Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
# Logging panggilan AWS KMS API dengan AWS CloudTrail
AWS KMS terintegrasi dengan [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/), layanan yang merekam semua panggilan AWS KMS oleh pengguna, peran, dan AWS layanan lainnya. CloudTrail menangkap semua panggilan API ke AWS KMS sebagai event, termasuk panggilan dari AWS KMS konsol AWS KMS APIs, CloudFormation template, AWS Command Line Interface (AWS CLI), dan Alat AWS untuk PowerShell.
CloudTrail [mencatat semua AWS KMS operasi, termasuk operasi hanya-baca, seperti [ListAliases](ct-listaliases.md)dan [GetKeyRotationStatus](ct-getkeyrotationstatus.md), operasi yang mengelola kunci KMS, seperti dan, [CreateKey](ct-createkey.md)dan [operasi kriptografi [PutKeyPolicy](ct-put-key-policy.md)](kms-cryptography.md#cryptographic-operations), seperti dan Dekripsi. [GenerateDataKey](ct-generatedatakey.md)](ct-decrypt.md) Ini juga mencatat operasi internal yang AWS KMS memanggil Anda, seperti [DeleteExpiredKeyMaterial](ct-deleteexpiredkeymaterial.md), [DeleteKey](ct-delete-key.md), [SynchronizeMultiRegionKey](ct-synchronize-multi-region-key.md), dan [RotateKey](ct-rotatekey.md).
CloudTrail mencatat semua operasi yang berhasil dan, dalam beberapa skenario, percobaan panggilan yang gagal, seperti ketika pemanggil ditolak akses ke sumber daya. [Operasi lintas akun pada kunci KMS](key-policy-modifying-external-accounts.md) dicatat di akun penelepon dan akun pemilik kunci KMS. Namun, AWS KMS permintaan lintas akun yang ditolak karena akses ditolak hanya dicatat di akun pemanggil.
Untuk alasan keamanan, beberapa bidang dihilangkan dari entri AWS KMS log, seperti `Plaintext` parameter permintaan [Enkripsi](https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html), dan respons terhadap [GetKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html)atau operasi kriptografi apa pun. Untuk mempermudah pencarian entri CloudTrail log untuk kunci KMS tertentu, AWS KMS tambahkan [ARN](concepts.md#key-id-key-ARN) kunci dari kunci KMS yang terpengaruh ke `responseElements` bidang di entri log untuk beberapa operasi manajemen AWS KMS kunci, bahkan ketika operasi API tidak mengembalikan ARN kunci.
Meskipun secara default, semua AWS KMS tindakan dicatat sebagai CloudTrail peristiwa, Anda dapat mengecualikan AWS KMS tindakan dari CloudTrail jejak. Lihat perinciannya di [Tidak termasuk AWS KMS acara dari jejak](#filtering-kms-events).
**Pelajari lebih lanjut**:
+ Untuk contoh CloudTrail log AWS KMS operasi untuk platform yang dibuktikan, lihat[Memantau permintaan yang dibuktikan](ct-attestation.md).
**Topics**
+ [Menemukan entri AWS KMS log di CloudTrail](#searching-kms-ct)
+ [Tidak termasuk AWS KMS acara dari jejak](#filtering-kms-events)
+ [Contoh entri AWS KMS log](understanding-kms-entries.md)
## Menemukan entri AWS KMS log di CloudTrail
Untuk mencari entri CloudTrail log, gunakan [CloudTrail konsol](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.html) atau [CloudTrail LookupEvents](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_LookupEvents.html)operasi. CloudTrail mendukung banyak [nilai atribut](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.html#filtering-cloudtrail-events) untuk memfilter pencarian Anda, termasuk nama acara, nama pengguna, dan sumber acara.
Untuk membantu Anda mencari entri AWS KMS log di CloudTrail, AWS KMS isi kolom entri CloudTrail log berikut.
**catatan**
Mulai Desember 2022, AWS KMS mengisi atribut **tipe Sumber Daya** dan **nama Sumber Daya** di semua operasi manajemen yang mengubah kunci KMS tertentu. Nilai atribut ini mungkin null dalam CloudTrail entri lama untuk operasi berikut: [CreateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html),, [CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html), [DeleteAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html), [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html), [ImportKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html), [ReplicateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html), [RetireGrant[RevokeGrant[UpdateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html)](https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html)](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html), dan. [UpdatePrimaryRegion](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdatePrimaryRegion.html)
| Atribut | Nilai | Entri log |
| --- | --- | --- |
| Sumber acara (EventSource) | kms.amazonaws.com | Semua operasi. |
| Jenis sumber daya (ResourceType) | AWS::KMS::Key | Operasi manajemen yang mengubah kunci KMS tertentu, seperti CreateKey danEnableKey, tetapi tidakListKeys. |
| Nama sumber daya (ResourceName) | ARN kunci (atau ID kunci dan kunci ARN) | Operasi manajemen yang mengubah kunci KMS tertentu, seperti CreateKey danEnableKey, tetapi tidakListKeys. |
Untuk membantu Anda menemukan entri log untuk operasi manajemen pada kunci KMS tertentu, AWS KMS mencatat ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` elemen entri log, bahkan ketika operasi AWS KMS API tidak mengembalikan kunci ARN.
Misalnya, panggilan yang berhasil ke [DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html)operasi tidak mengembalikan nilai apa pun dalam respons, tetapi alih-alih nilai nol, `responseElements.keyId` nilai dalam [entri DisableKey log](ct-disablekey.md) menyertakan ARN kunci dari kunci KMS yang dinonaktifkan.
Fitur ini ditambahkan pada Desember 2022 dan memengaruhi entri CloudTrail log berikut: [CreateAlias](ct-createalias.md),,,, [CreateGrant](ct-creategrant.md), [DeleteAlias](ct-deletealias.md), [DeleteKey](ct-delete-key.md), [DisableKey](ct-disablekey.md), [EnableKey](ct-enablekey.md), [EnableKeyRotation](ct-enablekeyrotation.md), [ImportKeyMaterial](ct-importkeymaterial.md), [RotateKey](ct-rotatekey.md), [SynchronizeMultiRegionKey](ct-synchronize-multi-region-key.md), [TagResource](ct-tagresource.md), [UntagResource[UpdateAlias](ct-updatealias.md)](ct-untagresource.md), dan [UpdatePrimaryRegion](ct-update-primary-region.md).
## Tidak termasuk AWS KMS acara dari jejak
Untuk memberikan catatan penggunaan dan pengelolaan AWS KMS sumber daya mereka, sebagian besar AWS KMS pengguna mengandalkan peristiwa dalam CloudTrail jejak. Jejak dapat menjadi sumber data yang berharga untuk mengaudit peristiwa penting, seperti membuat, menonaktifkan, dan menghapus, mengubah kebijakan utama AWS KMS keys, dan penggunaan kunci KMS Anda oleh AWS layanan atas nama Anda. Dalam beberapa kasus, metadata dalam entri CloudTrail log, seperti [konteks enkripsi](encrypt_context.md) dalam operasi enkripsi, dapat membantu Anda menghindari atau menyelesaikan kesalahan.
Namun, karena AWS KMS dapat menghasilkan sejumlah besar peristiwa, AWS CloudTrail memungkinkan Anda mengecualikan AWS KMS acara dari jejak. Pengaturan per-jejak ini mengecualikan semua AWS KMS peristiwa; Anda tidak dapat mengecualikan acara tertentu. AWS KMS
**Awas**
Mengecualikan AWS KMS peristiwa dari CloudTrail Log dapat mengaburkan tindakan yang menggunakan kunci KMS Anda. Berhati-hatilah saat memberikan `cloudtrail:PutEventSelectors` kepada pengguna utama yang diperlukan untuk melakukan operasi ini.
Untuk mengecualikan AWS KMS acara dari jejak:
+ Di CloudTrail konsol, gunakan setelan **peristiwa Layanan Manajemen Kunci Log** saat Anda [membuat jejak](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html) atau [memperbarui jejak](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-update-a-trail-console.html). Untuk petunjuk, lihat [Logging Management Events dengan Konsol Manajemen AWS](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-and-data-events-with-cloudtrail.html) di Panduan AWS CloudTrail Pengguna.
+ Di CloudTrail API, gunakan [PutEventSelectors](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_PutEventSelectors.html)operasi. Tambahkan atribut `ExcludeManagementEventSources` pada pemilih peristiwa Anda dengan nilai `kms.amazonaws.com`. Sebagai contoh, lihat [Contoh: Jejak yang tidak mencatat AWS Key Management Service peristiwa](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-additional-cli-commands.html#configuring-event-selector-example-kms) di Panduan AWS CloudTrail Pengguna.
Anda dapat menonaktifkan pengecualian ini kapan saja dengan mengubah pengaturan konsol atau pemilih peristiwa untuk jejak. Jejak kemudian akan mulai merekam AWS KMS acara. Namun, itu tidak dapat memulihkan AWS KMS peristiwa yang terjadi saat pengecualian efektif.
Saat Anda mengecualikan AWS KMS peristiwa dengan menggunakan konsol atau API, operasi CloudTrail `PutEventSelectors` API yang dihasilkan juga dicatat di CloudTrail Log Anda. Jika AWS KMS peristiwa tidak muncul di CloudTrail Log Anda, cari `PutEventSelectors` acara dengan `ExcludeManagementEventSources` atribut yang disetel ke`kms.amazonaws.com`.
# Contoh entri AWS KMS log
AWS KMS menulis entri ke CloudTrail log Anda saat Anda memanggil AWS KMS operasi dan ketika AWS layanan memanggil operasi atas nama Anda. AWS KMS juga menulis entri ketika memanggil operasi untuk Anda. Misalnya, ia menulis entri ketika [menghapus kunci KMS yang](ct-delete-key.md) Anda jadwalkan untuk dihapus.
Topik berikut menampilkan contoh entri CloudTrail log untuk AWS KMS operasi.
