Key Life Cycle Management APIs
This section describes the CCKM Key Life Cycle Management APIs for AWS.
Creating AWS Keys on CCKM
Use the post /v1/cckm/aws/keys API to create an AWS key on the CCKM.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "kms": "<kms id>",\n "region": "<region>",\n "aws_param": {<aws parameters>}' --compressed
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| kms | string | Name or ID of the KMS. |
| region | string | Name of the region. |
| aws_param | JSON | Key parameters such as alias, description, and usage. Refer to AWS Key Parameters for details. |
| external_accounts | array of strings | AWS accounts that can use this key. |
| key_admins | array of strings | IAM users who can administer this key using the KMS API. |
| key_users | array of strings | IAM users who can use this key in cryptographic operations. |
AWS Key Parameters
| Parameter | Type | Description |
|---|---|---|
| Alias | string | Alias of the key. |
| BypassPolicyLockoutSafetyCheck | boolean | Flag to bypass the key policy lockout safety check. |
| CustomerMasterKeySpec | string | Type of the key. Supported types are: • SYMMETRIC_DEFAULT (Default) • RSA_2048 (Asymmetric) • RSA_3072 (Asymmetric) • RSA_4096 (Asymmetric) • ECC_NIST_P256 (secp256r1) (Asymmetric) • ECC_NIST_P384 (secp384r1) (Asymmetric) • ECC_NIST_P521 (secp521r1) (Asymmetric) • ECC_SECG_P256K1 (secp256k1) (Asymmetric) |
| Description | string | Description of the key. |
| KeyUsage | string | Cryptographic operations performed by the key. Supported operations are: • ENCRYPT_DECRYPT • SIGN_VERIFY |
| Origin | string | Source of the key material. The key origin cannot be changed. The origin of the key can be: • AWS_KMS • External |
| Policy | JSON | Key policy used by the key. |
| Tags | array of JSONs | An optional parameter to add additional information to the key. The value must be specified as the key-value pair. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiOWU0ODBkZTktZTE4NC00ZDAyLTk5NjAtMzQ1NTU1ZDBjY2VmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImY1YzJjOTQzLWU0ZTAtNDQ2Yy04YmIyLTFjMWU4NjQzMTMzOCIsImlhdCI6MTU5NjYwNTI3MSwiZXhwIjoxNTk2NjA1NTcxfQ.xzpxhtlE3fZqUYZA_OZ4HcRmEaM-MToNgt4ubQKG_sw' -H 'Content-Type: application/json' --data-binary $'{\n "kms": "kms-name",\n "region": "ap-southeast-1",\n "aws_param": {\n "Alias": "key-test",\n "Tags": [\n {\n "TagKey": "key",\n "TagValue": "value"\n }\n ]\n }\n}' --compressed
Example Response
{
"id": "bbb05a14-7f48-4c4d-92af-2b3ff6d637d8",
"uri": "kylo:kylo:cckm:aws-key:bbb05a14-7f48-4c4d-92af-2b3ff6d637d8",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:30:32.060990387Z",
"updatedAt": "2020-08-05T05:30:32.058119983Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE",
"synced_at": "2020-08-05T05:30:32.053614984Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/b7724b44-2d9d-4b77-8528-
3db27667ed2f",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "b7724b44-2d9d-4b77-8528-3db27667ed2f",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:30:31Z",
"Policy": {
"Version": "2012-10-17",
"Id": "key-default-1",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
},
"Alias": [
"alias/key-test"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows that an AWS key (with alias key-test) is created on the AWS KMS. A unique ID (bbb05a14-7f48-4c4d-92af-2b3ff6d637d8) for the key is returned.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Fetching List of AWS Keys
Use the get /v1/cckm/aws/keys API to view the list of the AWS keys. The results can be filtered using the query parameters.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys?skip=0&limit=10&sort=updatedAt' -H 'Authorization: Bearer AUTHTOKEN' --compressed
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Request Query Parameters
| Parameter | Type | Description |
|---|---|---|
| id | string | Internal ID of the AWS key. |
| keyid | string | ID of the AWS key. |
| alias | string | Alias of the key. |
| kms | string | Name of the AWS KMS. |
| kms_id | string | ID of the AWS KMS. |
| region | string | Region name. |
| cloud_name | string | Cloud name. |
| origin | string | Origin of the AWS key. |
| job_config_id | string | ID of the scheduler configuration job. |
| enabled | boolean | Fetches the enabled keys. |
| gone | boolean | Fetches keys based on their existence in the cloud. |
| tags | string | Fetches the keys based on valid tag values. |
| keystate | string | State of the AWS key. |
| rotation_job_enabled | boolean | Fetches the key based on the rotation job status. |
| CustomerMasterKeySpec | string | Fetches keys based on CustomerMasterKeySpec. |
| skip | integer | Number of records to skip. For example, if "skip":5 is specified, the first five records will not be displayed in the output. |
| limit | integer | Numbers of records to display. For example, if "limit":10 is specified, then the next 10 records (after skipping the number of records specified in the skip parameter ) will be displayed in the output. |
| sort | string | Comma-delimited list of properties to sort the results. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys?skip=0&limit=10&sort=updatedAt' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiOWU0ODBkZTktZTE4NC00ZDAyLTk5NjAtMzQ1NTU1ZDBjY2VmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImY1YzJjOTQzLWU0ZTAtNDQ2Yy04YmIyLTFjMWU4NjQzMTMzOCIsImlhdCI6MTU5NjYwNTI3MSwiZXhwIjoxNTk2NjA1NTcxfQ.xzpxhtlE3fZqUYZA_OZ4HcRmEaM-MToNgt4ubQKG_sw' --compressed
Example Response
{
"skip": 0,
"limit": 10,
"total": 2,
"resources": [
{
"id": "0883e632-da66-4b41-b36b-18f0ed2ea03a",
"uri": "kylo:kylo:cckm:aws-key:0883e632-da66-4b41-b36b-18f0ed2ea03a",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:32:20.639581Z",
"updatedAt": "2020-08-05T05:32:20.63796Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:32:20.633629Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/ccaf94d9-6d70-
4b27-94be-63ee4faf75bf",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "ccaf94d9-6d70-4b27-94be-63ee4faf75bf",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:32:19Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/key-test-2"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
},
{
"id": "bbb05a14-7f48-4c4d-92af-2b3ff6d637d8",
"uri": "kylo:kylo:cckm:aws-key:bbb05a14-7f48-4c4d-92af-2b3ff6d637d8",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:30:32.06099Z",
"updatedAt": "2020-08-05T05:30:32.05812Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:30:32.053615Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/b7724b44-2d9d-
4b77-8528-3db27667ed2f",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "b7724b44-2d9d-4b77-8528-3db27667ed2f",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:30:31Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/key-test"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
]
}
The sample output shows the list of the AWS keys.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Viewing Details of AWS Keys
Use the get /v1/cckm/aws/keys/{id} API to view the details of an AWS key with a specific id.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}' -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the key ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/bbb05a14-7f48-4c4d-92af-2b3ff6d637d8' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiOWU0ODBkZTktZTE4NC00ZDAyLTk5NjAtMzQ1NTU1ZDBjY2VmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImY1YzJjOTQzLWU0ZTAtNDQ2Yy04YmIyLTFjMWU4NjQzMTMzOCIsImlhdCI6MTU5NjYwNTI3MSwiZXhwIjoxNTk2NjA1NTcxfQ.xzpxhtlE3fZqUYZA_OZ4HcRmEaM-MToNgt4ubQKG_sw' --compressed
Example Response
{
"id": "bbb05a14-7f48-4c4d-92af-2b3ff6d637d8",
"uri": "kylo:kylo:cckm:aws-key:bbb05a14-7f48-4c4d-92af-2b3ff6d637d8",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:30:32.06099Z",
"updatedAt": "2020-08-05T05:30:32.05812Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:30:32.053615Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/b7724b44-2d9d-4b77-8528-
3db27667ed2f",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "b7724b44-2d9d-4b77-8528-3db27667ed2f",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:30:31Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/key-test"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows the details corresponding to the key (with ID bbb05a14-7f48-4c4d-92af-2b3ff6d637d8).
