本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 密钥类型引用
<a name="symm-asymm-compare"></a>

Amazon KMS 支持不同*类型*的 KMS 密钥的不同功能。例如，只能使用[对称加密 KMS 密钥](symm-asymm-choose-key-spec.md#symmetric-cmks)来[生成对称数据密钥](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateDataKey.html)和[非对称数据密钥对](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateDataKeyPairs.html)。此外，仅对称加密 KMS 密钥支持[导入密钥材料](importing-keys.md)和[自动密钥轮换](rotate-keys.md)，并且在[自定义密钥存储](key-store-overview.md#custom-key-store-overview)中只能创建对称加密 KMS 密钥。

此参考包括两个表。
+ [密钥类型表](#key-type-table)列出了对称加密 KMS 密钥、非对称 KMS 密钥和 HMAC KMS 密钥有效的 Amazon KMS 操作。
+ [特殊功能表](#special-features-table)列出了对多区域 KMS 密钥、包含导入的密钥材料的 KMS 密钥，以及自定义密钥存储中的 KMS 密钥有效的 Amazon KMS 操作。

## 密钥类型表
<a name="key-type-table"></a>

您可能需要水平或垂直滚动才能查看此表中的所有数据。


| Amazon KMS API 操作 | 对称加密 KMS 密钥 | HMAC KMS 密钥 | 非对称 KMS 密钥 (ENCRYPT\_DECRYPT) | 非对称 KMS 密钥 (SIGN\_VERIFY) | 非对称 KMS 密钥（KEY\_AGREEMENT） | 
| --- | --- | --- | --- | --- | --- | 
| [CancelKeyDeletion](https://docs.amazonaws.cn/kms/latest/APIReference/API_CancelKeyDeletion.html) | 支持 | 是 | 是 | 是 | 是 | 
| [CreateAlias](https://docs.amazonaws.cn/kms/latest/APIReference/API_CreateAlias.html) | 是 | 是 | 是 | 是 | 是 | 
| [CreateGrant](https://docs.amazonaws.cn/kms/latest/APIReference/API_CreateGrant.html) | 是 | 是 | 是 | 是 | 是 | 
| [CreateKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_CreateKey.html) | 是 | 是 | 是 | 是 | 是 | 
| [Decrypt](https://docs.amazonaws.cn/kms/latest/APIReference/API_Decrypt.html) | 是 | 否 | 是 | 否 | 否 | 
| [DeleteAlias](https://docs.amazonaws.cn/kms/latest/APIReference/API_DeleteAlias.html) | 是 | 是 | 是 | 是 | 是 | 
| [DeleteImportedKeyMaterial](https://docs.amazonaws.cn/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html)<br />仅在包含导入的密钥材料的 KMS 密钥上有效（`Origin` 为 `EXTERNAL`）。 | 支持 | 是 | 是 | 是 | 是 | 
| [DeriveSharedSecret](https://docs.amazonaws.cn/kms/latest/APIReference/API_DeriveSharedSecret.html) | 否 | 否 | 否 | 否 | 是 | 
| [DescribeKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_DescribeKey.html) | 是 | 是 | 是 | 是 | 是 | 
| [DisableKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_DisableKey.html) | 是 | 是 | 是 | 是 | 是 | 
| [DisableKeyRotation](https://docs.amazonaws.cn/kms/latest/APIReference/API_DisableKeyRotation.html) |  是 仅对带有密钥材料 (is`AWS_KMS`) `Origin` 的 KMS 密 Amazon KMS 钥有效。 | 否 | 否 | 否 | 否 | 
| [EnableKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_EnableKey.html) | 是 | 是 | 是 | 是 | 是 | 
| [EnableKeyRotation](https://docs.amazonaws.cn/kms/latest/APIReference/API_EnableKeyRotation.html) | 是<br />仅对带有密钥材料 (is`AWS_KMS`) `Origin` 的 KMS 密 Amazon KMS 钥有效。 | 否 | 否 | 否 | 否 | 
| [Encrypt](https://docs.amazonaws.cn/kms/latest/APIReference/API_Encrypt.html) | 是 | 否 | 是 | 否 | 否 | 
| [GenerateDataKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateDataKey.html) | 是  | 否 | 否 | 否 | 否 | 
| [GenerateDataKeyPair](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateDataKeyPair.html)<br />生成受对称加密 KMS 密钥保护的非对称数据密钥对。 | 是 在自定义密钥存储中的 KMS 密钥上无效。 | 否 | 否 | 否 | 否 | 
| [GenerateDataKeyPairWithoutPlaintext](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html)<br />生成受对称加密 KMS 密钥保护的非对称数据密钥对。 | 是 <br />在自定义密钥存储中的 KMS 密钥上无效。 | 否 | 否 | 否 | 否 | 
| [GenerateDataKeyWithoutPlaintext](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html) | 是 | 否 | 否 | 否 | 否 | 
| [GenerateMac](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateMac.html) | 否 | 是 | 否 | 否 | 否 | 
| [GetKeyPolicy](https://docs.amazonaws.cn/kms/latest/APIReference/API_GetKeyPolicy.html) | 是 | 是 | 是 | 是 | 是 | 