Untuk contoh entri CloudTrail log permintaan dari platform yang AWS KMS dibuktikan, lihat. [Memantau permintaan yang dibuktikan](ct-attestation.md)
**Topics**
+ [CancelKeyDeletion](ct-cancel-key-deletion.md)
+ [ConnectCustomKeyStore](ct-connect-keystore.md)
+ [CreateAlias](ct-createalias.md)
+ [CreateCustomKeyStore](ct-create-keystore.md)
+ [CreateGrant](ct-creategrant.md)
+ [CreateKey](ct-createkey.md)
+ [Dekripsi](ct-decrypt.md)
+ [DeleteAlias](ct-deletealias.md)
+ [DeleteCustomKeyStore](ct-delete-keystore.md)
+ [DeleteExpiredKeyMaterial](ct-deleteexpiredkeymaterial.md)
+ [DeleteImportedKeyMaterial](ct-deleteimportedkeymaterial.md)
+ [DeleteKey](ct-delete-key.md)
+ [DescribeCustomKeyStores](ct-describe-keystores.md)
+ [DescribeKey](ct-describekey.md)
+ [DisableKey](ct-disablekey.md)
+ [DisableKeyRotation](ct-disable-key-rotation.md)
+ [DisconnectCustomKeyStore](ct-disconnect-keystore.md)
+ [EnableKey](ct-enablekey.md)
+ [EnableKeyRotation](ct-enablekeyrotation.md)
+ [Enkripsi](ct-encrypt.md)
+ [GenerateDataKey](ct-generatedatakey.md)
+ [GenerateDataKeyPair](ct-generatedatakeypair.md)
+ [GenerateDataKeyPairWithoutPlaintext](ct-generatedatakeypairwithoutplaintext.md)
+ [GenerateDataKeyWithoutPlaintext](ct-generatedatakeyplaintext.md)
+ [GenerateMac](ct-generatemac.md)
+ [GenerateRandom](ct-generaterandom.md)
+ [GetKeyPolicy](ct-getkeypolicy.md)
+ [GetKeyRotationStatus](ct-getkeyrotationstatus.md)
+ [GetParametersForImport](ct-getparametersforimport.md)
+ [ImportKeyMaterial](ct-importkeymaterial.md)
+ [ListAliases](ct-listaliases.md)
+ [ListGrants](ct-listgrants.md)
+ [ListKeyRotations](ct-listkeyrotations.md)
+ [PutKeyPolicy](ct-put-key-policy.md)
+ [ReEncrypt](ct-reencrypt.md)
+ [ReplicateKey](ct-replicate-key.md)
+ [RetireGrant](ct-retire-grant.md)
+ [RevokeGrant](ct-revoke-grant.md)
+ [RotateKey](ct-rotatekey.md)
+ [RotateKeyOnDemand](ct-rotatekeyondemand.md)
+ [ScheduleKeyDeletion](ct-schedule-key-deletion.md)
+ [Sign](ct-sign.md)
+ [SynchronizeMultiRegionKey](ct-synchronize-multi-region-key.md)
+ [TagResource](ct-tagresource.md)
+ [UntagResource](ct-untagresource.md)
+ [UpdateAlias](ct-updatealias.md)
+ [UpdateCustomKeyStore](ct-update-keystore.md)
+ [UpdateKeyDescription](ct-update-key-description.md)
+ [UpdatePrimaryRegion](ct-update-primary-region.md)
+ [VerifyMac](ct-verifymac.md)
+ [Verifikasi](ct-verify.md)
+ [Amazon EC2 contoh satu](ct-ec2one.md)
+ [Amazon EC2 contoh dua](ct-ec2two.md)
# CancelKeyDeletion
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [CancelKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html)operasi. Untuk informasi tentang menghapus AWS KMS keys, lihat[Menghapus sebuah AWS KMS key](deleting-keys.md).
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2020-07-27T21:53:17Z",
"eventSource": "kms.amazonaws.com",
"eventName": "CancelKeyDeletion",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": {
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "e3452e68-d4b0-4ec7-a768-7ae96c23764f",
"eventID": "d818bf03-6655-48e9-8b26-f279a07075fd",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# ConnectCustomKeyStore
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [https://docs.aws.amazon.com/kms/latest/APIReference/API_ConnectCustomKeyStore.html](https://docs.aws.amazon.com/kms/latest/APIReference/API_ConnectCustomKeyStore.html)operasi. Untuk informasi tentang menghubungkan toko kunci kustom, lihat[Putuskan sambungan toko AWS CloudHSM kunci](connect-keystore.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-10-21T20:17:32Z",
"eventSource": "kms.amazonaws.com",
"eventName": "ConnectCustomKeyStore",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"customKeyStoreId": "cks-1234567890abcdef0"
},
"responseElements": null,
"additionalEventData": {
"customKeyStoreName": "ExampleKeyStore",
"clusterId": "cluster-1a23b4cdefg"
},
"requestID": "abcde9e1-f1a3-4460-a423-577fb6e695c9",
"eventID": "114b61b9-0ea6-47f5-a9d2-4f2bdd0017d5",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
}
```
# CreateAlias
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [CreateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html)operasi. `resources`Elemen ini mencakup bidang untuk alias dan sumber daya kunci KMS. Untuk informasi tentang membuat alias di AWS KMS, lihat[Buat alias](alias-create.md).
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-08-14T23:08:31Z",
"eventSource": "kms.amazonaws.com",
"eventName": "CreateAlias",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"aliasName": "alias/ExampleAlias",
"targetKeyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "caec1e0c-ce03-419e-bdab-6ab1f7c57c01",
"eventID": "2dd6e784-8286-46a6-befd-d64e5a02fb28",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:alias/ExampleAlias"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# CreateCustomKeyStore
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateCustomKeyStore.html](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateCustomKeyStore.html)operasi di toko AWS CloudHSM kunci. Untuk informasi tentang membuat toko kunci kustom, lihat[Buat toko AWS CloudHSM kunci](create-keystore.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-10-21T20:17:32Z",
"eventSource": "kms.amazonaws.com",
"eventName": "CreateCustomKeyStore",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"customKeyStoreName": "ExampleKeyStore",
"clusterId": "cluster-1a23b4cdefg"
},
"responseElements": {
"customKeyStoreId": "cks-1234567890abcdef0"
},
"requestID": "abcde9e1-f1a3-4460-a423-577fb6e695c9",
"eventID": "114b61b9-0ea6-47f5-a9d2-4f2bdd0017d5",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
}
```
# CreateGrant
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html)operasi. Untuk informasi tentang membuat hibah di AWS KMS, lihat[Hibah di AWS KMS](grants.md).
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
```
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-04T00:53:12Z",
"eventSource": "kms.amazonaws.com",
"eventName": "CreateGrant",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"constraints": {
"encryptionContextSubset": {
"ContextKey1": "Value1"
}
},
"operations": ["Encrypt",
"RetireGrant"],
"granteePrincipal": "EX_PRINCIPAL_ID"
},
"responseElements": {
"grantId": "f020fe75197b93991dc8491d6f19dd3cebb24ee62277a05914386724f3d48758",
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "f3c08808-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "5d529779-2d27-42b5-92da-91aaea1fc4b5",
"readOnly": false,
"resources": [{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# CreateKey
Contoh-contoh ini menunjukkan entri AWS CloudTrail log untuk [CreateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html)operasi.
Entri `CreateKey` log dapat dihasilkan dari `CreateKey` permintaan atau `CreateKey` operasi untuk [ReplicateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html)permintaan.
Contoh berikut menunjukkan entri CloudTrail log untuk [CreateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html)operasi yang menciptakan kunci [KMS enkripsi simetris](symm-asymm-choose-key-spec.md#symmetric-cmks). Untuk informasi tentang membuat kunci KMS, lihat[Buat kunci KMS](create-keys.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-08-10T22:38:27Z",
"eventSource": "kms.amazonaws.com",
"eventName": "CreateKey",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"description": "",
"origin": "EXTERNAL",
"bypassPolicyLockoutSafetyCheck": false,
"customerMasterKeySpec": "SYMMETRIC_DEFAULT",
"keySpec": "SYMMETRIC_DEFAULT",
"keyUsage": "ENCRYPT_DECRYPT"
},
"responseElements": {
"keyMetadata": {
"AWSAccountId": "111122223333",
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"arn": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"creationDate": "Aug 10, 2022, 10:38:27 PM",
"enabled": false,
"description": "",
"keyUsage": "ENCRYPT_DECRYPT",
"keyState": "PendingImport",
"origin": "EXTERNAL",
"keyManager": "CUSTOMER",
"customerMasterKeySpec": "SYMMETRIC_DEFAULT",
"keySpec": "SYMMETRIC_DEFAULT",
"encryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"multiRegion": false
}
},
"requestID": "1aef6713-0223-4ff7-9a6d-781360521930",
"eventID": "36327b37-f4f6-40a9-92ab-48064ec905a2",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
Contoh berikut menunjukkan CloudTrail log `CreateKey` operasi yang menciptakan kunci KMS enkripsi simetris di toko [AWS CloudHSM kunci](keystore-cloudhsm.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-10-14T17:39:50Z",
"eventSource": "kms.amazonaws.com",
"eventName": "CreateKey",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyUsage": "ENCRYPT_DECRYPT",
"bypassPolicyLockoutSafetyCheck": false,
"origin": "AWS_CLOUDHSM",
"keySpec": "SYMMETRIC_DEFAULT",
"customerMasterKeySpec": "SYMMETRIC_DEFAULT",
"customKeyStoreId": "cks-1234567890abcdef0",
"description": ""
},
"responseElements": {
"keyMetadata": {
"aWSAccountId": "111122223333",
"keyId": "0987dcba-09fe-87dc-65ba-ab0987654321",
"arn": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321",
"creationDate": "Oct 14, 2021, 5:39:50 PM",
"enabled": true,
"description": "",
"keyUsage": "ENCRYPT_DECRYPT",
"keyState": "Enabled",
"origin": "AWS_CLOUDHSM",
"customKeyStoreId": "cks-1234567890abcdef0",
"cloudHsmClusterId": "cluster-1a23b4cdefg",
"keyManager": "CUSTOMER",
"customerMasterKeySpec": "SYMMETRIC_DEFAULT",
"keySpec": "SYMMETRIC_DEFAULT",
"encryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"multiRegion": false
}
},
"additionalEventData": {
"backingKey": "{\"backingKeyId\":\"backing-key-id\"}"
},
"requestID": "4f0b185c-588c-4767-9e90-c618f7e13cad",
"eventID": "c73964b8-703d-49e4-bd9e-f773d0ee1e65",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
Contoh berikut menunjukkan CloudTrail log `CreateKey` operasi yang membuat kunci KMS enkripsi simetris di toko [kunci eksternal](keystore-external.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-09-07T22:37:45Z",
"eventSource": "kms.amazonaws.com",
"eventName": "CreateKey",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"tags": [],
"keyUsage": "ENCRYPT_DECRYPT",
"description": "",
"origin": "EXTERNAL_KEY_STORE",
"multiRegion": false,
"keySpec": "SYMMETRIC_DEFAULT",
"customerMasterKeySpec": "SYMMETRIC_DEFAULT",
"bypassPolicyLockoutSafetyCheck": false,
"customKeyStoreId": "cks-1234567890abcdef0",
"xksKeyId": "bb8562717f809024"
},
"responseElements": {
"keyMetadata": {
"aWSAccountId": "111122223333",
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"arn": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"creationDate": "Dec 7, 2022, 10:37:45 PM",
"enabled": true,
"description": "",
"keyUsage": "ENCRYPT_DECRYPT",
"keyState": "Enabled",
"origin": "EXTERNAL_KEY_STORE",
"customKeyStoreId": "cks-1234567890abcdef0",
"keyManager": "CUSTOMER",
"customerMasterKeySpec": "SYMMETRIC_DEFAULT",
"keySpec": "SYMMETRIC_DEFAULT",
"encryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"multiRegion": false,
"xksKeyConfiguration": {
"id": "bb8562717f809024"
}
}
},
"requestID": "ba197c82-3ac7-487a-8ff4-7736bbeb1316",
"eventID": "838ad5f4-5fdd-4044-afd7-4dbd88c6af56",
"readOnly": false,
"resources": [
{
"accountId": "227179770375",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-east-1:227179770375:key/39c5eb22-f37c-4956-92ca-89e8f8b57ab2"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# Dekripsi
Contoh-contoh ini menunjukkan entri AWS CloudTrail log untuk operasi [Dekripsi](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html).
