Key Management Service (KMS) is an encryption and key management web service. This guide describes\nthe KMS operations that you can call programmatically. For general information about KMS,\nsee the \nKey Management Service Developer Guide\n.
\nKMS has replaced the term customer master key (CMK) with Key Management Service key\nand KMS key. The concept has not changed. To prevent breaking changes, KMS is keeping some variations of this term.
\nAmazon Web Services provides SDKs that consist of libraries and sample code for various programming\nlanguages and platforms (Java, Rust, Python, Ruby, .Net, macOS, Android, etc.). The SDKs\nprovide a convenient way to create programmatic access to KMS and other Amazon Web Services services.\nFor example, the SDKs take care of tasks such as signing requests (see below), managing\nerrors, and retrying requests automatically. For more information about the Amazon Web Services SDKs,\nincluding how to download and install them, see Tools\nfor Amazon Web Services.
\nWe recommend that you use the Amazon Web Services SDKs to make programmatic API calls to KMS.
\nIf you need to use FIPS 140-2 validated cryptographic modules when communicating with\nAmazon Web Services, use one of the FIPS endpoints in your preferred Amazon Web Services Region. If you need communicate\nover IPv6, use the dual-stack endpoint in your preferred Amazon Web Services Region. For more information\nsee Service\nendpoints in the Key Management Service topic of the Amazon Web Services General Reference and Dual-stack endpoint\nsupport in the KMS Developer Guide.
\nAll KMS API calls must be signed and be transmitted using Transport Layer Security\n(TLS). KMS recommends you always use the latest supported TLS version. Clients must also\nsupport cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral Diffie-Hellman\n(DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems such as Java 7\nand later support these modes.
\n\nSigning Requests\n
\nRequests must be signed using an access key ID and a secret access key. We strongly\nrecommend that you do not use your Amazon Web Services account root access key ID and secret access key for\neveryday work. You can use the access key ID and secret access key for an IAM user or you\ncan use the Security Token Service (STS) to generate temporary security credentials and use those to sign\nrequests.
\nAll KMS requests must be signed with Signature Version 4.
\n\nLogging API Requests\n
\nKMS supports CloudTrail, a service that logs Amazon Web Services API calls and related events for your\nAmazon Web Services account and delivers them to an Amazon S3 bucket that you specify. By using the\ninformation collected by CloudTrail, you can determine what requests were made to KMS, who made\nthe request, when it was made, and so on. To learn more about CloudTrail, including how to turn it\non and find your log files, see the CloudTrail User Guide.
\n\nAdditional Resources\n
\nFor more information about credentials and request signing, see the following:
\n\nAmazon Web Services\nSecurity Credentials - This topic provides general information about the types\nof credentials used to access Amazon Web Services.
\n\nTemporary\nSecurity Credentials - This section of the IAM User Guide\ndescribes how to create and use temporary security credentials.
\n\nSignature Version\n4 Signing Process - This set of topics walks you through the process of signing\na request using an access key ID and a secret access key.
\n\nCommonly Used API Operations\n
\nOf the API operations discussed in this guide, the following will prove the most useful\nfor most applications. You will likely perform operations other than these, such as creating\nkeys and assigning policies, by using the console.
\n\nEncrypt\n
\n\nDecrypt\n
\n\nGenerateDataKey\n
\n