detection.wiki

AWS Key Management Service (KMS)

eventNameDescriptionSampleRule
anyCatch-all entry for AWS Key Management Service (KMS) rules that match the service but not a specific eventName.NN
DecryptDecrypts ciphertext that was encrypted by an AWS KMS key.YN
DeleteImportedKeyMaterialDeletes key material that was previously imported into a customer-managed KMS key, rendering the key unusable until new material is imported.YY
DisableKeySets the status of a KMS key to disabled, preventing its use in cryptographic operations until it is re-enabled.YY
ImportKeyMaterialImports cryptographic key material into a KMS key that was created with no key material, enabling the caller to supply their own key material.NY
ListAliasesReturns a paginated list of KMS key aliases in the account and region, including system-defined and user-defined aliases.YY
ListKeysReturns a paginated list of KMS key IDs and ARNs for all customer-managed and AWS-managed keys in the current account and region.YY
PutKeyPolicyAttaches a key policy to a KMS key, replacing any existing policy and controlling who can use or manage the key.YY
ScheduleKeyDeletionSchedules a KMS key for deletion after a waiting period of 7 to 30 days, after which the key and its material are permanently deleted.YY
CancelKeyDeletionCancels the deletion of a KMS key.YN
ConnectCustomKeyStoreConnects or reconnects a custom key store to its backing key store.NN
CreateAliasCreates a friendly name for a KMS key.YN
CreateCustomKeyStoreCreates a custom key store backed by a key store that you own and manage.NN
CreateGrantAdds a grant to a KMS key.YN
CreateKeyCreates a unique customer managed KMS key in your Amazon Web Services account and Region.YN
DeleteAliasDeletes the specified alias.YN
DeleteCustomKeyStoreDeletes a custom key store.YN
DeriveSharedSecretDerives a shared secret using a key agreement algorithm.YN
DescribeCustomKeyStoresGets information about custom key stores in the account and Region.YN
DescribeKeyProvides detailed information about a KMS key.YN
DisableKeyRotationDisables automatic rotation of the key material of the specified symmetric encryption KMS key.YN
DisconnectCustomKeyStoreDisconnects the custom key store from its backing key store.NN
EnableKeySets the key state of a KMS key to enabled.YN
EnableKeyRotationEnables automatic rotation of the key material of the specified symmetric encryption KMS key.YN
EncryptEncrypts plaintext of up to 4,096 bytes using a KMS key.YN
GenerateDataKeyReturns a unique symmetric data key for use outside of KMS.YN
GenerateDataKeyPairReturns a unique asymmetric data key pair for use outside of KMS.YN
GenerateDataKeyPairWithoutPlaintextReturns a unique asymmetric data key pair for use outside of KMS.YN
GenerateDataKeyWithoutPlaintextReturns a unique symmetric data key for use outside of KMS.YN
GenerateMacGenerates a hash-based message authentication code (HMAC) for a message using an HMAC KMS key and a MAC algorithm that the key supports.YN
GenerateRandomReturns a random byte string that is cryptographically secure.YN
GetKeyLastUsageReturns usage information about the last successful cryptographic operation performed with a specified KMS key, including the operation type, timestamp, and associated CloudTrail event ID.YN
GetKeyPolicyGets a key policy attached to the specified KMS key.YN
GetKeyRotationStatusProvides detailed information about the rotation status for a KMS key, including whether automatic rotation of the key material is enabled for the specified KMS key, the rotation period, and the next scheduled rotation date.YN
GetParametersForImportReturns the public key and an import token you need to import or reimport key material for a KMS key.YN
GetPublicKeyReturns the public key of an asymmetric KMS key.YN
ListGrantsGets a list of all grants for the specified KMS key.YN
ListKeyPoliciesGets the names of the key policies that are attached to a KMS key.YN
ListKeyRotationsReturns information about the key materials associated with the specified KMS key.YN
ListResourceTagsReturns all tags on the specified KMS key.YN
ListRetirableGrantsReturns information about all grants in the Amazon Web Services account and Region that have the specified retiring principal or retiring service principal.NN
ReEncryptDecrypts ciphertext and then reencrypts it entirely within KMS.YN
ReplicateKeyReplicates a multi-Region key into the specified Region.NN
RetireGrantDeletes a grant.YN
RevokeGrantDeletes the specified grant.YN
RotateKeyOnDemandImmediately initiates rotation of the key material of the specified symmetric encryption KMS key.YN
SignCreates a digital signature for a message or message digest by using the private key in an asymmetric signing KMS key.YN
TagResourceAdds or edits tags on a customer managed key.YN
UntagResourceDeletes tags from a customer managed key.YN
UpdateAliasAssociates an existing KMS alias with a different KMS key.YN
UpdateCustomKeyStoreChanges the properties of a custom key store.YN
UpdateKeyDescriptionUpdates the description of a KMS key.YN
UpdatePrimaryRegionChanges the primary key of a multi-Region key.NN
VerifyVerifies a digital signature that was generated by the Sign operation.YN
VerifyMacVerifies the hash-based message authentication code (HMAC) for a specified message, HMAC KMS key, and MAC algorithm.YN
DeleteKeyDeleteKey recorded by CloudTrail for AWS Key Management Service (KMS). Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.NN
RotateKeyRotateKey recorded by CloudTrail for AWS Key Management Service (KMS). Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.NN
SynchronizeMultiRegionKeySynchronizeMultiRegionKey recorded by CloudTrail for AWS Key Management Service (KMS). Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.NN

any: AWS Key Management Service (KMS) (catch-all)

#
Service
kms

Description

Catch-all entry for AWS Key Management Service (KMS) rules that match the service but not a specific eventName.

Decrypt

#
Service
kms

Description

Decrypts ciphertext that was encrypted by an AWS KMS key.

