steampipe plugin install awssteampipe plugin install aws

Table: aws_kms_key

AWS Key Management Service (KMS) is an Amazon Web Services product that allows administrators to create, delete and control keys that encrypt data stored in AWS databases and products.

Examples

Basic info

select
  id,
  title,
  arn,
  key_manager,
  creation_date
from
  aws_kms_key;

List of KMS keys where key rotation is not enabled

select
  id,
  key_rotation_enabled
from
  aws_kms_key
where
  not key_rotation_enabled;

List of KMS Customer Managed keys scheduled for deletion

select
  id,
  key_state,
  deletion_date
from
  aws_kms_key
where
  key_state = 'PendingDeletion';

List of unused Customer Managed Keys

select
  id,
  enabled as key_enabled
from
  aws_kms_key
where
  not enabled;

Count of AWS KMS keys by Key manager

select
  key_manager,
  count(key_manager) as count
from
  aws_kms_key
group by
  key_manager;

Query examples

Control examples

.inspect aws_kms_key

AWS KMS Key

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
aliases	jsonb	A list of aliases for the key.
arn	text	ARN of the key.
aws_account_id	text	The twelve-digit account ID of the AWS account that owns the CMK.
creation_date	timestamp with time zone	The date and time when the CMK was created.
customer_master_key_spec	text	Describes the type of key material in the CMK.
deletion_date	timestamp with time zone	The date and time after which AWS KMS deletes the CMK.
description	text	The description of the CMK.
enabled	boolean	Specifies whether the CMK is enabled. When KeyState is Enabled this value is true, otherwise it is false.
id	text	Unique identifier of the key.
key_manager	text	The manager of the CMK. CMKs in your AWS account are either customer managed or AWS managed.
key_rotation_enabled	boolean	A Boolean value that specifies whether key rotation is enabled.
key_state	text	The current status of the CMK. For more information about how key state affects the use of a CMK, see [Key state: Effect on your CMK](https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html).
key_usage	text	The [cryptographic operations](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations) for which you can use the CMK.
origin	text	The source of the CMK's key material. When this value is AWS_KMS, AWS KMS created the key material. When this value is EXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material. When this value is AWS_CLOUDHSM, the key material was created in the AWS CloudHSM cluster associated with a custom key store.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
policy	jsonb	A key policy document in JSON format.
policy_std	jsonb	Contains the policy in a canonical form for easier searching.
region	text	The AWS Region in which the resource is located.
tags	jsonb	A map of tags for the resource.
tags_src	jsonb	A list of tags attached to key.
title	text	Title of the resource.
valid_to	timestamp with time zone	The time at which the imported key material expires.

turbot/aws