Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. AWS
  4. API Docs
  5. kms
  6. getKey
Viewing docs for AWS v7.50.0
published on Thursday, Oct 8, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.kms.getKey

aws logo aws logo
Viewing docs for AWS v7.50.0
published on Thursday, Oct 8, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Use this data source to get detailed information about the specified KMS Key with flexible key id input. This can be useful to reference key alias without having to hard code the ARN as input.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const byAlias = aws.kms.getKey({
    keyId: "alias/my-key",
});
const byId = aws.kms.getKey({
    keyId: "1234abcd-12ab-34cd-56ef-1234567890ab",
});
const byAliasArn = aws.kms.getKey({
    keyId: "arn:aws:kms:us-east-1:111122223333:alias/my-key",
});
const byKeyArn = aws.kms.getKey({
    keyId: "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
});

    import pulumi
import pulumi_aws as aws

by_alias = aws.kms.get_key(key_id="alias/my-key")
by_id = aws.kms.get_key(key_id="1234abcd-12ab-34cd-56ef-1234567890ab")
by_alias_arn = aws.kms.get_key(key_id="arn:aws:kms:us-east-1:111122223333:alias/my-key")
by_key_arn = aws.kms.get_key(key_id="arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab")

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.LookupKey(ctx, &kms.LookupKeyArgs{
			KeyId: "alias/my-key",
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.LookupKey(ctx, &kms.LookupKeyArgs{
			KeyId: "1234abcd-12ab-34cd-56ef-1234567890ab",
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.LookupKey(ctx, &kms.LookupKeyArgs{
			KeyId: "arn:aws:kms:us-east-1:111122223333:alias/my-key",
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.LookupKey(ctx, &kms.LookupKeyArgs{
			KeyId: "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var byAlias = Aws.Kms.GetKey.Invoke(new()
    {
        KeyId = "alias/my-key",
    });

    var byId = Aws.Kms.GetKey.Invoke(new()
    {
        KeyId = "1234abcd-12ab-34cd-56ef-1234567890ab",
    });

    var byAliasArn = Aws.Kms.GetKey.Invoke(new()
    {
        KeyId = "arn:aws:kms:us-east-1:111122223333:alias/my-key",
    });

    var byKeyArn = Aws.Kms.GetKey.Invoke(new()
    {
        KeyId = "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.kms.KmsFunctions;
import com.pulumi.aws.kms.inputs.GetKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var byAlias = KmsFunctions.getKey(GetKeyArgs.builder()
            .keyId("alias/my-key")
            .build());

        final var byId = KmsFunctions.getKey(GetKeyArgs.builder()
            .keyId("1234abcd-12ab-34cd-56ef-1234567890ab")
            .build());

        final var byAliasArn = KmsFunctions.getKey(GetKeyArgs.builder()
            .keyId("arn:aws:kms:us-east-1:111122223333:alias/my-key")
            .build());

        final var byKeyArn = KmsFunctions.getKey(GetKeyArgs.builder()
            .keyId("arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab")
            .build());

    }
}

    variables:
  byAlias:
    fn::invoke:
      function: aws:kms:getKey
      arguments:
        keyId: alias/my-key
  byId:
    fn::invoke:
      function: aws:kms:getKey
      arguments:
        keyId: 1234abcd-12ab-34cd-56ef-1234567890ab
  byAliasArn:
    fn::invoke:
      function: aws:kms:getKey
      arguments:
        keyId: arn:aws:kms:us-east-1:111122223333:alias/my-key
  byKeyArn:
    fn::invoke:
      function: aws:kms:getKey
      arguments:
        keyId: arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_kms_getkey" "byAlias" {
  key_id = "alias/my-key"
}
data "aws_kms_getkey" "byId" {
  key_id = "1234abcd-12ab-34cd-56ef-1234567890ab"
}
data "aws_kms_getkey" "byAliasArn" {
  key_id = "arn:aws:kms:us-east-1:111122223333:alias/my-key"
}
data "aws_kms_getkey" "byKeyArn" {
  key_id = "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}

