1. Packages
  2. Alibaba Cloud Provider
  3. API Docs
  4. kms
  5. getKeys
Viewing docs for Alibaba Cloud v3.98.0
published on Saturday, Apr 4, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-alicloud

alicloud.kms.getKeys

alicloud logo
Viewing docs for Alibaba Cloud v3.98.0
published on Saturday, Apr 4, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-alicloud

    This data source provides a list of KMS keys in an Alibaba Cloud account according to the specified filters.

    For information about KMS Key and how to use it, see What is Key.

    NOTE: Available since v1.85.0.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as alicloud from "@pulumi/alicloud";

// Declare the data source
const kmsKeysDs = alicloud.kms.getKeys({
    descriptionRegex: "Hello KMS",
    outputFile: "kms_keys.json",
});
export const firstKeyId = kmsKeysDs.then(kmsKeysDs => kmsKeysDs.keys?.[0]?.id);

    import pulumi
import pulumi_alicloud as alicloud

# Declare the data source
kms_keys_ds = alicloud.kms.get_keys(description_regex="Hello KMS",
    output_file="kms_keys.json")
pulumi.export("firstKeyId", kms_keys_ds.keys[0].id)

    package main

import (
	"github.com/pulumi/pulumi-alicloud/sdk/v3/go/alicloud/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Declare the data source
		kmsKeysDs, err := kms.GetKeys(ctx, &kms.GetKeysArgs{
			DescriptionRegex: pulumi.StringRef("Hello KMS"),
			OutputFile:       pulumi.StringRef("kms_keys.json"),
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("firstKeyId", kmsKeysDs.Keys[0].Id)
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AliCloud = Pulumi.AliCloud;

return await Deployment.RunAsync(() => 
{
    // Declare the data source
    var kmsKeysDs = AliCloud.Kms.GetKeys.Invoke(new()
    {
        DescriptionRegex = "Hello KMS",
        OutputFile = "kms_keys.json",
    });

    return new Dictionary<string, object?>
    {
        ["firstKeyId"] = kmsKeysDs.Apply(getKeysResult => getKeysResult.Keys[0]?.Id),
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.alicloud.kms.KmsFunctions;
import com.pulumi.alicloud.kms.inputs.GetKeysArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Declare the data source
        final var kmsKeysDs = KmsFunctions.getKeys(GetKeysArgs.builder()
            .descriptionRegex("Hello KMS")
            .outputFile("kms_keys.json")
            .build());

        ctx.export("firstKeyId", kmsKeysDs.keys()[0].id());
    }
}

    variables:
  # Declare the data source
  kmsKeysDs:
    fn::invoke:
      function: alicloud:kms:getKeys
      arguments:
        descriptionRegex: Hello KMS
        outputFile: kms_keys.json
outputs:
  firstKeyId: ${kmsKeysDs.keys[0].id}

    Using getKeys

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getKeys(args: GetKeysArgs, opts?: InvokeOptions): Promise<GetKeysResult>
function getKeysOutput(args: GetKeysOutputArgs, opts?: InvokeOptions): Output<GetKeysResult>
    def get_keys(description_regex: Optional[str] = None,
             enable_details: Optional[bool] = None,
             filters: Optional[str] = None,
             ids: Optional[Sequence[str]] = None,
             output_file: Optional[str] = None,
             status: Optional[str] = None,
             opts: Optional[InvokeOptions] = None) -> GetKeysResult
def get_keys_output(description_regex: Optional[pulumi.Input[str]] = None,
             enable_details: Optional[pulumi.Input[bool]] = None,
             filters: Optional[pulumi.Input[str]] = None,
             ids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             output_file: Optional[pulumi.Input[str]] = None,
             status: Optional[pulumi.Input[str]] = None,
             opts: Optional[InvokeOptions] = None) -> Output[GetKeysResult]
    func GetKeys(ctx *Context, args *GetKeysArgs, opts ...InvokeOption) (*GetKeysResult, error)
func GetKeysOutput(ctx *Context, args *GetKeysOutputArgs, opts ...InvokeOption) GetKeysResultOutput

    > Note: This function is named GetKeys in the Go SDK.

    public static class GetKeys 
{
    public static Task<GetKeysResult> InvokeAsync(GetKeysArgs args, InvokeOptions? opts = null)
    public static Output<GetKeysResult> Invoke(GetKeysInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetKeysResult> getKeys(GetKeysArgs args, InvokeOptions options)
public static Output<GetKeysResult> getKeys(GetKeysArgs args, InvokeOptions options)

    fn::invoke:
  function: alicloud:kms/getKeys:getKeys
  arguments:
    # arguments dictionary