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Deleting AWS Keys from CCKM
Use the delete /v1/cckm/aws/keys/{id} API to delete an AWS key from the CCKM.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}' -X DELETE -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the key ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/bbb05a14-7f48-4c4d-92af-2b3ff6d637d8' -X DELETE -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiOWU0ODBkZTktZTE4NC00ZDAyLTk5NjAtMzQ1NTU1ZDBjY2VmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImMwMTdiZTk1LTViNDctNGI1YS1hZmM4LTEwODExOWFiYWQ5YiIsImlhdCI6MTU5NjYwNTY1NSwiZXhwIjoxNTk2NjA1OTU1fQ.hmN4G7NGn0y3HzWsL8DspO3dWdEkuqmxR_R-XRzf7VI' --compressed
Example Response
{
"status": 204
}
The sample output shows that the key (with ID bbb05a14-7f48-4c4d-92af-2b3ff6d637d8) is deleted successfully from the CCKM and "status": 204 is returned in response.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Downloading Keys Created on AWS to CCKM
Use the post /v1/cckm/aws/synchronization-jobs API to download the keys created on the AWS KMS to the CCKM based on the KMS name and regions. If any region is not specified, then the AWS keys from all the regions will be synchronized.
Syntax
curl -k '<IP>/api/v1/cckm/aws/synchronization-jobs' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "kms": ["<kms_identifier>"],\n "regions": ["<region>"]\n}' --compressed
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| KMS | array of strings | Name or ID of the KMS from which the AWS keys will be synchronized. |
| regions | array of strings | Regions from which the AWS keys will be synchronized. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/synchronization-jobs' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiOWU0ODBkZTktZTE4NC00ZDAyLTk5NjAtMzQ1NTU1ZDBjY2VmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjU0NmIzNGE2LTcxYWYtNGQ1Ny04MGI3LWZiYTk4YTVjNWQwOCIsImlhdCI6MTU5NjYwNTk0OCwiZXhwIjoxNTk2NjA2MjQ4fQ._OQQOcury2w-4YFdSJa-VJUFG0ZlIDU91pR7c0ZKoFY' -H 'Content-Type: application/json' --data-binary $'{\n "kms": ["kms-name"],\n "regions": ["ap-southeast-1"]\n}' --compressed
Example Response
{
"id": "37f499bc-e57b-444c-a157-5a9c78784fe3",
"uri": "kylo:kylo:cckm:synchronize:37f499bc-e57b-444c-a157-5a9c78784fe3",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:39:10.049621831Z",
"updatedAt": "2020-08-05T05:39:10.05272589Z",
"overall_status": "in progress",
"cloud": "aws",
"regions": [
"ap-southeast-1"
],
"kms": [
"kms-name"
],
"abort": false
}
The sample output shows that the synchronization-jobs API has started downloading the keys from the region (ap-southeast-1) of the KMS (kms-name) to the CCKM. The status of synchronization process is in progress. A unique ID (37f499bc-e57b-444c-a157-5a9c78784fe3) for the synchronization process is returned.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Note
You can also schedule synchronization of the AWS keys when needed using the scheduler API. Refer to Scheduling Synchronization for details.
Viewing Synchronization Status
Use the get /v1/cckm/aws/synchronization-jobs API to view the status of the synchronization job. The results can be filtered using the query parameters.
Syntax
curl -k '<IP>/api/v1/cckm/aws/synchronization-jobs?skip=0&limit=10' -H 'Authorization: Bearer AUTHTOKEN' --compressed
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Request Query Parameters
| Parameter | Type | Description |
|---|---|---|
| id | string | Internal ID of the synchronization. |
| overall_status | string | Overall synchronization status. |
| skip | integer | Number of records to skip. For example, if "skip":5 is specified, the first five records will not be displayed in the output. |
| limit | integer | Numbers of records to display. For example, if "limit":10 is specified, then the next 10 records (after skipping the number of records specified in the skip parameter) will be displayed in the output. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/synchronization-jobs?skip=0&limit=10' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiOWU0ODBkZTktZTE4NC00ZDAyLTk5NjAtMzQ1NTU1ZDBjY2VmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjU0NmIzNGE2LTcxYWYtNGQ1Ny04MGI3LWZiYTk4YTVjNWQwOCIsImlhdCI6MTU5NjYwNTk0OCwiZXhwIjoxNTk2NjA2MjQ4fQ._OQQOcury2w-4YFdSJa-VJUFG0ZlIDU91pR7c0ZKoFY' --compressed
Example Response
{
"skip": 0,
"limit": 10,
"total": 2,
"resources": [
{
"id": "37f499bc-e57b-444c-a157-5a9c78784fe3",
"uri": "kylo:kylo:cckm:synchronize:37f499bc-e57b-444c-a157-5a9c78784fe3",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:39:10.049622Z",
"updatedAt": "2020-08-05T05:39:20.68137Z",
"completed_at": "2020-08-05T05:39:20.680806Z",
"overall_status": "synchronization completed",
"detailed_status": {
"123456789012/ap-southeast-1": "region synchronized successfully"
},
"cloud": "aws",
"regions": [
"ap-southeast-1"
],
"kms": [
"kms-name"
],
"abort": false
},
{
"id": "2d6915aa-5ead-4733-9cec-2a96433b764f",
"uri": "kylo:kylo:cckm:synchronize:2d6915aa-5ead-4733-9cec-2a96433b764f",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:41:14.830136Z",
"updatedAt": "2020-08-05T05:41:24.273419Z",
"completed_at": "2020-08-05T05:41:24.272752Z",
"overall_status": "synchronization aborted",
"detailed_status": {
"123456789012/eu-north-1": "in progress"
},
"cloud": "aws",
"kms": [
"kms-name"
],
"abort": true
}
]
}
The sample output shows the status of the synchronization processes.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Aborting Synchronization Jobs
Use the post /v1/cckm/aws/synchronization-jobs/{id}/cancel API to cancel a specific synchronization job.