    Using getKey

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getKey(args: GetKeyArgs, opts?: InvokeOptions): Promise<GetKeyResult>
function getKeyOutput(args: GetKeyOutputArgs, opts?: InvokeOutputOptions): Output<GetKeyResult>
    def get_key(grant_tokens: Optional[Sequence[str]] = None,
            key_id: Optional[str] = None,
            region: Optional[str] = None,
            opts: Optional[InvokeOptions] = None) -> GetKeyResult
def get_key_output(grant_tokens: pulumi.Input[Optional[Sequence[pulumi.Input[str]]]] = None,
            key_id: pulumi.Input[Optional[str]] = None,
            region: pulumi.Input[Optional[str]] = None,
            opts: Optional[InvokeOutputOptions] = None) -> Output[GetKeyResult]
    func LookupKey(ctx *Context, args *LookupKeyArgs, opts ...InvokeOption) (*LookupKeyResult, error)
func LookupKeyOutput(ctx *Context, args *LookupKeyOutputArgs, opts ...InvokeOption) LookupKeyResultOutput

    > Note: This function is named LookupKey in the Go SDK.

    public static class GetKey 
{
    public static Task<GetKeyResult> InvokeAsync(GetKeyArgs args, InvokeOptions? opts = null)
    public static Output<GetKeyResult> Invoke(GetKeyInvokeArgs args, InvokeOptions? opts = null)
    public static Output<GetKeyResult> Invoke(GetKeyInvokeArgs args, InvokeOutputOptions opts)
}
    public static CompletableFuture<GetKeyResult> getKey(GetKeyArgs args, InvokeOptions options)
public static Output<GetKeyResult> getKey(GetKeyArgs args, InvokeOptions options)
public static Output<GetKeyResult> getKey(GetKeyArgs args, InvokeOutputOptions options)

    fn::invoke:
  function: aws:kms/getKey:getKey
  arguments:
    # arguments dictionary
    data "aws_kms_get_key" "name" {
    # arguments
}

    The following arguments are supported:

    KeyId string
    Key identifier. Can be a key ID (e.g. 1234abcd-12ab-34cd-56ef-1234567890ab), key ARN (e.g. arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab), alias name (e.g. alias/my-key), or alias ARN (e.g. arn:aws:kms:us-east-1:111122223333:alias/my-key).
    GrantTokens List<string>
    List of grant tokens.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    KeyId string
    Key identifier. Can be a key ID (e.g. 1234abcd-12ab-34cd-56ef-1234567890ab), key ARN (e.g. arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab), alias name (e.g. alias/my-key), or alias ARN (e.g. arn:aws:kms:us-east-1:111122223333:alias/my-key).
    GrantTokens []string
    List of grant tokens.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    key_id string
    Key identifier. Can be a key ID (e.g. 1234abcd-12ab-34cd-56ef-1234567890ab), key ARN (e.g. arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab), alias name (e.g. alias/my-key), or alias ARN (e.g. arn:aws:kms:us-east-1:111122223333:alias/my-key).
    grant_tokens list(string)
    List of grant tokens.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    keyId String
    Key identifier. Can be a key ID (e.g. 1234abcd-12ab-34cd-56ef-1234567890ab), key ARN (e.g. arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab), alias name (e.g. alias/my-key), or alias ARN (e.g. arn:aws:kms:us-east-1:111122223333:alias/my-key).
    grantTokens List<String>
    List of grant tokens.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    keyId string
    Key identifier. Can be a key ID (e.g. 1234abcd-12ab-34cd-56ef-1234567890ab), key ARN (e.g. arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab), alias name (e.g. alias/my-key), or alias ARN (e.g. arn:aws:kms:us-east-1:111122223333:alias/my-key).
    grantTokens string[]
    List of grant tokens.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    key_id str
    Key identifier. Can be a key ID (e.g. 1234abcd-12ab-34cd-56ef-1234567890ab), key ARN (e.g. arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab), alias name (e.g. alias/my-key), or alias ARN (e.g. arn:aws:kms:us-east-1:111122223333:alias/my-key).
    grant_tokens Sequence[str]
    List of grant tokens.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    keyId String
    Key identifier. Can be a key ID (e.g. 1234abcd-12ab-34cd-56ef-1234567890ab), key ARN (e.g. arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab), alias name (e.g. alias/my-key), or alias ARN (e.g. arn:aws:kms:us-east-1:111122223333:alias/my-key).
    grantTokens List<String>
    List of grant tokens.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.