    The following arguments are supported:

    DescriptionRegex string
    A regex string to filter the results by the KMS key description.
    EnableDetails bool
    Default to true. Set it to true can output more details about resource attributes.
    Filters string
    The CMK filter. The filter consists of one or more key-value pairs. You can specify a maximum of 10 key-value pairs. More details see API ListKeys.
    Ids List<string>
    A list of KMS key IDs.
    OutputFile string
    File name where to save data source results (after running pulumi preview).
    Status string
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.
    DescriptionRegex string
    A regex string to filter the results by the KMS key description.
    EnableDetails bool
    Default to true. Set it to true can output more details about resource attributes.
    Filters string
    The CMK filter. The filter consists of one or more key-value pairs. You can specify a maximum of 10 key-value pairs. More details see API ListKeys.
    Ids []string
    A list of KMS key IDs.
    OutputFile string
    File name where to save data source results (after running pulumi preview).
    Status string
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.
    descriptionRegex String
    A regex string to filter the results by the KMS key description.
    enableDetails Boolean
    Default to true. Set it to true can output more details about resource attributes.
    filters String
    The CMK filter. The filter consists of one or more key-value pairs. You can specify a maximum of 10 key-value pairs. More details see API ListKeys.
    ids List<String>
    A list of KMS key IDs.
    outputFile String
    File name where to save data source results (after running pulumi preview).
    status String
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.
    descriptionRegex string
    A regex string to filter the results by the KMS key description.
    enableDetails boolean
    Default to true. Set it to true can output more details about resource attributes.
    filters string
    The CMK filter. The filter consists of one or more key-value pairs. You can specify a maximum of 10 key-value pairs. More details see API ListKeys.
    ids string[]
    A list of KMS key IDs.
    outputFile string
    File name where to save data source results (after running pulumi preview).
    status string
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.
    description_regex str
    A regex string to filter the results by the KMS key description.
    enable_details bool
    Default to true. Set it to true can output more details about resource attributes.
    filters str
    The CMK filter. The filter consists of one or more key-value pairs. You can specify a maximum of 10 key-value pairs. More details see API ListKeys.
    ids Sequence[str]
    A list of KMS key IDs.
    output_file str
    File name where to save data source results (after running pulumi preview).
    status str
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.
    descriptionRegex String
    A regex string to filter the results by the KMS key description.
    enableDetails Boolean
    Default to true. Set it to true can output more details about resource attributes.
    filters String
    The CMK filter. The filter consists of one or more key-value pairs. You can specify a maximum of 10 key-value pairs. More details see API ListKeys.
    ids List<String>
    A list of KMS key IDs.
    outputFile String
    File name where to save data source results (after running pulumi preview).
    status String
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.

    getKeys Result

    The following output properties are available:

    Id string
    The provider-assigned unique ID for this managed resource.
    Ids List<string>
    A list of KMS key IDs.
    Keys List<Pulumi.AliCloud.Kms.Outputs.GetKeysKey>
    A list of KMS keys. Each element contains the following attributes:
    DescriptionRegex string
    EnableDetails bool
    Filters string
    OutputFile string
    Status string
    Status of the key. Possible values: Enabled, Disabled and PendingDeletion.
    Id string
    The provider-assigned unique ID for this managed resource.
    Ids []string
    A list of KMS key IDs.
    Keys []GetKeysKey
    A list of KMS keys. Each element contains the following attributes:
    DescriptionRegex string
    EnableDetails bool
    Filters string
    OutputFile string
    Status string
    Status of the key. Possible values: Enabled, Disabled and PendingDeletion.
    id String
    The provider-assigned unique ID for this managed resource.
    ids List<String>
    A list of KMS key IDs.
    keys List<GetKeysKey>
    A list of KMS keys. Each element contains the following attributes:
    descriptionRegex String
    enableDetails Boolean
    filters String
    outputFile String
    status String
    Status of the key. Possible values: Enabled, Disabled and PendingDeletion.
    id string
    The provider-assigned unique ID for this managed resource.
    ids string[]
    A list of KMS key IDs.
    keys GetKeysKey[]
    A list of KMS keys. Each element contains the following attributes:
    descriptionRegex string
    enableDetails boolean
    filters string
    outputFile string
    status string
    Status of the key. Possible values: Enabled, Disabled and PendingDeletion.
    id str
    The provider-assigned unique ID for this managed resource.
    ids Sequence[str]
    A list of KMS key IDs.
    keys Sequence[GetKeysKey]
    A list of KMS keys. Each element contains the following attributes:
    description_regex str
    enable_details bool
    filters str
    output_file str
    status str
    Status of the key. Possible values: Enabled, Disabled and PendingDeletion.
    id String
    The provider-assigned unique ID for this managed resource.
    ids List<String>
    A list of KMS key IDs.
    keys List<Property Map>
    A list of KMS keys. Each element contains the following attributes:
    descriptionRegex String
    enableDetails Boolean
    filters String
    outputFile String
    status String
    Status of the key. Possible values: Enabled, Disabled and PendingDeletion.

