KMS
Symmetric and asymmetric keys, data keys, encrypt/decrypt, aliases.
Quick start
import boto3
kms = boto3.client("kms", endpoint_url="http://localhost:4566",
region_name="us-east-1",
aws_access_key_id="test", aws_secret_access_key="test")
k = kms.create_key()["KeyMetadata"]
ct = kms.encrypt(KeyId=k["KeyId"], Plaintext=b"secret")["CiphertextBlob"]
print(kms.decrypt(CiphertextBlob=ct)["Plaintext"])
Supported operations
41 operations exposed by this service as of MiniStack 1.5.24. Extracted directly from the handler dispatch in the source module.
CancelKeyDeletion
CreateAlias
CreateGrant
CreateKey
Decrypt
DeleteAlias
DeleteImportedKeyMaterial
DescribeKey
DisableKey
DisableKeyRotation
EnableKey
EnableKeyRotation
Encrypt
GenerateDataKey
GenerateDataKeyPair
GenerateDataKeyPairWithoutPlaintext
GenerateDataKeyWithoutPlaintext
GenerateMac
GenerateRandom
GetKeyPolicy
GetKeyRotationStatus
GetParametersForImport
GetPublicKey
ImportKeyMaterial
ListAliases
ListGrants
ListKeyPolicies
ListKeys
ListResourceTags
PutKeyPolicy
ReplicateKey
RetireGrant
RevokeGrant
ScheduleKeyDeletion
Sign
TagResource
UntagResource
UpdateAlias
UpdateKeyDescription
Verify
VerifyMac
CloudFormation
The CloudFormation engine provisions these resource types via this service:
AWS::KMS::Alias
AWS::KMS::Key
See CloudFormation engine for intrinsic support and lifecycle details.
Known limitations
- S3 SSE-KMS produces no real ciphertext — the key reference is tracked and echoed, but object bytes are stored as sent.
- HSM / CustomKeyStore operations are not implemented.
Source
ministack/services/kms.py
Read the source to verify the ops list above — dispatch tables and handler functions are the ground truth.