Skip to content
Reference
IAM Resources
KMS

KMS

create-kms-key 

[`POST /kms-key`](https://community.exoscale.com/reference/api/kms/kms-key/#create-kms-key)

Create a customer-managed unique KMS Key in your organization. A KMS Key is a logical representation of a cryptographic key material. It also includes metadata such as a UUID, a name and its state.

Parameters:

  • parameters.name
  • parameters.description
  • parameters.multi_zone
  • parameters.usage

disable-kms-key 

[`POST kms-key/{id}/disable`](https://community.exoscale.com/reference/api/kms/kms-key/#disable-kms-key)

Disables a KMS Key by setting its state to “disabled”. This prevents the use of the KMS key for cryptographic and key lifecycle operations.

Parameters:

  • parameters.id

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

enable-kms-key 

[`POST /kms-key/<id>`](https://community.exoscale.com/reference/api/kms/kms-key/#enable-kms-key)

Enables a KMS Key by setting its state to “enabled”. It restores the ability to fully use the KMS key for cryptographic operations and key lifecycle operations.

Parameters:

  • parameters.id

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

list-kms-key 

[`GET /kms-key`](https://community.exoscale.com/reference/api/kms/kms-key/#list-kms-keys)

Lists all KMS Keys in your organization in a given zone.

get-kms-key 

[`GET /kms-key/<id>`](https://community.exoscale.com/reference/api/kms/kms-key/#get-kms-key)

Retrieve KMS Key details.

Parameters:

  • parameters.id

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

rotate-kms-key 

[`POST /kms-key/<id>/rotate`](https://community.exoscale.com/reference/api/kms/kms-key/#rotate-kms-key)

Performs an immediate rotation of the key material for a symmetric key.

Parameters:

  • parameters.id

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

encrypt 

[`POST /kms-key/<id>/encrypt`](https://community.exoscale.com/reference/api/kms/cryptographic-operations/#encrypt)

Encrypts a plaintext.

Parameters:

  • parameters.id
  • parameters.encryption_context
  • parameters.plaintext

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

decrypt 

[`POST /kms-key/<id>/decrypt`](https://community.exoscale.com/reference/api/kms/cryptographic-operations/#decrypt)

Decrypts a ciphertext.

Parameters:

  • parameters.id
  • parameters.encryption_context
  • parameters.ciphertext

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

replicate-kms-key 

[`POST /kms-key/<id>/replicate`](https://community.exoscale.com/reference/api/kms/kms-key/#replicate-kms-key)

Replicate a KMS key to a target zone.

Parameters:

  • parameters.id
  • parameters.zone

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

re-encrypt 

[`POST /kms-key/<id>/re-encrypt`](https://community.exoscale.com/reference/api/kms/cryptographic-operations/#re-encrypt)

Decrypts an existing ciphertext using its original key material and re-encrypts the underlying plaintext using a specified KMS key or the latest key material of the same KMS Key.

This operation involves two KMS keys, both taken from the request body: the source key (source.key), which decrypts the ciphertext, and the destination key (destination.key), which encrypts the result. Both keys are authorized. The policy is evaluated once with resources.kms_key set to the source key, and once with resources.kms_key set to the destination key. The request is denied if either evaluation denies it.

Parameters:

  • parameters.id: the key ID in the path. It must match source.key in the request body, otherwise the request is rejected.
  • parameters.source
  • parameters.destination

Resources:

resources.kms_key is set to the source key in one evaluation, and to the destination key in the other:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

resources.source_kms_key and resources.destination_kms_key keep the same value in both evaluations, so use them to write a rule on one side of the operation only.

resources.source_kms_key is the key referenced by source.key in the request body. It exposes the same fields as resources.kms_key, for example:

  • resources.source_kms_key.id
  • resources.source_kms_key.name
  • resources.source_kms_key.state

resources.destination_kms_key is the key referenced by destination.key in the request body. It exposes the same fields as resources.kms_key, for example:

  • resources.destination_kms_key.id
  • resources.destination_kms_key.name
  • resources.destination_kms_key.state

Note

A rule on resources.kms_key applies to both keys. For example, a role only allowed to use key A can re-encrypt from A to A, but not from A to any other key. To allow re-encrypting from A to B, the policy must allow both keys, or use resources.source_kms_key and resources.destination_kms_key.

Warning

Because resources.kms_key is evaluated against each key in turn, do not pin it to one side in a re-encrypt rule. A condition such as resources.kms_key.name == 'key-source' is checked against the destination key too, so it rejects any legitimate call whose destination differs from the source. To constrain one side, use resources.source_kms_key or resources.destination_kms_key, whose values are stable across both evaluations. For example, to allow re-encrypting from key-source into key-destination:

"expression": "operation == 're-encrypt' && resources.source_kms_key.name == 'key-source' && resources.destination_kms_key.name == 'key-destination'",
"action": "allow"

schedule-kms-key-deletion 

[`POST /kms-key/<id>/schedule-deletion`](https://community.exoscale.com/reference/api/kms/kms-key/#schedule-kms-key-deletion)

Schedules a KMS key for deletion after a delay. You can specify a delay of 7-30 days.

Parameters:

  • parameters.id
  • parameters.delay-days

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

cancel-kms-key-deletion 

[`POST /kms-key/<id>/cancel-deletion`](https://community.exoscale.com/reference/api/kms/kms-key/#cancel-kms-key-deletion)

Cancels the scheduled deletion of a KMS Key.

Parameters:

  • parameters.id

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

generate-data-key 

[`POST /kms-key/<id>/generate-data-key`](https://community.exoscale.com/reference/api/kms/cryptographic-operations/#generate-data-key)

Generate a Data Encryption Key from a given KMS Key.

Parameters:

  • parameters.id
  • parameters.key_spec
  • parameters.bytes_count
  • parameters.encryption_context

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

enable-kms-key-rotation 

[`POST /kms-key/<id>/enable-key-rotation`](https://community.exoscale.com/reference/api/kms/kms-key/#enable-kms-key-rotation)

Enable the periodic rotation of a KMS Key.

Parameters:

  • parameters.id
  • parameters.rotation_period

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

disable-kms-key-rotation 

[`POST /kms-key/<id>/disable-key-rotation`](https://community.exoscale.com/reference/api/kms/kms-key/#disable-kms-key-rotation)

Disable the periodic rotation of a KMS Key.

Parameters:

  • parameters.id

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at

list-kms-key-rotations 

[`GET /kms-key/{id}/list-key-rotations`](https://community.exoscale.com/reference/api/kms/kms-key/#list-kms-key-rotations)

List all the key material versions of a KMS Key.

Parameters:

  • parameters.id

Resources:

  • resources.kms_key.id
  • resources.kms_key.name
  • resources.kms_key.description
  • resources.kms_key.material
  • resources.kms_key.multi_zone
  • resources.kms_key.origin_zone
  • resources.kms_key.replicas
  • resources.kms_key.replicas_status
  • resources.kms_key.revision
  • resources.kms_key.rotation
  • resources.kms_key.source
  • resources.kms_key.status
  • resources.kms_key.status_since
  • resources.kms_key.usage
  • resources.kms_key.state
  • resources.kms_key.created_at
Last updated on