# Importing key material in KMS

* You **can create a CMK with key material that you supply**.\\

* A **CMK contains key material used to encrypt and decrypt data**, in addition to its **key identifiers and other metadata**.\\

* When you create a CMK, **by default, KMS generates the key material for that CMK**.\\

* **But you can create a CMK without key material and then import your own key material** into that CMK, a feature often **known as "bring your own key" (BYOK)**.\\

* **Imported key material is supported only for symmetric CMKs** in KMS key stores.

## How to import key material

1. **Create a symmetric CMK with no key material whose origin is `EXTERNAL`** - This indicates that the key material was generated outside of KMS and **prevents KMS from generating key material for the CMK**.\\

2. **Download the public key and import token** - These items **protect the import of your key material to KMS**. The **import token contains metadata to ensure that your key material is imported correctly**.\\

3. **Encrypt the key material** - Use the **public key that you downloaded** in step 2 to **encrypt the key material that you created on your own system**. Typically, you encrypt your key material when you export it from your HSM or key management system.\\

4. **Import the key material** - **Upload the encrypted key material** that you created in step 3 **and the import token** that you downloaded in step 2.

* **KMS records an entry in your CloudTrail log when you create the CMK**, download the public key and import token, and import the key material.
