Skip to main content
Perform the following steps to create a customer-managed key in AWS KMS:
The KMS key you create has no key material because the KMES is ultimately the source of the key material.
1
Log in to the AWS Management Console.
2
Go to the Key Management Service.
3
Select Customer managed keys in the left-side menu, then select the orange Create Keybutton in the upper-right corner of the page.
4
Configure the key by selecting the following choices:
OptionRequired configuration
Key TypeSymmetric.
Key material originExternal.
The KMS option also works, but it generates a key so that the KMES does not have the key material for this initial key. The External option creates a placeholder key without key material, enabling the KMES to provide key material in later steps.
Regionality Single-Region key.
5
Select**[ Next ] **to continue.
6
Add the following labels:
OptionRequired configuration
AliasChoose a nickname.
DescriptionOptional.
TagsOptional.
7
Select**[ Next ]** to continue.
8
Define the following key administrative permissions:
OptionRequired configuration
Key administratorsSelect your user account.
Key deletionSelect the Allow key administrators to delete this key checkbox.
9
Select** [ Next ]**to continue.
10
Define the following key usage permissions:
OptionRequired configuration
This accountSelect your user account.
Other AWS accountsOptional.
11
Select** [ Next ]**to continue.
12
Review your configuration. Ensure the top three fields (Key Configuration, Alias and description, and Tags) are correct.
13
Copy and paste the contents of Key Policy into a file and save it with the JSONextension. You must copy this file or move it to the storage medium configured on your KMES Series 3 device.
14
Select [ Finish ].
15
When prompted to download a wrapping key and import token, select** [ Cancel ]**to skip that step.
16
On the main Key Management Service (KMS) page, make a copy of the generated key ID (formatted as xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). The AWS Propertiestab requires this ID (and the policy) when creating an HSM Protected Key Group on the KMES in the next section.