    getKey Result

    The following output properties are available:

    Arn string
    Key ARN of a primary or replica key of a multi-Region key.
    AwsAccountId string
    Twelve-digit account ID of the AWS account that owns the key.
    CloudHsmClusterId string
    Cluster ID of the AWS CloudHSM cluster that contains the key material for the KMS key.
    CreationDate string
    Date and time when the key was created.
    CustomKeyStoreId string
    Unique identifier for the custom key store that contains the KMS key.
    CustomerMasterKeySpec string
    See keySpec.
    DeletionDate string
    Date and time after which AWS KMS deletes the key. This value is present only when keyState is PendingDeletion, otherwise this value is 0.
    Description string
    Description of the key.
    Enabled bool
    Whether the key is enabled. When keyState is Enabled this value is true, otherwise it is false.
    ExpirationModel string
    Whether the key's key material expires. This value is present only when origin is EXTERNAL, otherwise this value is empty.
    Id string
    The provider-assigned unique ID for this managed resource.
    KeyId string
    KeyManager string
    Manager of the key.
    KeySpec string
    Type of key material in the KMS key.
    KeyState string
    State of the key.
    KeyUsage string
    Intended use of the key.
    MultiRegion bool
    Whether the KMS key is a multi-Region (true) or regional (false) key.
    MultiRegionConfigurations List<GetKeyMultiRegionConfiguration>
    Primary and replica keys in same multi-Region key. Present only when the value of multiRegion is true. See multiRegionConfiguration Block below.
    Origin string
    Source of the key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material.
    PendingDeletionWindowInDays int
    Waiting period before the primary key in a multi-Region key is deleted.
    Region string
    AWS Region of a primary or replica key in a multi-Region key.
    ValidTo string
    Time at which the imported key material expires. This value is present only when origin is EXTERNAL and whose expirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is 0.
    XksKeyConfigurations List<GetKeyXksKeyConfiguration>
    Information about the external key that is associated with a KMS key in an external key store. See xksKeyConfiguration Block below.
    GrantTokens List<string>
    Arn string
    Key ARN of a primary or replica key of a multi-Region key.
    AwsAccountId string
    Twelve-digit account ID of the AWS account that owns the key.
    CloudHsmClusterId string
    Cluster ID of the AWS CloudHSM cluster that contains the key material for the KMS key.
    CreationDate string
    Date and time when the key was created.
    CustomKeyStoreId string
    Unique identifier for the custom key store that contains the KMS key.
    CustomerMasterKeySpec string
    See keySpec.
    DeletionDate string
    Date and time after which AWS KMS deletes the key. This value is present only when keyState is PendingDeletion, otherwise this value is 0.
    Description string
    Description of the key.
    Enabled bool
    Whether the key is enabled. When keyState is Enabled this value is true, otherwise it is false.
    ExpirationModel string
    Whether the key's key material expires. This value is present only when origin is EXTERNAL, otherwise this value is empty.
    Id string
    The provider-assigned unique ID for this managed resource.
    KeyId string
    KeyManager string
    Manager of the key.
    KeySpec string
    Type of key material in the KMS key.
    KeyState string
    State of the key.
    KeyUsage string
    Intended use of the key.
    MultiRegion bool
    Whether the KMS key is a multi-Region (true) or regional (false) key.
    MultiRegionConfigurations []GetKeyMultiRegionConfiguration
    Primary and replica keys in same multi-Region key. Present only when the value of multiRegion is true. See multiRegionConfiguration Block below.
    Origin string
    Source of the key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material.
