public class CreateKeyRequest extends AmazonWebServiceRequest implements Serializable
Creates a customer master key (CMK) in the caller's AWS account.
You can use a CMK to encrypt small amounts of data (4 KiB or less) directly, but CMKs are more commonly used to encrypt data encryption keys (DEKs), which are used to encrypt raw data. For more information about DEKs and the difference between CMKs and DEKs, see the following:
The GenerateDataKey operation
AWS Key Management Service Concepts in the AWS Key Management Service Developer Guide
You cannot use this operation to create a CMK in a different AWS account.
| Constructor and Description |
|---|
CreateKeyRequest() |
| Modifier and Type | Method and Description |
|---|---|
boolean |
equals(Object obj) |
Boolean |
getBypassPolicyLockoutSafetyCheck()
A flag to indicate whether to bypass the key policy lockout safety check.
|
String |
getDescription()
A description of the CMK.
|
String |
getKeyUsage()
The intended use of the CMK.
|
String |
getOrigin()
The source of the CMK's key material.
|
String |
getPolicy()
The key policy to attach to the CMK.
|
List<Tag> |
getTags()
One or more tags.
|
int |
hashCode() |
Boolean |
isBypassPolicyLockoutSafetyCheck()
A flag to indicate whether to bypass the key policy lockout safety check.
|
void |
setBypassPolicyLockoutSafetyCheck(Boolean bypassPolicyLockoutSafetyCheck)
A flag to indicate whether to bypass the key policy lockout safety check.
|
void |
setDescription(String description)
A description of the CMK.
|
void |
setKeyUsage(KeyUsageType keyUsage)
The intended use of the CMK.
|
void |
setKeyUsage(String keyUsage)
The intended use of the CMK.
|
void |
setOrigin(OriginType origin)
The source of the CMK's key material.
|
void |
setOrigin(String origin)
The source of the CMK's key material.
|
void |
setPolicy(String policy)
The key policy to attach to the CMK.
|
void |
setTags(Collection<Tag> tags)
One or more tags.
|
String |
toString()
Returns a string representation of this object; useful for testing and
debugging.
|
CreateKeyRequest |
withBypassPolicyLockoutSafetyCheck(Boolean bypassPolicyLockoutSafetyCheck)
A flag to indicate whether to bypass the key policy lockout safety check.
|
CreateKeyRequest |
withDescription(String description)
A description of the CMK.
|
CreateKeyRequest |
withKeyUsage(KeyUsageType keyUsage)
The intended use of the CMK.
|
CreateKeyRequest |
withKeyUsage(String keyUsage)
The intended use of the CMK.
|
CreateKeyRequest |
withOrigin(OriginType origin)
The source of the CMK's key material.
|
CreateKeyRequest |
withOrigin(String origin)
The source of the CMK's key material.
|
CreateKeyRequest |
withPolicy(String policy)
The key policy to attach to the CMK.
|
CreateKeyRequest |
withTags(Collection<Tag> tags)
One or more tags.
|
CreateKeyRequest |
withTags(Tag... tags)
One or more tags.
|
clone, copyBaseTo, getCloneRoot, getCloneSource, getGeneralProgressListener, getRequestClientOptions, getRequestCredentials, getRequestMetricCollector, setGeneralProgressListener, setRequestCredentials, setRequestMetricCollector, withGeneralProgressListener, withRequestMetricCollectorpublic String getPolicy()
The key policy to attach to the CMK.
If you provide a key policy, it must meet the following criteria:
If you don't set BypassPolicyLockoutSafetyCheck to true, the
key policy must allow the principal that is making the
CreateKey request to make a subsequent PutKeyPolicy
request on the CMK. This reduces the risk that the CMK becomes
unmanageable. For more information, refer to the scenario in the Default Key Policy section of the AWS Key Management Service
Developer Guide.
Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS. For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide.
If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK. For more information, see Default Key Policy in the AWS Key Management Service Developer Guide.
The key policy size limit is 32 kilobytes (32768 bytes).
Constraints:
Length: 1 - 131072
Pattern: [ -ÿ]+
The key policy to attach to the CMK.
