• HashiCorp Developer

  • HashiCorp Cloud Platform
  • Terraform
  • Packer
  • Consul
  • Vault
  • Boundary
  • Nomad
  • Waypoint
  • Vagrant
Vault
  • Install
  • Tutorials
  • Documentation
  • API
  • Integrations
  • Try Cloud(opens in new tab)
  • Sign up
Vault Home

Documentation

Skip to main content
  • Documentation
  • What is Vault?
  • Use Cases

  • Browser Support
  • Installing Vault

    • Overview
    • Active Directory
    • AliCloud
    • AWS
    • Azure
    • Consul
    • Cubbyhole
    • Google Cloud
    • Google Cloud KMS
      • Overview
      • Azure Key Vault
      • AWS KMS
      • GCP Cloud KMS
    • KMIP
      ENTERPRISEENTERPRISE
    • Kubernetes
    • MongoDB Atlas
    • Nomad
    • LDAP
    • RabbitMQ
    • Terraform Cloud
    • TOTP
    • Venafi (Certificates)
  • Vault Integration Program
  • Vault Interoperability Matrix
  • Troubleshoot






  • Glossary


  • Resources

  • Tutorial Library
  • Certifications
  • Community Forum
    (opens in new tab)
  • Support
    (opens in new tab)
  • GitHub
    (opens in new tab)
  1. Developer
  2. Vault
  3. Documentation
  4. Secrets Engines
  5. Key Management
  6. AWS KMS
  • Vault
  • v1.11.x
  • v1.10.x
  • v1.9.x
  • v1.8.x
  • v1.7.x
  • v1.6.x
  • v1.5.x
  • v1.4.x

»AWS KMS

Note: This secret engine requires Vault Enterprise with the Advanced Data Protection Module.

The Key Management secrets engine supports lifecycle management of keys in AWS KMS regions. This is accomplished by configuring a KMS provider resource with the awskms provider and other provider-specific parameter values.

The following sections describe how to properly configure the secrets engine to enable the functionality.

Authentication

The Key Management secrets engine must be configured with credentials that have sufficient permissions to manage keys in an AWS KMS region. The authentication parameters are described in the credentials section of the API documentation. The authentication parameters will be set with the following order of precedence:

  1. KMS provider credentials
  2. Environment variables
  3. Shared credentials file
  4. IAM role for AWS EC2 or ECS task

The IAM principal associated with the provided credentials must have the following minimum AWS KMS permissions:

  • kms:CreateKey
  • kms:GetParametersForImport
  • kms:ImportKeyMaterial
  • kms:EnableKey
  • kms:DisableKey
  • kms:ScheduleKeyDeletion
  • kms:CreateAlias
  • kms:UpdateAlias
  • kms:DeleteAlias
  • kms:ListAliases
  • kms:TagResource

Configuration

The following is an example of how to configure the KMS provider resource using the Vault CLI:

$ vault write keymgmt/kms/example-kms \
    provider="awskms" \
    key_collection="us-west-1" \
    credentials=access_key="ASIADJO3WTX6WPLJM42V" \
    credentials=secret_key="bCiYmNroLxLmPNQ47VIvjlm8mQu5oktZcQdq195w"

Refer to the AWS KMS API documentation for a detailed description of individual configuration parameters.

Key Transfer Specification

Keys are securely transferred from the secrets engine to AWS KMS regions in accordance with the AWS KMS Bring Your Own Key specification.

Key Rotation

AWS KMS keys with imported key material are not eligible for automatic key rotation within AWS KMS. As such, key rotations performed by the secrets engine use the manual key rotation process. Applications should refer to the alias associated with imported keys. Aliases will always have the form: hashicorp/<key_name>-<unix_timestamp>.

Key Purpose Compatability

The following table defines which key purposes can be used for each key type supported by AWS KMS.

Key TypePurpose
aes256-gcm96encrypt and decrypt
Edit this page on GitHub

On this page

  1. AWS KMS
  2. Authentication
  3. Configuration
  4. Key Transfer Specification
  5. Key Rotation
  6. Key Purpose Compatability
Give Feedback(opens in new tab)
  • Certifications
  • System Status
  • Terms of Use
  • Security
  • Privacy
  • Trademark Policy
  • Trade Controls
  • Give Feedback(opens in new tab)