AWS KMS

Enterprise

Appropriate Vault Enterprise license or HCP Vault Dedicated cluster required.

AWS KMS secrets engine requires Vault Enterprise with the Advanced Data Protection (ADP) module.

The Key Management secrets engine supports lifecycle management of keys in AWS KMS regions. This is accomplished by configuring a KMS provider resource with the awskms provider and other provider-specific parameter values.

The following sections describe how to properly configure the secrets engine to enable the functionality.

Authentication

The Key Management secrets engine must be configured with credentials that have sufficient permissions to manage keys in an AWS KMS region. The authentication parameters are described in the credentials section of the API documentation. The authentication parameters will be set with the following order of precedence:

KMS provider credentials
Environment variables
Shared credentials file
IAM role for AWS EC2 or ECS task

The IAM principal associated with the provided credentials must have the following minimum AWS KMS permissions:

You must have the following permissions to use multi-region keys:

Configuration

The following is an example of how to configure the KMS provider resource using the Vault CLI:

$ vault write keymgmt/kms/example-kms \
    provider="awskms" \
    key_collection="us-west-1" \
    credentials=access_key="ASIADJO3WTX6WPLJM42V" \
    credentials=secret_key="bCiYmNroLxLmPNQ47VIvjlm8mQu5oktZcQdq195w"

Refer to the AWS KMS API documentation for a detailed description of individual configuration parameters.

Key transfer specification

Keys are securely transferred from the secrets engine to AWS KMS regions in accordance with the AWS KMS Bring Your Own Key specification.

Key rotation

AWS KMS keys with imported key material are not eligible for automatic key rotation within AWS KMS. As such, key rotations performed by the secrets engine use the manual key rotation process. Applications should refer to the alias associated with imported keys. Aliases will always have the form: hashicorp/<key_name>-<unix_timestamp>.

Multi-region keys

You can use the Key Management secrets engine to distribute keys as AWS KMS multi-region keys to make the same key material available in multiple AWS regions. Multi-region keys can improve performance for applications that operate across regions by lowering latency on cryptographic operations and helping with cross-region disaster recovery.

Vault currently limits multi-region support to aes256-gcm96 keys with the awskms provider, and sets the primary region based on the key_collection parameter on the KMS provider resource.

Multi-region key replication

When you create a multi-region key, you must set replica_regions and call the /replicate endpoint after distributing the key:

Create the key with explicit replica regions. You cannot change the assigned regions after key creation:

$ vault write keymgmt/key/example-key \
    type="aes256-gcm96"               \
    replica_regions="us-east-1,eu-west-1"

Distribute the key to the primary KMS region. Distributing the key creates a multi-region primary CMK in the primary region and imports the key material:
Call the /replicate endpoint to replicate the key to the regions set in replica_regions during key creation:

Key purpose compatibility

The following table defines which key purposes can be used for each key type supported by AWS KMS.

Key Type	Purpose
`aes256-gcm96`	`encrypt` and `decrypt`