alias

Creates, updates, deletes, gets or lists an alias resource.

Overview

Name	alias
Type	Resource
Id	aws.kms.alias

Fields

The following fields are returned by SELECT queries:

SELECT not supported for this resource, use SHOW METHODS to view available operations for the resource.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
create_alias	insert	region, AliasName, TargetKeyId		Creates a friendly name for a KMS key. Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see ABAC for KMS in the Key Management Service Developer Guide. You can use an alias to identify a KMS key in the KMS console, in the DescribeKey operation and in cryptographic operations, such as Encrypt and GenerateDataKey. You can also change the KMS key that's associated with the alias (UpdateAlias) or delete the alias (DeleteAlias) at any time. These operations don't affect the underlying KMS key. You can associate the alias with any customer managed key in the same Amazon Web Services Region. Each alias is associated with only one KMS key at a time, but a KMS key can have multiple aliases. A valid KMS key is required. You can't create an alias without a KMS key. The alias must be unique in the account and Region, but you can have aliases with the same name in different Regions. For detailed information about aliases, see Aliases in KMS in the Key Management Service Developer Guide. This operation does not return a response. To get the alias that you created, use the ListAliases operation. The KMS key that you use for this operation must be in a compatible key state. For details, see Key states of KMS keys in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on an alias in a different Amazon Web Services account. Required permissions kms:CreateAlias on the alias (IAM policy). kms:CreateAlias on the KMS key (key policy). For details, see Controlling access to aliases in the Key Management Service Developer Guide. Related operations: DeleteAlias ListAliases UpdateAlias Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.
update_alias	update	region, AliasName, TargetKeyId		Associates an existing KMS alias with a different KMS key. Each alias is associated with only one KMS key at a time, although a KMS key can have multiple aliases. The alias and the KMS key must be in the same Amazon Web Services account and Region. Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see ABAC for KMS in the Key Management Service Developer Guide. The current and new KMS key must be the same type (both symmetric or both asymmetric or both HMAC), and they must have the same key usage. This restriction prevents errors in code that uses aliases. If you must assign an alias to a different type of KMS key, use DeleteAlias to delete the old alias and CreateAlias to create a new alias. You cannot use UpdateAlias to change an alias name. To change an alias name, use DeleteAlias to delete the old alias and CreateAlias to create a new alias. Because an alias is not a property of a KMS key, you can create, update, and delete the aliases of a KMS key without affecting the KMS key. Also, aliases do not appear in the response from the DescribeKey operation. To get the aliases of all KMS keys in the account, use the ListAliases operation. The KMS key that you use for this operation must be in a compatible key state. For details, see Key states of KMS keys in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions kms:UpdateAlias on the alias (IAM policy). kms:UpdateAlias on the current KMS key (key policy). kms:UpdateAlias on the new KMS key (key policy). For details, see Controlling access to aliases in the Key Management Service Developer Guide. Related operations: CreateAlias DeleteAlias ListAliases Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.
delete_alias	delete	region		Deletes the specified alias. Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see ABAC for KMS in the Key Management Service Developer Guide. Because an alias is not a property of a KMS key, you can delete and change the aliases of a KMS key without affecting the KMS key. Also, aliases do not appear in the response from the DescribeKey operation. To get the aliases of all KMS keys, use the ListAliases operation. Each KMS key can have multiple aliases. To change the alias of a KMS key, use DeleteAlias to delete the current alias and CreateAlias to create a new alias. To associate an existing alias with a different KMS key, call UpdateAlias. Cross-account use: No. You cannot perform this operation on an alias in a different Amazon Web Services account. Required permissions kms:DeleteAlias on the alias (IAM policy). kms:DeleteAlias on the KMS key (key policy). For details, see Controlling access to aliases in the Key Management Service Developer Guide. Related operations: CreateAlias ListAliases UpdateAlias Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