Syntax
curl -k '<IP>/api/v1/cckm/aws/synchronization-jobs/{id}/cancel' -X POST -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the synchronization job ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/synchronization-jobs/2d6915aa-5ead-4733-9cec-2a96433b764f/cancel' -X POST -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiOWU0ODBkZTktZTE4NC00ZDAyLTk5NjAtMzQ1NTU1ZDBjY2VmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjU0NmIzNGE2LTcxYWYtNGQ1Ny04MGI3LWZiYTk4YTVjNWQwOCIsImlhdCI6MTU5NjYwNTk0OCwiZXhwIjoxNTk2NjA2MjQ4fQ._OQQOcury2w-4YFdSJa-VJUFG0ZlIDU91pR7c0ZKoFY' --compressed
Example Response
{
"id": "2d6915aa-5ead-4733-9cec-2a96433b764f",
"uri": "kylo:kylo:cckm:synchronize:2d6915aa-5ead-4733-9cec-2a96433b764f",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:41:14.830136Z",
"updatedAt": "2020-08-05T05:41:23.847193245Z",
"overall_status": "in progress",
"detailed_status": {
"123456789012/eu-north-1": "in progress"
},
"cloud": "aws",
"kms": [
"kms-name"
],
"abort": true
}
The sample output shows that the abort parameter is set to true. This indicates that the synchronization job (with ID (2d6915aa-5ead-4733-9cec-2a96433b764f) is canceled.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Viewing Details of Synchronization Jobs
Use the get /v1/cckm/aws/synchronization-jobs/{id} API to view the details of a synchronization job with a specific ID.
Syntax
curl -k '<IP>/api/v1/cckm/aws/synchronization-jobs/{id}' -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the synchronization job ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/synchronization-jobs/37f499bc-e57b-444c-a157-5a9c78784fe3' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiOWU0ODBkZTktZTE4NC00ZDAyLTk5NjAtMzQ1NTU1ZDBjY2VmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImM4YTBlYWQyLTcwZjItNGZhMy1hMGU2LWY3ODdjN2M3MDYwMSIsImlhdCI6MTU5NjYwNjI4MSwiZXhwIjoxNTk2NjA2NTgxfQ.__I0niHKBJbetS2mHkPiKL3wHQaUYGG4QbAS9t7ESwA' --compressed
Example Response
{
"id": "37f499bc-e57b-444c-a157-5a9c78784fe3",
"uri": "kylo:kylo:cckm:synchronize:37f499bc-e57b-444c-a157-5a9c78784fe3",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:39:10.049622Z",
"updatedAt": "2020-08-05T05:39:20.68137Z",
"completed_at": "2020-08-05T05:39:20.680806Z",
"overall_status": "synchronization completed",
"detailed_status": {
"123456789012/ap-southeast-1": "region synchronized successfully"
},
"cloud": "aws",
"regions": [
"ap-southeast-1"
],
"kms": [
"kms-name"
],
"abort": false
}
The sample output shows the details corresponding to the synchronization job ( with ID 37f499bc-e57b-444c-a157-5a9c78784fe3).
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Uploading Keys to AWS KMS
Use the post /v1/cckm/aws/upload-key API to upload a key created on the CipherTrust Manager to the AWS KMS.
Syntax
curl -k '<IP>/api/v1/cckm/aws/upload-key' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "source_key_identifier": "<source_key_identifier>",\n "region": "<region>",\n "kms": "<kms_identifier>",\n "KeyExpiration": <boolean>,\n "aws_param": {<aws parameters>}' --compressed
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| kms | string | Name or ID of the KMS where the key will be uploaded. |
| region | string | Name of the region. |
| source_key_identifier | string | Name or ID of the key to be uploaded. This key is created on the CipherTrust Manager. |
| aws_param | JSON | AWS key parameters such as alias, description, and usage. Refer to AWS Key Parameters for details. |
| external_accounts | array of strings | AWS accounts that can use this key. |
| key_admins | array of strings | IAM users who can administer this key using the KMS API. |
| key_expiration | boolean | Flag to enable key expiration. |
| key_users | array of strings | IAM users who can use this key in cryptographic operations. |
AWS Key Parameters
| Parameter | Type | Description |
|---|---|---|
| Alias | string | Alias of the key. |
| BypassPolicyLockoutSafetyCheck | boolean | Flag to bypass the key policy lockout safety check. |
| Description | string | Description of the key. |
| Policy | string | Key policy used by the key. |
| Tags | array of JSONs | An optional parameter to add additional information to the key. The value must be specified as the key-value pair. |
| ValidTo | string | Key expiration time, must be formatted as per RFC3339. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/upload-key' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZTQyMjE3NjYtMzE3NS00ODBmLWIzY2EtMGU0NzYzMzM1ZmI4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImFlYmM5MGJlLWY0ZWUtNDBmMS1hMDE2LTUxMDIyMTUzNjYyYSIsImlhdCI6MTU5NjYxMjg1MCwiZXhwIjoxNTk2NjEzMTUwfQ.tqvMRZDFa1w7GTcHv9Ly99Bu0XdF68cDNcRI1V7-Cxs' -H 'Content-Type: application/json' --data-binary $'{\n "source_key_identifier": "aes_key",\n "region": "ap-southeast-1",\n "kms": "kms-name",\n "KeyExpiration": true,\n "aws_param": {\n "Alias": "TestUploadKey",\n "Tags": [\n {\n "TagKey": "key",\n "TagValue": "value"\n }\n ],\n "ValidTo": "2021-07-24T04:10:56.180805743Z"\n }\n}' --compressed
Example Response
{
"id": "62909f80-a546-469a-9666-f0b15d372cbe",
"uri": "kylo:kylo:cckm:aws-key:62909f80-a546-469a-9666-f0b15d372cbe",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T07:35:07.992884578Z",
"updatedAt": "2020-08-05T07:35:08.705870871Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T07:35:07.970464896Z",
"local_key_id": "fa897e9382564352a65b02769cfb8217c37da335943a4c6f82d92bf88e6e99cf",
"local_key_name": "aes_key",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/5bb6fef8-6673-4c53-ab2e-
b6a50063dd44",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "5bb6fef8-6673-4c53-ab2e-b6a50063dd44",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "EXTERNAL",
"CreationDate": "2020-08-05T07:35:07Z",
"Policy": {
"Version": "2012-10-17",
"Id": "key-default-1",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
},
"Alias": [
"alias/TestUploadKey"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false,
"ExpirationModel": "KEY_MATERIAL_DOES_NOT_EXPIRE"
}
}
The sample output shows that a key (with alias TestUploadKey) is uploaded to the AWS KMS. As the key is not created on the AWS KMS, its origin is EXTERNAL. A unique ID (62909f80-a546-469a-9666-f0b15d372cbe) for the uploaded key is returned.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Importing Key Material to AWS KMS