| [GetKeyRotationStatus](https://docs.amazonaws.cn/kms/latest/APIReference/API_GetKeyRotationStatus.html) | 是 |  是 （`KeyRotationEnabled` 将始终为 `false`。） |  是 （`KeyRotationEnabled` 将始终为 `false`。） |  是 （`KeyRotationEnabled` 将始终为 `false`。） |  是 （`KeyRotationEnabled` 将始终为 `false`。） | 
| [GetParametersForImport](https://docs.amazonaws.cn/kms/latest/APIReference/API_GetParametersForImport.html)<br />仅在包含导入的密钥材料的 KMS 密钥上有效（`Origin` 为 `EXTERNAL`）。 | 支持 | 是 | 是 | 是 | 是 | 
| [GetPublicKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_GetPublicKey.html) | 否 | 否 | 是 | 是 | 是 | 
| [ImportKeyMaterial](https://docs.amazonaws.cn/kms/latest/APIReference/API_ImportKeyMaterial.html)<br />仅在包含导入的密钥材料的 KMS 密钥上有效（`Origin` 为 `EXTERNAL`）。 | 支持 | 是 | 是 | 是 | 是 | 
| [ListAliases](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListAliases.html) | 是 | 是 | 是 | 是 | 是 | 
| [ListGrants](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListGrants.html) | 是 | 是 | 是 | 是 | 是 | 
| [ListKeyPolicies](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListKeyPolicies.html) | 是 | 是 | 是 | 是 | 是 | 
| [ListKeyRotations](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListKeyRotations.html) | 是 | 是 （`Rotations` 字段将始终为 null 或空。） | 是 （`Rotations` 字段将始终为 null 或空。） | 是 （`Rotations` 字段将始终为 null 或空。） | 是 （`Rotations` 字段将始终为 null 或空。） | 
| [ListResourceTags](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListResourceTags.html) | 支持 | 是 | 是 | 是 | 是 | 
| [ListRetirableGrants](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListRetirableGrants.html) | 是 | 是 | 是 | 是 | 是 | 
| [PutKeyPolicy](https://docs.amazonaws.cn/kms/latest/APIReference/API_PutKeyPolicy.html) | 是 | 是 | 是 | 是 | 是 | 
| [ReEncrypt](https://docs.amazonaws.cn/kms/latest/APIReference/API_ReEncrypt.html) | 是 | 否 | 是 | 否 | 否 | 
| [ReplicateKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_ReplicateKey.html)<br />- 仅在多区域密钥上有效 | 支持 | 是 | 是 | 是 | 是 | 
| [RetireGrant](https://docs.amazonaws.cn/kms/latest/APIReference/API_RetireGrant.html) | 是 | 是 | 是 | 是 | 是 | 
| [RevokeGrant](https://docs.amazonaws.cn/kms/latest/APIReference/API_RevokeGrant.html) | 是 | 是 | 是 | 是 | 是 | 
| [RotateKeyOnDemand](https://docs.amazonaws.cn/kms/latest/APIReference/API_RotateKeyOnDemand.html) | 是 仅对来源为 `AWS_KMS` 或 `EXTERNAL` 的客户自主管理型对称加密 KMS 密钥有效。 | 否 | 否 | 否 | 否 | 
| [ScheduleKeyDeletion](https://docs.amazonaws.cn/kms/latest/APIReference/API_ScheduleKeyDeletion.html) | 是 | 是 | 是 | 是 | 是 | 
| [Sign](https://docs.amazonaws.cn/kms/latest/APIReference/API_Sign.html) | 否 | 否 | 否 | 是 | 否 | 
| [TagResource](https://docs.amazonaws.cn/kms/latest/APIReference/API_TagResource.html) | 是 | 是 | 是 | 是 | 是 | 
| [UntagResource](https://docs.amazonaws.cn/kms/latest/APIReference/API_UntagResource.html) | 是 | 是 | 是 | 是 | 是 | 
| [UpdateAlias](https://docs.amazonaws.cn/kms/latest/APIReference/API_UpdateAlias.html)<br />当前 KMS 密钥和新的 KMS 密钥必须为相同类型（要么都是对称的，要么都是非对称的，要么都是 HMAC），并且它们必须用于相同的[密钥用途](create-keys.md#key-usage)。 | 支持 | 是 | 是 | 是 | 是 | 
| [UpdateKeyDescription](https://docs.amazonaws.cn/kms/latest/APIReference/API_UpdateKeyDescription.html) | 是 | 是 | 是 | 是 | 是 | 
| [UpdateReplicaRegion](https://docs.amazonaws.cn/kms/latest/APIReference/API_UpdateReplicaRegion.html)<br />- 仅在多区域密钥上有效 | 支持 | 是 | 是 | 是 | 是 | 
| [Verify](https://docs.amazonaws.cn/kms/latest/APIReference/API_Verify.html) | 否 | 否 | 否 | 是 | 否 | 
| [VerifyMac](https://docs.amazonaws.cn/kms/latest/APIReference/API_VerifyMac.html) | 否 | 是 | 否 | 否 | 否 | 