INSERT examples

create_alias

Creates a friendly name for a KMS key. Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see ABAC for KMS in the Key Management Service Developer Guide. You can use an alias to identify a KMS key in the KMS console, in the DescribeKey operation and in cryptographic operations, such as Encrypt and GenerateDataKey. You can also change the KMS key that's associated with the alias (UpdateAlias) or delete the alias (DeleteAlias) at any time. These operations don't affect the underlying KMS key. You can associate the alias with any customer managed key in the same Amazon Web Services Region. Each alias is associated with only one KMS key at a time, but a KMS key can have multiple aliases. A valid KMS key is required. You can't create an alias without a KMS key. The alias must be unique in the account and Region, but you can have aliases with the same name in different Regions. For detailed information about aliases, see Aliases in KMS in the Key Management Service Developer Guide. This operation does not return a response. To get the alias that you created, use the ListAliases operation. The KMS key that you use for this operation must be in a compatible key state. For details, see Key states of KMS keys in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on an alias in a different Amazon Web Services account. Required permissions kms:CreateAlias on the alias (IAM policy). kms:CreateAlias on the KMS key (key policy). For details, see Controlling access to aliases in the Key Management Service Developer Guide. Related operations: DeleteAlias ListAliases UpdateAlias Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.

INSERT INTO aws.kms.alias (
AliasName,
TargetKeyId,
region
)
SELECT 
'{{ AliasName }}' /* required */,
'{{ TargetKeyId }}' /* required */,
'{{ region }}'
;

Manifest

# Description fields are for documentation purposes
- name: alias
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the alias resource.
  - name: AliasName
    value: "{{ AliasName }}"
    description: |
      Specifies the alias name. This value must begin with alias/ followed by a name, such as alias/ExampleAlias. Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output. The AliasName value must be string of 1-256 characters. It can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). The alias name cannot begin with alias/aws/. The alias/aws/ prefix is reserved for Amazon Web Services managed keys.
  - name: TargetKeyId
    value: "{{ TargetKeyId }}"
    description: |
      Associates the alias with the specified customer managed key. The KMS key must be in the same Amazon Web Services Region. A valid key ID is required. If you supply a null or empty string value, this operation returns an error. For help finding the key ID and ARN, see Find the key ID and key ARN in the Key Management Service Developer Guide . Specify the key ID or key ARN of the KMS key. For example: Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.

UPDATE examples

update_alias

Associates an existing KMS alias with a different KMS key. Each alias is associated with only one KMS key at a time, although a KMS key can have multiple aliases. The alias and the KMS key must be in the same Amazon Web Services account and Region. Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see ABAC for KMS in the Key Management Service Developer Guide. The current and new KMS key must be the same type (both symmetric or both asymmetric or both HMAC), and they must have the same key usage. This restriction prevents errors in code that uses aliases. If you must assign an alias to a different type of KMS key, use DeleteAlias to delete the old alias and CreateAlias to create a new alias. You cannot use UpdateAlias to change an alias name. To change an alias name, use DeleteAlias to delete the old alias and CreateAlias to create a new alias. Because an alias is not a property of a KMS key, you can create, update, and delete the aliases of a KMS key without affecting the KMS key. Also, aliases do not appear in the response from the DescribeKey operation. To get the aliases of all KMS keys in the account, use the ListAliases operation. The KMS key that you use for this operation must be in a compatible key state. For details, see Key states of KMS keys in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions kms:UpdateAlias on the alias (IAM policy). kms:UpdateAlias on the current KMS key (key policy). kms:UpdateAlias on the new KMS key (key policy). For details, see Controlling access to aliases in the Key Management Service Developer Guide. Related operations: CreateAlias DeleteAlias ListAliases Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.

UPDATE aws.kms.alias
SET 
AliasName = '{{ AliasName }}',
TargetKeyId = '{{ TargetKeyId }}'
WHERE 
region = '{{ region }}' --required
AND AliasName = '{{ AliasName }}' --required
AND TargetKeyId = '{{ TargetKeyId }}' --required;

DELETE examples

delete_alias

Deletes the specified alias. Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see ABAC for KMS in the Key Management Service Developer Guide. Because an alias is not a property of a KMS key, you can delete and change the aliases of a KMS key without affecting the KMS key. Also, aliases do not appear in the response from the DescribeKey operation. To get the aliases of all KMS keys, use the ListAliases operation. Each KMS key can have multiple aliases. To change the alias of a KMS key, use DeleteAlias to delete the current alias and CreateAlias to create a new alias. To associate an existing alias with a different KMS key, call UpdateAlias. Cross-account use: No. You cannot perform this operation on an alias in a different Amazon Web Services account. Required permissions kms:DeleteAlias on the alias (IAM policy). kms:DeleteAlias on the KMS key (key policy). For details, see Controlling access to aliases in the Key Management Service Developer Guide. Related operations: CreateAlias ListAliases UpdateAlias Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.

DELETE FROM aws.kms.alias
WHERE region = '{{ region }}' --required
;