Managing KMS key tags in the console - Amazon Key Management Service
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Managing KMS key tags in the console

You can add tags to a KMS key when you create the KMS key in the Amazon KMS console. You can also use the Tags tab in the console to add, edit, and delete tags on customer managed keys To add, edit, view, and delete tags for a KMS key, you must have the required permissions. For details, see Controlling access to tags.

Add tags while creating a KMS key

To add tags when creating a KMS key in the console, you must have kms:TagResource permission in an IAM policy in addition to the permissions required to create KMS keys and view KMS keys in the console. At a minimum, the permission must cover all KMS keys in the account and Region.

  1. Sign in to the Amazon Web Services Management Console and open the Amazon Key Management Service (Amazon KMS) console at https://console.amazonaws.cn/kms.

  2. To change the Amazon Web Services Region, use the Region selector in the upper-right corner of the page.

  3. In the navigation pane, choose Customer managed keys. (You cannot manage the tags of an Amazon managed key)

  4. Choose the key type, then choose Next.

  5. Enter an alias and optional description.

  6. Enter a tag key and, optionally, a tag value. To add additional tags, choose Add tag. To delete a tag, choose Remove. When you're done tagging your new KMS key, choose Next.

  7. Finish creating your KMS key.

View and manage tags on existing KMS keys

To add, view, edit, and delete tags in the console, you need tagging permission on the KMS key. You can get this permission from the key policy for the KMS key or, if the key policy allows it, from an IAM policy that includes the KMS key. You need these permissions in addition to the permissions to view KMS keys in the console.

  1. Sign in to the Amazon Web Services Management Console and open the Amazon Key Management Service (Amazon KMS) console at https://console.amazonaws.cn/kms.

  2. To change the Amazon Web Services Region, use the Region selector in the upper-right corner of the page.

  3. In the navigation pane, choose Customer managed keys. (You cannot manage the tags of an Amazon managed key)

  4. You can use the table filter to display only KMS keys with particular tags. For details, see Sorting and filtering your KMS keys.

  5. Select the check box next to the alias of a KMS key.

  6. Choose Key actions, Add or edit tags.

  7. On the details page for KMS key, choose the Tags tab.

    • To create your first tag, choose Create tag, type a tag key (required) and tag value (optional), and then choose Save.

      If you leave the tag value blank, the actual tag value is a null or empty string.

    • To add a tag, choose Edit, choose Add tag, type a tag key and tag value, and then choose Save.

    • To change the name or value of a tag, choose Edit, make your changes, and then choose Save.

    • To delete a tag, choose Edit. On the tag row, choose Remove, and then choose Save.

  8. To save your changes, choose Save changes.