AWS KMS (API)

The Key Management secrets engine supports lifecycle management of keys in AWS KMS regions. This is accomplished by configuring a KMS provider resource with the awskms provider and other provider-specific parameter values.

The following sections provide API documentation that is specific to AWS KMS.

Create/Update KMS Provider

This endpoint creates or updates a KMS provider. If a KMS provider with the given name does not exist, it will be created. If the KMS provider exists, it will be updated with the given parameter values.

Parameters

• name (string: <required>) – Specifies the name of the KMS provider to create or update. This is provided as part of the request URL.

• provider (string: <required>) – Specifies the name of a KMS provider that's external to Vault. Must be set to awskms. Cannot be changed after creation.

• key_collection (string: <required>) – Refers to the name of an AWS region. Cannot be changed after creation.

• credentials (map<string|string>: nil) – The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables.

  • access_key (string: <required>) - The AWS access key ID. May also be specified by the AWS_ACCESS_KEY_ID environment variable.
  • secret_key (string: <required>) - The AWS secret access key. May also be specified by the AWS_SECRET_ACCESS_KEY environment variable.
  • session_token (string: <optional>) - The AWS session token. May also be specified by the AWS_SESSION_TOKEN environment variable.
  • endpoint (string: <optional>) - The KMS API endpoint to be used to make AWS KMS requests. May also be specified by the AWS_KMS_ENDPOINT environment variable. This is useful when connecting to KMS over a VPC Endpoint. If not set, the secrets engine will use the default API endpoint for the region.