Use the post /v1/cckm/aws/keys/{id}/import-material API to import the key material to the AWS KMS.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/import-material' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "source_key_identifier": "<source_key_identifier>",\n "key_expiration": <boolean>,\n "valid_to": "<key validity>"\n}' --compressed
Here, {id} represents the key material ID.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| key_expiration | boolean | Flag to disable encryption on the key which is getting rotated. |
| source_key_identifier | string | Name or ID of the key to be imported to the AWS KMS. This key is created on the CipherTrust Manager. The AWS also allows re-importing the same key material, therefore it is mandatory to provide source key identifier of the same key which was imported previously. By default, a new CipherTrust Manager key would be generated automatically. |
| valid_to | string | Key expiration time of the newly rotated key, must be formatted as per RFC3339. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/132522b2-5663-402e-8718-23a8d66207d4/import-material' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZTQyMjE3NjYtMzE3NS00ODBmLWIzY2EtMGU0NzYzMzM1ZmI4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImFiYjA2MWMyLTIyODctNDQyOC05OTUwLTI5NGU5Y2FhM2VjMCIsImlhdCI6MTU5NjYxMzEwNSwiZXhwIjoxNTk2NjEzNDA1fQ.E-VCb8zY1UvXGbC-vST3S3mMdQWmLz2sDQQAz8iC2LA' -H 'Content-Type: application/json' --data-binary $'{\n "source_key_identifier": "aes_key",\n "key_expiration": true,\n "valid_to": "2021-07-24T04:10:56.180805743Z"\n}' --compressed
Example Response
{
"id": "132522b2-5663-402e-8718-23a8d66207d4",
"uri": "kylo:kylo:cckm:aws-key:132522b2-5663-402e-8718-23a8d66207d4",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T07:37:41.684075Z",
"updatedAt": "2020-08-05T07:38:29.685841431Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T07:37:41.667362Z",
"local_key_id": "fa897e9382564352a65b02769cfb8217c37da335943a4c6f82d92bf88e6e99cf",
"local_key_name": "aes_key",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/cbde84f3-fc83-401f-9273-
c62611935adf",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "cbde84f3-fc83-401f-9273-c62611935adf",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "EXTERNAL",
"CreationDate": "2020-08-05T07:37:40Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/ImportKeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"ValidTo": "2021-07-24T04:10:56.180805743Z",
"KeyRotationEnabled": false,
"ExpirationModel": "KEY_MATERIAL_EXPIRES"
}
}
The sample output shows that the key material is imported to the AWS KMS. As the key is not created on the AWS KMS, its origin is EXTERNAL. A unique ID (132522b2-5663-402e-8718-23a8d66207d4) for the imported key is returned.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Deleting Imported Key Material
Use the post /v1/cckm/aws/keys/{id}/delete-material API to delete an imported key material from the AWS KMS.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/delete-material' -X POST -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the key material ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/132522b2-5663-402e-8718-23a8d66207d4/delete-material' -X POST -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZTQyMjE3NjYtMzE3NS00ODBmLWIzY2EtMGU0NzYzMzM1ZmI4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImFiYjA2MWMyLTIyODctNDQyOC05OTUwLTI5NGU5Y2FhM2VjMCIsImlhdCI6MTU5NjYxMzEwNSwiZXhwIjoxNTk2NjEzNDA1fQ.E-VCb8zY1UvXGbC-vST3S3mMdQWmLz2sDQQAz8iC2LA' --compressed
Example Response
{
"id": "132522b2-5663-402e-8718-23a8d66207d4",
"uri": "kylo:kylo:cckm:aws-key:132522b2-5663-402e-8718-23a8d66207d4",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T07:37:41.684075Z",
"updatedAt": "2020-08-05T07:39:31.634355989Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T07:37:41.667362Z",
"local_key_id": "fa897e9382564352a65b02769cfb8217c37da335943a4c6f82d92bf88e6e99cf",
"local_key_name": "aes_key",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/cbde84f3-fc83-401f-9273-
c62611935adf",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Enabled": false,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "cbde84f3-fc83-401f-9273-c62611935adf",
"KeyManager": "CUSTOMER",
"KeyState": "PendingImport",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "EXTERNAL",
"CreationDate": "2020-08-05T07:37:40Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/ImportKeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false,
"ExpirationModel": "KEY_MATERIAL_EXPIRES"
}
}
The sample output shows that the imported key material (with ID 132522b2-5663-402e-8718-23a8d66207d4) is deleted from the AWS KMS.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Scheduling Key Deletion
Use the post /v1/cckm/aws/keys/{id}/schedule-deletion API to schedule deletion of a key.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/schedule-deletion' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "days": <days>\n}' --compressed
Here, {id} represents the key ID.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| days | integer | Number of days after which the key will be deleted. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/schedule-deletion' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiI3MDZhYzYzOC04MTI0LTRmMjYtYjhlYy05OGI0ZWIyYWY0MTgiLCJzdWIiOiJsb2NhbHxlNWViZjc3Ni0xYzlkLTRjMjEtOWI4YS01ZTVhZTJmY2RmMzAiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMzFkN2M3MGQtMmM1MC00NzZmLWI1NjgtMGVjY2Y1OGU5Y2I4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjdhYTM4NmFjLTYwZjctNDk0NS1hNGM3LTdiOWQwMTVjMmQxYSIsImlhdCI6MTU5NjcwOTAyNSwiZXhwIjoxNTk2NzA5MzI1fQ.M6O-iHvMp0-Vu-XaxcklibRD1MN8K6BqUaGj0EDynjU' -H 'Content-Type: application/json' --data-binary $'{\n "days": 7\n}' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T07:28:36.973094375Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": false,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "PendingDeletion",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"DeletionDate": "2020-08-12T07:28:36.971635369Z",
