Imported key material

Lesson 4 of 5 in KMS, Keys, and Certificates.

SCS-C03 adds imported key material as an explicit skill, including the ability to describe the differences between material you import and material AWS generates. It is a short topic with sharp edges, and the edges are what gets tested.

Normally KMS generates a key’s material inside its HSMs and it never exists anywhere else. With imported key material — “bring your own key” — you create a KMS key with Origin: EXTERNAL, which produces a key container with no material in it: the key is in state PendingImport and cannot be used for anything. You then import 256 bits of symmetric key material that you generated yourself, wrapped so it cannot be read in transit.

Why do this at all? Three defensible reasons, and the exam phrases them almost verbatim. A compliance regime or internal policy requires that key material be generated by your own entropy source or your own HSM. You need provable key custody — the ability to say, with an off-AWS copy and your own ceremony records, that you hold the authoritative original. Or you need the ability to make a key unusable on demand and immediately, by deleting the imported material, without the 7-to-30-day waiting period that applies to deleting a key.

Everything else about the key behaves normally: key policies, grants, aliases, CloudTrail, encryption context, and service integrations such as S3 SSE-KMS and EBS all work exactly as they do for a KMS-generated key. What changes is the lifecycle, and the responsibility.

The import ceremony — and what each step protects

  1. Create key with Origin: EXTERNAL

    The key exists but has no material. State is PendingImport; every cryptographic call fails until material arrives. Key id, ARN, policy and tags are already real and can be referenced by infrastructure code.

  2. Get parameters for import

    GetParametersForImport returns an RSA public wrapping key and an import token. You choose the wrapping algorithm (an RSA-OAEP variant) and the wrapping key spec. Both values are time-limited — they expire in 24 hours — and the token is single-use, which is what stops a captured wrapped blob being replayed into a different key later.

  3. Generate your 256-bit material

    Produced by your HSM or an audited offline process. This is the copy you must retain outside AWS: AWS keeps no record of it beyond the key itself, and cannot regenerate or recover it.

  4. Wrap the material with the public key

    Encrypt your key material under the returned public wrapping key using the algorithm you requested. The plaintext material never crosses the network — only the wrapped blob does, and only KMS holds the matching private key.

  5. ImportKeyMaterial

    Submit the wrapped material with the import token, and optionally a ValidTo expiry. KMS unwraps inside its HSMs; the key moves to Enabled. Choosing KEY_MATERIAL_DOES_NOT_EXPIRE or a date is a one-time decision per import, and an expiry you set is enforced without mercy.

  6. Key usable — and fully your responsibility

    Encrypt, decrypt, envelope operations and service integrations all behave normally. But automatic rotation is unavailable, AWS cannot recover the material, and DeleteImportedKeyMaterial or expiry makes the key — and every ciphertext under it — unusable immediately.

Now the differences the guide asks you to describe, in the order they bite.

Rotation. A customer managed key with AWS-generated material can rotate automatically on a schedule you configure, and KMS keeps every previous version of the material so old ciphertext stays readable. A key with imported material cannot be automatically rotated — there is nothing for KMS to generate. Since 2024 KMS supports on-demand rotation for symmetric keys with imported material: you import the replacement material first (it sits in state PENDING_ROTATION), then call RotateKeyOnDemand, and the new material becomes current while the key id and ARN stay the same — so nothing referencing the key has to change. Before that capability existed, “rotating” an imported key meant creating a new key and updating every reference, and plenty of exam material still describes it that way. On-demand rotation is capped (a maximum of 25 on-demand rotations per key), and for multi-Region keys you import the same new material into the primary and each replica, then invoke the rotation on the primary.

Recoverability. AWS cannot recover your imported material. If you lose your copy and the material is deleted or expires, the ciphertext is gone — this is the single most important sentence in the lesson. Retaining a secure, tested copy outside AWS is not a best practice here, it is the only backup that exists.

Expiry and deletion. You may set a ValidTo expiry when importing; when it passes, the key becomes unusable and KMS deletes the material. You may also call DeleteImportedKeyMaterial at any moment for the same effect, immediately and with no waiting period — unlike ScheduleKeyDeletion’s 7-to-30 days. In both cases the key survives as a container in state PendingImport, so re-importing the same material restores access to existing ciphertext. Re-importing different material does not: the old ciphertext stays unreadable forever.

AWS-generated versus imported key material — the differences the exam expects you to be able to describe
DimensionAWS-generated (Origin: AWS_KMS)Imported (Origin: EXTERNAL)

Who creates the material

AWS KMS, inside its HSMs; it never exists outside them

You, in your own HSM or audited process, then wrapped and imported

Automatic rotation

Supported — annual by default, configurable period; old versions retained

Not supported. On-demand rotation only, after importing replacement material

Can AWS recover it

Yes — KMS retains all versions for the life of the key

No. Your off-AWS copy is the only backup in existence

Making the key unusable fast

Disable the key, or schedule deletion (7–30 day window)

Disable, or delete the material immediately — no waiting period; the key container survives

Expiry

None — material lives until the key is deleted

Optional ValidTo at import; on expiry the material is deleted and the key stops working

Re-establishing access

Not applicable — nothing to re-import

Re-import the identical material to restore it; different material leaves old ciphertext unreadable

Everything else

Key policy, grants, aliases, CloudTrail, encryption context, service integrations

Identical — the difference is lifecycle and custody, not capability

Key terms: Imported key material (BYOK), On-demand key rotation, KMS key rotation

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.