Function key_management

python/example_code/kms/key_management.py:259–328

(kms_client)

def key_management(kms_client):
    logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")

    print("-" * 88)
    print("Welcome to the AWS Key Management Service (AWS KMS) key management demo.")
    print("-" * 88)

    key_manager = KeyManager(kms_client)

    answer = "y"
    while answer.lower() == "y":
        key_desc = input("\nLet's create a key. Describe it for me: ")
        if not key_desc:
            key_desc = "Key management demo key"
        try:
            key = key_manager.create_key(key_desc)
        except ClientError as err:
            logging.error(
                "Couldn't create your key. Here's why: %s",
                err.response["Error"]["Message"],
            )
            raise
        else:
            print("Key created:")
            pprint(key)
            answer = input("Create another (y/n)? ")

    print("-" * 88)
    key_manager.list_keys()
    print("-" * 88)
    key_id = input("Enter a key ID or ARN here to get information about the key: ")
    if key_id:
        key = key_manager.describe_key(key_id)
        print(f"Got key {key_id}:")
        pprint(key)
    if key_id:
        answer = input("Do you want to disable and then enable that key (y/n)? ")
        if answer.lower() == "y":
            key_manager.disable_key(key_id)
            key = key_manager.describe_key(key_id)
            print(f"AWS KMS says your key state is: {key['KeyState']}.")
            key_manager.enable_key(key_id)
            key = key_manager.describe_key(key_id)
            print(f"AWS KMS says your key state is: {key['KeyState']}.")

    print("-" * 88)
    key_manager.generate_data_key(key_id)
    print("-" * 88)
    print("For this demo, we created these keys:")
    for key in key_manager.created_keys:
        print(f"\tKeyId: {key['KeyId']}")
        print(f"\tDescription: {key['Description']}")
        print("-" * 66)
    print(
        """
      Warning:
          Deleting a KMS key is a destructive and potentially dangerous operation. When a KMS key is deleted,
          all data that was encrypted under the KMS key is unrecoverable.