KMS
Symmetric and asymmetric keys, data keys, encrypt/decrypt, aliases.
Quick start
import boto3
kms = boto3.client("kms", endpoint_url="http://localhost:4566",
region_name="us-east-1",
aws_access_key_id="test", aws_secret_access_key="test")
k = kms.create_key()["KeyMetadata"]
ct = kms.encrypt(KeyId=k["KeyId"], Plaintext=b"secret")["CiphertextBlob"]
print(kms.decrypt(CiphertextBlob=ct)["Plaintext"])
Supported operations
31 operations exposed by this service as of MiniStack 1.5.8. Extracted directly from the handler dispatch in the source module.
CancelKeyDeletion
CreateAlias
CreateKey
Decrypt
DeleteAlias
DescribeKey
DisableKey
DisableKeyRotation
EnableKey
EnableKeyRotation
Encrypt
GenerateDataKey
GenerateDataKeyPair
GenerateDataKeyPairWithoutPlaintext
GenerateDataKeyWithoutPlaintext
GenerateRandom
GetKeyPolicy
GetKeyRotationStatus
GetPublicKey
ListAliases
ListKeyPolicies
ListKeys
ListResourceTags
PutKeyPolicy
ScheduleKeyDeletion
Sign
TagResource
UntagResource
UpdateAlias
UpdateKeyDescription
Verify
CloudFormation
The CloudFormation engine provisions these resource types via this service:
AWS::KMS::Alias
AWS::KMS::Key
See CloudFormation engine for intrinsic support and lifecycle details.
Known limitations
- S3 SSE-KMS produces no real ciphertext — the key reference is tracked and echoed, but object bytes are stored as sent.
- HSM / CustomKeyStore operations are not implemented.
Source
ministack/services/kms.py
Read the source to verify the ops list above — dispatch tables and handler functions are the ground truth.