Entri CloudTrail log untuk `Decrypt` operasi selalu menyertakan `encryptionAlgorithm` dalam `requestParameters` bahkan jika algoritma enkripsi tidak ditentukan dalam permintaan. Ciphertext dalam permintaan dan plaintext dalam respons dihilangkan.
**Topics**
+ [Dekripsi dengan kunci enkripsi simetris standar](#ct-decrypt-default)
+ [Dekripsi kegagalan dengan kunci enkripsi simetris standar](#ct-decrypt-fail)
+ [Dekripsi dengan kunci KMS di toko kunci AWS CloudHSM](#ct-decrypt-hsm)
+ [Dekripsi dengan kunci KMS di toko kunci eksternal](#ct-decrypt-xks)
+ [Dekripsi kegagalan dengan kunci KMS di toko kunci eksternal](#ct-decrypt-xks-fail)
+ [Dekripsi dengan kunci enkripsi simetris standar melalui koneksi TLS pasca-kuantum](#ct-decrypt-default-pqtls)
## Dekripsi dengan kunci enkripsi simetris standar
Berikut ini adalah contoh entri CloudTrail log untuk `Decrypt` operasi dengan kunci enkripsi simetris standar.
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-05-20T20:45:00Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Decrypt",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"encryptionAlgorithm": "SYMMETRIC_DEFAULT",
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"encryptionContext": {
"Department": "Engineering",
"Project": "Alpha"
}
},
"responseElements": null,
"additionalEventData": {
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"requestID": "12345126-30d5-4b28-98b9-9153da559963",
"eventID": "abcde202-ba1a-467c-b4ba-f729d45ae521",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.2",
"cipherSuite": "ECDHE-RSA-AES256-GCM-SHA384",
"clientProvidedHostHeader": "kms.us-west-2.amazonaws.com"
}
}
```
## Dekripsi kegagalan dengan kunci enkripsi simetris standar
Contoh entri CloudTrail log berikut mencatat `Decrypt` operasi yang gagal dengan kunci KMS enkripsi simetris standar. Exception (`errorCode`) dan error message (`errorMessage`) disertakan membantu Anda mengatasi kesalahan.
Dalam hal ini, kunci KMS enkripsi simetris yang ditentukan dalam `Decrypt` permintaan bukanlah kunci KMS enkripsi simetris yang digunakan untuk mengenkripsi data.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-11-24T18:57:43Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Decrypt",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"errorCode": "IncorrectKeyException"
"errorMessage": "The key ID in the request does not identify a CMK that can perform this operation.",
"requestParameters": {
"encryptionAlgorithm": "SYMMETRIC_DEFAULT",
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"encryptionContext": {
"Department": "Engineering",
"Project": "Alpha"
}
},
"responseElements": null,
"requestID": "22345126-30d5-4b28-98b9-9153da559963",
"eventID": "abcde202-ba1a-467c-b4ba-f729d45ae521",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
## Dekripsi dengan kunci KMS di toko kunci AWS CloudHSM
Contoh entri CloudTrail log berikut mencatat `Decrypt` operasi dengan kunci KMS di [toko AWS CloudHSM kunci](keystore-cloudhsm.md). Semua entri log untuk operasi kriptografi dengan kunci KMS di toko kunci khusus menyertakan `additionalEventData` bidang dengan dan. `customKeyStoreId` `backingKeyId` Nilai yang dikembalikan di `backingKeyId` bidang adalah atribut kunci `id` CloudHSM. `additionalEventData`Tidak ditentukan dalam permintaan.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-10-26T23:41:27Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Decrypt",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"requestParameters": {
"encryptionAlgorithm": "SYMMETRIC_DEFAULT",
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"encryptionContext": {
"Department": "Development",
"Purpose": "Test"
}
},
"responseElements": null,
"additionalEventData": {
"customKeyStoreId": "cks-1234567890abcdef0"
},
"requestID": "e1b881f8-2048-41f8-b6cc-382b7857ec61",
"eventID": "a79603d5-4cde-46fc-819c-a7cf547b9df4",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
## Dekripsi dengan kunci KMS di toko kunci eksternal
Contoh entri CloudTrail log berikut mencatat `Decrypt` operasi dengan kunci KMS di [toko kunci eksternal](keystore-external.md). Selain itu`customKeyStoreId`, `additionalEventData` bidang termasuk [ID kunci eksternal](keystore-external.md#concept-external-key) (`XksKeyId`). `additionalEventData`Tidak ditentukan dalam permintaan.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-11-24T00:26:58Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Decrypt",
"awsRegion": "us-west-2",
"sourceIPAddress": "AWS Internal",
"requestParameters": {
"encryptionAlgorithm": "SYMMETRIC_DEFAULT",
"keyId": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321",
"encryptionContext": {
"Department": "Engineering",
"Purpose": "Test"
}
},
"responseElements": null,
"additionalEventData": {
"customKeyStoreId": "cks-9876543210fedcba9",
"xksKeyId": "abc01234567890fe"
},
"requestID": "f1b881f8-2048-41f8-b6cc-382b7857ec61",
"eventID": "b79603d5-4cde-46fc-819c-a7cf547b9df4",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
## Dekripsi kegagalan dengan kunci KMS di toko kunci eksternal
Contoh entri CloudTrail log berikut mencatat permintaan gagal untuk `Decrypt` operasi dengan kunci KMS di [penyimpanan kunci eksternal](keystore-external.md). CloudWatch mencatat permintaan yang gagal, selain permintaan yang berhasil. Saat merekam kegagalan, entri CloudTrail log menyertakan pengecualian (ErrorCode) dan pesan kesalahan yang menyertainya (ErrorMessage).
Jika permintaan gagal mencapai proxy penyimpanan kunci eksternal Anda, seperti dalam contoh ini, Anda dapat menggunakan `requestId` nilai untuk mengaitkan permintaan yang gagal dengan permintaan yang sesuai, log proxy penyimpanan kunci eksternal Anda, jika proxy Anda menyediakannya.
Untuk bantuan terkait `Decrypt` permintaan di toko kunci eksternal, lihat[Kesalahan dekripsi](xks-troubleshooting.md#fix-xks-decrypt).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-11-24T00:26:58Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Decrypt",
"awsRegion": "us-west-2",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"errorCode": "KMSInvalidStateException",
"errorMessage": "The external key store proxy rejected the request because the specified ciphertext or additional authenticated data is corrupted, missing, or otherwise invalid.",
"requestParameters": {
"encryptionAlgorithm": "SYMMETRIC_DEFAULT",
"keyId": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321",
"encryptionContext": {
"Department": "Engineering",
"Purpose": "Test"
}
},
"responseElements": null,
"additionalEventData": {
"customKeyStoreId": "cks-9876543210fedcba9",
"xksKeyId": "abc01234567890fe"
},
"requestID": "f1b881f8-2048-41f8-b6cc-382b7857ec61",
"eventID": "b79603d5-4cde-46fc-819c-a7cf547b9df4",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
## Dekripsi dengan kunci enkripsi simetris standar melalui koneksi TLS pasca-kuantum
Berikut ini adalah contoh entri CloudTrail log untuk `Decrypt` operasi dengan kunci enkripsi simetris standar melalui koneksi TLS pasca-kuantum. Bidang KeyExchange di `tlsDetails` bagian menyebutkan`X25519MLKEM768`. [Ini adalah algoritma *hibrida* yang menggabungkan [Elliptic Curve Diffie-Hellman (ECDH) melalui Curve](https://en.wikipedia.org/wiki/Elliptic-curve_Diffie%E2%80%93Hellman)[25519](https://en.wikipedia.org/wiki/Curve25519), algoritma pertukaran kunci klasik yang digunakan saat ini di TLS, dengan [Module-Lattice-Based Key-Encapsulation Mechanism (), enkripsi](https://csrc.nist.gov/pubs/fips/203/final) kunci publik dan algoritma pembentukan kunci yang telah ditetapkan oleh National Institute for Standards and Technology (NISTML-KEM) sebagai algoritma kesepakatan kunci pasca-kuantum standar pertamanya.](https://csrc.nist.gov/pubs/fips/203/final)
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-11-12T15:16:26Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Decrypt",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "aws-sdk-java/2.30.22 md/io#async md/http#AwsCommonRuntime ...",
"requestParameters": {
"encryptionAlgorithm": "SYMMETRIC_DEFAULT",
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"encryptionContext": {
"Department": "Engineering",
"Project": "Alpha"
}
},
"responseElements": null,
"additionalEventData": {
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"requestID": "12345126-30d5-4b28-98b9-9153da559963",
"eventID": "abcde202-ba1a-467c-b4ba-f729d45ae521",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"clientProvidedHostHeader": "kms.us-west-2.amazonaws.com",
"keyExchange": "X25519MLKEM768"
}
}
```
# DeleteAlias
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [DeleteAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html)operasi. Untuk informasi tentang cara menghapus alias, lihat [Hapus alias](alias-delete.md).
