Find KMS keys and key material in an Amazon CloudHSM key store - Amazon Key Management Service
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Find KMS keys and key material in an Amazon CloudHSM key store

If you manage an Amazon CloudHSM key store, you might need to identify the KMS keys in each Amazon CloudHSM key store. For example, you might need to do some of the following tasks.

  • Track the KMS keys in Amazon CloudHSM key store in Amazon CloudTrail logs.

  • Predict the effect on KMS keys of disconnecting an Amazon CloudHSM key store.

  • Schedule deletion of KMS keys before you delete an Amazon CloudHSM key store.

In addition, you might want to identify the keys in your Amazon CloudHSM cluster that serve as key material for your KMS keys. Although Amazon KMS manages the KMS keys and the key material, you still retain control of and responsibility for the management of your Amazon CloudHSM cluster, as well as the HSMs and backups and the keys in the HSMs. You might need to identify the keys in order to audit the key material, protect it from accidental deletion, or delete it from HSMs and cluster backups after deleting the KMS key.

All key material for the KMS keys in your Amazon CloudHSM key store is owned by the kmsuser crypto user (CU). Amazon KMS sets the key label attribute, which is viewable only in Amazon CloudHSM, to the Amazon Resource Name (ARN) of the KMS key.

To find KMS keys and key material, use any of the following techniques.