CloudTrail management event, logged by default. Logged as a management event by default, but extremely high volume: many organizations exclude KMS or route its crypto operations to data events to control cost, so it may be absent or filtered. The plaintext is never recorded.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "c6ebc8b7-572c-4123-92bf-9d94933724ca",
  "eventName": "Decrypt",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2023-07-10T11:57:50Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "667f6ef8-c878-4517-bc4a-a6fb04ad2dac",
  "requestParameters": {
    "encryptionAlgorithm": "SYMMETRIC_DEFAULT",
    "encryptionContext": {
      "SecretARN": "arn:aws:secretsmanager:us-east-1:123837392027:secret:stratus-red-team-retrieve-secret-14-ZgthLn",
      "SecretVersionId": "B2617553-D7AD-4E0A-B780-1FEE2DE64093"
    }
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-east-1:123837392027:key/dad21b23-9915-42bd-981b-2a9f3c8f20c8",
      "accountId": "123837392027",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "secretsmanager.amazonaws.com",
  "userAgent": "secretsmanager.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIATFQR7NSC6V3LY3GE",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "invokedBy": "secretsmanager.amazonaws.com",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "sessionContext": {
      "attributes": {
        "creationDate": "2023-07-10T11:57:49Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bert-jan"
  },
  "vpcEndpointId": "vpce-0d985940f92611b87"
}

References #

DeleteImportedKeyMaterial

#
Service
kms

Description

Deletes key material that was previously imported into a customer-managed KMS key, rendering the key unusable until new material is imported.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NotFoundException",
  "errorMessage": "Invalid keyId 'ddddd'",
  "eventCategory": "Management",
  "eventID": "f1b58362-0393-4374-9c9d-ffe0d91b1725",
  "eventName": "DeleteImportedKeyMaterial",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T19:24:40Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "92f6458c-598c-4c1f-9d56-519259ded52b",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • AWS KMS Imported Key Material Deleted source medium: Identifies deletion of imported key material from an AWS KMS customer managed key via DeleteImportedKeyMaterial. Keys created with an external key material origin (BYOK) rely on key material that the customer imports. Deleting that material immediately makes the key unusable and renders all data encrypted under it inaccessible, with no recovery window. Unlike ScheduleKeyDeletion, which enforces a pending deletion period of 7 to 30 days, this action takes effect instantly, making it an attractive primitive for cloud ransomware and data-destruction attacks. Because this operation only applies to external-origin keys and is rare in normal operations, its use by an unexpected principal warrants prompt review.T1485, T1485.001

DisableKey

#
Service
kms

Description

Sets the status of a KMS key to disabled, preventing its use in cryptographic operations until it is re-enabled.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "f1109fb8-2b65-4989-a1e2-141f40a7d4dd",
  "eventName": "DisableKey",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T11:18:17Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "111111111111",
  "requestID": "cbe4b243-7231-4326-a0e6-d4bf24c5b63d",
  "requestParameters": {
    "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "95.90.199.65",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLK74OPBDR",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local",
    "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T09:03:18Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/okta_adm_role",
        "principalId": "AROAIJIESMXKGCJRCTPR6",
        "type": "Role",
        "userName": "okta_adm_role"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS KMS Customer Managed Key Disabled or Scheduled for Deletion source medium: Identifies attempts to disable or schedule the deletion of an AWS customer managed KMS Key. Disabling or scheduling a KMS key for deletion removes the ability to decrypt data encrypted under that key and can permanently destroy access to critical resources. Adversaries may use these operations to cause irreversible data loss, disrupt business operations, impede incident response, or hide evidence of prior activity. Because KMS keys often protect sensitive or regulated data, any modification to their lifecycle should be considered highly sensitive and investigated promptly.T1485, T1485.001↳ also matches ScheduleKeyDeletion

YARA-L #

Panther #

References #

ImportKeyMaterial

#
Service
kms

Description

Imports cryptographic key material into a KMS key that was created with no key material, enabling the caller to supply their own key material.

CloudTrail management event, logged by default.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

ListAliases

#
Service
kms

Description

Returns a paginated list of KMS key aliases in the account and region, including system-defined and user-defined aliases.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "934b6a24-565f-4e08-abad-5a9938d4c4b0",
  "eventName": "ListAliases",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T12:40:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111",
  "requestID": "2e3a641c-5512-4680-9be4-55e481334c28",
  "requestParameters": {
    "keyId": "c401f7ec-087a-4001-b085-0d25b6313dc1",
    "limit": 100
  },
  "responseElements": null,
  "sourceIPAddress": "95.90.199.65",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLK74OPBDR",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local",
    "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T09:03:18Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/okta_adm_role",
        "principalId": "AROAIJIESMXKGCJRCTPR6",
        "type": "Role",
        "userName": "okta_adm_role"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS Discovery API Calls from VPN ASN for the First Time by Identity source high: Flags the first time a given IAM principal invokes a narrow set of high-signal discovery APIs (credential check, account and IAM enumeration, bucket and compute inventory, logging introspection) from a source IP whose autonomous system number (ASN) matches a curated set commonly associated with consumer VPN brands, VPN-heavy hosting, and provider networks referenced in public reporting on TeamPCP activity (for example 31173 Services AB AS39351 and Oy Crea Nova Hosting Solution Ltd). Broad List*/Describe* patterns are intentionally omitted to reduce noise. Hosting ASNs are heavily dual-use; validate source.as.number in your data and extend event.action only when your baseline allows it.T1526, T1580↳ also matches ListKeys

References #

ListKeys

#
Service
kms

Description

Returns a paginated list of KMS key IDs and ARNs for all customer-managed and AWS-managed keys in the current account and region.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "1e68cb37-6f69-4527-907c-73e78c2a033d",
  "eventName": "ListKeys",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T13:01:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111",
  "requestID": "b2eedbd8-024f-4b96-9a69-3a9403de7c9d",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "config.amazonaws.com",
  "userAgent": "config.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLKF7YU6WG",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/config-role-us-west-2/KMSDescribeHandlerSession",
    "invokedBy": "config.amazonaws.com",
    "principalId": "AROAIQ3J3AWJKHZRVZC62:KMSDescribeHandlerSession",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T13:01:01Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/service-role/config-role-us-west-2",
        "principalId": "AROAIQ3J3AWJKHZRVZC62",
        "type": "Role",
        "userName": "config-role-us-west-2"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS Discovery API Calls from VPN ASN for the First Time by Identity source high: Flags the first time a given IAM principal invokes a narrow set of high-signal discovery APIs (credential check, account and IAM enumeration, bucket and compute inventory, logging introspection) from a source IP whose autonomous system number (ASN) matches a curated set commonly associated with consumer VPN brands, VPN-heavy hosting, and provider networks referenced in public reporting on TeamPCP activity (for example 31173 Services AB AS39351 and Oy Crea Nova Hosting Solution Ltd). Broad List*/Describe* patterns are intentionally omitted to reduce noise. Hosting ASNs are heavily dual-use; validate source.as.number in your data and extend event.action only when your baseline allows it.T1526, T1580↳ also matches ListAliases

