KMS — Key Management Service

AWS docs: https://docs.aws.amazon.com/kms/latest/APIReference/Welcome.html

KMS accepts AWS JSON 1.1 requests at POST / with X-Amz-Target: TrentService.<OperationName> and Smithy RPC v2 CBOR requests at /service/kms/operation/<OperationName> with Smithy-Protocol: rpc-v2-cbor.

---

Summary

Category	✅ Supported	⚠️ Partial
Key lifecycle	7	1
Aliases	4
Symmetric crypto	6
Asymmetric crypto	4
Tags	3
Key policies	3
Grants	5

---

Endpoints

Key lifecycle

Operation	Status	Notes	AWS Docs
CreateKey	⚠️ Partial	Symmetric and RSA key specs; validates caller-safe custom policies unless bypassed; accepts Tags; rejects Origin other than AWS_KMS and MultiRegion=true (not emulated)	docs
DescribeKey	✅ Supported	Lookup by UUID, ARN, or alias	docs
ListKeys	✅ Supported	Excludes PendingDeletion keys; no pagination (Truncated=false)	docs
EnableKey	✅ Supported		docs
DisableKey	✅ Supported		docs
UpdateKeyDescription	✅ Supported	Also dispatched by CloudFormation when AWS::KMS::Key Description changes	docs
ScheduleKeyDeletion	✅ Supported	PendingWindowInDays honoured; defaults to 30 days	docs
CancelKeyDeletion	✅ Supported	Restores key to Disabled state	docs

Aliases

Operation	Status	Notes	AWS Docs
CreateAlias	✅ Supported	alias/ prefix required	docs
DeleteAlias	✅ Supported		docs
ListAliases	✅ Supported	Optional KeyId filter (UUID, ARN, alias)	docs
UpdateAlias	✅ Supported	Updates target key for an existing alias	docs

Symmetric crypto

Operation	Status	Notes	AWS Docs
Encrypt	✅ Supported	AES-256-GCM; ciphertext envelope includes key ID	docs
Decrypt	✅ Supported	Extracts key ID from ciphertext envelope	docs
GenerateDataKey	✅ Supported	AES_256 and AES_128 specs; returns plaintext + encrypted	docs
GenerateDataKeyWithoutPlaintext	✅ Supported	Returns encrypted data key only	docs
ReEncrypt	✅ Supported	Decrypts and re-encrypts ciphertext with destination key	docs
GenerateDataKeyPair	✅ Supported	RSA_2048, RSA_3072, RSA_4096 key pair specs	docs

Asymmetric crypto

Operation	Status	Notes	AWS Docs
Sign	✅ Supported	RSA_2048 with RSASSA_PKCS1_V1_5_SHA_256	docs
Verify	✅ Supported	Returns SignatureValid: true/false	docs
GetPublicKey	✅ Supported	Returns DER-encoded public key for RSA keys	docs
VerifyMac	✅ Supported	HMAC_SHA_256, HMAC_SHA_384, HMAC_SHA_512	docs

Tags

Operation	Status	Notes	AWS Docs
TagResource	✅ Supported	Add tags to a KMS key	docs
UntagResource	✅ Supported	Remove tags from a KMS key	docs
ListResourceTags	✅ Supported	List tags for a KMS key	docs

Key policies

Operation	Status	Notes	AWS Docs
GetKeyPolicy	✅ Supported	Returns default or custom key policy	docs
PutKeyPolicy	✅ Supported	Validates policy structure, principals, and caller lockout safety before mutation	docs
ListKeyPolicies	✅ Supported	Returns list of policy names	docs

Grants

Operation	Status	Notes	AWS Docs
CreateGrant	✅ Supported	Creates a grant with optional constraints and retiring principal	docs
ListGrants	✅ Supported	Lists grants with optional KeyId, GrantId, and GranteePrincipal filters	docs
RevokeGrant	✅ Supported	Revokes a grant by ID	docs
RetireGrant	✅ Supported	Retires a grant by ID or token	docs
ListRetirableGrants	✅ Supported	Lists grants retirable by a principal	docs