## 特殊功能表
<a name="special-features-table"></a>

下表显示了每种类型的*特殊用途密钥*支持的 Amazon KMS API 操作。

在阅读此表时，请注意以下交互：
+ [多区域密钥](multi-region-keys-overview.md)：
  + 多区域密钥可以是对称加密 KMS 密钥、非对称 KMS 密钥、HMAC KMS 密钥，以及包含导入的密钥材料的 KMS 密钥。
  + 您不能在自定义密钥存储中创建多区域密钥。
+ [导入的密钥材料](importing-keys.md)
  + 您可以导入对称加密 KMS 密钥、非对称 KMS 密钥和 HMAC KMS 密钥的密钥材料。
  + 您可创建[具有导入密钥材料的多区域密钥](multi-region-keys-overview.md)。
  + 您不能在自定义密钥存储中使用导入的密钥材料创建密钥。
  + 带有导入密钥材料的 KMS 密钥不支持自动密钥轮换 (`EnableKeyRotation`、`DisableKeyRotation`)。
  + 使用导入的密钥材料对称加密 KMS 密钥支持按需密钥轮换 (`RotateKeyOnDemand`)。
+ [自定义密钥存储](key-store-overview.md#custom-key-store-overview)
  + 自定义密钥存储仅支持对称加密 KMS 密钥。
  + 自定义密钥存储中的 KMS 密钥不支持对非对称密钥对（`GenerateDataKeyPair`、`GenerateDataKeyPairWithoutPlaintext`）进行对称操作。
  + 自定义密钥存储中的 KMS 密钥不支持自动密钥转换 (`EnableKeyRotation`、`DisableKeyRotation`)。
  + 您不能在自定义密钥存储中创建多区域密钥。

