Overcast is alpha — behaviour and APIs may change between releases. Pin your version and read the changelog before upgrading.

overcast

KMS operations

Every KMS operation Overcast declares — 34 of 34 implemented — with status, behaviour notes and a link to the AWS API reference for each.

All 34 listed operations are implemented. Back to KMS.

Summary

Category✅ Supported⚠️ Partial
Key lifecycle71
Aliases4
Symmetric crypto61
Asymmetric crypto4
Tags3
Key policies3
Grants5

Endpoints

Key lifecycle

OperationStatusNotesAWS Docs
CreateKey⚠️ PartialSymmetric and RSA key specs; validates caller-safe custom policies unless bypassed; accepts Tags; rejects Origin other than AWS_KMS and MultiRegion=true (not emulated)docs
DescribeKey✅ SupportedLookup by UUID, ARN, or aliasdocs
ListKeys✅ SupportedExcludes PendingDeletion keys; no pagination (Truncated=false)docs
EnableKey✅ Supporteddocs
DisableKey✅ Supporteddocs
UpdateKeyDescription✅ SupportedAlso dispatched by CloudFormation when AWS::KMS::Key Description changesdocs
ScheduleKeyDeletion✅ SupportedPendingWindowInDays 7-30, defaulting to 30 and returned in the response; response KeyId is the key ARNdocs
CancelKeyDeletion✅ SupportedRestores key to Disabled state; response KeyId is the key ARNdocs

Aliases

OperationStatusNotesAWS Docs
CreateAlias✅ Supportedalias/ prefix required; reserved alias/aws/ and duplicate names rejecteddocs
DeleteAlias✅ Supporteddocs
ListAliases✅ SupportedOptional KeyId filter (UUID, ARN, alias)docs
UpdateAlias✅ SupportedUpdates target key for an existing aliasdocs

Symmetric crypto

OperationStatusNotesAWS Docs
Encrypt✅ SupportedAES-256-GCM; Plaintext capped at 4096 bytes; ciphertext envelope includes key IDdocs
Decrypt✅ SupportedExtracts key ID from ciphertext envelope; a KeyId naming a different key is an IncorrectKeyExceptiondocs
GenerateDataKey✅ SupportedExactly one of KeySpec (AES_256/AES_128) or NumberOfBytes (1-1024); returns plaintext + encrypteddocs
GenerateDataKeyWithoutPlaintext✅ SupportedSame KeySpec/NumberOfBytes rules as GenerateDataKey; returns encrypted data key onlydocs
GenerateRandom⚠️ PartialNumberOfBytes (1-1024) required; CustomKeyStoreId and Recipient are ignored (not emulated)docs
ReEncrypt✅ SupportedDecrypts and re-encrypts ciphertext with destination key; a SourceKeyId naming a different key is an IncorrectKeyExceptiondocs
GenerateDataKeyPair✅ SupportedRSA_2048, RSA_3072, RSA_4096 key pair specsdocs

Asymmetric crypto

OperationStatusNotesAWS Docs
Sign✅ SupportedRSA_2048 with RSASSA_PKCS1_V1_5_SHA_256docs
Verify✅ SupportedReturns SignatureValid: true/falsedocs
GetPublicKey✅ SupportedReturns DER-encoded public key for RSA keysdocs
VerifyMac✅ SupportedHMAC_SHA_256, HMAC_SHA_384, HMAC_SHA_512docs

Tags

OperationStatusNotesAWS Docs
TagResource✅ SupportedAdd tags to a KMS keydocs
UntagResource✅ SupportedRemove tags from a KMS keydocs
ListResourceTags✅ SupportedList tags for a KMS keydocs

Key policies

OperationStatusNotesAWS Docs
GetKeyPolicy✅ SupportedReturns default or custom key policydocs
PutKeyPolicy✅ SupportedValidates policy structure, principals, and caller lockout safety before mutationdocs
ListKeyPolicies✅ SupportedReturns list of policy namesdocs

Grants

OperationStatusNotesAWS Docs
CreateGrant✅ SupportedCreates a grant with optional constraints and retiring principaldocs
ListGrants✅ SupportedLists grants with optional KeyId, GrantId, and GranteePrincipal filtersdocs
RevokeGrant✅ SupportedRevokes a grant by IDdocs
RetireGrant✅ SupportedRetires a grant by ID or tokendocs
ListRetirableGrants✅ SupportedLists grants retirable by a principaldocs