or replica of a multi-Region key.

For more information about any listed KMS key, use the DescribeKey operation.

Declaration

Objective-C

@interface AWSKMSMultiRegionConfiguration

Swift

class AWSKMSMultiRegionConfiguration


                    
                    
                    AWSKMSMultiRegionKey

Describes the primary or replica key in a multi-Region key.

Declaration

Objective-C

@interface AWSKMSMultiRegionKey

Swift

class AWSKMSMultiRegionKey


                    
                    
                    AWSKMSPutKeyPolicyRequest

Declaration

Objective-C

@interface AWSKMSPutKeyPolicyRequest

Swift

class AWSKMSPutKeyPolicyRequest


                    
                    
                    AWSKMSReEncryptRequest

Declaration

Objective-C

@interface AWSKMSReEncryptRequest

Swift

class AWSKMSReEncryptRequest


                    
                    
                    AWSKMSReEncryptResponse

Declaration

Objective-C

@interface AWSKMSReEncryptResponse

Swift

class AWSKMSReEncryptResponse


                    
                    
                    AWSKMSRecipientInfo

Contains information about the party that receives the response from the API operation.

This data type is designed to support Amazon Web Services Nitro Enclaves, which lets you create an isolated compute environment in Amazon EC2. For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses KMS in the Key Management Service Developer Guide.

Declaration

Objective-C

@interface AWSKMSRecipientInfo

Swift

class AWSKMSRecipientInfo


                    
                    
                    AWSKMSReplicateKeyRequest

Declaration

Objective-C

@interface AWSKMSReplicateKeyRequest

Swift

class AWSKMSReplicateKeyRequest


                    
                    
                    AWSKMSReplicateKeyResponse

Declaration

Objective-C

@interface AWSKMSReplicateKeyResponse

Swift

class AWSKMSReplicateKeyResponse


                    
                    
                    AWSKMSRetireGrantRequest

Declaration

Objective-C

@interface AWSKMSRetireGrantRequest

Swift

class AWSKMSRetireGrantRequest


                    
                    
                    AWSKMSRevokeGrantRequest

Declaration

Objective-C

@interface AWSKMSRevokeGrantRequest

Swift

class AWSKMSRevokeGrantRequest


                    
                    
                    AWSKMSRotateKeyOnDemandRequest

Declaration

Objective-C

@interface AWSKMSRotateKeyOnDemandRequest

Swift

class AWSKMSRotateKeyOnDemandRequest


                    
                    
                    AWSKMSRotateKeyOnDemandResponse

Declaration

Objective-C

@interface AWSKMSRotateKeyOnDemandResponse

Swift

class AWSKMSRotateKeyOnDemandResponse


                    
                    
                    AWSKMSRotationsListEntry

Contains information about completed key material rotations.

Declaration

Objective-C

@interface AWSKMSRotationsListEntry

Swift

class AWSKMSRotationsListEntry


                    
                    
                    AWSKMSScheduleKeyDeletionRequest

Declaration

Objective-C

@interface AWSKMSScheduleKeyDeletionRequest

Swift

class AWSKMSScheduleKeyDeletionRequest


                    
                    
                    AWSKMSScheduleKeyDeletionResponse

Declaration

Objective-C

@interface AWSKMSScheduleKeyDeletionResponse

Swift

class AWSKMSScheduleKeyDeletionResponse


                    
                    
                    AWSKMSSignRequest

Declaration

Objective-C

@interface AWSKMSSignRequest

Swift

class AWSKMSSignRequest


                    
                    
                    AWSKMSSignResponse

Declaration

Objective-C

@interface AWSKMSSignResponse

Swift

class AWSKMSSignResponse


                    
                    
                    AWSKMSTag

A key-value pair. A tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.

Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.

For information about the rules that apply to tag keys and tag values, see User-Defined Tag Restrictions in the Amazon Web Services Billing and Cost Management User Guide.

Required parameters: [TagKey, TagValue]

Declaration

Objective-C

@interface AWSKMSTag

Swift

class AWSKMSTag


                    
                    
                    AWSKMSTagResourceRequest

Declaration

Objective-C

@interface AWSKMSTagResourceRequest

Swift

class AWSKMSTagResourceRequest


                    
                    
                    AWSKMSUntagResourceRequest

Declaration

Objective-C

@interface AWSKMSUntagResourceRequest

Swift

class AWSKMSUntagResourceRequest


                    
                    
                    AWSKMSUpdateAliasRequest

Declaration

Objective-C

@interface AWSKMSUpdateAliasRequest

Swift

class AWSKMSUpdateAliasRequest


                    
                    
                    AWSKMSUpdateCustomKeyStoreRequest

Declaration

Objective-C

@interface AWSKMSUpdateCustomKeyStoreRequest

Swift

class AWSKMSUpdateCustomKeyStoreRequest


                    
                    
                    AWSKMSUpdateCustomKeyStoreResponse

Declaration

Objective-C

@interface AWSKMSUpdateCustomKeyStoreResponse

Swift

class AWSKMSUpdateCustomKeyStoreResponse


                    
                    
                    AWSKMSUpdateKeyDescriptionRequest

Declaration

Objective-C

@interface AWSKMSUpdateKeyDescriptionRequest

Swift

class AWSKMSUpdateKeyDescriptionRequest


                    
                    
                    AWSKMSUpdatePrimaryRegionRequest

Declaration

Objective-C

@interface AWSKMSUpdatePrimaryRegionRequest

Swift

class AWSKMSUpdatePrimaryRegionRequest


                    
                    