References #

PutKeyPolicy

#
Service
kms

Description

Attaches a key policy to a KMS key, replacing any existing policy and controlling who can use or manage the key.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "612f17e3-2317-4dd9-8aa3-393bc8a7961b",
  "eventName": "PutKeyPolicy",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T11:04:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "111111111111",
  "requestID": "c7836c7a-ca95-47aa-a3fb-a7db0d66fec8",
  "requestParameters": {
    "bypassPolicyLockoutSafetyCheck": false,
    "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1",
    "policy": {
      "Version": "2012-10-17",
      "Id": "key-consolepolicy-3",
      "Statement": [
        {
          "Sid": "Enable IAM User Permissions",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::111111111111:root"
          },
          "Action": "kms:*",
          "Resource": "*"
        },
        {
          "Sid": "Allow access for Key Administrators",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::111111111111:user/patrick_cli"
          },
          "Action": [
            "kms:Create*",
            "kms:Describe*",
            "kms:Enable*",
            "kms:List*",
            "kms:Put*",
            "kms:Update*",
            "kms:Revoke*",
            "kms:Disable*",
            "kms:Get*",
            "kms:Delete*",
            "kms:TagResource",
            "kms:UntagResource",
            "kms:ScheduleKeyDeletion",
            "kms:CancelKeyDeletion"
          ],
          "Resource": "*"
        },
        {
          "Sid": "Allow use of the key",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::111111111111:user/patrick_cli"
          },
          "Action": [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:ReEncrypt*",
            "kms:GenerateDataKey*",
            "kms:DescribeKey"
          ],
          "Resource": "*"
        },
        {
          "Sid": "Allow attachment of persistent resources",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::111111111111:user/patrick_cli"
          },
          "Action": [
            "kms:CreateGrant",
            "kms:ListGrants",
            "kms:RevokeGrant"
          ],
          "Resource": "*",
          "Condition": {
            "Bool": {
              "kms:GrantIsForAWSResource": "true"
            }
          }
        },
        {
          "Sid": "Allow use of the key",
          "Effect": "Allow",
          "Principal": {
            "AWS": "*"
          },
          "Action": [
            "kms:Encrypt"
          ],
          "Resource": "*"
        }
      ]
    },
    "policyName": "default"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "95.90.199.65",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLK74OPBDR",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local",
    "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T09:03:18Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/okta_adm_role",
        "principalId": "AROAIJIESMXKGCJRCTPR6",
        "type": "Role",
        "userName": "okta_adm_role"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
aws::errorMessage (kusto rule field)is_null2 ruleskusto
Effect (kusto rule field)eqallow1 rulekusto
Principal (kusto rule field)eq*1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS KMS Key Policy Updated via PutKeyPolicy source medium: Identifies successful PutKeyPolicy calls on AWS KMS keys. The key policy is a resource-based policy that controls which principals can use the key for cryptographic operations and administration. Adversaries with "kms:PutKeyPolicy" may add or broaden principals (including external accounts) to decrypt or exfiltrate data protected by the key, or to preserve access after other credentials are rotated. This is distinct from disabling or scheduling deletion of the key.T1548, T1548.005, T1562

Splunk #

Kusto #

References #

ScheduleKeyDeletion

#
Service
kms

Description

Schedules a KMS key for deletion after a waiting period of 7 to 30 days, after which the key and its material are permanently deleted.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "e7495da9-8fb5-4525-aced-0b9343a4bf96",
  "eventName": "ScheduleKeyDeletion",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T11:18:59Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "111111111111",
  "requestID": "7fa7a926-a548-407f-9b78-7175087a30be",
  "requestParameters": {
    "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1",
    "pendingWindowInDays": 7
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "deletionDate": "Jan 18, 2021, 11:18:59 AM",
    "keyId": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1"
  },
  "sourceIPAddress": "95.90.199.65",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLK74OPBDR",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local",
    "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T09:03:18Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/okta_adm_role",
        "principalId": "AROAIJIESMXKGCJRCTPR6",
        "type": "Role",
        "userName": "okta_adm_role"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS KMS Customer Managed Key Disabled or Scheduled for Deletion source medium: Identifies attempts to disable or schedule the deletion of an AWS customer managed KMS Key. Disabling or scheduling a KMS key for deletion removes the ability to decrypt data encrypted under that key and can permanently destroy access to critical resources. Adversaries may use these operations to cause irreversible data loss, disrupt business operations, impede incident response, or hide evidence of prior activity. Because KMS keys often protect sensitive or regulated data, any modification to their lifecycle should be considered highly sensitive and investigated promptly.T1485, T1485.001↳ also matches DisableKey

YARA-L #

Panther #

References #

CancelKeyDeletion

#
Service
kms

Description

Cancels the deletion of a KMS key.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "f15233b8-aef9-48c6-b42b-adbc9944dd91",
  "eventName": "CancelKeyDeletion",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T12:40:27Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "111111111111",
  "requestID": "5ca55007-4e40-48cf-a1df-ccd553130035",
  "requestParameters": {
    "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "keyId": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1"
  },
  "sourceIPAddress": "95.90.199.65",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLK74OPBDR",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local",
    "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T09:03:18Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/okta_adm_role",
        "principalId": "AROAIJIESMXKGCJRCTPR6",
        "type": "Role",
        "userName": "okta_adm_role"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

ConnectCustomKeyStore

#
Service
kms

Description

Connects or reconnects a custom key store to its backing key store.

CreateAlias

#
Service
kms

Description

Creates a friendly name for a KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "dd2459c5-4acf-448d-b0e3-8a3fc2f40f14",
  "eventName": "CreateAlias",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T09:56:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "111111111111",
  "requestID": "1c8fe783-9f88-49e6-889c-d992e6fe4567",
  "requestParameters": {
    "aliasName": "alias/patrick_test",
    "targetKeyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    },
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:alias/patrick_test",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "95.90.199.65",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLK74OPBDR",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local",
    "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T09:03:18Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/okta_adm_role",
        "principalId": "AROAIJIESMXKGCJRCTPR6",
        "type": "Role",
        "userName": "okta_adm_role"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

CreateCustomKeyStore

#
Service
kms

Description

Creates a custom key store backed by a key store that you own and manage.

CreateGrant

#
Service
kms

Description

Adds a grant to a KMS key.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-2",
  "eventCategory": "Management",
  "eventID": "dc79edb4-8b8d-4d40-9399-eb4ecfb0e85d",
  "eventName": "CreateGrant",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-07-07T17:26:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "797507667711",
  "requestID": "9640dde2-3cc1-4a74-b907-76dc7a35a332",
  "requestParameters": {
    "constraints": {
      "encryptionContextSubset": {
        "aws:ebs:id": "vol-06f5cc4e2b61c9635"
      }
    },
    "granteePrincipal": "ec2.us-east-2.amazonaws.com",
    "keyId": "arn:aws:kms:us-east-2:797507667711:key/b08ed03c-6fbd-461f-84e5-ccb29cc262c3",
    "operations": [
      "Decrypt"
    ],
    "retiringPrincipal": "ec2.us-east-2.amazonaws.com"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-east-2:797507667711:key/b08ed03c-6fbd-461f-84e5-ccb29cc262c3",
      "accountId": "797507667711",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "grantId": "73f2d78027de2d15567023a5f4d95ef5973063c4fc8cf3a6813e383dbee948d2"
  },
  "sourceIPAddress": "ec2-frontend-api.amazonaws.com",
  "userAgent": "ec2-frontend-api.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAIVZMOSVLK2E3LJGA",
    "accountId": "797507667711",
    "arn": "arn:aws:sts::797507667711:assumed-role/Cado-Response-myCadoResponseRole-1TT3JQ6EQN4FG/1625678781.013978",
    "invokedBy": "ec2-frontend-api.amazonaws.com",
    "principalId": "AROA3TLZJI37S6HPJWVJ2:1625678781.013978",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-07-07T17:26:21Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "797507667711",
        "arn": "arn:aws:iam::797507667711:role/Cado-Response-myCadoResponseRole-1TT3JQ6EQN4FG",
        "principalId": "AROA3TLZJI37S6HPJWVJ2",
        "type": "Role",
        "userName": "Cado-Response-myCadoResponseRole-1TT3JQ6EQN4FG"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

