Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions,
see Getting Started with Amazon Web Services in China
(PDF).
Use GenerateDataKeyWithoutPlaintext
with an Amazon SDK or CLI
The following code examples show how to use GenerateDataKeyWithoutPlaintext
.
- CLI
-
- Amazon CLI
-
To generate a 256-bit symmetric data key without a plaintext key
The following generate-data-key-without-plaintext
example requests an encrypted copy of a 256-bit symmetric data key for use outside of Amazon. You can call Amazon KMS to decrypt the data key when you are ready to use it.
To request a 256-bit data key, use the key-spec
parameter with a value of AES_256
. To request a 128-bit data key, use the key-spec
parameter with a value of AES_128
. For all other data key lengths, use the number-of-bytes
parameter.
The KMS key you specify must be a symmetric encryption KMS key, that is, a KMS key with a key spec value of SYMMETRIC_DEFAULT.
aws kms generate-data-key-without-plaintext \
--key-id "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
\
--key-spec AES_256
Output:
{
"CiphertextBlob": "AQEDAHjRYf5WytIc0C857tFSnBaPn2F8DgfmThbJlGfR8P3WlwAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDEFogL",
"KeyId": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
The CiphertextBlob
(encrypted data key) is returned in base64-encoded format.
For more information, see Data keys in the Amazon Key Management Service Developer Guide.
- Rust
-
- SDK for Rust
-
async fn make_key(client: &Client, key: &str) -> Result<(), Error> {
let resp = client
.generate_data_key_without_plaintext()
.key_id(key)
.key_spec(DataKeySpec::Aes256)
.send()
.await?;
// Did we get an encrypted blob?
let blob = resp.ciphertext_blob.expect("Could not get encrypted text");
let bytes = blob.as_ref();
let s = base64::encode(bytes);
println!();
println!("Data key:");
println!("{}", s);
Ok(())
}
For a complete list of Amazon SDK developer guides and code examples, see
Using Amazon KMS with an Amazon SDK.
This topic also includes information about getting started and details about previous SDK versions.