AWS CDK Reference

Appearance

v2.273.0

KeySpec Enum ​

The key spec, represents the cryptographic configuration of keys.

Source
aws-kms/lib/key.ts
Type last changed
v2.236.0 · 23 Jan 2026

Example ​

ts
const key = new kms.Key(this, 'MyKey', {
  keySpec: kms.KeySpec.ECC_SECG_P256K1, // Default to SYMMETRIC_DEFAULT
  keyUsage: kms.KeyUsage.SIGN_VERIFY,    // and ENCRYPT_DECRYPT
});

Members ​

MemberDescription
SYMMETRIC_DEFAULTThe default key spec.
RSA_2048RSA with 2048 bits of key.
RSA_3072RSA with 3072 bits of key.
RSA_4096RSA with 4096 bits of key.
ECC_NIST_P256NIST FIPS 186-4, Section 6.4, ECDSA signature using the curve specified by the key and SHA-256 for the message digest.
ECC_NIST_P384NIST FIPS 186-4, Section 6.4, ECDSA signature using the curve specified by the key and SHA-384 for the message digest.
ECC_NIST_P521NIST FIPS 186-4, Section 6.4, ECDSA signature using the curve specified by the key and SHA-512 for the message digest.
ECC_SECG_P256K1Standards for Efficient Cryptography 2, Section 2.4.1, ECDSA signature on the Koblitz curve.
HMAC_224Hash-Based Message Authentication Code as defined in RFC 2104 using the message digest function SHA224.
HMAC_256Hash-Based Message Authentication Code as defined in RFC 2104 using the message digest function SHA256.
HMAC_384Hash-Based Message Authentication Code as defined in RFC 2104 using the message digest function SHA384.
HMAC_512Hash-Based Message Authentication Code as defined in RFC 2104 using the message digest function SHA512.
SM2Elliptic curve key spec available only in China Regions.
ML_DSA_44ML-DSA-44 lattice-based digital signature algorithm.
ML_DSA_65ML-DSA-65 lattice-based digital signature algorithm.
ML_DSA_87ML-DSA-87 lattice-based digital signature algorithm.
ECC_NIST_EDWARDS25519NIST-standard Edwards25519 (ed25519) elliptic curve key pair.

Referenced by ​

  • KeyProps.keySpeckey_speckeySpecKeySpecKeySpec