CreateKey

#
Service
kms

Description

Creates a unique customer managed KMS key in your Amazon Web Services account and Region.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "f09518ac-5ae5-4214-80ee-4f23ccdedd4c",
  "eventName": "CreateKey",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T09:56:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "121521347698",
  "requestID": "3356af25-a237-471f-ba5e-abb37d4a256f",
  "requestParameters": {
    "bypassPolicyLockoutSafetyCheck": false,
    "customerMasterKeySpec": "SYMMETRIC_DEFAULT",
    "description": "",
    "keyUsage": "ENCRYPT_DECRYPT",
    "origin": "AWS_KMS",
    "policy": {
      "Id": "key-consolepolicy-3",
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "Enable IAM User Permissions",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::121521347698:root"
          },
          "Action": "kms:*",
          "Resource": "*"
        },
        {
          "Sid": "Allow access for Key Administrators",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::121521347698:user/patrick_cli"
          },
          "Action": [
            "kms:Create*",
            "kms:Describe*",
            "kms:Enable*",
            "kms:List*",
            "kms:Put*",
            "kms:Update*",
            "kms:Revoke*",
            "kms:Disable*",
            "kms:Get*",
            "kms:Delete*",
            "kms:TagResource",
            "kms:UntagResource",
            "kms:ScheduleKeyDeletion",
            "kms:CancelKeyDeletion"
          ],
          "Resource": "*"
        },
        {
          "Sid": "Allow use of the key",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::121521347698:user/patrick_cli"
          },
          "Action": [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:ReEncrypt*",
            "kms:GenerateDataKey*",
            "kms:DescribeKey"
          ],
          "Resource": "*"
        },
        {
          "Sid": "Allow attachment of persistent resources",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::121521347698:user/patrick_cli"
          },
          "Action": [
            "kms:CreateGrant",
            "kms:ListGrants",
            "kms:RevokeGrant"
          ],
          "Resource": "*",
          "Condition": {
            "Bool": {
              "kms:GrantIsForAWSResource": "true"
            }
          }
        },
        {
          "Sid": "Allow use of the key",
          "Effect": "Allow",
          "Principal": {
            "AWS": "*"
          },
          "Action": [
            "kms:Encrypt"
          ],
          "Resource": "*"
        }
      ]
    },
    "tags": []
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:121521347698:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "accountId": "121521347698",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "keyMetadata": {
      "aWSAccountId": "121521347698",
      "arn": "arn:aws:kms:us-west-2:121521347698:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "creationDate": "Jan 11, 2021, 9:56:30 AM",
      "customerMasterKeySpec": "SYMMETRIC_DEFAULT",
      "description": "",
      "enabled": true,
      "encryptionAlgorithms": [
        "SYMMETRIC_DEFAULT"
      ],
      "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "keyManager": "CUSTOMER",
      "keyState": "Enabled",
      "keyUsage": "ENCRYPT_DECRYPT",
      "origin": "AWS_KMS"
    }
  },
  "sourceIPAddress": "95.90.199.65",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLK74OPBDR",
    "accountId": "121521347698",
    "arn": "arn:aws:sts::121521347698:assumed-role/okta_adm_role/pbareiss@contoso.local",
    "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@contoso.local",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T09:03:18Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "121521347698",
        "arn": "arn:aws:iam::121521347698:role/okta_adm_role",
        "principalId": "AROAIJIESMXKGCJRCTPR6",
        "type": "Role",
        "userName": "okta_adm_role"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

DeleteAlias

#
Service
kms

Description

Deletes the specified alias.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "a7c73cbf-bb78-4893-8e03-b890132b4fec",
  "eventName": "DeleteAlias",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d6fb90c1-f317-4f7e-8677-63a82cd74ba3",
  "requestParameters": {
    "aliasName": "alias/dwfix"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:alias/dwfix",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    },
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "keyId": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteCustomKeyStore

#
Service
kms

Description

Deletes a custom key store.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "CustomKeyStoreNotFoundException",
  "eventCategory": "Management",
  "eventID": "a3c724b5-9850-4986-9f0b-a7b0abf54298",
  "eventName": "DeleteCustomKeyStore",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T19:24:40Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c651b6a6-5434-418e-bc25-0d733b140b29",
  "requestParameters": {
    "customKeyStoreId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeriveSharedSecret

#
Service
kms

Description

Derives a shared secret using a key agreement algorithm.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "bf391458-9c39-4e27-834a-c7b9b94c9464",
  "eventName": "DeriveSharedSecret",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "413456f6-8cf5-40f8-bd5e-818bfa1ade8d",
  "requestParameters": {
    "keyAgreementAlgorithm": "ECDH",
    "keyId": "33caf5bd-4720-4d57-87a1-42459b648429",
    "publicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGmMjDbt7DdOZx6Z+Po4lJcs6efaACry/3Js6j0HZHBig0HpbjpLe8rR4Mlsj8A1I8I3hpqrJ1gtYApqW5lmFPA=="
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/33caf5bd-4720-4d57-87a1-42459b648429",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeCustomKeyStores

#
Service
kms

Description

Gets information about custom key stores in the account and Region.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "d29c06d7-b30f-4d45-be5e-7adec8335889",
  "eventName": "DescribeCustomKeyStores",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T11:18:25Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111",
  "requestID": "5faf5922-5252-4f7b-8d14-da215bcf9f66",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "95.90.199.65",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLK74OPBDR",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local",
    "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T09:03:18Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/okta_adm_role",
        "principalId": "AROAIJIESMXKGCJRCTPR6",
        "type": "Role",
        "userName": "okta_adm_role"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