"KeyRotationEnabled": false
}
}
The sample output shows that the key will be deleted after 7 days. When key deletion is scheduled, the state of the key changes from enabled to pending deletion.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Canceling Deletion of Keys
Use the post /v1/cckm/aws/keys/{id}/cancel-deletion API to cancel deletion of a key.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/cancel-deletion' -X POST -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the key ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/cancel-deletion' -X POST -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZTQyMjE3NjYtMzE3NS00ODBmLWIzY2EtMGU0NzYzMzM1ZmI4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6Ijc4OTRmY2ZkLTZhODYtNDI0Ny1hMjFkLWNlZWVlYWI5ZTc3MSIsImlhdCI6MTU5NjYxMjUwMSwiZXhwIjoxNTk2NjEyODAxfQ.0NvQOdRc1EUrgQuGK_wxVqxdO4xusGygM4iOMjrPpV4' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T07:29:55.233669022Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": false,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Disabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows that the key deletion is canceled and the state of the key changes to disable. To use this key again, enable the key using the post /v1/cckm/aws/keys/{id}/enable API.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Updating Key Policy
Use the post /v1/cckm/aws/keys/{id}/policy API to update the policy of an AWS key.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/policy' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "key_users": ["key_user"],\n "key_admins": ["key_admin"],\n "external_accounts": ["external_account"]\n\n}'--compressed
Here, {id} represents the key ID.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| external_accounts | array of strings | AWS accounts that can use this key. |
| key_admins | array of strings | IAM users who can administer this key using the KMS API. |
| key_users | array of strings | IAM users who can use this key in cryptographic operations. |
| policy | JSON | Key policy mapped to the key. |
Note
Policy and key administrators, key users, and AWS accounts are mutually exclusive. Specify either the policy or any one user at a time. If no parameters are specified, the default policy is used.
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/policy' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxMzNiNzY4NS1iNzY1LTQ5ZWQtYTc3Mi1iNDA0ZTVmOWMxY2IiLCJzdWIiOiJsb2NhbHw0NjJhZjBiZS1hMTJhLTQ3NmYtOWI3MS1jYmQ0NjgzNDA1OTEiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiNzFhNmJlNTEtZWYxOS00OWU5LThkN2ItZWQ3NGQ4NTcwODEwIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImEyNTdiZWM3LTU5Y2QtNGIwYi05NzBjLTY0MmFhNDVhMzRlZSIsImlhdCI6MTU5ODkzNTI3NywiZXhwIjoxNTk4OTM1NTc3fQ.FkteRgJSzndGGeEmgtVP7aK0XooBPrt-h9DNlAYe3jA' -H 'Content-Type: application/json' --data-binary $'{\n "key_users": ["DummyUser"],\n "key_admins": ["DummyAdmin"],\n "external_accounts": ["arn:aws:iam::123456789012:root"]\n\n}' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:f7c54616-d647-4dae-86b8-261296b13222",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-31T04:43:47.982573Z",
"updatedAt": "2020-08-31T11:41:59.448662366Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"synced_at": "2020-08-31T04:43:47.976184Z",
"rotation_status": "",
"cloud_name": "aws",
"key_users": [
"arn:aws:iam::123456789012:user/DummyUser"
],
"key_admins": [
"arn:aws:iam::123456789012:user/DummyAdmin"
],
"key_type": "symmetric",
"external_accounts": [
"arn:aws:iam::123456789012:root"
],
"basic_view_enabled": true,
"region": "us-east-1",
"gone": false,
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:us-east-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-31T04:43:48Z",
"Policy": {
"Id": "key-consolepolicy-3",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM UserName Permissions",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::123456789012:root"
]
},
"Action": [
"kms:*"
],
"Resource": "*"
},
{
"Sid": "Allow access for Key Administrators",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::123456789012:user/DummyAdmin"
]
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow use of the key",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::123456789012:user/DummyUser",
"arn:aws:iam::123456789012:root"
]
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "Allow attachment of persistent resources",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::123456789012:user/DummyUser",
"arn:aws:iam::123456789012:root"
]
},
"Action": [
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant"
],
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": "true"
}
}
}
]
},
"Alias": [
"alias/aaa123"
],
"KeyRotationEnabled": false
}
}
The sample output shows that External Account (arn:aws:iam::123456789012:root), Key User (DummyUser), and Key Admin (DummyAdmin) are added and based on the assigned permissions, these entities can perform cryptographic operations on the AWS KMS.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Updating Key Description
Use the post /v1/cckm/aws/keys/{id}/update-description API to update the description of an AWS key.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/update-description' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "description": "<description>"\n}' --compressed
Here, {id} represents the key ID.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| description | string | Updated description for the key. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/update-description' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiOWU0ODBkZTktZTE4NC00ZDAyLTk5NjAtMzQ1NTU1ZDBjY2VmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImM4YTBlYWQyLTcwZjItNGZhMy1hMGU2LWY3ODdjN2M3MDYwMSIsImlhdCI6MTU5NjYwNjI4MSwiZXhwIjoxNTk2NjA2NTgxfQ.__I0niHKBJbetS2mHkPiKL3wHQaUYGG4QbAS9t7ESwA' -H 'Content-Type: application/json' --data-binary $'{\n "description": "Update-key-description"\n}' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T05:46:04.555094903Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output reflects the updated description (Update-key-description) for the key (with ID f7c54616-d647-4dae-86b8-261296b13222).