    Supporting Types

    GetKeysKey

    Arn string
    The Alibaba Cloud Resource Name (ARN) of the key.
    AutomaticRotation string
    (Available in 1.123.1+) Specifies whether to enable automatic key rotation.
    CreationDate string
    Creation date of key.
    Creator string
    The owner of the key.
    DeleteDate string
    Deletion date of key.
    Description string
    Description of the key.
    Id string
    ID of the key.
    KeyId string
    (Available in 1.123.1+) ID of the key.
    KeySpec string
    (Available in 1.123.1+) The type of the CMK.
    KeyUsage string
    (Available in 1.123.1+) The usage of CMK.
    LastRotationDate string
    (Available in 1.123.1+) The date and time the last rotation was performed.
    MaterialExpireTime string
    (Available in 1.123.1+) The time and date the key material for the CMK expires.
    NextRotationDate string
    (Available in 1.123.1+) The time the next rotation is scheduled for execution.
    Origin string
    (Available in 1.123.1+) The source of the key material for the CMK.
    PrimaryKeyVersion string
    (Available in 1.123.1+) The ID of the current primary key version of the symmetric CMK.
    ProtectionLevel string
    (Available in 1.123.1+) The protection level of the CMK.
    RotationInterval string
    (Available in 1.123.1+) The period of automatic key rotation.
    Status string
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.
    Arn string
    The Alibaba Cloud Resource Name (ARN) of the key.
    AutomaticRotation string
    (Available in 1.123.1+) Specifies whether to enable automatic key rotation.
    CreationDate string
    Creation date of key.
    Creator string
    The owner of the key.
    DeleteDate string
    Deletion date of key.
    Description string
    Description of the key.
    Id string
    ID of the key.
    KeyId string
    (Available in 1.123.1+) ID of the key.
    KeySpec string
    (Available in 1.123.1+) The type of the CMK.
    KeyUsage string
    (Available in 1.123.1+) The usage of CMK.
    LastRotationDate string
    (Available in 1.123.1+) The date and time the last rotation was performed.
    MaterialExpireTime string
    (Available in 1.123.1+) The time and date the key material for the CMK expires.
    NextRotationDate string
    (Available in 1.123.1+) The time the next rotation is scheduled for execution.
    Origin string
    (Available in 1.123.1+) The source of the key material for the CMK.
    PrimaryKeyVersion string
    (Available in 1.123.1+) The ID of the current primary key version of the symmetric CMK.
    ProtectionLevel string
    (Available in 1.123.1+) The protection level of the CMK.
    RotationInterval string
    (Available in 1.123.1+) The period of automatic key rotation.
    Status string
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.
    arn String
    The Alibaba Cloud Resource Name (ARN) of the key.
    automaticRotation String
    (Available in 1.123.1+) Specifies whether to enable automatic key rotation.
    creationDate String
    Creation date of key.
    creator String
    The owner of the key.
    deleteDate String
    Deletion date of key.
    description String
    Description of the key.
    id String
    ID of the key.
    keyId String
    (Available in 1.123.1+) ID of the key.
    keySpec String
    (Available in 1.123.1+) The type of the CMK.
    keyUsage String
    (Available in 1.123.1+) The usage of CMK.
    lastRotationDate String
    (Available in 1.123.1+) The date and time the last rotation was performed.
    materialExpireTime String
    (Available in 1.123.1+) The time and date the key material for the CMK expires.
    nextRotationDate String
    (Available in 1.123.1+) The time the next rotation is scheduled for execution.
    origin String
    (Available in 1.123.1+) The source of the key material for the CMK.
    primaryKeyVersion String
    (Available in 1.123.1+) The ID of the current primary key version of the symmetric CMK.
    protectionLevel String
    (Available in 1.123.1+) The protection level of the CMK.
    rotationInterval String
    (Available in 1.123.1+) The period of automatic key rotation.
    status String
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.
    arn string
    The Alibaba Cloud Resource Name (ARN) of the key.
    automaticRotation string
    (Available in 1.123.1+) Specifies whether to enable automatic key rotation.