您可能需要水平或垂直滚动才能查看此表中的所有数据。


| Amazon KMS API 操作 | 多区域密钥 | 导入的密钥材料 | 自定义密钥存储中的 KMS 密钥 | 
| --- | --- | --- | --- | 
| [CancelKeyDeletion](https://docs.amazonaws.cn/kms/latest/APIReference/API_CancelKeyDeletion.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [CreateAlias](https://docs.amazonaws.cn/kms/latest/APIReference/API_CreateAlias.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [CreateGrant](https://docs.amazonaws.cn/kms/latest/APIReference/API_CreateGrant.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [ CreateKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_CreateKey.html)您可以使用 `CreateKey` 创建多区域主键、包含导入的密钥材料的 KMS 密钥，或自定义密钥存储中的 KMS 密钥。若要创建多区域副本密钥，请使用 `ReplicateKey`。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)  | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [Decrypt](https://docs.amazonaws.cn/kms/latest/APIReference/API_Decrypt.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) <br />仅当 `KeyUsage` 为 `ENCRYPT_DECRYPT` 时才有效 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [DeleteAlias](https://docs.amazonaws.cn/kms/latest/APIReference/API_DeleteAlias.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [DeleteImportedKeyMaterial](https://docs.amazonaws.cn/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅对包含导入的密钥材料的密钥有效（`Origin` 为 `EXTERNAL`） | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [DeriveSharedSecret](https://docs.amazonaws.cn/kms/latest/APIReference/API_DeriveSharedSecret.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅在 `KeyUsage` 为 `KEY_AGREEMENT` 时有效） | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅在 `KeyUsage` 为 `KEY_AGREEMENT` 时有效） | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [DescribeKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_DescribeKey.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [DisableKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_DisableKey.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [DisableKeyRotation](https://docs.amazonaws.cn/kms/latest/APIReference/API_DisableKeyRotation.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)仅对带有密钥材料 (`Origin`is`AWS_KMS`) 的对称加密密 Amazon KMS 钥有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [EnableKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_EnableKey.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅在对称加密 KMS 密钥上有效 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [EnableKeyRotation](https://docs.amazonaws.cn/kms/latest/APIReference/API_EnableKeyRotation.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅对带有密钥材料 (`Origin`is`AWS_KMS`) 的对称加密密 Amazon KMS 钥有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [Encrypt](https://docs.amazonaws.cn/kms/latest/APIReference/API_Encrypt.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅当 `KeyUsage` 为 `ENCRYPT_DECRYPT` 时才有效 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [GenerateDataKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateDataKey.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) <br />仅在对称加密 KMS 密钥上有效 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [GenerateDataKeyPair](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateDataKeyPair.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅在对称加密 KMS 密钥上有效 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [GenerateDataKeyPairWithoutPlaintext](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅在对称加密 KMS 密钥上有效 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [GenerateDataKeyWithoutPlaintext](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅在对称加密 KMS 密钥上有效 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [GenerateMac](https://docs.amazonaws.cn/kms/latest/APIReference/API_GenerateMac.html)仅在 HMAC KMS 密钥上有效 |  ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)  | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)  | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [GetKeyPolicy](https://docs.amazonaws.cn/kms/latest/APIReference/API_GetKeyPolicy.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [GetKeyRotationStatus](https://docs.amazonaws.cn/kms/latest/APIReference/API_GetKeyRotationStatus.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)（`KeyRotationEnabled` 将始终为 `false`。） |  ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png)  | 
| [GetParametersForImport](https://docs.amazonaws.cn/kms/latest/APIReference/API_GetParametersForImport.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅对包含已导入的密钥材料的密钥有效（`Origin` 为 `EXTERNAL`）。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [GetPublicKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_GetPublicKey.html)<br />仅对[非对称 KMS 密钥](symmetric-asymmetric.md)有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [ImportKeyMaterial](https://docs.amazonaws.cn/kms/latest/APIReference/API_ImportKeyMaterial.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅对包含已导入的密钥材料的密钥有效（`Origin` 为 `EXTERNAL`）。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [ListAliases](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListAliases.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [ListGrants](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListGrants.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [ListKeyPolicies](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListKeyPolicies.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [ListKeyRotations](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListKeyRotations.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅对`EXTERNAL`源自`AWS_KMS`或的对称加密密钥有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅对对称加密密钥有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [ListResourceTags](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListResourceTags.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [ListRetirableGrants](https://docs.amazonaws.cn/kms/latest/APIReference/API_ListRetirableGrants.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [PutKeyPolicy](https://docs.amazonaws.cn/kms/latest/APIReference/API_PutKeyPolicy.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [ReEncrypt](https://docs.amazonaws.cn/kms/latest/APIReference/API_ReEncrypt.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅当 `KeyUsage` 为 `ENCRYPT_DECRYPT` 时才有效 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [ReplicateKey](https://docs.amazonaws.cn/kms/latest/APIReference/API_ReplicateKey.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅在多区域主键上有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)仅在多区域主键上有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [RetireGrant](https://docs.amazonaws.cn/kms/latest/APIReference/API_RetireGrant.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [RevokeGrant](https://docs.amazonaws.cn/kms/latest/APIReference/API_RevokeGrant.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [RotateKeyOnDemand](https://docs.amazonaws.cn/kms/latest/APIReference/API_RotateKeyOnDemand.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅对`EXTERNAL`源自`AWS_KMS`或的对称加密密钥有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)<br />仅对对称加密密钥有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [ScheduleKeyDeletion](https://docs.amazonaws.cn/kms/latest/APIReference/API_ScheduleKeyDeletion.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [Sign](https://docs.amazonaws.cn/kms/latest/APIReference/API_Sign.html)<br />仅当 `KeyUsage` 为 `SIGN_VERIFY` 时才有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [TagResource](https://docs.amazonaws.cn/kms/latest/APIReference/API_TagResource.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [UntagResource](https://docs.amazonaws.cn/kms/latest/APIReference/API_UntagResource.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [UpdateAlias](https://docs.amazonaws.cn/kms/latest/APIReference/API_UpdateAlias.html)<br />– 当前 KMS 密钥和新的 KMS 密钥必须为相同类型（要么都是对称的，要么都是非对称的，要么都是 HMAC），并且它们必须用于相同的[密钥用途](create-keys.md#key-usage)。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [UpdateKeyDescription](https://docs.amazonaws.cn/kms/latest/APIReference/API_UpdateKeyDescription.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | 
| [UpdateReplicaRegion](https://docs.amazonaws.cn/kms/latest/APIReference/API_UpdateReplicaRegion.html) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)仅在多区域密钥上有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [Verify](https://docs.amazonaws.cn/kms/latest/APIReference/API_Verify.html)<br />仅当 `KeyUsage` 为 `SIGN_VERIFY` 时才有效。 | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) | 
| [VerifyMac](https://docs.amazonaws.cn/kms/latest/APIReference/API_VerifyMac.html) 仅在 HMAC KMS 密钥上有效 |  ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png)  | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-successful.png) | ![](http://docs.amazonaws.cn/kms/latest/developerguide/images/icon-failed.png) |