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Enabling AWS Keys
Use the post /v1/cckm/aws/keys/{id}/enable API to enable an AWS key.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/enable' -X POST -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the key ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/enable' -X POST -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMDJmNTE0YzYtZTgwNy00MDIyLWFhOGItNWU1MTAxMWJlYWFmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImQzM2I1MWExLTJkNmEtNGVlMi04ZmZjLTE1MmZiOWY4YjliZiIsImlhdCI6MTU5NjYwODQ3NCwiZXhwIjoxNTk2NjA4Nzc0fQ.xjQH5A-DCgYXeg5jPxuPZqFWaRWHEVmqCL3tUlBLD6s' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T06:22:58.090402675Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows that the key (with ID f7c54616-d647-4dae-86b8-261296b13222) is enabled and the KeyState parameter of the key becomes Enabled.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Disabling AWS Keys
Use the post /v1/cckm/aws/keys/{id}/disable API to disable an AWS key.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/disable' -X POST -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the key ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/disable' -X POST -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMDJmNTE0YzYtZTgwNy00MDIyLWFhOGItNWU1MTAxMWJlYWFmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImQzM2I1MWExLTJkNmEtNGVlMi04ZmZjLTE1MmZiOWY4YjliZiIsImlhdCI6MTU5NjYwODQ3NCwiZXhwIjoxNTk2NjA4Nzc0fQ.xjQH5A-DCgYXeg5jPxuPZqFWaRWHEVmqCL3tUlBLD6s' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T06:21:22.697415428Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": false,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Disabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows that the key (with ID f7c54616-d647-4dae-86b8-261296b13222) is disabled and the KeyState parameter becomes Disabled.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Adding Tags to AWS Keys
Use the post /v1/cckm/aws/keys/{id}/add-tags API to add tags to an AWS key. The tags must be specified in the following format:
"tags": [
{
"tag_key": "<key>",
"tag_value": "<value>"
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/add-tags' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "tags": [<key-value pair> ]\n}' --compressed
Here, {id} represents the key ID.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| tags | array of JSONs | Additional information to be added to the key. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/add-tags' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZTQyMjE3NjYtMzE3NS00ODBmLWIzY2EtMGU0NzYzMzM1ZmI4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImE5MTRlYjc3LTBmZjItNDIxOS05Y2Q1LWJhODZlN2UzNzMwZiIsImlhdCI6MTU5NjYxMzQ2NywiZXhwIjoxNTk2NjEzNzY3fQ.T3ddmeuRPsu_7_bDbUeHe2cP8ZG1BwlNgLwQfXsVCBI' -H 'Content-Type: application/json' --data-binary $'{\n "tags": [\n {\n "tag_key": "newtagkey",\n "tag_value": "value"\n}\n ]\n}' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T07:45:17.676387364Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
},
{
"TagKey": "newtagkey",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows that the tag key and its value (TagKey": "newtagkey", "TagValue": "value") are added to the key (with ID f7c54616-d647-4dae-86b8-261296b13222).
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Removing Tags from AWS Keys
Use the post /v1/cckm/aws/keys/{id}/remove-tags API to remove the tags from an AWS key.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/remove-tags' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "tags": [<tags>]\n}' --compressed
Here, {id} represents the key ID.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| tags | array | Tags to be removed from the AWS key. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/remove-tags' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZTQyMjE3NjYtMzE3NS00ODBmLWIzY2EtMGU0NzYzMzM1ZmI4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImE5MTRlYjc3LTBmZjItNDIxOS05Y2Q1LWJhODZlN2UzNzMwZiIsImlhdCI6MTU5NjYxMzQ2NywiZXhwIjoxNTk2NjEzNzY3fQ.T3ddmeuRPsu_7_bDbUeHe2cP8ZG1BwlNgLwQfXsVCBI' -H 'Content-Type: application/json' --data-binary $'{\n "tags": ["newtagkey"]\n}' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T07:47:16.719435901Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows that the tag and its value ("tags": ["newtagkey"]) are removed from the key.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Adding Alias to AWS Keys
Use the post /v1/cckm/aws/keys/{id}/add-alias API to add an alias to an AWS key.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/add-alias' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "alias": "<alias>"\n}' --compressed
Here, {id} represents the key ID.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| alias | string | Alias to be added to the AWS key. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/add-alias' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMDJmNTE0YzYtZTgwNy00MDIyLWFhOGItNWU1MTAxMWJlYWFmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImQzM2I1MWExLTJkNmEtNGVlMi04ZmZjLTE1MmZiOWY4YjliZiIsImlhdCI6MTU5NjYwODQ3NCwiZXhwIjoxNTk2NjA4Nzc0fQ.xjQH5A-DCgYXeg5jPxuPZqFWaRWHEVmqCL3tUlBLD6s' -H 'Content-Type: application/json' --data-binary $'{\n "alias": "NewlyAddedAlias"\n}' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T06:25:11.255931503Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-
83d9-83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest",
"alias/NewAddedAlias"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows that the alias (NewlyAddedAlias) is appended to the key.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Deleting Alias from AWS Keys
Use the post /v1/cckm/aws/keys/{id}/delete-alias API to delete an alias from an AWS key.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/delete-alias' -H 'Authorization: Bearer AUTHTOKEN 'Content-Type: application/json' --data-binary $'{\n "alias": "<alias>"\n}' --compressed
Here, {id} represents the key ID.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| alias | string | Alias to be deleted from the AWS key. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/delete-alias' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiMDJmNTE0YzYtZTgwNy00MDIyLWFhOGItNWU1MTAxMWJlYWFmIiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImI0MTRlMTk1LWE0ZGUtNDEwZi05NjQxLTAyNGUyZjE1M2JjZCIsImlhdCI6MTU5NjYwODc5MSwiZXhwIjoxNTk2NjA5MDkxfQ.dpjzqbmckwYcs5vX482qYaNf4i_L4oMzvNreV4eGt2s' -H 'Content-Type: application/json' --data-binary $'{\n "alias": "NewAddedAlias"\n}' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T06:27:29.705649856Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows that the alias (NewAddedAlias) is removed from the key.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Verifying Alias on AWS KMS
Use the post /v1/cckm/aws/alias/verify API to check the availability of an alias on the AWS KMS.