    PendingDeletionWindowInDays int
    Waiting period before the primary key in a multi-Region key is deleted.
    Region string
    AWS Region of a primary or replica key in a multi-Region key.
    ValidTo string
    Time at which the imported key material expires. This value is present only when origin is EXTERNAL and whose expirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is 0.
    XksKeyConfigurations []GetKeyXksKeyConfiguration
    Information about the external key that is associated with a KMS key in an external key store. See xksKeyConfiguration Block below.
    GrantTokens []string
    arn string
    Key ARN of a primary or replica key of a multi-Region key.
    aws_account_id string
    Twelve-digit account ID of the AWS account that owns the key.
    cloud_hsm_cluster_id string
    Cluster ID of the AWS CloudHSM cluster that contains the key material for the KMS key.
    creation_date string
    Date and time when the key was created.
    custom_key_store_id string
    Unique identifier for the custom key store that contains the KMS key.
    customer_master_key_spec string
    See keySpec.
    deletion_date string
    Date and time after which AWS KMS deletes the key. This value is present only when keyState is PendingDeletion, otherwise this value is 0.
    description string
    Description of the key.
    enabled bool
    Whether the key is enabled. When keyState is Enabled this value is true, otherwise it is false.
    expiration_model string
    Whether the key's key material expires. This value is present only when origin is EXTERNAL, otherwise this value is empty.
    id string
    The provider-assigned unique ID for this managed resource.
    key_id string
    key_manager string
    Manager of the key.
    key_spec string
    Type of key material in the KMS key.
    key_state string
    State of the key.
    key_usage string
    Intended use of the key.
    multi_region bool
    Whether the KMS key is a multi-Region (true) or regional (false) key.
    multi_region_configurations list(object)
    Primary and replica keys in same multi-Region key. Present only when the value of multiRegion is true. See multiRegionConfiguration Block below.
    origin string
    Source of the key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material.
    pending_deletion_window_in_days number
    Waiting period before the primary key in a multi-Region key is deleted.
    region string
    AWS Region of a primary or replica key in a multi-Region key.
    valid_to string
    Time at which the imported key material expires. This value is present only when origin is EXTERNAL and whose expirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is 0.
    xks_key_configurations list(object)
    Information about the external key that is associated with a KMS key in an external key store. See xksKeyConfiguration Block below.
    grant_tokens list(string)
    arn String
    Key ARN of a primary or replica key of a multi-Region key.
    awsAccountId String
    Twelve-digit account ID of the AWS account that owns the key.
    cloudHsmClusterId String
    Cluster ID of the AWS CloudHSM cluster that contains the key material for the KMS key.
    creationDate String
    Date and time when the key was created.
    customKeyStoreId String
    Unique identifier for the custom key store that contains the KMS key.
    customerMasterKeySpec String
    See keySpec.
    deletionDate String
    Date and time after which AWS KMS deletes the key. This value is present only when keyState is PendingDeletion, otherwise this value is 0.
    description String
    Description of the key.
    enabled Boolean
    Whether the key is enabled. When keyState is Enabled this value is true, otherwise it is false.
    expirationModel String
    Whether the key's key material expires. This value is present only when origin is EXTERNAL, otherwise this value is empty.
    id String
    The provider-assigned unique ID for this managed resource.
    keyId String
    keyManager String
