Search code examples
pythonamazon-web-servicesencryptionasymmetric

Is it possible to encrypt/decrypt a text with aws-encryption-sdk-python and using an asymmetric customer key present in KMS?

Is it possible to encrypt/decrypt a text using an asymmetric customer key, stored in KMS, passing it to the encrypt and decrypt functions of the aws-encryption-sdk-python? I tried this but could not pass the encryption step, it raises an error:

An error ocurred (InvalidKeyUsageException) when calling the GenerateDataKey operation: You cannot generate a data key with an assymetric CMK.
Solution

  • No there is no such way. From docs:

    The AWS Encryption SDK supports only symmetric encryption KMS keys. You cannot use an asymmetric KMS key for encryption or signing in the AWS Encryption SDK.