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
```
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2014-11-04T00:52:27Z"
}
}
},
"eventTime": "2014-11-04T00:52:27Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DeleteAlias",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"aliasName": "alias/my_alias"
},
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "d9542792-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "12f48554-bb04-4991-9cfc-e7e85f68eda0",
"readOnly": false,
"resources": [{
"ARN": "arn:aws:kms:us-east-1:111122223333:alias/my_alias",
"accountId": "111122223333"
},
{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# DeleteCustomKeyStore
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteCustomKeyStore.html](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteCustomKeyStore.html)operasi. Untuk informasi tentang membuat toko kunci kustom, lihat[Hapus toko AWS CloudHSM kunci](delete-keystore.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-10-21T20:17:32Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DeleteCustomKeyStore",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"customKeyStoreId": "cks-1234567890abcdef0"
},
"responseElements": null,
"additionalEventData": {
"customKeyStoreName": "ExampleKeyStore",
"clusterId": "cluster-1a23b4cdefg"
},
"requestID": "abcde9e1-f1a3-4460-a423-577fb6e695c9",
"eventID": "114b61b9-0ea6-47f5-a9d2-4f2bdd0017d5",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
}
```
# DeleteExpiredKeyMaterial
Saat Anda mengimpor materi kunci ke dalam AWS KMS key (kunci KMS), Anda dapat mengatur tanggal dan waktu kedaluwarsa untuk materi kunci tersebut. AWS KMS mencatat entri di CloudTrail log Anda saat Anda [mengimpor materi kunci](ct-importkeymaterial.md) (dengan pengaturan kedaluwarsa) dan saat AWS KMS menghapus materi kunci yang kedaluwarsa. Untuk informasi tentang membuat kunci KMS dengan materi kunci impor, lihat[Mengimpor bahan kunci untuk AWS KMS kunci](importing-keys.md).
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan saat AWS KMS menghapus materi kunci kedaluwarsa.
```
{
"eventVersion": "1.11",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "AWS Internal"
},
"eventTime": "2025-05-22T19:55:11Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DeleteExpiredKeyMaterial",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "cfa932fd-0d3a-4a76-a8b8-616863a2b547",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsServiceEvent",
"recipientAccountId": "111122223333",
"serviceEventDetails": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"eventCategory": "Management"
}
```
# DeleteImportedKeyMaterial
Jika Anda mengimpor materi kunci ke kunci KMS, Anda dapat menghapus materi kunci yang diimpor kapan saja dengan menggunakan [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html)operasi. Saat Anda menghapus materi kunci yang diimpor dari kunci KMS, status kunci kunci KMS berubah menjadi `PendingImport` dan kunci KMS tidak dapat digunakan dalam operasi kriptografi apa pun. Lihat perinciannya di [Hapus materi kunci yang diimpor](importing-keys-delete-key-material.md).
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan untuk `DeleteImportedKeyMaterial` operasi.
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-05-20T20:45:08Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DeleteImportedKeyMaterial",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"responseElements": {
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"requestID": "dcf0e82f-dad0-4622-a378-a5b964ad42c1",
"eventID": "2afbb991-c668-4641-8a00-67d62e1fecbd",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.2",
"cipherSuite": "ECDHE-RSA-AES256-GCM-SHA384",
"clientProvidedHostHeader": "kms.us-west-2.amazonaws.com"
}
}
```
# DeleteKey
Contoh-contoh ini menunjukkan entri AWS CloudTrail log yang dihasilkan ketika kunci KMS dihapus. Untuk menghapus kunci KMS, Anda menggunakan [ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html)operasi. Setelah masa tunggu yang ditentukan berakhir, AWS KMS hapus kunci KMS dan catat entri seperti yang berikut di CloudTrail log Anda untuk merekam peristiwa itu.
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
Untuk contoh entri CloudTrail log untuk `ScheduleKeyDeletion` operasi, lihat[ScheduleKeyDeletion](ct-schedule-key-deletion.md). Untuk informasi tentang menghapus kunci KMS, lihat. [Menghapus sebuah AWS KMS key](deleting-keys.md)
Contoh entri CloudTrail log berikut mencatat `DeleteKey` operasi kunci KMS dengan materi kunci di AWS KMS.
```
{
"eventVersion": "1.08",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "AWS Internal"
},
"eventTime": "2020-07-31T00:07:00Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DeleteKey",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "b25f9cda-74e1-4458-847b-4972a0bf9668",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsServiceEvent",
"recipientAccountId": "111122223333",
"managementEvent": true,
"eventCategory": "Management"
}
```
Entri CloudTrail log berikut mencatat `DeleteKey` operasi kunci KMS di [toko kunci AWS CloudHSM kustom](key-store-overview.md#custom-key-store-overview).
```
{
"eventVersion": "1.08",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "AWS Internal"
},
"eventTime": "2021-10-26T23:41:27Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DeleteKey",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"additionalEventData": {
"customKeyStoreId": "cks-1234567890abcdef0",
"clusterId": "cluster-1a23b4cdefg",
"backingKeys": "[{\"backingKeyId\":\"backing-key-id\"}]",
"backingKeysDeletionStatus": "[{\"backingKeyId\":\"backing-key-id\",\"deletionStatus\":\"SUCCESS\"}]"
},
"eventID": "1234585c-4b0c-4340-ab11-662414b79239",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsServiceEvent",
"recipientAccountId": "111122223333",
"managementEvent": true,
"eventCategory": "Management"
}
```
# DescribeCustomKeyStores
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeCustomKeyStores.html](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeCustomKeyStores.html)operasi. Untuk informasi tentang melihat toko kunci khusus, lihat[Lihat toko AWS CloudHSM kunci](view-keystore.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-10-21T20:17:32Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DescribeCustomKeyStores",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"customKeyStoreId": "cks-1234567890abcdef0"
},
"responseElements": null,
"requestID": "abcde9e1-f1a3-4460-a423-577fb6e695c9",
"eventID": "2ea1735f-628d-43e3-b2ee-486d02913a78",
"readOnly": true,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
}
```
# DescribeKey
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [DescribeKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html)operasi. AWS KMS merekam entri seperti yang berikut ketika Anda memanggil `DescribeKey` operasi atau [melihat kunci KMS](viewing-keys.md) di AWS KMS konsol. Panggilan ini adalah hasil dari melihat kunci di konsol AWS KMS manajemen.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-09-26T18:01:36Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DescribeKey",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": null,
"requestID": "12345126-30d5-4b28-98b9-9153da559963",
"eventID": "abcde202-ba1a-467c-b4ba-f729d45ae521",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# DisableKey
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html)operasi. Untuk informasi tentang mengaktifkan dan menonaktifkan, lihat AWS KMS keys . AWS KMS[Aktifkan dan nonaktifkan kunci](enabling-keys.md)
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
```
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-04T00:52:43Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DisableKey",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "12345126-30d5-4b28-98b9-9153da559963",
"eventID": "abcde202-ba1a-467c-b4ba-f729d45ae521",
"readOnly": false,
"resources": [{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# DisableKeyRotation
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [DisableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html)operasi. Untuk informasi tentang rotasi tombol otomatis, lihat[Putar AWS KMS keys](rotate-keys.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-09-01T19:31:39Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DisableKeyRotation",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": null,
"requestID": "d6a9351a-ed6e-4581-88d1-2a9a8a538497",
"eventID": "6313164c-83aa-4cc3-9e1a-b7c426f7a5b1",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# DisconnectCustomKeyStore
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [https://docs.aws.amazon.com/kms/latest/APIReference/API_DisconnectCustomKeyStore.html](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisconnectCustomKeyStore.html)operasi. Untuk informasi tentang memutuskan sambungan penyimpanan kunci kustom, lihat[Putuskan sambungan toko AWS CloudHSM kunci](disconnect-keystore.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-10-21T20:17:32Z",
"eventSource": "kms.amazonaws.com",
"eventName": "DisconnectCustomKeyStore",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"customKeyStoreId": "cks-1234567890abcdef0"
},
"responseElements": null,
"additionalEventData": {
"customKeyStoreName": "ExampleKeyStore",
"clusterId": "cluster-1a23b4cdefg"
},
"requestID": "abcde9e1-f1a3-4460-a423-577fb6e695c9",
"eventID": "114b61b9-0ea6-47f5-a9d2-4f2bdd0017d5",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
}
```
# EnableKey
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [EnableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html)operasi. Untuk informasi tentang mengaktifkan dan menonaktifkan, lihat AWS KMS keys .. AWS KMS[Aktifkan dan nonaktifkan kunci](enabling-keys.md)
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
```
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-04T00:52:20Z",
"eventSource": "kms.amazonaws.com",
"eventName": "EnableKey",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "d528a6fb-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "be393928-3629-4370-9634-567f9274d52e",
"readOnly": false,
"resources": [{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# EnableKeyRotation
Contoh berikut menunjukkan entri AWS CloudTrail log panggilan ke [EnableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html)operasi. Untuk contoh entri CloudTrail log yang ditulis saat kunci diputar, lihat[RotateKey](ct-rotatekey.md). Untuk informasi tentang rotasi AWS KMS keys, lihat[Putar AWS KMS keys](rotate-keys.md).
