Skip to content
AWS for Query.Farm

aws.kms.describe_key

Example SQL Queries

SELECT * FROM
aws.kms.describe_key
WHERE
"key_id" = 'VALUE';

Description

Provides detailed information about a KMS key. You can run DescribeKey on a customer managed key or an Amazon Web Services managed key.

This detailed information includes the key ARN, creation date (and deletion date, if applicable), the key state, and the origin and expiration date (if any) of the key material. It includes fields, like KeySpec, that help you distinguish different types of KMS keys. It also displays the key usage (encryption, signing, or generating and verifying MACs) and the algorithms that the KMS key supports.

For multi-Region keys, DescribeKey displays the primary key and all related replica keys. For KMS keys in CloudHSM key stores, it includes information about the key store, such as the key store ID and the CloudHSM cluster ID. For KMS keys in external key stores, it includes the custom key store ID and the ID of the external key.

DescribeKey does not return the following information:

  • Aliases associated with the KMS key. To get this information, use ListAliases.

  • Whether automatic key rotation is enabled on the KMS key. To get this information, use GetKeyRotationStatus. Also, some key states prevent a KMS key from being automatically rotated. For details, see How Automatic Key Rotation Works in the Key Management Service Developer Guide.

  • Tags on the KMS key. To get this information, use ListResourceTags.

  • Key policies and grants on the KMS key. To get this information, use GetKeyPolicy and ListGrants.

In general, DescribeKey is a non-mutating operation. It returns data about KMS keys, but doesn't change them. However, Amazon Web Services services use DescribeKey to create Amazon Web Services managed keys from a predefined Amazon Web Services alias with no key ID.

Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter.

Required permissions: kms:DescribeKey (key policy)

Related operations:

Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.

Table Definition

Column NameColumn Data Type
key_id Required Input Column

Describes the specified KMS key.

If you specify a predefined Amazon Web Services alias (an Amazon Web Services alias with no key ID), KMS associates the alias with an Amazon Web Services managed key and returns its KeyId and Arn in the response.

To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.

For example:

  • Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab

  • Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

  • Alias name: alias/ExampleAlias

  • Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias

To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey. To get the alias name and alias ARN, use ListAliases.

VARCHAR
grant_tokens Input Column

A list of grant tokens.

Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved eventual consistency. For more information, see Grant token and Using a grant token in the Key Management Service Developer Guide.

VARCHAR[]
Show child fields
grant_tokens[]
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
key_metadata

Metadata associated with the key.

STRUCT(
    "aws_account_id" VARCHAR,
    "key_id" VARCHAR,
    "arn" VARCHAR,
    "creation_date" TIMESTAMP_S,
    "enabled" BOOLEAN,
    "description" VARCHAR,
    "key_usage" VARCHAR,
    "key_state" VARCHAR,
    "deletion_date" TIMESTAMP_S,
    "valid_to" TIMESTAMP_S,
    "origin" VARCHAR,
    "custom_key_store_id" VARCHAR,
    "cloud_hsm_cluster_id" VARCHAR,
    "expiration_model" VARCHAR,
    "key_manager" VARCHAR,
    "customer_master_key_spec" VARCHAR,
    "key_spec" VARCHAR,
    "encryption_algorithms" VARCHAR[],
    "signing_algorithms" VARCHAR[],
    "key_agreement_algorithms" VARCHAR[],
    "multi_region" BOOLEAN,
    "multi_region_configuration" STRUCT(
        "multi_region_key_type" VARCHAR,
        "primary_key" STRUCT(
            "arn" VARCHAR,
            "region" VARCHAR
        ),
        "replica_keys" STRUCT(
            "arn" VARCHAR,
            "region" VARCHAR
        )[]
    ),
    "pending_deletion_window_in_days" BIGINT,
    "mac_algorithms" VARCHAR[],
    "xks_key_configuration" STRUCT(
        "id" VARCHAR
    )
)
Show child fields
key_metadata.arn

The Amazon Resource Name (ARN) of the KMS key. For examples, see Key Management Service (KMS) in the Example ARNs section of the Amazon Web Services General Reference.

key_metadata.aws_account_id

The twelve-digit account ID of the Amazon Web Services account that owns the KMS key.

key_metadata.cloud_hsm_cluster_id

The cluster ID of the CloudHSM cluster that contains the key material for the KMS key. When you create a KMS key in an CloudHSM custom key store, KMS creates the key material for the KMS key in the associated CloudHSM cluster. This field is present only when the KMS key is created in an CloudHSM key store.

key_metadata.creation_date

The date and time when the KMS key was created.

key_metadata.custom_key_store_id

A unique identifier for the custom key store that contains the KMS key. This field is present only when the KMS key is created in a custom key store.

key_metadata.customer_master_key_spec

Instead, use the KeySpec field.