    creationDate string
    Creation date of key.
    creator string
    The owner of the key.
    deleteDate string
    Deletion date of key.
    description string
    Description of the key.
    id string
    ID of the key.
    keyId string
    (Available in 1.123.1+) ID of the key.
    keySpec string
    (Available in 1.123.1+) The type of the CMK.
    keyUsage string
    (Available in 1.123.1+) The usage of CMK.
    lastRotationDate string
    (Available in 1.123.1+) The date and time the last rotation was performed.
    materialExpireTime string
    (Available in 1.123.1+) The time and date the key material for the CMK expires.
    nextRotationDate string
    (Available in 1.123.1+) The time the next rotation is scheduled for execution.
    origin string
    (Available in 1.123.1+) The source of the key material for the CMK.
    primaryKeyVersion string
    (Available in 1.123.1+) The ID of the current primary key version of the symmetric CMK.
    protectionLevel string
    (Available in 1.123.1+) The protection level of the CMK.
    rotationInterval string
    (Available in 1.123.1+) The period of automatic key rotation.
    status string
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.
    arn str
    The Alibaba Cloud Resource Name (ARN) of the key.
    automatic_rotation str
    (Available in 1.123.1+) Specifies whether to enable automatic key rotation.
    creation_date str
    Creation date of key.
    creator str
    The owner of the key.
    delete_date str
    Deletion date of key.
    description str
    Description of the key.
    id str
    ID of the key.
    key_id str
    (Available in 1.123.1+) ID of the key.
    key_spec str
    (Available in 1.123.1+) The type of the CMK.
    key_usage str
    (Available in 1.123.1+) The usage of CMK.
    last_rotation_date str
    (Available in 1.123.1+) The date and time the last rotation was performed.
    material_expire_time str
    (Available in 1.123.1+) The time and date the key material for the CMK expires.
    next_rotation_date str
    (Available in 1.123.1+) The time the next rotation is scheduled for execution.
    origin str
    (Available in 1.123.1+) The source of the key material for the CMK.
    primary_key_version str
    (Available in 1.123.1+) The ID of the current primary key version of the symmetric CMK.
    protection_level str
    (Available in 1.123.1+) The protection level of the CMK.
    rotation_interval str
    (Available in 1.123.1+) The period of automatic key rotation.
    status str
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.
    arn String
    The Alibaba Cloud Resource Name (ARN) of the key.
    automaticRotation String
    (Available in 1.123.1+) Specifies whether to enable automatic key rotation.
    creationDate String
    Creation date of key.
    creator String
    The owner of the key.
    deleteDate String
    Deletion date of key.
    description String
    Description of the key.
    id String
    ID of the key.
    keyId String
    (Available in 1.123.1+) ID of the key.
    keySpec String
    (Available in 1.123.1+) The type of the CMK.
    keyUsage String
    (Available in 1.123.1+) The usage of CMK.
    lastRotationDate String
    (Available in 1.123.1+) The date and time the last rotation was performed.
    materialExpireTime String
    (Available in 1.123.1+) The time and date the key material for the CMK expires.
    nextRotationDate String
    (Available in 1.123.1+) The time the next rotation is scheduled for execution.
    origin String
    (Available in 1.123.1+) The source of the key material for the CMK.
    primaryKeyVersion String
    (Available in 1.123.1+) The ID of the current primary key version of the symmetric CMK.
    protectionLevel String
    (Available in 1.123.1+) The protection level of the CMK.
    rotationInterval String
    (Available in 1.123.1+) The period of automatic key rotation.
    status String
    Filter the results by status of the KMS keys. Valid values: Enabled, Disabled, PendingDeletion.

    Package Details

    Repository
    Alibaba Cloud pulumi/pulumi-alicloud
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the alicloud Terraform Provider.
    alicloud logo
    Viewing docs for Alibaba Cloud v3.98.0
    published on Saturday, Apr 4, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-alicloud
      Try Pulumi Cloud free. Your team will thank you.