**catatan**
[rotation-period](rotate-keys.md#rotation-period)Ini adalah parameter permintaan opsional. Jika Anda tidak menentukan periode rotasi saat Anda mengaktifkan rotasi kunci otomatis, nilai defaultnya adalah 365 hari.
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2020-07-25T23:41:56Z",
"eventSource": "kms.amazonaws.com",
"eventName": "EnableKeyRotation",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"rotationPeriodInDays": 180
},
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "81f5b794-452b-4d6a-932b-68c188165273",
"eventID": "fefc43a7-8e06-419f-bcab-b3bf18d6a401",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# Enkripsi
Contoh berikut menunjukkan entri AWS CloudTrail log untuk operasi [Enkripsi](https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html).
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-05-20T20:46:16Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Encrypt",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"encryptionContext": {
"Department": "Engineering"
},
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"encryptionAlgorithm": "SYMMETRIC_DEFAULT",
},
"responseElements": null,
"additionalEventData": {
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"requestID": "f3423043-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "91235988-eb87-476a-ac2c-0cdc244e6dca",
"readOnly": true,
"resources": [{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"clientProvidedHostHeader": "kms.us-east-1.amazonaws.com"
}
}
```
# GenerateDataKey
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [GenerateDataKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html)operasi.
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-05-20T20:46:16Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GenerateDataKey",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"keySpec": "AES_256",
"encryptionContext": {
"Department": "Engineering",
"Project": "Alpha"
}
},
"responseElements": null,
"additionalEventData": {
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"requestID": "e0eb83e3-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "a9dea4f9-8395-46c0-942c-f509c02c2b71",
"readOnly": true,
"resources": [{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"clientProvidedHostHeader": "kms.us-east-1.amazonaws.com"
}
}
```
# GenerateDataKeyPair
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [GenerateDataKeyPair](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html)operasi. Contoh ini mencatat operasi yang menghasilkan key pair RSA yang dienkripsi di bawah enkripsi simetris. AWS KMS key
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-05-20T20:46:16Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GenerateDataKeyPair",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyPairSpec": "RSA_3072",
"encryptionContext": {
"Project": "Alpha"
},
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": null,
"additionalEventData": {
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"requestID": "52fb127b-0fe5-42bb-8e5e-f560febde6b0",
"eventID": "9b6bd6d2-529d-4890-a949-593b13800ad7",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"clientProvidedHostHeader": "kms.us-west-2.amazonaws.com"
}
}
```
# GenerateDataKeyPairWithoutPlaintext
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [GenerateDataKeyPairWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html)operasi. Contoh ini mencatat operasi yang menghasilkan key pair RSA yang dienkripsi di bawah enkripsi simetris. AWS KMS key
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-05-20T20:46:16Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GenerateDataKeyPairWithoutPlaintext",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyPairSpec": "RSA_4096",
"encryptionContext": {
"Index": "5"
},
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": null,
"additionalEventData": {
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"requestID": "52fb127b-0fe5-42bb-8e5e-f560febde6b0",
"eventID": "9b6bd6d2-529d-4890-a949-593b13800ad7",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"clientProvidedHostHeader": "kms.us-west-2.amazonaws.com"
}
}
```
# GenerateDataKeyWithoutPlaintext
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [GenerateDataKeyWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html)operasi.
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-05-20T20:46:16Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GenerateDataKeyWithoutPlaintext",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"keySpec": "AES_256",
"encryptionContext": {
"Project": "Alpha"
}
},
"responseElements": null,
"additionalEventData": {
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"requestID": "d6b8e411-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "f7734272-9ec5-4c80-9f36-528ebbe35e4a",
"readOnly": true,
"resources": [{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"clientProvidedHostHeader": "kms.us-east-1.amazonaws.com"
}
}
```
# GenerateMac
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [GenerateMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateMac.html)operasi.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-12-23T19:26:54Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GenerateMac",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"macAlgorithm": "HMAC_SHA_512",
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": null,
"requestID": "e0eb83e3-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "a9dea4f9-8395-46c0-942c-f509c02c2b71",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# GenerateRandom
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [GenerateRandom](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateRandom.html)operasi. Karena operasi ini tidak menggunakan AWS KMS key, `resources` bidang kosong.
```
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-04T00:52:37Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GenerateRandom",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"requestID": "df1e3de6-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "239cb9f7-ae05-4c94-9221-6ea30eef0442",
"readOnly": true,
"resources": [],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# GetKeyPolicy
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [GetKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html)operasi. Untuk informasi tentang melihat kebijakan kunci untuk kunci KMS, lihat[Melihat kebijakan utama](key-policy-viewing.md).
```
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-04T00:50:30Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GetKeyPolicy",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"policyName": "default"
},
"responseElements": null,
"requestID": "93746dd6-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "4aa7e4d5-d047-452a-a5a6-2cce282a7e82",
"readOnly": true,
"resources": [{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# GetKeyRotationStatus
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [GetKeyRotationStatus](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html)operasi. Untuk informasi tentang rotasi otomatis dan sesuai permintaan bahan kunci untuk kunci KMS, lihat. [Putar AWS KMS keys](rotate-keys.md)
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2024-02-20T19:16:45Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GetKeyRotationStatus",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": null,
"requestID": "12f9b7e8-49b9-4c1c-a7e3-34ac0cdf0467",
"eventID": "3d082126-9e7d-4167-8372-a6cfcbed4be6",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
"tlsDetails": {
"tlsVersion": "TLSv1.2",
"cipherSuite": "ECDHE-RSA-AES256-GCM-SHA384",
"clientProvidedHostHeader": "kms.us-east-1.amazonaws.com"
}
}
```
# GetParametersForImport
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan saat Anda menggunakan [GetParametersForImport](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html)operasi. Operasi ini mengembalikan kunci publik dan token impor yang Anda gunakan saat mengimpor materi kunci ke kunci KMS. CloudTrail Entri yang sama direkam saat Anda menggunakan `GetParametersForImport` operasi atau menggunakan AWS KMS konsol untuk [mengunduh kunci publik dan token impor](importing-keys-get-public-key-and-token.md).
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2020-07-25T23:58:23Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GetParametersForImport",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"wrappingAlgorithm": "RSAES_OAEP_SHA_256",
"wrappingKeySpec": "RSA_2048"
},
"responseElements": null,
"requestID": "b5786406-e3c7-43d6-8d3c-6d5ef96e2278",
"eventID": "4023e622-0c3e-4324-bdef-7f58193bba87",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# ImportKeyMaterial
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan saat Anda menggunakan [ImportKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html)operasi. CloudTrail Entri yang sama direkam saat Anda menggunakan `ImportKeyMaterial` operasi atau menggunakan AWS KMS konsol untuk [mengimpor materi kunci](importing-keys-import-key-material.md) ke dalam file AWS KMS key.
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-05-21T05:42:31Z",
"eventSource": "kms.amazonaws.com",
"eventName": "ImportKeyMaterial",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"validTo": "May 21, 2025, 5:47:45 AM",
"expirationModel": "KEY_MATERIAL_EXPIRES",
"importType": "NEW_KEY_MATERIAL",
"keyMaterialDescription": "ExampleKeyMaterialA"
},
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"keyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"requestID": "89e10ee7-a612-414d-95a2-a128346969fd",
"eventID": "c7abd205-a5a2-4430-bbfa-fc10f3e2d79f",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"clientProvidedHostHeader": "kms.us-west-2.amazonaws.com"
}
}
```
# ListAliases
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [ListAliases](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html)operasi. Karena operasi ini tidak menggunakan alias tertentu atau AWS KMS key, `resources` bidang kosong. Untuk informasi tentang melihat alias di AWS KMS, lihat[Temukan nama alias dan alias ARN untuk kunci KMS](alias-view.md).
```
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-04T00:51:45Z",
"eventSource": "kms.amazonaws.com",
"eventName": "ListAliases",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"limit": 5,
"marker": "eyJiIjoiYWxpYXMvZTU0Y2MxOTMtYTMwNC00YzEwLTliZWItYTJjZjA3NjA2OTJhIiwiYSI6ImFsaWFzL2U1NGNjMTkzLWEzMDQtNGMxMC05YmViLWEyY2YwNzYwNjkyYSJ9"
},
"responseElements": null,
"requestID": "bfe6c190-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "a27dda7b-76f1-4ac3-8b40-42dfba77bcd6",
"readOnly": true,
"resources": [],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# ListGrants
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [ListGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html)operasi. Untuk informasi tentang hibah di AWS KMS, lihat[Hibah di AWS KMS](grants.md).
```
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-04T00:52:49Z",
"eventSource": "kms.amazonaws.com",
"eventName": "ListGrants",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"marker": "eyJncmFudElkIjoiMWY4M2U2ZmM0YTY2NDgxYjQ2Yzc4MTdhM2Y4YmQwMDFkZDNiYmQ1MGVlYTMyY2RmOWFiNWY1Nzc1NDNjYmNmMyIsImtleUFybiI6ImFybjphd3M6dHJlbnQtc2FuZGJveDp1cy1lYXN0LTE6NTc4Nzg3Njk2NTMwOmtleS9lYTIyYTc1MS1lNzA3LTQwZDAtOTJhYy0xM2EyOGZhOWViMTEifQ\u003d\u003d",
"limit": 10
},
"responseElements": null,
"requestID": "e5c23960-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "d24380f5-1b20-4253-8e92-dd0492b3bd3d",
"readOnly": true,
"resources": [{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# ListKeyRotations
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html)operasi. Untuk informasi tentang rotasi otomatis dan sesuai permintaan bahan kunci untuk kunci KMS, lihat. [Putar AWS KMS keys](rotate-keys.md)
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-05-21T05:42:35Z",
"eventSource": "kms.amazonaws.com",
"eventName": "ListKeyRotations",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"includeKeyMaterial": "ALL_KEY_MATERIAL"
},
"responseElements": null,
"requestID": "99c88d32-f2db-455e-8a9a-23855258a452",
"eventID": "8ce0e74b-b9c7-45a2-96ef-83136d38068e",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.2",
"cipherSuite": "ECDHE-RSA-AES256-GCM-SHA384",
"clientProvidedHostHeader": "kms.us-east-1.amazonaws.com"
}
}
```
# PutKeyPolicy
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [PutKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html)operasi. Untuk informasi tentang memperbarui kebijakan utama, lihat[Mengubah kebijakan utama](key-policy-modifying.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-09-01T20:06:16Z",
"eventSource": "kms.amazonaws.com",
"eventName": "PutKeyPolicy",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"policyName": "default",
"policy": "{\n \"Version\" : \"2012-10-17\",\n \"Id\" : \"key-default-1\",\n \"Statement\" : [ {\n \"Sid\" : \"Enable IAM User Permissions\",\n \"Effect\" : \"Allow\",\n \"Principal\" : {\n \"AWS\" : \"arn:aws:iam::111122223333:root\"\n },\n \"Action\" : \"kms:*\",\n \"Resource\" : \"*\"\n } ]\n}",
"bypassPolicyLockoutSafetyCheck": false
},
"responseElements": null,
"requestID": "7bb906fa-dc21-4350-b65c-808ff0f72f55",
"eventID": "c217db1f-903f-4a2f-8f88-9580182d6313",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# ReEncrypt
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [ReEncrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html)operasi. `resources`Bidang dalam entri log ini menentukan dua AWS KMS keys, kunci KMS sumber dan kunci KMS tujuan, dalam urutan itu.
