Importing key material in KMS

• You can create a CMK with key material that you supply.

• A CMK contains key material used to encrypt and decrypt data, in addition to its key identifiers and other metadata.

• When you create a CMK, by default, KMS generates the key material for that CMK.

• But you can create a CMK without key material and then import your own key material into that CMK, a feature often known as "bring your own key" (BYOK).

• Imported key material is supported only for symmetric CMKs in KMS key stores.

How to import key material

1. Create a symmetric CMK with no key material whose origin is EXTERNAL - This indicates that the key material was generated outside of KMS and prevents KMS from generating key material for the CMK.

2. Download the public key and import token - These items protect the import of your key material to KMS. The import token contains metadata to ensure that your key material is imported correctly.

3. Encrypt the key material - Use the public key that you downloaded in step 2 to encrypt the key material that you created on your own system. Typically, you encrypt your key material when you export it from your HSM or key management system.

4. Import the key material - Upload the encrypted key material that you created in step 3 and the import token that you downloaded in step 2.

• KMS records an entry in your CloudTrail log when you create the CMK, download the public key and import token, and import the key material.