DescribeKey

#
Service
kms

Description

Provides detailed information about a KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "3bf3aaeb-17af-4713-ae79-2fed95dacd53",
  "eventName": "DescribeKey",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T13:01:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111",
  "requestID": "12588bf3-6c0c-44e8-8462-a2ea7bc7429e",
  "requestParameters": {
    "keyId": "0af18a2f-d7f3-4d85-8ead-4b7c94df5d23"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/0af18a2f-d7f3-4d85-8ead-4b7c94df5d23",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "config.amazonaws.com",
  "userAgent": "config.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLKF7YU6WG",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/config-role-us-west-2/KMSDescribeHandlerSession",
    "invokedBy": "config.amazonaws.com",
    "principalId": "AROAIQ3J3AWJKHZRVZC62:KMSDescribeHandlerSession",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T13:01:01Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/service-role/config-role-us-west-2",
        "principalId": "AROAIQ3J3AWJKHZRVZC62",
        "type": "Role",
        "userName": "config-role-us-west-2"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

DisableKeyRotation

#
Service
kms

Description

Disables automatic rotation of the key material of the specified symmetric encryption KMS key.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "954a132f-186e-45c3-8e54-50959cabacea",
  "eventName": "DisableKeyRotation",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "22c16376-93f9-4745-918e-4c69355f19df",
  "requestParameters": {
    "keyId": "149f6bcf-132d-459e-a177-b670bf8fdb35"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "keyId": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisconnectCustomKeyStore

#
Service
kms

Description

Disconnects the custom key store from its backing key store.

EnableKey

#
Service
kms

Description

Sets the key state of a KMS key to enabled.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "39e8716f-84c4-4768-987c-5613394b06a5",
  "eventName": "EnableKey",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T12:40:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "111111111111",
  "requestID": "7a73dcde-d731-43c7-bec6-3d844c97a70a",
  "requestParameters": {
    "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "95.90.199.65",
  "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLK74OPBDR",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local",
    "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T09:03:18Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/okta_adm_role",
        "principalId": "AROAIJIESMXKGCJRCTPR6",
        "type": "Role",
        "userName": "okta_adm_role"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

EnableKeyRotation

#
Service
kms

Description

Enables automatic rotation of the key material of the specified symmetric encryption KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "646b3fa5-c78d-470d-b8b0-d852a4336f5e",
  "eventName": "EnableKeyRotation",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f2f96e6e-0763-4ae9-9727-c6bc7515680a",
  "requestParameters": {
    "enableKeyRotationNow": false,
    "keyId": "149f6bcf-132d-459e-a177-b670bf8fdb35"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "keyId": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Encrypt

#
Service
kms

Description

Encrypts plaintext of up to 4,096 bytes using a KMS key.

CloudTrail management event, logged by default. Logged as a management event by default. Like Decrypt, high volume in environments with heavy KMS usage. Organizations may exclude all KMS events from a trail to control cost, in which case Encrypt events will be absent.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "a8713198-6e16-4b3a-9481-16e6ea225acd",
  "eventName": "Encrypt",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2023-07-10T11:58:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "befa3664-ae5a-4ff7-b256-4e2016194aae",
  "requestParameters": {
    "encryptionAlgorithm": "SYMMETRIC_DEFAULT",
    "encryptionContext": {
      "PARAMETER_ARN": "arn:aws:ssm:us-east-1:123837392027:parameter/credentials/stratus-red-team/credentials-5"
    },
    "keyId": "alias/aws/ssm"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-east-1:123837392027:key/0e5d0ab6-097e-49d8-99ef-747ce3e5f8f4",
      "accountId": "123837392027",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "AWS Internal",
  "userAgent": "AWS Internal",
  "userIdentity": {
    "accessKeyId": "ASIATFQR7NSCY3B4ATOG",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "invokedBy": "AWS Internal",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "sessionContext": {
      "attributes": {
        "creationDate": "2023-07-10T11:58:10Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

GenerateDataKey

#
Service
kms

Description

Returns a unique symmetric data key for use outside of KMS.

CloudTrail management event, logged by default. Logged as a management event by default. Very high volume in environments using SSE-KMS for S3, EBS, or Secrets Manager, as each write operation generates a data key. Organizations may exclude KMS events from a trail.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "1fb0962b-8d29-4ea5-b0f3-b12665a99c40",
  "eventName": "GenerateDataKey",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2023-07-10T11:57:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "b3783285-1b8b-44d9-96d6-8ab4686105a2",
  "requestParameters": {
    "encryptionContext": {
      "SecretARN": "arn:aws:secretsmanager:us-east-1:123837392027:secret:stratus-red-team-retrieve-secret-18-L0CnJd",
      "SecretVersionId": "83DAFE35-675A-49C6-A3CB-E80E7996AE01"
    },
    "keyId": "alias/aws/secretsmanager",
    "keySpec": "AES_256"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-east-1:123837392027:key/dad21b23-9915-42bd-981b-2a9f3c8f20c8",
      "accountId": "123837392027",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "secretsmanager.amazonaws.com",
  "userAgent": "secretsmanager.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIATFQR7NSC4TIW5GWC",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "invokedBy": "secretsmanager.amazonaws.com",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "sessionContext": {
      "attributes": {
        "creationDate": "2023-07-10T11:57:47Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "bert-jan"
  },
  "vpcEndpointId": "vpce-0d985940f92611b87"
}

References #

GenerateDataKeyPair

#
Service
kms

Description

Returns a unique asymmetric data key pair for use outside of KMS.

Example CloudTrail Event #

{
  "additionalEventData": {
    "keyMaterialId": "4437347c8bdc75c0615743e1207af9931a7d7d70211f195b59488690259826e4"
  },
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "bebf575e-482e-4690-b200-f2b7329ba6d9",
  "eventName": "GenerateDataKeyPair",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3c037dc7-974c-4ce5-b401-d32ee6bf4f73",
  "requestParameters": {
    "keyId": "12e38ad9-f936-40e9-ad5a-064a82f7c92e",
    "keyPairSpec": "ECC_NIST_P256"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/12e38ad9-f936-40e9-ad5a-064a82f7c92e",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GenerateDataKeyPairWithoutPlaintext

#
Service
kms

Description

Returns a unique asymmetric data key pair for use outside of KMS.

Example CloudTrail Event #

{
  "additionalEventData": {
    "keyMaterialId": "4437347c8bdc75c0615743e1207af9931a7d7d70211f195b59488690259826e4"
  },
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "97b304e6-53d8-43ab-88c6-6e905c8c1f01",
  "eventName": "GenerateDataKeyPairWithoutPlaintext",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "05c5fdf0-b89f-4619-8c5a-70698d890068",
  "requestParameters": {
    "keyId": "12e38ad9-f936-40e9-ad5a-064a82f7c92e",
    "keyPairSpec": "ECC_NIST_P256"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/12e38ad9-f936-40e9-ad5a-064a82f7c92e",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GenerateDataKeyWithoutPlaintext

#
Service
kms

Description

Returns a unique symmetric data key for use outside of KMS.