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2025-05-22T19:34:55Z",
"eventSource": "kms.amazonaws.com",
"eventName": "ReEncrypt",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"sourceEncryptionAlgorithm": "SYMMETRIC_DEFAULT",
"sourceEncryptionContext": {
"Project": "Alpha",
"Department": "Engineering"
},
"destinationKeyId": "0987dcba-09fe-87dc-65ba-ab0987654321",
"destinationEncryptionAlgorithm": "SYMMETRIC_DEFAULT",
"destinationEncryptionContext": {
"Level": "3A"
}
},
"responseElements": null,
"additionalEventData": {
"destinationKeyMaterialId": "96083e4fb6dbc41d77578a213a6b6669c044dd4c143e96755396d2bf11fd6068",
"sourceKeyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0"
},
"requestID": "03769fd4-acf9-4b33-adf3-2ab8ca73aadf",
"eventID": "542d9e04-0e8d-4e05-bf4b-4bdeb032e6ec",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"clientProvidedHostHeader": "kms.us-west-2.amazonaws.com"
}
}
```
# ReplicateKey
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [ReplicateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html)operasi. `ReplicateKey`Permintaan menghasilkan `ReplicateKey` operasi dan [CreateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html)operasi.
Untuk informasi tentang cara mereplikasi kunci multi-Wilayah, lihat [Buat kunci replika Multi-wilayah](multi-region-keys-replicate.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2020-11-18T01:29:18Z",
"eventSource": "kms.amazonaws.com",
"eventName": "ReplicateKey",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"replicaRegion": "us-west-2",
"bypassPolicyLockoutSafetyCheck": false,
"description": ""
},
"responseElements": {
"replicaKeyMetadata": {
"aWSAccountId": "111122223333",
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"arn": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"creationDate": "Nov 18, 2020, 1:29:18 AM",
"enabled": false,
"description": "",
"keyUsage": "ENCRYPT_DECRYPT",
"keyState": "Creating",
"origin": "AWS_KMS",
"keyManager": "CUSTOMER",
"keySpec": "SYMMETRIC_DEFAULT",
"customerMasterKeySpec": "SYMMETRIC_DEFAULT",
"encryptionAlgorithms": [
"SYMMETRIC_DEFAULT"
],
"multiRegion": true,
"multiRegionConfiguration": {
"multiRegionKeyType": "REPLICA",
"primaryKey": {
"arn": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"region": "us-east-1"
},
"replicaKeys": [
{
"arn": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"region": "us-west-2"
}
]
}
},
"replicaPolicy": "{\n \"Version\":\"2012-10-17\",\n \"Statement\":[{\n \"Effect\":\"Allow\",\n \"Principal\":{\"AWS\":\"arn:aws:iam::123456789012:user/Alice\"},\n \"Action\":\"kms:*\",\n \"Resource\":\"*\"\n }, {\n \"Effect\":\"Allow\",\n \"Principal\":{\"AWS\":\"arn:aws:iam::012345678901:user/Bob\"},\n \"Action\":\"kms:CreateGrant\",\n \"Resource\":\"*\"\n }, {\n \"Effect\":\"Allow\",\n \"Principal\":{\"AWS\":\"arn:aws:iam::012345678901:user/Charlie\"},\n \"Action\":\"kms:Encrypt\",\n \"Resource\":\"*\"\n}]\n}",
},
"requestID": "abcdef68-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "fedcba44-6773-4f96-8763-1993aec9ae6a",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# RetireGrant
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html)operasi. Untuk informasi tentang pensiun hibah, lihat. [Menghentikan dan mencabut pemberian izin](grant-delete.md)
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-09-01T19:39:33Z",
"eventSource": "kms.amazonaws.com",
"eventName": "RetireGrant",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"additionalEventData": {
"grantId": "abcde1237f76e4ba7987489ac329fbfba6ad343d6f7075dbd1ef191f0120514a"
},
"requestID": "1d274d57-5697-462c-a004-f25fcc29fa26",
"eventID": "0771bcfb-3e24-4332-9ac8-e1c06563eecf",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# RevokeGrant
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [RevokeGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html)operasi. Untuk informasi tentang mencabut hibah, lihat. [Menghentikan dan mencabut pemberian izin](grant-delete.md)
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-09-01T19:35:17Z",
"eventSource": "kms.amazonaws.com",
"eventName": "RevokeGrant",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"grantId": "abcde1237f76e4ba7987489ac329fbfba6ad343d6f7075dbd1ef191f0120514a"
},
"responseElements": null,
"requestID": "59d94c03-c5b7-428d-ae6e-f2c4b47d2917",
"eventID": "07a23a39-6526-4ae2-b31e-d35fbe9e24ee",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# RotateKey
Contoh-contoh ini menunjukkan entri AWS CloudTrail log untuk operasi yang berputar AWS KMS keys. Untuk informasi tentang memutar tombol KMS, lihat. [Putar AWS KMS keys](rotate-keys.md)
Contoh berikut menunjukkan entri CloudTrail log untuk operasi yang memutar kunci KMS enkripsi simetris di mana rotasi kunci otomatis diaktifkan. Untuk informasi tentang mengaktifkan rotasi otomatis, lihat[Putar AWS KMS keys](rotate-keys.md).
Untuk contoh entri CloudTrail log yang mencatat `EnableKeyRotation` operasi, lihat[EnableKeyRotation](ct-enablekeyrotation.md).
```
{
"eventVersion": "1.11",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "AWS Internal"
},
"eventTime": "2025-05-20T20:44:37Z",
"eventSource": "kms.amazonaws.com",
"eventName": "RotateKey",
"awsRegion": "us-west-2",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "a24b3967-ddad-417f-9b22-2332b918db06",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "111122223333",
"serviceEventDetails": {
"rotationType": "AUTOMATIC",
"keyOrigin": "AWS_KMS",
"previousKeyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0",
"currentKeyMaterialId": "96083e4fb6dbc41d77578a213a6b6669c044dd4c143e96755396d2bf11fd6068",
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"eventCategory": "Management"
}
```
Contoh berikut menunjukkan entri CloudTrail log untuk rotasi sesuai permintaan yang diprakarsai oleh operasi. [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html) Untuk informasi tentang memutar kunci KMS enkripsi simetris sesuai permintaan, lihat. [Lakukan rotasi kunci sesuai permintaan](rotating-keys-on-demand.md)
Untuk contoh entri CloudTrail log yang mencatat `RotateKeyOnDemand` operasi, lihat[RotateKeyOnDemand](ct-rotatekeyondemand.md).
```
{
"eventVersion": "1.11",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "AWS Internal"
},
"eventTime": "2025-05-20T20:44:37Z",
"eventSource": "kms.amazonaws.com",
"eventName": "RotateKey",
"awsRegion": "us-west-2",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "a24b3967-ddad-417f-9b22-2332b918db06",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "111122223333",
"serviceEventDetails": {
"rotationType": "ON_DEMAND",
"keyOrigin": "EXTERNAL",
"previousKeyMaterialId": "123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0",
"currentKeyMaterialId": "96083e4fb6dbc41d77578a213a6b6669c044dd4c143e96755396d2bf11fd6068",
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"eventCategory": "Management"
}
```
# RotateKeyOnDemand
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html)operasi. Untuk contoh entri CloudTrail log yang ditulis saat kunci diputar, lihat[RotateKey](ct-rotatekey.md). Untuk informasi lebih lanjut tentang rotasi sesuai permintaan bahan kunci untuk kunci KMS, lihat. [Lakukan rotasi kunci sesuai permintaan](rotating-keys-on-demand.md)
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2024-02-20T17:41:57Z",
"eventSource": "kms.amazonaws.com",
"eventName": "RotateKeyOnDemand",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "9e1dee86-eb84-42fd-8f25-e3fc7dbb32c8",
"eventID": "00a09fbc-20d6-4a58-9b92-7da85984ab77",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.2",
"cipherSuite": "ECDHE-RSA-AES256-GCM-SHA384",
"clientProvidedHostHeader": "kms.us-east-1.amazonaws.com"
}
}
```
# ScheduleKeyDeletion
Contoh-contoh ini menunjukkan entri AWS CloudTrail log untuk [ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html)operasi.
Untuk contoh entri CloudTrail log yang ditulis saat kunci dihapus, lihat[DeleteKey](ct-delete-key.md). Untuk informasi tentang menghapus AWS KMS keys, lihat[Menghapus sebuah AWS KMS key](deleting-keys.md).