The KeySpec and CustomerMasterKeySpec fields have the same value. We recommend that you use the KeySpec field in your code. However, to avoid breaking changes, KMS supports both fields.

key_metadata.deletion_date

The date and time after which KMS deletes this KMS key. This value is present only when the KMS key is scheduled for deletion, that is, when its KeyState is PendingDeletion.

When the primary key in a multi-Region key is scheduled for deletion but still has replica keys, its key state is PendingReplicaDeletion and the length of its waiting period is displayed in the PendingDeletionWindowInDays field.

key_metadata.description

The description of the KMS key.

key_metadata.enabled

Specifies whether the KMS key is enabled. When KeyState is Enabled this value is true, otherwise it is false.

key_metadata.encryption_algorithms[]
key_metadata.expiration_model

Specifies whether the KMS key's key material expires. This value is present only when Origin is EXTERNAL, otherwise this value is omitted.

key_metadata.key_agreement_algorithms[]
key_metadata.key_id

The globally unique identifier for the KMS key.

key_metadata.key_manager

The manager of the KMS key. KMS keys in your Amazon Web Services account are either customer managed or Amazon Web Services managed. For more information about the difference, see KMS keys in the Key Management Service Developer Guide.

key_metadata.key_spec

Describes the type of key material in the KMS key.

key_metadata.key_state

The current status of the KMS key.

For more information about how key state affects the use of a KMS key, see Key states of KMS keys in the Key Management Service Developer Guide.

key_metadata.key_usage

The cryptographic operations for which you can use the KMS key.

key_metadata.mac_algorithms[]
key_metadata.multi_region

Indicates whether the KMS key is a multi-Region (True) or regional (False) key. This value is True for multi-Region primary and replica keys and False for regional KMS keys.

For more information about multi-Region keys, see Multi-Region keys in KMS in the Key Management Service Developer Guide.

key_metadata.multi_region_configuration

Lists the primary and replica keys in same multi-Region key. This field is present only when the value of the MultiRegion field is True.

For more information about any listed KMS key, use the DescribeKey operation.

  • MultiRegionKeyType indicates whether the KMS key is a PRIMARY or REPLICA key.

  • PrimaryKey displays the key ARN and Region of the primary key. This field displays the current KMS key if it is the primary key.

  • ReplicaKeys displays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.

Show child fields
key_metadata.multi_region_configuration.multi_region_key_type

Indicates whether the KMS key is a PRIMARY or REPLICA key.

key_metadata.multi_region_configuration.primary_key

Displays the key ARN and Region of the primary key. This field includes the current KMS key if it is the primary key.

Show child fields
key_metadata.multi_region_configuration.primary_key.arn

Displays the key ARN of a primary or replica key of a multi-Region key.

key_metadata.multi_region_configuration.primary_key.region

Displays the Amazon Web Services Region of a primary or replica key in a multi-Region key.

key_metadata.multi_region_configuration.replica_keys[]
Show child fields
key_metadata.multi_region_configuration.replica_keys[].arn

Displays the key ARN of a primary or replica key of a multi-Region key.

key_metadata.multi_region_configuration.replica_keys[].region

Displays the Amazon Web Services Region of a primary or replica key in a multi-Region key.

key_metadata.origin

The source of the key material for the KMS key. When this value is AWS_KMS, KMS created the key material. When this value is EXTERNAL, the key material was imported or the KMS key doesn't have any key material. When this value is AWS_CLOUDHSM, the key material was created in the CloudHSM cluster associated with a custom key store.

key_metadata.pending_deletion_window_in_days

The waiting period before the primary key in a multi-Region key is deleted. This waiting period begins when the last of its replica keys is deleted. This value is present only when the KeyState of the KMS key is PendingReplicaDeletion. That indicates that the KMS key is the primary key in a multi-Region key, it is scheduled for deletion, and it still has existing replica keys.

When a single-Region KMS key or a multi-Region replica key is scheduled for deletion, its deletion date is displayed in the DeletionDate field. However, when the primary key in a multi-Region key is scheduled for deletion, its waiting period doesn't begin until all of its replica keys are deleted. This value displays that waiting period. When the last replica key in the multi-Region key is deleted, the KeyState of the scheduled primary key changes from PendingReplicaDeletion to PendingDeletion and the deletion date appears in the DeletionDate field.

key_metadata.signing_algorithms[]
key_metadata.valid_to

The time at which the imported key material expires. When the key material expires, KMS deletes the key material and the KMS key becomes unusable. This value is present only for KMS keys whose Origin is EXTERNAL and whose ExpirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is omitted.

key_metadata.xks_key_configuration

Information about the external key that is associated with a KMS key in an external key store.

For more information, see External key in the Key Management Service Developer Guide.

Show child fields
key_metadata.xks_key_configuration.id

The ID of the external key in its external key manager. This is the ID that the external key store proxy uses to identify the external key.