If you provide a key policy, it must meet the following criteria:
If you don't set BypassPolicyLockoutSafetyCheck to
true, the key policy must allow the principal that is making the
CreateKey request to make a subsequent
PutKeyPolicy request on the CMK. This reduces the risk
that the CMK becomes unmanageable. For more information, refer to
the scenario in the Default Key Policy section of the AWS Key Management
Service Developer Guide.
Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS. For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide.
If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK. For more information, see Default Key Policy in the AWS Key Management Service Developer Guide.
The key policy size limit is 32 kilobytes (32768 bytes).
public void setPolicy(String policy)
The key policy to attach to the CMK.
If you provide a key policy, it must meet the following criteria:
If you don't set BypassPolicyLockoutSafetyCheck to true, the
key policy must allow the principal that is making the
CreateKey request to make a subsequent PutKeyPolicy
request on the CMK. This reduces the risk that the CMK becomes
unmanageable. For more information, refer to the scenario in the Default Key Policy section of the AWS Key Management Service
Developer Guide.
Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS. For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide.
If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK. For more information, see Default Key Policy in the AWS Key Management Service Developer Guide.
The key policy size limit is 32 kilobytes (32768 bytes).
Constraints:
Length: 1 - 131072
Pattern: [ -ÿ]+
policy - The key policy to attach to the CMK.
If you provide a key policy, it must meet the following criteria:
If you don't set BypassPolicyLockoutSafetyCheck
to true, the key policy must allow the principal that is
making the CreateKey request to make a subsequent
PutKeyPolicy request on the CMK. This reduces the risk
that the CMK becomes unmanageable. For more information, refer
to the scenario in the Default Key Policy section of the AWS Key Management
Service Developer Guide.
Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS. For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide.
If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK. For more information, see Default Key Policy in the AWS Key Management Service Developer Guide.
The key policy size limit is 32 kilobytes (32768 bytes).
public CreateKeyRequest withPolicy(String policy)
The key policy to attach to the CMK.
If you provide a key policy, it must meet the following criteria:
If you don't set BypassPolicyLockoutSafetyCheck to true, the
key policy must allow the principal that is making the
CreateKey request to make a subsequent PutKeyPolicy
request on the CMK. This reduces the risk that the CMK becomes
unmanageable. For more information, refer to the scenario in the Default Key Policy section of the AWS Key Management Service
Developer Guide.
Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS. For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide.
If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK. For more information, see Default Key Policy in the AWS Key Management Service Developer Guide.
The key policy size limit is 32 kilobytes (32768 bytes).
Returns a reference to this object so that method calls can be chained together.
Constraints:
Length: 1 - 131072
Pattern: [ -ÿ]+
policy - The key policy to attach to the CMK.
If you provide a key policy, it must meet the following criteria:
If you don't set BypassPolicyLockoutSafetyCheck
to true, the key policy must allow the principal that is
making the CreateKey request to make a subsequent
PutKeyPolicy request on the CMK. This reduces the risk
that the CMK becomes unmanageable. For more information, refer
to the scenario in the Default Key Policy section of the AWS Key Management
Service Developer Guide.
Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS. For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide.
If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK. For more information, see Default Key Policy in the AWS Key Management Service Developer Guide.
The key policy size limit is 32 kilobytes (32768 bytes).
public String getDescription()
A description of the CMK.
Use a description that helps you decide whether the CMK is appropriate for a task.
Constraints:
Length: 0 - 8192
A description of the CMK.
Use a description that helps you decide whether the CMK is appropriate for a task.
public void setDescription(String description)
A description of the CMK.
Use a description that helps you decide whether the CMK is appropriate for a task.
Constraints:
Length: 0 - 8192
description - A description of the CMK.
Use a description that helps you decide whether the CMK is appropriate for a task.
public CreateKeyRequest withDescription(String description)
A description of the CMK.
Use a description that helps you decide whether the CMK is appropriate for a task.
Returns a reference to this object so that method calls can be chained together.
Constraints:
Length: 0 - 8192
description - A description of the CMK.