Contoh berikut mencatat `ScheduleKeyDeletion` permintaan untuk kunci KMS Single-region.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-03-23T18:58:30Z",
"eventSource": "kms.amazonaws.com",
"eventName": "ScheduleKeyDeletion",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"pendingWindowInDays": 20,
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": {
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"keyState": "PendingDeletion",
"deletionDate": "Apr 12, 2021 18:58:30 PM"
},
"requestID": "ee408f36-ea01-422b-ac14-b0f147c68334",
"eventID": "3c4226b0-1e81-48a8-a333-7fa5f3cbd118",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
Contoh berikut mencatat `ScheduleKeyDeletion` permintaan untuk kunci KMS Multi-wilayah dengan kunci replika.
Karena AWS KMS tidak akan menghapus kunci Multi-wilayah sampai semua kunci replika dihapus, di `responseElements` bidang, `keyState` is `PendingReplicaDeletion` dan `deletionDate` bidang dihilangkan.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-10-28T17:59:05Z",
"eventSource": "kms.amazonaws.com",
"eventName": "ScheduleKeyDeletion",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"pendingWindowInDays": 30,
"keyId": "mrk-1234abcd12ab34cd56ef1234567890ab"
},
"responseElements": {
"keyId": "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab",
"keyState": "PendingReplicaDeletion",
"pendingWindowInDays": 30
},
"requestID": "12341411-d846-42a6-a476-b1cbe3011f89",
"eventID": "abcda5f-396d-494c-9380-0c47860df5f1",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
Contoh berikut mencatat `ScheduleKeyDeletion` permintaan untuk kunci KMS di [toko kunci AWS CloudHSM kustom](key-store-overview.md#custom-key-store-overview).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-10-26T23:25:25Z",
"eventSource": "kms.amazonaws.com",
"eventName": "ScheduleKeyDeletion",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321",
"pendingWindowInDays": 30
},
"responseElements": {
"keyId": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321",
"deletionDate": "Nov 2, 2021, 11:25:25 PM",
"keyState": "PendingDeletion",
"pendingWindowInDays": 30
},
"additionalEventData": {
"customKeyStoreId": "cks-1234567890abcdef0",
"clusterId": "cluster-1a23b4cdefg",
"backingKeys": "[{\"backingKeyId\":\"backing-key-id\"}]"
},
"requestID": "abcd9f60-2c9c-4a0b-a456-d5d998f7f321",
"eventID": "ca01996a-01b0-4edd-bbbb-25d7b6d1a6fa",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# Sign
Contoh-contoh ini menunjukkan entri AWS CloudTrail log untuk operasi [Tanda tangan](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html).
Contoh berikut menunjukkan entri CloudTrail log untuk operasi [Tanda](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html) yang menggunakan kunci KMS RSA asimetris untuk menghasilkan tanda tangan digital untuk sebuah file.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-03-07T22:36:44Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Sign",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"messageType": "RAW",
"keyId": "0987dcba-09fe-87dc-65ba-ab0987654321",
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_256"
},
"responseElements": null,
"requestID": "8d0b35e0-46cf-48b9-be99-bf2ebc9ab9fb",
"eventID": "107b3cac-b125-4556-9702-12a2b9afcff7",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# SynchronizeMultiRegionKey
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan saat AWS KMS menyinkronkan kunci [Multi-region](multi-region-keys-overview.md). Sinkronisasi melibatkan panggilan lintas wilayah untuk menyalin [properti bersama](multi-region-keys-overview.md#mrk-sync-properties) dari kunci utama Multi-wilayah ke kunci replika. AWS KMS menyinkronkan kunci Multi-region secara berkala untuk memastikan bahwa semua kunci Multi-region terkait memiliki materi kunci yang sama.
`resources`Elemen entri CloudTrail log mencakup ARN kunci dari kunci primer Multi-wilayah, termasuk nya. Wilayah AWS Kunci replika multi-Wilayah terkait dan Wilayah mereka tidak tercantum dalam entri log ini.
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
```
{
"eventVersion": "1.08",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "AWS Internal"
},
"eventTime": "2020-11-18T02:04:37Z",
"eventSource": "kms.amazonaws.com",
"eventName": "SynchronizeMultiRegionKey",
"awsRegion": "us-west-2",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "12345681-de97-42e9-bed0-b02ae1abd8dc",
"eventID": "abcdec99-2b5c-4670-9521-ddb8f031e146",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# TagResource
Contoh berikut menunjukkan entri AWS CloudTrail log panggilan ke [TagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html)operasi untuk menambahkan tag dengan kunci tag `Department` dan nilai tag dari`IT`.
Untuk contoh entri `UntagResource` CloudTrail log yang ditulis saat kunci diputar, lihat[UntagResource](ct-untagresource.md). Untuk informasi tentang penandaan AWS KMS keys, lihat[Tag di AWS KMS](tagging-keys.md).
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2020-07-01T21:19:25Z",
"eventSource": "kms.amazonaws.com",
"eventName": "TagResource",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"tags": [
{
"tagKey": "Department",
"tagValue": "IT"
}
]
},
"responseElements": null,
"requestID": "b942584a-f77d-4787-9feb-b9c5be6e746d",
"eventID": "0a091b9b-0df5-4cf9-b667-6f2879532b8f",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# UntagResource
Contoh berikut menunjukkan entri AWS CloudTrail log panggilan ke [UntagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html)operasi untuk menghapus tag dengan kunci tag dari`Dept`.
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
Untuk contoh entri `TagResource` CloudTrail log, lihat[TagResource](ct-tagresource.md). Untuk informasi tentang penandaan AWS KMS keys, lihat[Tag di AWS KMS](tagging-keys.md).
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2020-07-01T21:19:19Z",
"eventSource": "kms.amazonaws.com",
"eventName": "UntagResource",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"tagKeys": [
"Dept"
]
},
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "cb1d507b-6015-47f4-812b-179713af8068",
"eventID": "0b00f4b0-036e-411d-aa75-87eb4a35a4b3",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# UpdateAlias
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [UpdateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html)operasi. `resources`Elemen ini mencakup bidang untuk alias dan sumber daya kunci KMS. Untuk informasi tentang membuat alias di AWS KMS, lihat[Buat alias](alias-create.md).
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan kunci ARN.
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2020-11-13T23:18:15Z",
"eventSource": "kms.amazonaws.com",
"eventName": "UpdateAlias",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"aliasName": "alias/my_alias",
"targetKeyId": "1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "d9472f40-63bc-11e4-bc2b-4198b6150d5c",
"eventID": "f72d3993-864f-48d6-8f16-e26e1ae8dff0",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:alias/my_alias"
},
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
```
# UpdateCustomKeyStore
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateCustomKeyStore.html](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateCustomKeyStore.html)operasi untuk memperbarui ID cluster untuk penyimpanan kunci kustom. Untuk informasi tentang mengedit toko kunci kustom, lihat[Edit pengaturan penyimpanan AWS CloudHSM kunci](update-keystore.md).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-10-21T20:17:32Z",
"eventSource": "kms.amazonaws.com",
"eventName": "UpdateCustomKeyStore",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"customKeyStoreId": "cks-1234567890abcdef0",
"clusterId": "cluster-1a23b4cdefg"
},
"responseElements": null,
"additionalEventData": {
"customKeyStoreName": "ExampleKeyStore",
"clusterId": "cluster-1a23b4cdefg"
},
"requestID": "abcde9e1-f1a3-4460-a423-577fb6e695c9",
"eventID": "114b61b9-0ea6-47f5-a9d2-4f2bdd0017d5",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333"
}
```
# UpdateKeyDescription
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [UpdateKeyDescription](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html)operasi.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-09-01T19:22:40Z",
"eventSource": "kms.amazonaws.com",
"eventName": "UpdateKeyDescription",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
"description": "New key description"
},
"responseElements": null,
"requestID": "8c3c1f8b-336d-4896-b034-4eb9916bc9b3",
"eventID": "f5f3d548-2e9e-4658-8427-9dcb5b1ea791",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# UpdatePrimaryRegion
Contoh berikut menunjukkan entri AWS CloudTrail log yang dihasilkan dengan memanggil [UpdatePrimaryRegion](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdatePrimaryRegion.html)operasi pada kunci [Multi-region](multi-region-keys-overview.md).
`UpdatePrimaryRegion`Operasi menulis dua entri CloudTrail log: satu di Wilayah dengan kunci primer Multi-wilayah yang dikonversi menjadi kunci replika, dan satu di Wilayah dengan kunci replika Multi-wilayah yang dikonversi ke kunci primer.
CloudTrail entri log untuk operasi ini yang direkam pada atau setelah Desember 2022 menyertakan ARN kunci dari kunci KMS yang terpengaruh dalam `responseElements.keyId` nilainya, meskipun operasi ini tidak mengembalikan ARN kunci.
Contoh berikut menunjukkan entri CloudTrail log untuk `UpdatePrimaryRegion` di Wilayah di mana kunci Multi-region berubah dari kunci primer menjadi kunci replika (us-west-2). Kolom `primaryRegion` menunjukkan Wilayah yang sekarang menghosting kunci utama (ap-northeast-1).
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2021-03-10T20:23:37Z",
"eventSource": "kms.amazonaws.com",
"eventName": "UpdatePrimaryRegion",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "mrk-1234abcd12ab34cd56ef1234567890ab",
"primaryRegion": "ap-northeast-1"
},
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "ee408f36-ea01-422b-ac14-b0f147c68334",
"eventID": "3c4226b0-1e81-48a8-a333-7fa5f3cbd118",
"readOnly": false,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"eventCategory": "Management",
"recipientAccountId": "111122223333"
}
```
Contoh berikut mewakili entri CloudTrail log untuk `UpdatePrimaryRegion` di Wilayah di mana kunci Multi-wilayah berubah dari kunci replika ke kunci utama (ap-northeast-1). Entri log ini tidak mengidentifikasi Wilayah utama sebelumnya.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice",
"invokedBy": "kms.amazonaws.com"
},
"eventTime": "2021-03-10T20:23:37Z",
"eventSource": "kms.amazonaws.com",
"eventName": "UpdatePrimaryRegion",
"awsRegion": "ap-northeast-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"keyId": "arn:aws:kms:ap-northeast-1:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab",
"primaryRegion": "ap-northeast-1"
},
"responseElements": {
"keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"requestID": "ee408f36-ea01-422b-ac14-b0f147c68334",
"eventID": "091e6be5-737f-43c6-8431-e3679d6d0619",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"eventCategory": "Management",
"recipientAccountId": "111122223333"
}
```
# VerifyMac
Contoh berikut menunjukkan entri AWS CloudTrail log untuk [VerifyMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_VerifyMac.html)operasi.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-03-31T19:25:54Z",
"eventSource": "kms.amazonaws.com",
"eventName": "VerifyMac",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"macAlgorithm": "HMAC_SHA_384",
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": null,
"requestID": "f35da560-edff-4d6e-9b40-fb306fa9ef1e",
"eventID": "6b464487-6dea-44cd-84ad-225d7450c975",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# Verifikasi
Contoh ini menunjukkan entri AWS CloudTrail log untuk operasi [Verifikasi](https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html).