    Manager of the key.
    keySpec String
    Type of key material in the KMS key.
    keyState String
    State of the key.
    keyUsage String
    Intended use of the key.
    multiRegion Boolean
    Whether the KMS key is a multi-Region (true) or regional (false) key.
    multiRegionConfigurations List<GetKeyMultiRegionConfiguration>
    Primary and replica keys in same multi-Region key. Present only when the value of multiRegion is true. See multiRegionConfiguration Block below.
    origin String
    Source of the key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material.
    pendingDeletionWindowInDays Integer
    Waiting period before the primary key in a multi-Region key is deleted.
    region String
    AWS Region of a primary or replica key in a multi-Region key.
    validTo String
    Time at which the imported key material expires. This value is present only when origin is EXTERNAL and whose expirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is 0.
    xksKeyConfigurations List<GetKeyXksKeyConfiguration>
    Information about the external key that is associated with a KMS key in an external key store. See xksKeyConfiguration Block below.
    grantTokens List<String>
    arn string
    Key ARN of a primary or replica key of a multi-Region key.
    awsAccountId string
    Twelve-digit account ID of the AWS account that owns the key.
    cloudHsmClusterId string
    Cluster ID of the AWS CloudHSM cluster that contains the key material for the KMS key.
    creationDate string
    Date and time when the key was created.
    customKeyStoreId string
    Unique identifier for the custom key store that contains the KMS key.
    customerMasterKeySpec string
    See keySpec.
    deletionDate string
    Date and time after which AWS KMS deletes the key. This value is present only when keyState is PendingDeletion, otherwise this value is 0.
    description string
    Description of the key.
    enabled boolean
    Whether the key is enabled. When keyState is Enabled this value is true, otherwise it is false.
    expirationModel string
    Whether the key's key material expires. This value is present only when origin is EXTERNAL, otherwise this value is empty.
    id string
    The provider-assigned unique ID for this managed resource.
    keyId string
    keyManager string
    Manager of the key.
    keySpec string
    Type of key material in the KMS key.
    keyState string
    State of the key.
    keyUsage string
    Intended use of the key.
    multiRegion boolean
    Whether the KMS key is a multi-Region (true) or regional (false) key.
    multiRegionConfigurations GetKeyMultiRegionConfiguration[]
    Primary and replica keys in same multi-Region key. Present only when the value of multiRegion is true. See multiRegionConfiguration Block below.
    origin string
    Source of the key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material.
    pendingDeletionWindowInDays number
    Waiting period before the primary key in a multi-Region key is deleted.
    region string
    AWS Region of a primary or replica key in a multi-Region key.
    validTo string
    Time at which the imported key material expires. This value is present only when origin is EXTERNAL and whose expirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is 0.
    xksKeyConfigurations GetKeyXksKeyConfiguration[]
    Information about the external key that is associated with a KMS key in an external key store. See xksKeyConfiguration Block below.
    grantTokens string[]
    arn str
    Key ARN of a primary or replica key of a multi-Region key.
    aws_account_id str
    Twelve-digit account ID of the AWS account that owns the key.
    cloud_hsm_cluster_id str
    Cluster ID of the AWS CloudHSM cluster that contains the key material for the KMS key.
    creation_date str
    Date and time when the key was created.
    custom_key_store_id str
    Unique identifier for the custom key store that contains the KMS key.
    customer_master_key_spec str
    See keySpec.
    deletion_date str