Syntax
curl -k '<IP>/api/v1/cckm/aws/alias/verify' -H 'Authorization: Bearer AUTHTOKEN 'Content-Type: application/json' --data-binary $'{\n "alias": "<alias>",\n "region": "<region>",\n "kms": "<kms name>"\n}' --compressed
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| alias | string | Key alias to be verified. |
| kms | string | ID or name of the KMS. |
| region | string | Region in which the alias is to be verified. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/alias/verify' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZTQyMjE3NjYtMzE3NS00ODBmLWIzY2EtMGU0NzYzMzM1ZmI4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjMxOTJmZjNjLWQzZWYtNDNiNC1hZjY5LTEzYTMwMDQxNmJmMyIsImlhdCI6MTU5NjYxMjIwMSwiZXhwIjoxNTk2NjEyNTAxfQ.Vx_Jd7z9c_M2LUGT9SJ38bcPfF7wQNTvxvl65--pwSQ' -H 'Content-Type: application/json' --data-binary $'{\n "alias": "newalias",\n "region": "ap-southeast-1",\n "kms": "kms-name"\n}' --compressed
Example Response
"Alias available"
The sample output shows that the alias (newalias) is available on the KMS (kms-name) and the "Alias available" message is returned in response.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Enabling Key for Rotation Job
Use the post /v1/cckm/aws/keys/{id}/enable-rotation-job API to enable an AWS key for scheduled rotation job. To use this API, first create a new rotation job configuration, the job_config_id is required to call this API. Refer to Scheduling Key Rotation for details.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/enable-rotation-job' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "job_config_id": "<job config id>",\n "auto_rotate_disable_encrypt": <boolean>\n}' --compressed
Here, {id} represents the key ID.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| job_config_id | string | ID of the scheduler configuration job that will schedule the key rotation. |
| auto_rotate_disable_encrypt | boolean | Flag to disable encryption on the old key. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/a22742b4-2ad9-4f4a-9103-3507bed1420e/enable-rotation-job' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiI4N2QxNzA4MC02MzAxLTQ5ZjItYmU2Mi02NzY2ZmUwMDMwOGIiLCJzdWIiOiJsb2NhbHwxNDc2NDcwMC1lYmJlLTQ0ODUtYTkzZS05N2RjNTdkZWQ1YWIiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZWE2MTI4MTctMTcxZi00MmY2LTk4ZGQtODgzYjJmNWJlZTg0Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjBiMDU3MDhiLThhYTUtNGQzMS05N2Q0LWNkMzIxMjFiZWNkOCIsImlhdCI6MTU5NjgwMTQxNiwiZXhwIjoxNTk2ODAxNzE2fQ.ot1tXSJ3WPGDpu5SDhNoftzK46U16qKapzEQ1YS9pNc' -H 'Content-Type: application/json' --data-binary $'{\n "job_config_id": "c9c784e0-2a82-4813-95cd-be8b975824b1",\n "auto_rotate_disable_encrypt": true\n}' --compressed
Example Response
{
"id": "a22742b4-2ad9-4f4a-9103-3507bed1420e",
"uri": "kylo:kylo:cckm:aws-key:a22742b4-2ad9-4f4a-9103-3507bed1420e",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-07T11:55:19.978733Z",
"updatedAt": "2020-08-07T11:56:58.066302842Z",
"kms_id": "42267e0f-60ae-4630-ae3e-5e5e26809455",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"labels": {
"disable_encrypt_on_auto_rotate": "true",
"job_config_id": "c9c784e0-2a82-4813-95cd-be8b975824b1"
},
"synced_at": "2020-08-07T11:55:19.882843Z",
"cloud_name": "aws",
"key_type": "symmetric",
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/8b1d7fca-5b9b-4837-973a-
da71c9142526",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "8b1d7fca-5b9b-4837-973a-da71c9142526",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-07T11:55:18Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/rotationtestkey"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows that the key (with ID a22742b4-2ad9-4f4a-9103-3507bed1420e) is enabled for the scheduled key rotation.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Disabling Key for Rotation Job
Use the post /v1/cckm/aws/keys/{id}/disable-rotation-job API to disable the scheduled rotation job for an AWS key.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/disable-rotation-job' -X POST -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the key ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/a22742b4-2ad9-4f4a-9103-3507bed1420e/disable-rotation-job' -X POST -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiI4N2QxNzA4MC02MzAxLTQ5ZjItYmU2Mi02NzY2ZmUwMDMwOGIiLCJzdWIiOiJsb2NhbHwxNDc2NDcwMC1lYmJlLTQ0ODUtYTkzZS05N2RjNTdkZWQ1YWIiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZWE2MTI4MTctMTcxZi00MmY2LTk4ZGQtODgzYjJmNWJlZTg0Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjBiMDU3MDhiLThhYTUtNGQzMS05N2Q0LWNkMzIxMjFiZWNkOCIsImlhdCI6MTU5NjgwMTQxNiwiZXhwIjoxNTk2ODAxNzE2fQ.ot1tXSJ3WPGDpu5SDhNoftzK46U16qKapzEQ1YS9pNc' --compressed
Example Response
{
"id": "a22742b4-2ad9-4f4a-9103-3507bed1420e",
"uri": "kylo:kylo:cckm:aws-key:a22742b4-2ad9-4f4a-9103-3507bed1420e",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-07T11:55:19.978733Z",
"updatedAt": "2020-08-07T11:58:30.191204734Z",
"kms_id": "42267e0f-60ae-4630-ae3e-5e5e26809455",
"kms": "a1",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-07T11:55:19.882843Z",
"cloud_name": "aws",
"key_type": "symmetric",
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/8b1d7fca-5b9b-4837-973a-
da71c9142526",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "8b1d7fca-5b9b-4837-973a-da71c9142526",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-07T11:55:18Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/rotationtestkey"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Enabling Automatic Key Rotation
Use the post /v1/cckm/aws/keys/{id}/enable-auto-rotation API to enable automatic rotation for the AWS native keys. The AWS KMS will generate a new key material for the keys every year.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/enable-auto-rotation' -X POST -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the key ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/enable-auto-rotation' -X POST -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZTQyMjE3NjYtMzE3NS00ODBmLWIzY2EtMGU0NzYzMzM1ZmI4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjMxOTJmZjNjLWQzZWYtNDNiNC1hZjY5LTEzYTMwMDQxNmJmMyIsImlhdCI6MTU5NjYxMjIwMSwiZXhwIjoxNTk2NjEyNTAxfQ.Vx_Jd7z9c_M2LUGT9SJ38bcPfF7wQNTvxvl65--pwSQ' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T07:24:18.334064395Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": true
}
}
The sample output shows that the KeyRotationEnabled parameter is set to true. This indicates that the key (with ID f7c54616-d647-4dae-86b8-261296b13222) is ready for automatic key rotation.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Disabling Automatic Key Rotation
Use the post /v1/cckm/aws/keys/{id}/disable-auto-rotation API to disable automatic rotation of the AWS native keys.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/disable-auto-rotation' -X POST -H 'Authorization: Bearer AUTHTOKEN' --compressed
Here, {id} represents the key ID.
