Question: How do I import my keys into AWS Key Management Service?

I want to import my key material into AWS Key Management Service (AWS KMS) so I can use 256-bit symmetric keys with AWS services.

ResolutionAWS KMS allows you to import your key material into an AWS KMS key. You can then use this key with AWS services that are supported by AWS KMS.Follow these steps to import your key material into AWS KMS:1.    Create an AWS KMS key with no key material. Note your AWS KMS key's ID.Note: For Define Key Administrative Permissions and Define Key Usage Permissions, it's a best practice to separate the key administrator and key roles. This limits the impact if either credential is exposed.2.    Open a terminal on your local machine or Amazon Elastic Compute Cloud (Amazon EC2) instance with OpenSSL installed. For more information, see the OpenSSL website.3.    To generate a 256-bit symmetric key, run the following command:openssl rand -out PlaintextKeyMaterial.bin 324.    To describe the key and get the parameters for the import, run the following AWS Command Line Interface (AWS CLI) commands:Note: The commands store the public key and import token parameters into a variable.export KEY=`aws kms --region eu-west-2 get-parameters-for-import --key-id example1-2345-67ab-9123-456789abcdef --wrapping-algorithm RSAES_OAEP_SHA_256 --wrapping-key-spec RSA_2048 --query '{Key:PublicKey,Token:ImportToken}' --output text`5.    To place the public key and import token into separate base64-encoded files, run the following command:echo $KEY | awk '{print $1}' > PublicKey.b64echo $KEY | awk '{print $2}' > ImportToken.b646.    To convert the base64-encoded file into binary files to import, run the following commands:openssl enc -d -base64 -A -in PublicKey.b64 -out PublicKey.binopenssl enc -d -base64 -A -in ImportToken.b64 -out ImportToken.bin7.    To encrypt the key material with the public key that was converted to a binary file, run the following command:openssl pkeyutl -in PlaintextKeyMaterial.bin -out EncryptedKeyMaterial.bin -inkey PublicKey.bin -keyform DER -pubin -encrypt -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha2568.    To import the encrypted key material into AWS KMS, run the following command:Note: This example specifies that the key material doesn't expire, but you can set an expiration date for your key material. For more information, see ExpirationModel.aws kms --region eu-west-2 import-key-material --key-id example1-2345-67ab-9123-456789abcdef --encrypted-key-material fileb://EncryptedKeyMaterial.bin --import-token fileb://ImportToken.bin --expiration-model KEY_MATERIAL_DOES_NOT_EXPIRE9.    Verify that the imported key status is set to Enabled. To do this, review the key in the AWS KMS console, or run the DescribeKey API action.If you can't import your key, then note the following causes and resolutions:You waited longer than 24 hours and the import token is expired. To resolve this, download the wrapping key and import token again to re-encrypt the key material.Your key material is not a 256-bit symmetric key. To resolve this, verify that the file size of the encrypted key material is 32 bytes. To check the file size, run one of the following commands:Linuxwc -c <filename>.binWindowsdir <filename>.binFor more information, see Importing key material in AWS KMS keys.

Related informationAbout imported key materialI'm using OpenSSL to import my key into AWS KMS, but I'm getting an "InvalidCiphertext" error. How can I fix this?