                    AWSKMSVerifyMacRequest

Declaration

Objective-C

@interface AWSKMSVerifyMacRequest

Swift

class AWSKMSVerifyMacRequest


                    
                    
                    AWSKMSVerifyMacResponse

Declaration

Objective-C

@interface AWSKMSVerifyMacResponse

Swift

class AWSKMSVerifyMacResponse


                    
                    
                    AWSKMSVerifyRequest

Declaration

Objective-C

@interface AWSKMSVerifyRequest

Swift

class AWSKMSVerifyRequest


                    
                    
                    AWSKMSVerifyResponse

Declaration

Objective-C

@interface AWSKMSVerifyResponse

Swift

class AWSKMSVerifyResponse


                    
                    
                    AWSKMSXksKeyConfigurationType

Information about the external key that is associated with a KMS key in an external key store.

This element appears in a CreateKey or DescribeKey response only for a KMS key in an external key store.

The external key is a symmetric encryption key that is hosted by an external key manager outside of Amazon Web Services. When you use the KMS key in an external key store in a cryptographic operation, the cryptographic operation is performed in the external key manager using the specified external key. For more information, see External key in the Key Management Service Developer Guide.

Declaration

Objective-C

@interface AWSKMSXksKeyConfigurationType

Swift

class AWSKMSXksKeyConfigurationType


                    
                    
                    AWSKMSXksProxyAuthenticationCredentialType

KMS uses the authentication credential to sign requests that it sends to the external key store proxy (XKS proxy) on your behalf. You establish these credentials on your external key store proxy and report them to KMS.

The XksProxyAuthenticationCredential includes two required elements.

Required parameters: [AccessKeyId, RawSecretAccessKey]

Declaration

Objective-C

@interface AWSKMSXksProxyAuthenticationCredentialType

Swift

class AWSKMSXksProxyAuthenticationCredentialType


                    
                    
                    AWSKMSXksProxyConfigurationType

Detailed information about the external key store proxy (XKS proxy). Your external key store proxy translates KMS requests into a format that your external key manager can understand. These fields appear in a DescribeCustomKeyStores response only when the CustomKeyStoreType is EXTERNAL_KEY_STORE.

Declaration

Objective-C

@interface AWSKMSXksProxyConfigurationType

Swift

class AWSKMSXksProxyConfigurationType


                    
                    
                    AWSKMSResources

Undocumented

Declaration

Objective-C

@interface AWSKMSResources : NSObject

+ (instancetype)sharedInstance;

- (NSDictionary *)JSONObject;

@end

Swift

class AWSKMSResources : NSObject


                    
                    
                    AWSKMS

Key Management Service

Key Management Service (KMS) is an encryption and key management web service. This guide describes the KMS operations that you can call programmatically. For general information about KMS, see the Key Management Service Developer Guide.

KMS has replaced the term customer master key (CMK) with KMS key and KMS key. The concept has not changed. To prevent breaking changes, KMS is keeping some variations of this term.

Amazon Web Services provides SDKs that consist of libraries and sample code for various programming languages and platforms (Java, Ruby, .Net, macOS, Android, etc.). The SDKs provide a convenient way to create programmatic access to KMS and other Amazon Web Services services. For example, the SDKs take care of tasks such as signing requests (see below), managing errors, and retrying requests automatically. For more information about the Amazon Web Services SDKs, including how to download and install them, see Tools for Amazon Web Services.

We recommend that you use the Amazon Web Services SDKs to make programmatic API calls to KMS.

If you need to use FIPS 140-2 validated cryptographic modules when communicating with Amazon Web Services, use the FIPS endpoint in your preferred Amazon Web Services Region. For more information about the available FIPS endpoints, see Service endpoints in the Key Management Service topic of the Amazon Web Services General Reference.

All KMS API calls must be signed and be transmitted using Transport Layer Security (TLS). KMS recommends you always use the latest supported TLS version. Clients must also support cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems such as Java 7 and later support these modes.

Signing Requests

Requests must be signed using an access key ID and a secret access key. We strongly recommend that you do not use your Amazon Web Services account root access key ID and secret access key for everyday work. You can use the access key ID and secret access key for an IAM user or you can use the Security Token Service (STS) to generate temporary security credentials and use those to sign requests.

All KMS requests must be signed with Signature Version 4.

Logging API Requests

KMS supports CloudTrail, a service that logs Amazon Web Services API calls and related events for your Amazon Web Services account and delivers them to an Amazon S3 bucket that you specify. By using the information collected by CloudTrail, you can determine what requests were made to KMS, who made the request, when it was made, and so on. To learn more about CloudTrail, including how to turn it on and find your log files, see the CloudTrail User Guide.

Additional Resources

For more information about credentials and request signing, see the following:

Amazon Web Services Security Credentials - This topic provides general information about the types of credentials used to access Amazon Web Services.
Temporary Security Credentials - This section of the IAM User Guide describes how to create and use temporary security credentials.
Signature Version 4 Signing Process - This set of topics walks you through the process of signing a request using an access key ID and a secret access key.

Commonly Used API Operations

Of the API operations discussed in this guide, the following will prove the most useful for most applications. You will likely perform operations other than these, such as creating keys and assigning policies, by using the console.

Encrypt
Decrypt
GenerateDataKey
GenerateDataKeyWithoutPlaintext

Declaration

Objective-C

@interface AWSKMS

Swift

class AWSKMS