replicate-key AWS CLI 2.3.2 Command Reference

May 2024 · 8 minute read

Description

Replicates a multi-Region key into the specified Region. This operation creates a multi-Region replica key based on a multi-Region primary key in a different Region of the same Amazon Web Services partition. You can create multiple replicas of a primary key, but each must be in a different Region. To create a multi-Region primary key, use the CreateKey operation.

This operation supports multi-Region keys , an KMS feature that lets you create multiple interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see Using multi-Region keys in the Key Management Service Developer Guide .

A replica key is a fully-functional KMS key that can be used independently of its primary and peer replica keys. A primary key and its replica keys share properties that make them interoperable. They have the same key ID and key material. They also have the same key spec , key usage , key material origin , and automatic key rotation status . KMS automatically synchronizes these shared properties among related multi-Region keys. All other properties of a replica key can differ, including its key policy , tags , aliases , and key state . KMS pricing and quotas for KMS keys apply to each primary key and replica key.

When this operation completes, the new replica key has a transient key state of Creating . This key state changes to Enabled (or PendingImport ) after a few seconds when the process of creating the new replica key is complete. While the key state is Creating , you can manage key, but you cannot yet use it in cryptographic operations. If you are creating and using the replica key programmatically, retry on KMSInvalidStateException or call DescribeKey to check its KeyState value before using it. For details about the Creating key state, see Key state: Effect on your KMS key in the Key Management Service Developer Guide .

The CloudTrail log of a ReplicateKey operation records a ReplicateKey operation in the primary key’s Region and a CreateKey operation in the replica key’s Region.

If you replicate a multi-Region primary key with imported key material, the replica key is created with no key material. You must import the same key material that you imported into the primary key. For details, see Importing key material into multi-Region keys in the Key Management Service Developer Guide .

To convert a replica key to a primary key, use the UpdatePrimaryRegion operation.

Note

ReplicateKey uses different default values for the KeyPolicy and Tags parameters than those used in the KMS console. For details, see the parameter descriptions.

Cross-account use : No. You cannot use this operation to create a replica key in a different Amazon Web Services account.

Required permissions :

Related operations

See also: AWS API Documentation

See ‘aws help’ for descriptions of global parameters.

Options

--key-id (string)

Identifies the multi-Region primary key that is being replicated. To determine whether a KMS key is a multi-Region primary key, use the DescribeKey operation to check the value of the MultiRegionKeyType property.

Specify the key ID or key ARN of a multi-Region primary key.

For example:

To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey .

--replica-region (string)

The Region ID of the Amazon Web Services Region for this replica key.

Enter the Region ID, such as us-east-1 or ap-southeast-2 . For a list of Amazon Web Services Regions in which KMS is supported, see KMS service endpoints in the Amazon Web Services General Reference .

The replica must be in a different Amazon Web Services Region than its primary key and other replicas of that primary key, but in the same Amazon Web Services partition. KMS must be available in the replica Region. If the Region is not enabled by default, the Amazon Web Services account must be enabled in the Region.

For information about Amazon Web Services partitions, see Amazon Resource Names (ARNs) in the *Amazon Web Services General Reference* . For information about enabling and disabling Regions, see Enabling a Region and Disabling a Region in the Amazon Web Services General Reference .

--policy (string)

The key policy to attach to the KMS key. This parameter is optional. If you do not provide a key policy, KMS attaches the default key policy to the KMS key.

The key policy is not a shared property of multi-Region keys. You can specify the same key policy or a different key policy for each key in a set of related multi-Region keys. KMS does not synchronize this property.

If you provide a key policy, it must meet the following criteria:

--bypass-policy-lockout-safety-check | --no-bypass-policy-lockout-safety-check (boolean)

A flag to indicate whether to bypass the key policy lockout safety check.

Warning

Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.

For more information, refer to the scenario in the Default Key Policy section in the Key Management Service Developer Guide .

Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the KMS key.

The default value is false.

--description (string)

A description of the KMS key. The default value is an empty string (no description).

The description is not a shared property of multi-Region keys. You can specify the same description or a different description for each key in a set of related multi-Region keys. KMS does not synchronize this property.

--tags (list)

Assigns one or more tags to the replica key. Use this parameter to tag the KMS key when it is created. To tag an existing KMS key, use the TagResource operation.

Note

Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see Using ABAC in KMS in the Key Management Service Developer Guide .

To use this parameter, you must have kms:TagResource permission in an IAM policy.

Tags are not a shared property of multi-Region keys. You can specify the same tags or different tags for each key in a set of related multi-Region keys. KMS does not synchronize this property.

Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.

When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see Tagging Keys .

(structure)

A key-value pair. A tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.

For information about the rules that apply to tag keys and tag values, see User-Defined Tag Restrictions in the Amazon Web Services Billing and Cost Management User Guide .

TagKey -> (string)

The key of the tag.

TagValue -> (string)

The value of the tag.

Shorthand Syntax:

TagKey=string,TagValue=string ... 

JSON Syntax:

[ { "TagKey": "string", "TagValue": "string" } ... ] 

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

See ‘aws help’ for descriptions of global parameters.

ncG1vNJzZmiZp6iwrbWNmqSasp%2Bjrri%2FjZympmemZ3ylu8KupJ6mpJbBqrvNaJipoV9ne3R6kWipnp6Vp7Kvr8RooqarX6eysbjInJitnV2gsrp6x62kpQ%3D%3D