Contoh berikut menunjukkan entri CloudTrail log untuk operasi [Verifikasi](https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html) yang menggunakan kunci KMS RSA asimetris untuk memverifikasi tanda tangan digital.
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2022-03-07T22:50:41Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Verify",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_256",
"keyId": "0987dcba-09fe-87dc-65ba-ab0987654321",
"messageType": "RAW"
},
"responseElements": null,
"requestID": "c73ab82a-af82-4750-ae2c-b6bb790e9c28",
"eventID": "3b4331cd-5b7b-4de5-bf5f-82ec22f0dac0",
"readOnly": true,
"resources": [
{
"accountId": "111122223333",
"type": "AWS::KMS::Key",
"ARN": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"
}
],
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
# Amazon EC2 contoh satu
Contoh berikut mencatat prinsipal IAM yang membuat volume terenkripsi menggunakan kunci volume default di konsol manajemen Amazon EC2 .
Contoh berikut menunjukkan entri CloudTrail log di mana pengguna Alice membuat volume terenkripsi dengan kunci volume default di konsol manajemen Amazon EC2 . Catatan file EC2 log mencakup `volumeId` bidang dengan nilai`"vol-13439757"`. AWS KMS Catatan berisi `encryptionContext` bidang dengan nilai`"aws:ebs:id": "vol-13439757"`. Demikian pula, `principalId` dan `accountId` antara dua catatan cocok. Catatan mencerminkan fakta bahwa membuat volume terenkripsi menghasilkan kunci data yang digunakan untuk mengenkripsi konten volume.
```
{
"Records": [
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-05T20:50:18Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "CreateVolume",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"size": "10",
"zone": "us-east-1a",
"volumeType": "gp2",
"encrypted": true
},
"responseElements": {
"volumeId": "vol-13439757",
"size": "10",
"zone": "us-east-1a",
"status": "creating",
"createTime": 1415220618876,
"volumeType": "gp2",
"iops": 30,
"encrypted": true
},
"requestID": "1565210e-73d0-4912-854c-b15ed349e526",
"eventID": "a3447186-135f-4b00-8424-bc41f1a93b4f",
"eventType": "AwsApiCall",
"recipientAccountId": "123456789012"
},
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-05T20:50:19Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GenerateDataKeyWithoutPlaintext",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "&AWS; Internal",
"requestParameters": {
"encryptionContext": {
"aws:ebs:id": "vol-13439757"
},
"numberOfBytes": 64,
"keyId": "alias/aws/ebs"
},
"responseElements": null,
"requestID": "create-123456789012-758241111-1415220618",
"eventID": "4bd2a696-d833-48cc-b72c-05e61b608399",
"readOnly": true,
"resources": [
{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
]
}
```
# Amazon EC2 contoh dua
Dalam contoh berikut, prinsipal IAM yang menjalankan EC2 instance Amazon membuat dan memasang volume data yang dienkripsi di bawah kunci KMS. Tindakan ini menghasilkan beberapa catatan CloudTrail log. Untuk informasi selengkapnya tentang Amazon EBS dan enkripsi, lihat [Persyaratan enkripsi Amazon EBS](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption-requirements.html#ebs-encryption-instance-permissions).
Saat volume dibuat, Amazon EC2, bertindak atas nama pelanggan, mendapatkan kunci data terenkripsi dari AWS KMS ()`GenerateDataKeyWithoutPlaintext`. Kemudian, volume membuat izin (`CreateGrant`) yang memungkinkannya untuk mendekripsi kunci data. Saat volume dipasang, Amazon EC2 memanggil AWS KMS untuk mendekripsi kunci data ()`Decrypt`.
EC2 Contoh Amazon,`"i-81e2f56c"`, muncul di `RunInstances` acara tersebut. `instanceId` ID instans yang sama memenuhi syarat `granteePrincipal` dari izin yang dibuat (`"111122223333:aws:ec2-infrastructure:i-81e2f56c"`) dan asumsi peran yang merupakan perwakilan dalam panggilan `Decrypt` (`"arn:aws:sts::111122223333:assumed-role/aws:ec2-infrastructure/i-81e2f56c"`).
[Kunci ARN](concepts.md#key-id-key-ARN) dari kunci KMS yang melindungi volume data,`arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`, muncul di ketiga AWS KMS panggilan (`CreateGrant`,`GenerateDataKeyWithoutPlaintext`, dan). `Decrypt`
```
{
"Records": [
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-05T21:35:27Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "RunInstances",
"awsRegion": "us-west-2",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"instancesSet": {
"items": [
{
"imageId": "ami-b66ed3de",
"minCount": 1,
"maxCount": 1
}
]
},
"groupSet": {
"items": [
{
"groupId": "sg-98b6e0f2"
}
]
},
"instanceType": "m3.medium",
"blockDeviceMapping": {
"items": [
{
"deviceName": "/dev/xvda",
"ebs": {
"volumeSize": 8,
"deleteOnTermination": true,
"volumeType": "gp2"
}
},
{
"deviceName": "/dev/sdb",
"ebs": {
"volumeSize": 8,
"deleteOnTermination": false,
"volumeType": "gp2",
"encrypted": true
}
}
]
},
"monitoring": {
"enabled": false
},
"disableApiTermination": false,
"instanceInitiatedShutdownBehavior": "stop",
"clientToken": "XdKUT141516171819",
"ebsOptimized": false
},
"responseElements": {
"reservationId": "r-5ebc9f74",
"ownerId": "111122223333",
"groupSet": {
"items": [
{
"groupId": "sg-98b6e0f2",
"groupName": "launch-wizard-2"
}
]
},
"instancesSet": {
"items": [
{
"instanceId": "i-81e2f56c",
"imageId": "ami-b66ed3de",
"instanceState": {
"code": 0,
"name": "pending"
},
"amiLaunchIndex": 0,
"productCodes": {
},
"instanceType": "m3.medium",
"launchTime": 1415223328000,
"placement": {
"availabilityZone": "us-east-1a",
"tenancy": "default"
},
"monitoring": {
"state": "disabled"
},
"stateReason": {
"code": "pending",
"message": "pending"
},
"architecture": "x86_64",
"rootDeviceType": "ebs",
"rootDeviceName": "/dev/xvda",
"blockDeviceMapping": {
},
"virtualizationType": "hvm",
"hypervisor": "xen",
"clientToken": "XdKUT1415223327917",
"groupSet": {
"items": [
{
"groupId": "sg-98b6e0f2",
"groupName": "launch-wizard-2"
}
]
},
"networkInterfaceSet": {
},
"ebsOptimized": false
}
]
}
},
"requestID": "41c4b4f7-8bce-4773-bf0e-5ae3bb5cbce2",
"eventID": "cd75a605-2fee-4fda-b847-9c3d330ebaae",
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
},
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-05T21:35:35Z",
"eventSource": "kms.amazonaws.com",
"eventName": "CreateGrant",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"constraints": {
"encryptionContextSubset": {
"aws:ebs:id": "vol-f67bafb2"
}
},
"granteePrincipal": "111122223333:aws:ec2-infrastructure:i-81e2f56c",
"keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
},
"responseElements": {
"grantId": "abcde1237f76e4ba7987489ac329fbfba6ad343d6f7075dbd1ef191f0120514a"
},
"requestID": "41c4b4f7-8bce-4773-bf0e-5ae3bb5cbce2",
"eventID": "c1ad79e3-0d3f-402a-b119-d5c31d7c6a6c",
"readOnly": false,
"resources": [
{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
},
{
"eventVersion": "1.02",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::111122223333:user/Alice",
"accountId": "111122223333",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice"
},
"eventTime": "2014-11-05T21:35:32Z",
"eventSource": "kms.amazonaws.com",
"eventName": "GenerateDataKeyWithoutPlaintext",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "AWS Internal",
"requestParameters": {
"encryptionContext": {
"aws:ebs:id": "vol-f67bafb2"
},
"numberOfBytes": 64,
"keyId": "alias/aws/ebs"
},
"responseElements": null,
"requestID": "create-111122223333-758247346-1415223332",
"eventID": "ac3cab10-ce93-4953-9d62-0b6e5cba651d",
"readOnly": true,
"resources": [
{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
},
{
"eventVersion": "1.02",
"userIdentity": {
"type": "AssumedRole",
"principalId": "111122223333:aws:ec2-infrastructure:i-81e2f56c",
"arn": "arn:aws:sts::111122223333:assumed-role/aws:ec2-infrastructure/i-81e2f56c",
"accountId": "111122223333",
"accessKeyId": "",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2014-11-05T21:35:38Z"
},
"sessionIssuer": {
"type": "Role",
"principalId": "111122223333:aws:ec2-infrastructure",
"arn": "arn:aws:iam::111122223333:role/aws:ec2-infrastructure",
"accountId": "111122223333",
"userName": "aws:ec2-infrastructure"
}
}
},
"eventTime": "2014-11-05T21:35:47Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Decrypt",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"requestParameters": {
"encryptionContext": {
"aws:ebs:id": "vol-f67bafb2"
}
},
"responseElements": null,
"requestID": "b4b27883-6533-11e4-b4d9-751f1761e9e5",
"eventID": "edb65380-0a3e-4123-bbc8-3d1b7cff49b0",
"readOnly": true,
"resources": [
{
"ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
"accountId": "111122223333"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "111122223333"
}
]
}
```