Example CloudTrail Event #

{
  "awsRegion": "us-east-2",
  "eventCategory": "Management",
  "eventID": "63985476-40ff-4756-a828-7dc65802fd06",
  "eventName": "GenerateDataKeyWithoutPlaintext",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-07-07T17:26:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "797507667711",
  "requestID": "9640dde2-3cc1-4a74-b907-76dc7a35a332",
  "requestParameters": {
    "encryptionContext": {
      "aws:ebs:id": "vol-06f5cc4e2b61c9635"
    },
    "keyId": "alias/aws/ebs",
    "numberOfBytes": 64
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-east-2:797507667711:key/b08ed03c-6fbd-461f-84e5-ccb29cc262c3",
      "accountId": "797507667711",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "ec2-frontend-api.amazonaws.com",
  "userAgent": "ec2-frontend-api.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAIVZMOSVLK2E3LJGA",
    "accountId": "797507667711",
    "arn": "arn:aws:sts::797507667711:assumed-role/Cado-Response-myCadoResponseRole-1TT3JQ6EQN4FG/1625678781.013978",
    "invokedBy": "ec2-frontend-api.amazonaws.com",
    "principalId": "AROA3TLZJI37S6HPJWVJ2:1625678781.013978",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-07-07T17:26:21Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "797507667711",
        "arn": "arn:aws:iam::797507667711:role/Cado-Response-myCadoResponseRole-1TT3JQ6EQN4FG",
        "principalId": "AROA3TLZJI37S6HPJWVJ2",
        "type": "Role",
        "userName": "Cado-Response-myCadoResponseRole-1TT3JQ6EQN4FG"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

GenerateMac

#
Service
kms

Description

Generates a hash-based message authentication code (HMAC) for a message using an HMAC KMS key and a MAC algorithm that the key supports.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "80e20e5d-3a57-4471-aa55-512250a85570",
  "eventName": "GenerateMac",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2d5d4089-5864-413d-9f76-202d4b77b08a",
  "requestParameters": {
    "keyId": "d5fa9ce3-9f4a-44fe-891f-56a2a5b1cc0d",
    "macAlgorithm": "HMAC_SHA_256"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/d5fa9ce3-9f4a-44fe-891f-56a2a5b1cc0d",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GenerateRandom

#
Service
kms

Description

Returns a random byte string that is cryptographically secure.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "3d32b9d3-ccd7-4e00-8a9d-f7d5d257137e",
  "eventName": "GenerateRandom",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "95080808-50d4-4239-b2c8-8ccb24fe57d5",
  "requestParameters": {
    "numberOfBytes": 32
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetKeyLastUsage

#
Service
kms

Description

Returns usage information about the last successful cryptographic operation performed with a specified KMS key, including the operation type, timestamp, and associated CloudTrail event ID.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NotFoundException",
  "errorMessage": "Invalid keyId 'ddddd'",
  "eventCategory": "Management",
  "eventID": "07955d83-0c07-4a9b-a988-dac23df31abc",
  "eventName": "GetKeyLastUsage",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T18:45:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3687a80b-7f63-4c66-98f7-2253aa3342ef",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetKeyPolicy

#
Service
kms

Description

Gets a key policy attached to the specified KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "4a679655-a8de-4d13-a3a4-56015bbce027",
  "eventName": "GetKeyPolicy",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T13:01:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111",
  "requestID": "cef27d65-fd02-428e-bf67-e6d41d82a83b",
  "requestParameters": {
    "keyId": "c401f7ec-087a-4001-b085-0d25b6313dc1",
    "policyName": "default"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/c401f7ec-087a-4001-b085-0d25b6313dc1",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "config.amazonaws.com",
  "userAgent": "config.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLKF7YU6WG",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/config-role-us-west-2/KMSDescribeHandlerSession",
    "invokedBy": "config.amazonaws.com",
    "principalId": "AROAIQ3J3AWJKHZRVZC62:KMSDescribeHandlerSession",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T13:01:01Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/service-role/config-role-us-west-2",
        "principalId": "AROAIQ3J3AWJKHZRVZC62",
        "type": "Role",
        "userName": "config-role-us-west-2"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

GetKeyRotationStatus

#
Service
kms

Description

Provides detailed information about the rotation status for a KMS key, including whether automatic rotation of the key material is enabled for the specified KMS key, the rotation period, and the next scheduled rotation date.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "3274955f-8412-49ec-9449-096139b45f71",
  "eventName": "GetKeyRotationStatus",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T13:01:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111",
  "requestID": "455f0486-4637-40fb-99c0-9c6d9bb688b5",
  "requestParameters": {
    "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "config.amazonaws.com",
  "userAgent": "config.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLKF7YU6WG",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/config-role-us-west-2/KMSDescribeHandlerSession",
    "invokedBy": "config.amazonaws.com",
    "principalId": "AROAIQ3J3AWJKHZRVZC62:KMSDescribeHandlerSession",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T13:01:01Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/service-role/config-role-us-west-2",
        "principalId": "AROAIQ3J3AWJKHZRVZC62",
        "type": "Role",
        "userName": "config-role-us-west-2"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

GetParametersForImport

#
Service
kms

Description

Returns the public key and an import token you need to import or reimport key material for a KMS key.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NotFoundException",
  "errorMessage": "Invalid keyId 'ddddd'",
  "eventCategory": "Management",
  "eventID": "9dd52ef8-47db-4981-b431-3019bf3e23d9",
  "eventName": "GetParametersForImport",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T18:45:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "57c30d83-6127-4d13-8b45-b526879808c9",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetPublicKey

#
Service
kms

Description

Returns the public key of an asymmetric KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NotFoundException",
  "errorMessage": "Invalid keyId 'ddddd'",
  "eventCategory": "Management",
  "eventID": "e1ae4440-fd15-4949-9c4d-f0cff1cd2c72",
  "eventName": "GetPublicKey",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T18:45:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "48734f65-2c72-4a81-adbd-95deaa4a3fa3",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListGrants

#
Service
kms

Description

Gets a list of all grants for the specified KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "2403c913-b88d-4fd5-84aa-cbd458d9a248",
  "eventName": "ListGrants",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T12:52:16Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111",
  "requestID": "15c828ef-5d23-47ab-9ddb-b8e7d6bd65af",
  "requestParameters": {
    "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "access-analyzer.amazonaws.com",
  "userAgent": "access-analyzer.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLPF7F55U5",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/AWSServiceRoleForAccessAnalyzer/access-analyzer",
    "invokedBy": "access-analyzer.amazonaws.com",
    "principalId": "AROAYTOGP2RLHCEDQ3SGQ:access-analyzer",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T12:52:16Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer",
        "principalId": "AROAYTOGP2RLHCEDQ3SGQ",
        "type": "Role",
        "userName": "AWSServiceRoleForAccessAnalyzer"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

