A new platform for documentation and tutorials is launching soon.
We are migrating Vault documentation into HashiCorp Developer, our new developer experience.
»AWS KMS (API)
The Key Management secrets engine supports lifecycle management of keys in AWS KMS
regions. This is accomplished by configuring a KMS provider resource with the
awskms provider and
other provider-specific parameter values.
The following sections provide API documentation that is specific to AWS KMS.
»Create/Update KMS Provider
This endpoint creates or updates a KMS provider. If a KMS provider with the given
does not exist, it will be created. If the KMS provider exists, it will be updated with
the given parameter values.
(string: <required>)– Specifies the name of the KMS provider to create or update. This is provided as part of the request URL.
(string: <required>)– Specifies the name of a KMS provider that's external to Vault. Must be set to
awskms. Cannot be changed after creation.
(map<string|string>: nil)– The credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables.
(string: <required>)- The AWS access key ID. May also be specified by the
(string: <required>)- The AWS secret access key. May also be specified by the
(string: <optional>)- The AWS session token. May also be specified by the
(string: <optional>)- The KMS API endpoint to be used to make AWS KMS requests. May also be specified by the
AWS_KMS_ENDPOINTenvironment variable. This is useful when connecting to KMS over a VPC Endpoint. If not set, the secrets engine will use the default API endpoint for the region.