Use a description that helps you decide whether the CMK is appropriate for a task.
public String getKeyUsage()
The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
Constraints:
Allowed Values: ENCRYPT_DECRYPT
The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
KeyUsageTypepublic void setKeyUsage(String keyUsage)
The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
Constraints:
Allowed Values: ENCRYPT_DECRYPT
keyUsage - The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
KeyUsageTypepublic CreateKeyRequest withKeyUsage(String keyUsage)
The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
Returns a reference to this object so that method calls can be chained together.
Constraints:
Allowed Values: ENCRYPT_DECRYPT
keyUsage - The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
KeyUsageTypepublic void setKeyUsage(KeyUsageType keyUsage)
The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
Constraints:
Allowed Values: ENCRYPT_DECRYPT
keyUsage - The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
KeyUsageTypepublic CreateKeyRequest withKeyUsage(KeyUsageType keyUsage)
The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
Returns a reference to this object so that method calls can be chained together.
Constraints:
Allowed Values: ENCRYPT_DECRYPT
keyUsage - The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
KeyUsageTypepublic String getOrigin()
The source of the CMK's key material.
The default is AWS_KMS, which means AWS KMS creates the key
material. When this parameter is set to EXTERNAL, the
request creates a CMK without key material so that you can import key
material from your existing key management infrastructure. For more
information about importing key material into AWS KMS, see Importing Key Material in the AWS Key Management Service
Developer Guide.
The CMK's Origin is immutable and is set when the CMK is
created.
Constraints:
Allowed Values: AWS_KMS, EXTERNAL
The source of the CMK's key material.
The default is AWS_KMS, which means AWS KMS creates
the key material. When this parameter is set to
EXTERNAL, the request creates a CMK without key
material so that you can import key material from your existing
key management infrastructure. For more information about
importing key material into AWS KMS, see Importing Key Material in the AWS Key Management Service
Developer Guide.
The CMK's Origin is immutable and is set when the
CMK is created.
OriginTypepublic void setOrigin(String origin)
The source of the CMK's key material.
The default is AWS_KMS, which means AWS KMS creates the key
material. When this parameter is set to EXTERNAL, the
request creates a CMK without key material so that you can import key
material from your existing key management infrastructure. For more
information about importing key material into AWS KMS, see Importing Key Material in the AWS Key Management Service
Developer Guide.
The CMK's Origin is immutable and is set when the CMK is
created.
Constraints:
Allowed Values: AWS_KMS, EXTERNAL
origin - The source of the CMK's key material.
The default is AWS_KMS, which means AWS KMS
creates the key material. When this parameter is set to
EXTERNAL, the request creates a CMK without key
material so that you can import key material from your
existing key management infrastructure. For more information
about importing key material into AWS KMS, see Importing Key Material in the AWS Key Management
Service Developer Guide.
The CMK's Origin is immutable and is set when the
CMK is created.
OriginTypepublic CreateKeyRequest withOrigin(String origin)
The source of the CMK's key material.
The default is AWS_KMS, which means AWS KMS creates the key
material. When this parameter is set to EXTERNAL, the
request creates a CMK without key material so that you can import key
material from your existing key management infrastructure. For more
information about importing key material into AWS KMS, see Importing Key Material in the AWS Key Management Service
Developer Guide.
The CMK's Origin is immutable and is set when the CMK is
created.
Returns a reference to this object so that method calls can be chained together.
Constraints:
Allowed Values: AWS_KMS, EXTERNAL
origin - The source of the CMK's key material.
The default is AWS_KMS, which means AWS KMS
creates the key material. When this parameter is set to
EXTERNAL, the request creates a CMK without key
material so that you can import key material from your
existing key management infrastructure. For more information
about importing key material into AWS KMS, see Importing Key Material in the AWS Key Management
Service Developer Guide.
The CMK's Origin is immutable and is set when the
CMK is created.
OriginTypepublic void setOrigin(OriginType origin)
The source of the CMK's key material.
The default is AWS_KMS, which means AWS KMS creates the key
material. When this parameter is set to EXTERNAL, the
request creates a CMK without key material so that you can import key
material from your existing key management infrastructure. For more
information about importing key material into AWS KMS, see Importing Key Material in the AWS Key Management Service
Developer Guide.
The CMK's Origin is immutable and is set when the CMK is
created.
Constraints:
Allowed Values: AWS_KMS, EXTERNAL
origin - The source of the CMK's key material.