ListKeyPolicies

#
Service
kms

Description

Gets the names of the key policies that are attached to a KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "c5543160-7465-4434-95e0-cd1613a134f8",
  "eventName": "ListKeyPolicies",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-04-13T13:30:42Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "760111141337",
  "requestID": "4db05a17-c6c5-4162-9d74-fac3424d02bb",
  "requestParameters": {
    "keyId": "c401f7ec-087a-4001-b085-0d25b6313dc1"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:760111141337:key/c401f7ec-087a-4001-b085-0d25b6313dc1",
      "accountId": "760111141337",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "95.9.125.40",
  "userAgent": "Boto3/1.14.6 Python/3.9.4 Darwin/20.3.0 Botocore/1.17.6",
  "userIdentity": {
    "accessKeyId": "AKIAYTOGP2RLIXX7QSZR",
    "accountId": "760111141337",
    "arn": "arn:aws:iam::760111141337:user/cloudmapper",
    "principalId": "AIDAYTOGP2RLK32EB7QZV",
    "type": "IAMUser",
    "userName": "cloudmapper"
  }
}

References #

ListKeyRotations

#
Service
kms

Description

Returns information about the key materials associated with the specified KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NotFoundException",
  "errorMessage": "Invalid keyId 'ddddd'",
  "eventCategory": "Management",
  "eventID": "d5374f79-1f80-4281-b1c0-5dd4e81c2767",
  "eventName": "ListKeyRotations",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T18:45:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2c428814-6794-48d4-b39e-915eb77a1448",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListResourceTags

#
Service
kms

Description

Returns all tags on the specified KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-2",
  "eventCategory": "Management",
  "eventID": "ff7472b2-9db6-4188-aaa1-6013683f9ea4",
  "eventName": "ListResourceTags",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-01-11T13:01:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111",
  "requestID": "409e9a3d-5f27-4b47-be51-5d4d8c8c29a5",
  "requestParameters": {
    "keyId": "e16ded1e-99c6-4991-96fd-247977778729"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-2:111111111111:key/e16ded1e-99c6-4991-96fd-247977778729",
      "accountId": "111111111111",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "config.amazonaws.com",
  "userAgent": "config.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAYTOGP2RLKF7YU6WG",
    "accountId": "111111111111",
    "arn": "arn:aws:sts::111111111111:assumed-role/config-role-us-west-2/KMSDescribeHandlerSession",
    "invokedBy": "config.amazonaws.com",
    "principalId": "AROAIQ3J3AWJKHZRVZC62:KMSDescribeHandlerSession",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-01-11T13:01:01Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "111111111111",
        "arn": "arn:aws:iam::111111111111:role/service-role/config-role-us-west-2",
        "principalId": "AROAIQ3J3AWJKHZRVZC62",
        "type": "Role",
        "userName": "config-role-us-west-2"
      },
      "webIdFederationData": {}
    },
    "type": "AssumedRole"
  }
}

References #

ListRetirableGrants

#
Service
kms

Description

Returns information about all grants in the Amazon Web Services account and Region that have the specified retiring principal or retiring service principal.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "0ff89cfe-885c-4d5a-8581-8a35c82bf3de",
  "eventSource": "kms.amazonaws.com",
  "eventName": "ListRetirableGrants",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "1380bc5d-4128-4176-ba36-2ed2db347add",
  "userAgent": "mgn.amazonaws.com"
}

ReEncrypt

#
Service
kms

Description

Decrypts ciphertext and then reencrypts it entirely within KMS.

CloudTrail management event, logged by default. Logged as a CloudTrail management event by default, though AWS KMS events can be excluded from a trail.

Example CloudTrail Event #

{
  "additionalEventData": {
    "destinationKeyMaterialId": "462ef053ab80ea24638b91dcad20d4b05ad4349916587be3d4bef3da48684d43",
    "sourceKeyMaterialId": "4437347c8bdc75c0615743e1207af9931a7d7d70211f195b59488690259826e4"
  },
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "032619cd-593c-40e0-8b1a-e04e7e302b2f",
  "eventName": "ReEncrypt",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "477109d0-ad3e-4e57-8cb5-949e124c86e5",
  "requestParameters": {
    "destinationEncryptionAlgorithm": "SYMMETRIC_DEFAULT",
    "destinationKeyId": "c2d30841-a81b-4fce-a1c6-5967cab9a249",
    "sourceEncryptionAlgorithm": "SYMMETRIC_DEFAULT"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/12e38ad9-f936-40e9-ad5a-064a82f7c92e",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    },
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/c2d30841-a81b-4fce-a1c6-5967cab9a249",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ReplicateKey

#
Service
kms

Description

Replicates a multi-Region key into the specified Region.

RetireGrant

#
Service
kms

Description

Deletes a grant.

Example CloudTrail Event #

{
  "additionalEventData": {
    "grantId": "028a3d5aa1530879db47eafbd8cfebb050971a2815c4861cbcaa4dd966137c2a"
  },
  "awsRegion": "us-east-2",
  "eventCategory": "Management",
  "eventID": "4d52cf79-478d-4057-8ff4-b2a82839a789",
  "eventName": "RetireGrant",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2021-07-07T17:39:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "797507667711",
  "requestID": "c4a37446-3d10-4723-9101-54f5e94ae9a7",
  "requestParameters": null,
  "resources": [
    {
      "ARN": "arn:aws:kms:us-east-2:797507667711:key/b08ed03c-6fbd-461f-84e5-ccb29cc262c3",
      "accountId": "797507667711",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sharedEventID": "d252f2b1-bc3a-4afd-a8f2-a8dfbf93e428",
  "sourceIPAddress": "AWS Internal",
  "userAgent": "AWS Internal",
  "userIdentity": {
    "invokedBy": "AWS Internal",
    "type": "AWSService"
  }
}

References #

RevokeGrant

#
Service
kms

Description

Deletes the specified grant.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "NotFoundException",
  "errorMessage": "Invalid keyId 'ddddd'",
  "eventCategory": "Management",
  "eventID": "8c8f6995-bba9-44b6-af95-10615e9d60a6",
  "eventName": "RevokeGrant",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T19:24:40Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a9381bea-fea8-4333-99d2-2eff806324a5",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