    Date and time after which AWS KMS deletes the key. This value is present only when keyState is PendingDeletion, otherwise this value is 0.
    description str
    Description of the key.
    enabled bool
    Whether the key is enabled. When keyState is Enabled this value is true, otherwise it is false.
    expiration_model str
    Whether the key's key material expires. This value is present only when origin is EXTERNAL, otherwise this value is empty.
    id str
    The provider-assigned unique ID for this managed resource.
    key_id str
    key_manager str
    Manager of the key.
    key_spec str
    Type of key material in the KMS key.
    key_state str
    State of the key.
    key_usage str
    Intended use of the key.
    multi_region bool
    Whether the KMS key is a multi-Region (true) or regional (false) key.
    multi_region_configurations Sequence[GetKeyMultiRegionConfiguration]
    Primary and replica keys in same multi-Region key. Present only when the value of multiRegion is true. See multiRegionConfiguration Block below.
    origin str
    Source of the key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material.
    pending_deletion_window_in_days int
    Waiting period before the primary key in a multi-Region key is deleted.
    region str
    AWS Region of a primary or replica key in a multi-Region key.
    valid_to str
    Time at which the imported key material expires. This value is present only when origin is EXTERNAL and whose expirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is 0.
    xks_key_configurations Sequence[GetKeyXksKeyConfiguration]
    Information about the external key that is associated with a KMS key in an external key store. See xksKeyConfiguration Block below.
    grant_tokens Sequence[str]
    arn String
    Key ARN of a primary or replica key of a multi-Region key.
    awsAccountId String
    Twelve-digit account ID of the AWS account that owns the key.
    cloudHsmClusterId String
    Cluster ID of the AWS CloudHSM cluster that contains the key material for the KMS key.
    creationDate String
    Date and time when the key was created.
    customKeyStoreId String
    Unique identifier for the custom key store that contains the KMS key.
    customerMasterKeySpec String
    See keySpec.
    deletionDate String
    Date and time after which AWS KMS deletes the key. This value is present only when keyState is PendingDeletion, otherwise this value is 0.
    description String
    Description of the key.
    enabled Boolean
    Whether the key is enabled. When keyState is Enabled this value is true, otherwise it is false.
    expirationModel String
    Whether the key's key material expires. This value is present only when origin is EXTERNAL, otherwise this value is empty.
    id String
    The provider-assigned unique ID for this managed resource.
    keyId String
    keyManager String
    Manager of the key.
    keySpec String
    Type of key material in the KMS key.
    keyState String
    State of the key.
    keyUsage String
    Intended use of the key.
    multiRegion Boolean
    Whether the KMS key is a multi-Region (true) or regional (false) key.
    multiRegionConfigurations List<Property Map>
    Primary and replica keys in same multi-Region key. Present only when the value of multiRegion is true. See multiRegionConfiguration Block below.
    origin String
    Source of the key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material.
    pendingDeletionWindowInDays Number
    Waiting period before the primary key in a multi-Region key is deleted.
    region String
    AWS Region of a primary or replica key in a multi-Region key.
    validTo String
    Time at which the imported key material expires. This value is present only when origin is EXTERNAL and whose expirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is 0.
    xksKeyConfigurations List<Property Map>
    Information about the external key that is associated with a KMS key in an external key store. See xksKeyConfiguration Block below.
    grantTokens List<String>

