# KMS compatibility, v0.0.1-alpha.44 > Compatibility test results for KMS in Overcast v0.0.1-alpha.44. 56 tests. Of the 385 results that measure Overcast, 357 pass (92.7%). 5 tests have a result Overcast has to act on, listed below with the evidence. The overview, with every service, is at https://overcast.sh/compat/index.md. ## Tests Overcast does not yet pass ### DescribeKeyMetadata (DescribeKey) Group `kms-gen-key`. - AWS CLI v2: New test, still soaking. responseField matches at `$.KeyMetadata.AWSAccountId`: expected a string matching "^[0-9]{12}$", actual . - AWS SDK for .NET: New test, still soaking. responseField matches at `$.KeyMetadata.AWSAccountId`: expected a string matching "^[0-9]{12}$", actual . - AWS SDK for Go v2: New test, still soaking. responseField matches at `$.KeyMetadata.AWSAccountId`: expected a string matching "^[0-9]{12}$", actual . - AWS SDK for Java 2.x: New test, still soaking. responseField matches at `$.KeyMetadata.AWSAccountId`: expected a string matching "^[0-9]{12}$", actual . - AWS SDK for JavaScript v3: New test, still soaking. responseField at `$.KeyMetadata.AWSAccountId`: expected a string matching /^[0-9]{12}$/, actual . - AWS SDK for Python (boto3): New test, still soaking. responseField matches at `$.KeyMetadata.AWSAccountId`: expected /^[0-9]{12}$/, actual . - AWS SDK for Rust: New test, still soaking. responseField matches at `$.KeyMetadata.AWSAccountId`: expected a string matching "^[0-9]{12}$", actual . ### DescribeCustomKeyStores Group `kms-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetKeyRotationStatus Group `kms-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetParametersForImport Group `kms-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListKeyRotations Group `kms-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ## Not tested Operations with no test. The generator declined to write one, for the reason given. - ConnectCustomKeyStore (`never-probe`): Connects a custom key store to its AWS CloudHSM cluster or external key store proxy, which changes whether every KMS key in that store can be used at all. - CreateCustomKeyStore (`never-probe`): Creates a custom key store bound to a CloudHSM cluster or an external key manager. Nothing in a probe group removes it, and an orphaned key store keeps its backing cluster associated. - Decrypt (`probe-of-implemented-op`): Decrypt is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - DeleteCustomKeyStore (`never-probe`): Deletes a custom key store. AWS refuses only while the store still holds KMS keys, so a store emptied by an earlier deletion is destroyed by this call. - DeleteImportedKeyMaterial (`never-probe`): Deletes the imported key material of a KMS key. Every ciphertext encrypted under that key becomes undecryptable until the same material is imported again, and AWS keeps no copy of it. - DeriveSharedSecret (`never-probe`): Performs an ECDH key agreement with the caller's public key and bills for it. It also takes a raw public key blob, which the IR cannot express. - DisableKeyRotation (`never-probe`): Turns off automatic annual rotation for a live KMS key, which is a control an account's compliance posture is usually built on. - DisconnectCustomKeyStore (`never-probe`): Disconnects a custom key store from its backing cluster. Every KMS key in the store stops working for cryptographic operations until it is reconnected. - EnableKeyRotation (`never-probe`): Turns on automatic annual rotation for a live KMS key. AWS bills for each key version the rotation creates, and rotation cannot be undone for versions already generated. - Encrypt (`probe-of-implemented-op`): Encrypt is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - GenerateDataKeyPairWithoutPlaintext (`never-probe`): GenerateDataKeyPairWithoutPlaintext is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - GenerateMac (`never-probe`): GenerateMac is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - GetKeyLastUsage (`probe-binds-live-resource`): GetKeyLastUsage.KeyId would bind to key.id, a value exported from a resource the run owns; a probe calls an operation the emulator does not implement, so against real AWS it would act on that resource for real. Add a curated literal for KeyId to values.json, or leave the operation refused - ImportKeyMaterial (`never-probe`): Replaces the key material of a KMS key with material the caller supplies, which changes what every existing ciphertext under that key decrypts with. - ReEncrypt (`probe-of-implemented-op`): ReEncrypt is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - ReplicateKey (`never-probe`): Creates a replica of a multi-Region key in another Region. The replica is a KMS key of its own, in a Region nothing in this run looks at, and it can only be removed by scheduling its deletion there. - RotateKeyOnDemand (`never-probe`): Creates a new key version of a live KMS key immediately. AWS bills for each version and a version cannot be removed. - Sign (`probe-of-implemented-op`): Sign is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - UpdateCustomKeyStore (`never-probe`): Changes the cluster, credentials or proxy configuration of a live custom key store, which can leave every KMS key in it unusable. - UpdatePrimaryRegion (`never-probe`): Moves the primary of a multi-Region key to another Region, demoting the current primary to a replica. It changes which Region may replicate and manage the key. - Verify (`probe-of-implemented-op`): Verify is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - VerifyMac (`probe-of-implemented-op`): VerifyMac is implemented (Supported), so it may not be probed, and no recipe resource gives it a role