RotateKeyOnDemand

#
Service
kms

Description

Immediately initiates rotation of the key material of the specified symmetric encryption KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "82d02249-ddfd-4d48-8130-d3ec2725062f",
  "eventName": "RotateKeyOnDemand",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "11e1ca6f-7fe2-4cfd-a67c-2a8f94e8531a",
  "requestParameters": {
    "keyId": "12e38ad9-f936-40e9-ad5a-064a82f7c92e"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/12e38ad9-f936-40e9-ad5a-064a82f7c92e",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "keyId": "arn:aws:kms:us-west-1:123456789012:key/12e38ad9-f936-40e9-ad5a-064a82f7c92e"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Sign

#
Service
kms

Description

Creates a digital signature for a message or message digest by using the private key in an asymmetric signing KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "7a3cf3e1-05f5-4bd2-8903-e750606ade32",
  "eventName": "Sign",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ca7cd384-9b0f-4bb3-b34f-c7243f9f64b8",
  "requestParameters": {
    "keyId": "c02df18f-aafa-4423-83c3-205b1d5df3ad",
    "messageType": "RAW",
    "signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_256"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/c02df18f-aafa-4423-83c3-205b1d5df3ad",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

#
Service
kms

Description

Adds or edits tags on a customer managed key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "fcc1ae75-ed60-40d4-9402-e879d7aee2c5",
  "eventName": "TagResource",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "9b3edc77-7f14-4e10-8cd0-d5b16d68aa84",
  "requestParameters": {
    "keyId": "149f6bcf-132d-459e-a177-b670bf8fdb35",
    "tags": [
      {
        "tagKey": "dw",
        "tagValue": "f"
      }
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "keyId": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

#
Service
kms

Description

Deletes tags from a customer managed key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "ec811b2b-5cb4-4bf3-a770-d36a36fd469f",
  "eventName": "UntagResource",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "bf71b80d-dbda-4154-aa3e-22210cd610a9",
  "requestParameters": {
    "keyId": "149f6bcf-132d-459e-a177-b670bf8fdb35",
    "tagKeys": [
      "dw"
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "keyId": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateAlias

#
Service
kms

Description

Associates an existing KMS alias with a different KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "2e5398b1-367e-4f24-8fec-e38657ad56ea",
  "eventName": "UpdateAlias",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "af61999d-30c7-4344-92e2-11671fdae15e",
  "requestParameters": {
    "aliasName": "alias/dwfix-kms-test",
    "targetKeyId": "c2d30841-a81b-4fce-a1c6-5967cab9a249"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:alias/dwfix-kms-test",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    },
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/c2d30841-a81b-4fce-a1c6-5967cab9a249",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "keyId": "arn:aws:kms:us-west-1:123456789012:key/c2d30841-a81b-4fce-a1c6-5967cab9a249"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateCustomKeyStore

#
Service
kms

Description

Changes the properties of a custom key store.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "CustomKeyStoreNotFoundException",
  "eventCategory": "Management",
  "eventID": "b62dac2e-e72a-4fc9-9634-aa08780fcc12",
  "eventName": "UpdateCustomKeyStore",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T19:24:40Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "0916e546-0f25-4120-beec-d932189239e6",
  "requestParameters": {
    "customKeyStoreId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateKeyDescription

#
Service
kms

Description

Updates the description of a KMS key.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "b76d3e17-3057-4c8d-80e1-a5236a4311d0",
  "eventName": "UpdateKeyDescription",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T19:12:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "db3eeebe-cfa4-4b46-a9d8-26aa377b5a7a",
  "requestParameters": {
    "description": "dw2",
    "keyId": "149f6bcf-132d-459e-a177-b670bf8fdb35"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": {
    "keyId": "arn:aws:kms:us-west-1:123456789012:key/149f6bcf-132d-459e-a177-b670bf8fdb35"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdatePrimaryRegion

#
Service
kms

Description

Changes the primary key of a multi-Region key.

Verify

#
Service
kms

Description

Verifies a digital signature that was generated by the Sign operation.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "f3530fd2-be4f-4bec-93bb-21e98a9edbc9",
  "eventName": "Verify",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1f708f9d-3b8e-4a0c-bb66-527590dd0d3b",
  "requestParameters": {
    "keyId": "c02df18f-aafa-4423-83c3-205b1d5df3ad",
    "messageType": "RAW",
    "signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_256"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/c02df18f-aafa-4423-83c3-205b1d5df3ad",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

VerifyMac

#
Service
kms

Description

Verifies the hash-based message authentication code (HMAC) for a specified message, HMAC KMS key, and MAC algorithm.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "a26c6b36-26b7-40b9-b884-67c2d0113d18",
  "eventName": "VerifyMac",
  "eventSource": "kms.amazonaws.com",
  "eventTime": "2026-06-29T20:59:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "f67908e6-5493-44f6-a9d6-e1e241359f18",
  "requestParameters": {
    "keyId": "d5fa9ce3-9f4a-44fe-891f-56a2a5b1cc0d",
    "macAlgorithm": "HMAC_SHA_256"
  },
  "resources": [
    {
      "ARN": "arn:aws:kms:us-west-1:123456789012:key/d5fa9ce3-9f4a-44fe-891f-56a2a5b1cc0d",
      "accountId": "123456789012",
      "type": "AWS::KMS::Key"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "clientProvidedHostHeader": "kms.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,n,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteKey

#
Service
kms

Description

DeleteKey recorded by CloudTrail for AWS Key Management Service (KMS). Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "7723d255-b62b-4def-ad29-f19363ed365d",
  "eventSource": "kms.amazonaws.com",
  "eventName": "DeleteKey",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "userAgent": "AWS Internal",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::KMS::Key",
      "ARN": "arn:aws:kms:us-east-1:123456789012:key/EXAMPLE"
    }
  ]
}

RotateKey

#
Service
kms

Description

RotateKey recorded by CloudTrail for AWS Key Management Service (KMS). Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "c262e538-9cbc-4aac-9db9-ca688ef66f12",
  "eventSource": "kms.amazonaws.com",
  "eventName": "RotateKey",
  "awsRegion": "us-east-2",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "userAgent": "AWS Internal",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::KMS::Key",
      "ARN": "arn:aws:kms:us-east-2:123456789012:key/EXAMPLE"
    }
  ]
}

SynchronizeMultiRegionKey

#
Service
kms

Description

SynchronizeMultiRegionKey recorded by CloudTrail for AWS Key Management Service (KMS). Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "21e37e1f-449b-465b-ab16-0e71b37487be",
  "eventSource": "kms.amazonaws.com",
  "eventName": "SynchronizeMultiRegionKey",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "e4a55faa-6a03-48ac-87d4-ab22194e2282",
  "userAgent": "kms.amazonaws.com",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::KMS::Key",
      "ARN": "arn:aws:kms:us-east-1:123456789012:key/EXAMPLE"
    }
  ]
}