The default is AWS_KMS, which means AWS KMS
creates the key material. When this parameter is set to
EXTERNAL, the request creates a CMK without key
material so that you can import key material from your
existing key management infrastructure. For more information
about importing key material into AWS KMS, see Importing Key Material in the AWS Key Management
Service Developer Guide.
The CMK's Origin is immutable and is set when the
CMK is created.
OriginTypepublic CreateKeyRequest withOrigin(OriginType origin)
The source of the CMK's key material.
The default is AWS_KMS, which means AWS KMS creates the key
material. When this parameter is set to EXTERNAL, the
request creates a CMK without key material so that you can import key
material from your existing key management infrastructure. For more
information about importing key material into AWS KMS, see Importing Key Material in the AWS Key Management Service
Developer Guide.
The CMK's Origin is immutable and is set when the CMK is
created.
Returns a reference to this object so that method calls can be chained together.
Constraints:
Allowed Values: AWS_KMS, EXTERNAL
origin - The source of the CMK's key material.
The default is AWS_KMS, which means AWS KMS
creates the key material. When this parameter is set to
EXTERNAL, the request creates a CMK without key
material so that you can import key material from your
existing key management infrastructure. For more information
about importing key material into AWS KMS, see Importing Key Material in the AWS Key Management
Service Developer Guide.
The CMK's Origin is immutable and is set when the
CMK is created.
OriginTypepublic Boolean isBypassPolicyLockoutSafetyCheck()
A flag to indicate whether to bypass the key policy lockout safety check.
Setting this value to true increases the risk that the CMK becomes unmanageable. Do not set this value to true indiscriminately.
For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.
Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.
The default value is false.
A flag to indicate whether to bypass the key policy lockout safety check.
Setting this value to true increases the risk that the CMK becomes unmanageable. Do not set this value to true indiscriminately.
For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.
Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.
The default value is false.
public Boolean getBypassPolicyLockoutSafetyCheck()
A flag to indicate whether to bypass the key policy lockout safety check.
Setting this value to true increases the risk that the CMK becomes unmanageable. Do not set this value to true indiscriminately.
For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.
Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.
The default value is false.
A flag to indicate whether to bypass the key policy lockout safety check.
Setting this value to true increases the risk that the CMK becomes unmanageable. Do not set this value to true indiscriminately.
For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.
Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.
The default value is false.
public void setBypassPolicyLockoutSafetyCheck(Boolean bypassPolicyLockoutSafetyCheck)
A flag to indicate whether to bypass the key policy lockout safety check.
Setting this value to true increases the risk that the CMK becomes unmanageable. Do not set this value to true indiscriminately.
For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.
Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.
The default value is false.
bypassPolicyLockoutSafetyCheck - A flag to indicate whether to bypass the key policy lockout safety check.
Setting this value to true increases the risk that the CMK becomes unmanageable. Do not set this value to true indiscriminately.
For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.
Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.
The default value is false.
public CreateKeyRequest withBypassPolicyLockoutSafetyCheck(Boolean bypassPolicyLockoutSafetyCheck)
A flag to indicate whether to bypass the key policy lockout safety check.
Setting this value to true increases the risk that the CMK becomes unmanageable. Do not set this value to true indiscriminately.
For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.
Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.
The default value is false.
Returns a reference to this object so that method calls can be chained together.
bypassPolicyLockoutSafetyCheck - A flag to indicate whether to bypass the key policy lockout safety check.
Setting this value to true increases the risk that the CMK becomes unmanageable. Do not set this value to true indiscriminately.
For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.
Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.
The default value is false.
public List<Tag> getTags()
One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using TagResource.
One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using TagResource.
public void setTags(Collection<Tag> tags)
One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using TagResource.
tags - One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using TagResource.
public CreateKeyRequest withTags(Tag... tags)
One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using TagResource.
Returns a reference to this object so that method calls can be chained together.
tags - One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using TagResource.
public CreateKeyRequest withTags(Collection<Tag> tags)
One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using TagResource.
Returns a reference to this object so that method calls can be chained together.
tags - One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using TagResource.
public String toString()
toString in class ObjectObject.toString()Copyright © 2018. All rights reserved.