Request Parameter
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/f7c54616-d647-4dae-86b8-261296b13222/disable-auto-rotation' -X POST -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZTQyMjE3NjYtMzE3NS00ODBmLWIzY2EtMGU0NzYzMzM1ZmI4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6IjMxOTJmZjNjLWQzZWYtNDNiNC1hZjY5LTEzYTMwMDQxNmJmMyIsImlhdCI6MTU5NjYxMjIwMSwiZXhwIjoxNTk2NjEyNTAxfQ.Vx_Jd7z9c_M2LUGT9SJ38bcPfF7wQNTvxvl65--pwSQ' --compressed
Example Response
{
"id": "f7c54616-d647-4dae-86b8-261296b13222",
"uri": "kylo:kylo:cckm:aws-key:592dfacb-61e0-4a92-aae4-56602839bb0c",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T05:35:46.530046Z",
"updatedAt": "2020-08-05T07:25:10.02216775Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"synced_at": "2020-08-05T05:39:16.181308Z",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/a38d9095-7c32-40ae-83d9-
83c9009bb8b1",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "Update-key-description",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "a38d9095-7c32-40ae-83d9-83c9009bb8b1",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "AWS_KMS",
"CreationDate": "2020-08-05T05:35:45Z",
"Policy": {
"Id": "key-default-1",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Action": "kms:*",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
}
}
]
},
"Alias": [
"alias/KeyTest"
],
"Tags": [
{
"TagKey": "key",
"TagValue": "value"
}
],
"KeyRotationEnabled": false
}
}
The sample output shows that the KeyRotationEnabled parameter is set to false. This indicates that the key (with ID f7c54616-d647-4dae-86b8-261296b13222) will not be automatically rotated.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
Rotating Keys on AWS KMS
Use the post /v1/cckm/aws/keys/{id}/rotate API to rotate a key on the AWS KMS.
Syntax
curl -k '<IP>/api/v1/cckm/aws/keys/{id}/rotate' -H 'Authorization: Bearer AUTHTOKEN' -H 'Content-Type: application/json' --data-binary $'{\n "source_key_id": "<source key>",\n "disable_encrypt": <boolean>,\n "description": "<description>",\n "key_expiration": <boolean>,\n "valid_to": "<key validity>"\n}' --compressed
Here, {id} represents the key ID.
Request Parameters
| Parameter | Type | Description |
|---|---|---|
| AUTHTOKEN | string | Authorization token. |
| description | string | Description for the newly rotated key. |
| disable_encrypt | boolean | Flag to disable encryption on key which is getting rotated. |
| key_expiration | boolean | Flag to enable key expiration of the newly rotated key. |
| source_key_id | string | Name or ID of the key created on the CipherTrust Manager. By default, a new key is automatically generated on the CipherTrust Manager. |
| valid_to | string | Key expiration time of the newly rotated key, must be formatted as per RFC3339. |
Example Request
curl -k 'https://127.0.0.1/api/v1/cckm/aws/keys/ab71854a-887f-4a22-a4fd-3a7bf0c7649d/rotate' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIxYmQ5ZjA4ZS01ZTQyLTQ1MjUtYWJjZi1hMThhMDI5NjdmMjciLCJzdWIiOiJsb2NhbHw2MzViNzZjNS00ZjQyLTQ3OTMtYmMwNy03ZjdmOTQ3ZWM3MGYiLCJpc3MiOiJreWxvIiwiYWNjIjoia3lsbyIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIiwiY3VzdCI6eyJkb21haW5faWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAiLCJncm91cHMiOlsiYWRtaW4iXSwic2lkIjoiZTQyMjE3NjYtMzE3NS00ODBmLWIzY2EtMGU0NzYzMzM1ZmI4Iiwiem9uZV9pZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9LCJqd3RpZCI6ImFiYjA2MWMyLTIyODctNDQyOC05OTUwLTI5NGU5Y2FhM2VjMCIsImlhdCI6MTU5NjYxMzEwNSwiZXhwIjoxNTk2NjEzNDA1fQ.E-VCb8zY1UvXGbC-vST3S3mMdQWmLz2sDQQAz8iC2LA' -H 'Content-Type: application/json' --data-binary $'{\n "source_key_id": "aes_key",\n "disable_encrypt": true,\n "description": "rotated key",\n "key_expiration": true,\n "valid_to": "2021-08-05T07:39:31.634355989Z"\n}' --compressed
Example Response
{
"id": "afe23b94-b37e-473d-a2c4-83172165bedd",
"uri": "kylo:kylo:cckm:aws-key:afe23b94-b37e-473d-a2c4-83172165bedd",
"account": "kylo:kylo:admin:accounts:kylo",
"application": "ncryptify:gemalto:admin:apps:kylo",
"devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
"createdAt": "2020-08-05T07:42:46.197175005Z",
"updatedAt": "2020-08-05T07:42:47.918879151Z",
"kms_id": "2308baff-4711-484d-941f-667f8d9e8322",
"kms": "kms-name",
"rotation_status": "ACTIVE"
"rotated_at": "2020-08-05T07:42:47.907624706Z",
"rotated_from": "ab71854a-887f-4a22-a4fd-3a7bf0c7649d",
"synced_at": "2020-08-05T07:42:46.169209168Z",
"rotation_status": "ACTIVE",
"local_key_id": "fa897e9382564352a65b02769cfb8217c37da335943a4c6f82d92bf88e6e99cf",
"local_key_name": "aes_key",
"cloud_name": "aws",
"key_type": "symmetric"
"basic_view_enabled": false,
"region": "ap-southeast-1",
"aws_param": {
"AWSAccountId": "123456789012",
"Arn": "arn:aws:kms:ap-southeast-1:123456789012:key/31730e29-fe8a-4939-af07-
cb2647e17e65",
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
"Description": "rotated key",
"Enabled": true,
"EncryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"KeyID": "31730e29-fe8a-4939-af07-cb2647e17e65",
"KeyManager": "CUSTOMER",
"KeyState": "Enabled",
"KeyUsage": "ENCRYPT_DECRYPT",
"Origin": "EXTERNAL",
"CreationDate": "2020-08-05T07:42:45Z",
"Policy": {
"Version": "2012-10-17",
"Id": "key-default-1",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
},
"Alias": [
"alias/RotateKeyTest"
],
"ValidTo": "2021-08-05T07:39:31.634355989Z",
"KeyRotationEnabled": false,
"ExpirationModel": "KEY_MATERIAL_EXPIRES"
}
}
The sample output shows that the key on the AWS KMS is rotated successfully.
To know more about response parameters, refer to Response Parameters of Key Life Cycle Management APIs.
Response Codes
| Response Code | Description |
|---|---|
| 2xx | Success |
| 4xx | Client errors |
| 5xx | Server errors |
Refer to HTTP status codes for details.