    Supporting Types

    GetKeyMultiRegionConfiguration

    MultiRegionKeyType string
    Whether the KMS key is a PRIMARY or REPLICA key.
    PrimaryKeys List<GetKeyMultiRegionConfigurationPrimaryKey>
    Key ARN and Region of the primary key. This is the current KMS key if it is the primary key. See multi_region_configuration.primary_key Block below.
    ReplicaKeys List<GetKeyMultiRegionConfigurationReplicaKey>
    Key ARNs and Regions of all replica keys. Includes the current KMS key if it is a replica key. See multi_region_configuration.replica_keys Block below.
    MultiRegionKeyType string
    Whether the KMS key is a PRIMARY or REPLICA key.
    PrimaryKeys []GetKeyMultiRegionConfigurationPrimaryKey
    Key ARN and Region of the primary key. This is the current KMS key if it is the primary key. See multi_region_configuration.primary_key Block below.
    ReplicaKeys []GetKeyMultiRegionConfigurationReplicaKey
    Key ARNs and Regions of all replica keys. Includes the current KMS key if it is a replica key. See multi_region_configuration.replica_keys Block below.
    multi_region_key_type string
    Whether the KMS key is a PRIMARY or REPLICA key.
    primary_keys list(object)
    Key ARN and Region of the primary key. This is the current KMS key if it is the primary key. See multi_region_configuration.primary_key Block below.
    replica_keys list(object)
    Key ARNs and Regions of all replica keys. Includes the current KMS key if it is a replica key. See multi_region_configuration.replica_keys Block below.
    multiRegionKeyType String
    Whether the KMS key is a PRIMARY or REPLICA key.
    primaryKeys List<GetKeyMultiRegionConfigurationPrimaryKey>
    Key ARN and Region of the primary key. This is the current KMS key if it is the primary key. See multi_region_configuration.primary_key Block below.
    replicaKeys List<GetKeyMultiRegionConfigurationReplicaKey>
    Key ARNs and Regions of all replica keys. Includes the current KMS key if it is a replica key. See multi_region_configuration.replica_keys Block below.
    multiRegionKeyType string
    Whether the KMS key is a PRIMARY or REPLICA key.
    primaryKeys GetKeyMultiRegionConfigurationPrimaryKey[]
    Key ARN and Region of the primary key. This is the current KMS key if it is the primary key. See multi_region_configuration.primary_key Block below.
    replicaKeys GetKeyMultiRegionConfigurationReplicaKey[]
    Key ARNs and Regions of all replica keys. Includes the current KMS key if it is a replica key. See multi_region_configuration.replica_keys Block below.
    multi_region_key_type str
    Whether the KMS key is a PRIMARY or REPLICA key.
    primary_keys Sequence[GetKeyMultiRegionConfigurationPrimaryKey]
    Key ARN and Region of the primary key. This is the current KMS key if it is the primary key. See multi_region_configuration.primary_key Block below.
    replica_keys Sequence[GetKeyMultiRegionConfigurationReplicaKey]
    Key ARNs and Regions of all replica keys. Includes the current KMS key if it is a replica key. See multi_region_configuration.replica_keys Block below.
    multiRegionKeyType String
    Whether the KMS key is a PRIMARY or REPLICA key.
    primaryKeys List<Property Map>
    Key ARN and Region of the primary key. This is the current KMS key if it is the primary key. See multi_region_configuration.primary_key Block below.
    replicaKeys List<Property Map>
    Key ARNs and Regions of all replica keys. Includes the current KMS key if it is a replica key. See multi_region_configuration.replica_keys Block below.

    GetKeyMultiRegionConfigurationPrimaryKey

    Arn string
    Key ARN of a primary or replica key of a multi-Region key.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Arn string
    Key ARN of a primary or replica key of a multi-Region key.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    arn string
    Key ARN of a primary or replica key of a multi-Region key.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    arn String
    Key ARN of a primary or replica key of a multi-Region key.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    arn string
    Key ARN of a primary or replica key of a multi-Region key.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    arn str
    Key ARN of a primary or replica key of a multi-Region key.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    arn String
    Key ARN of a primary or replica key of a multi-Region key.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.

    GetKeyMultiRegionConfigurationReplicaKey

    Arn string
    Key ARN of a primary or replica key of a multi-Region key.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Arn string
    Key ARN of a primary or replica key of a multi-Region key.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    arn string
    Key ARN of a primary or replica key of a multi-Region key.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    arn String
    Key ARN of a primary or replica key of a multi-Region key.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    arn string
    Key ARN of a primary or replica key of a multi-Region key.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    arn str
    Key ARN of a primary or replica key of a multi-Region key.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    arn String
    Key ARN of a primary or replica key of a multi-Region key.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.

    GetKeyXksKeyConfiguration

    Id string
    ID of the external key in the external key manager.
    Id string
    ID of the external key in the external key manager.
    id string
    ID of the external key in the external key manager.
    id String
    ID of the external key in the external key manager.
    id string
    ID of the external key in the external key manager.
    id str
    ID of the external key in the external key manager.
    id String
    ID of the external key in the external key manager.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo aws logo
    Viewing docs for AWS v7.50.0
    published on Thursday, Oct 8, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial