# Key type reference
<a name="symm-asymm-compare"></a>

AWS KMS supports different features for different *types* of KMS keys. For example, you can only use [symmetric encryption KMS keys](symm-asymm-choose-key-spec.md#symmetric-cmks) to [generate symmetric data keys](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html) and [asymmetric data key pairs](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairs.html). Also, [importing key material](importing-keys.md) and [automatic key rotation](rotate-keys.md) are supported only for symmetric encryption KMS keys, and you can create only symmetric encryption KMS keys in a [custom key store](key-store-overview.md#custom-key-store-overview). 

This reference includes two tables. 
+ The [Key type table](#key-type-table) lists the AWS KMS operations that are valid for symmetric encryption KMS keys, asymmetric KMS keys, and HMAC KMS keys. 
+ The [Special features table](#special-features-table) lists the AWS KMS operations that are valid for multi-Region KMS keys, KMS keys with imported key material, and KMS keys in custom key stores.

## Key type table
<a name="key-type-table"></a>

You might need to scroll horizontally or vertically to see all of the data in this table.


| AWS KMS API operation | Symmetric encryption KMS keys | HMAC KMS keys | Asymmetric KMS keys (ENCRYPT\$1DECRYPT) | Asymmetric KMS keys (SIGN\$1VERIFY) | Asymmetric KMS keys (KEY\$1AGREEMENT) | 
| --- | --- | --- | --- | --- | --- | 
|  [CancelKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [CreateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html)  | Yes | Yes | Yes | Yes | Yes | 
|  [CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
| [CreateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html) |  Yes  | Yes |  Yes  |  Yes  | Yes | 
|  [Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html)  |  Yes  | No |  Yes  | No | No | 
|  [DeleteAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html) Valid only on KMS keys with imported key material (`Origin` is `EXTERNAL`).  |  Yes  | Yes | Yes | Yes | Yes | 
|  [DeriveSharedSecret](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeriveSharedSecret.html)  | No | No | No | No | Yes | 
|  [DescribeKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [DisableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html)  |  Yes Valid only on KMS keys with AWS KMS key material (`Origin` is `AWS_KMS`).  | No |  No  | No | No | 
|  [EnableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [EnableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html)  |  Yes Valid only on KMS keys with AWS KMS key material (`Origin` is `AWS_KMS`).  | No |  No  | No | No | 
|  [Encrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html)  |  Yes  | No |  Yes  | No | No | 
|  [GenerateDataKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html)  |  Yes   | No |  No  | No | No | 
|  [GenerateDataKeyPair](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html) Generates an asymmetric data key pair that is protected by a symmetric encryption KMS key.  | Yes Not valid on KMS keys in custom key stores. | No |  No  | No | No | 
|  [GenerateDataKeyPairWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html) Generates an asymmetric data key pair that is protected by a symmetric encryption KMS key.  |  Yes  Not valid on KMS keys in custom key stores.  | No |  No  | No | No | 
|  [GenerateDataKeyWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html)  |  Yes  | No |  No  | No | No | 
| [GenerateMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateMac.html) | No | Yes | No | No | No | 
|  [GetKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [GetKeyRotationStatus](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html)  |  Yes  |  Yes (`KeyRotationEnabled` will always be `false`.)  |  Yes (`KeyRotationEnabled` will always be `false`.)  |  Yes (`KeyRotationEnabled` will always be `false`.)  |  Yes (`KeyRotationEnabled` will always be `false`.)  | 
|  [GetParametersForImport](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html) Valid only on KMS keys with imported key material (`Origin` is `EXTERNAL`).  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [GetPublicKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html)  |  No  | No |  Yes  | Yes | Yes | 
|  [ImportKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html) Valid only on KMS keys with imported key material (`Origin` is `EXTERNAL`).  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [ListAliases](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [ListGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [ListKeyPolicies](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html)  | Yes | Yes (The `Rotations` field will always be null or empty.) | Yes (The `Rotations` field will always be null or empty.) | Yes (The `Rotations` field will always be null or empty.) | Yes (The `Rotations` field will always be null or empty.) | 
|  [ListResourceTags](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [ListRetirableGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [PutKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [ReEncrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html)  |  Yes  | No |  Yes  | No | No | 
|  [ReplicateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html) - Valid only on multi-Region keys  |  Yes  | Yes |  Yes  |  Yes  | Yes | 
|  [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html)  |  Yes  | Yes |  Yes  |  Yes  | Yes | 
|  [RevokeGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html)  | Yes Valid only on customer-managed, symmetric encryption KMS keys with `AWS_KMS` or `EXTERNAL` origin. | No | No | No | No | 
|  [ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [Sign](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html)  |  No  | No |  No  | Yes | No | 
|  [TagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [UntagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [UpdateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html) The current KMS key and the new KMS key must be the same type (both symmetric or both asymmetric or both HMAC) and they must have the same [key usage](create-keys.md#key-usage).  | Yes | Yes |  Yes  | Yes | Yes | 
|  [UpdateKeyDescription](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html)  |  Yes  | Yes |  Yes  | Yes | Yes | 
|  [UpdateReplicaRegion](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateReplicaRegion.html) - Valid only on multi-Region keys  |  Yes  | Yes |  Yes  |  Yes  | Yes | 
|  [Verify](https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html)  |  No  | No |  No  | Yes | No | 
| [VerifyMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_VerifyMac.html) | No | Yes | No | No | No | 

## Special features table
<a name="special-features-table"></a>

This table shows the AWS KMS API operations that are supported on each type of *special-purpose key*. 

While reading this table, be aware of the following interactions:
+ [Multi-Region keys](multi-region-keys-overview.md): 
  + Multi-Region keys can be symmetric encryption KMS keys, asymmetric KMS keys, HMAC KMS keys, and KMS keys with imported key material.
  + You cannot create multi-Region keys in a custom key store.
+ [Imported key material](importing-keys.md)
  + You can import key material for symmetric encryption KMS keys, asymmetric KMS keys, and HMAC KMS keys.
  + You can create [multi-Region keys with imported key material](multi-region-keys-overview.md).
  + You cannot create keys with imported key material in a custom key store. 
  + Automatic key rotation (`EnableKeyRotation`, `DisableKeyRotation`) is not supported for KMS keys with imported key material.
  + On-demand key rotation (`RotateKeyOnDemand`) is supported for symmetric encryption KMS keys with imported key material.
+ [Custom key stores](key-store-overview.md#custom-key-store-overview)
  + Custom key stores support only symmetric encryption KMS keys.
  + Symmetric operations on asymmetric key pairs (`GenerateDataKeyPair`, `GenerateDataKeyPairWithoutPlaintext`) are not supported on KMS keys in custom key stores.
  + Automatic key rotation (`EnableKeyRotation`, `DisableKeyRotation`) is not supported on KMS keys in custom key stores.
  + You cannot create multi-Region keys in custom key stores.

You might need to scroll horizontally or vertically to see all of the data in this table.


| AWS KMS API operation | Multi-Region keys | Imported key material | KMS keys in a custom key store | 
| --- | --- | --- | --- | 
|  [CancelKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [CreateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
|  [CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
| [ CreateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html) You can use `CreateKey` to create a multi-Region primary key, a KMS key with imported key material, or a KMS key in a custom key store. To create a multi-Region replica key, use `ReplicateKey`. | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | 
|  [Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  Valid only when `KeyUsage` is `ENCRYPT_DECRYPT`  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [DeleteAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only for keys with imported key material (`Origin` is `EXTERNAL`)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
|  [DeriveSharedSecret](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeriveSharedSecret.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only when `KeyUsage` is `KEY_AGREEMENT`)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only when `KeyUsage` is `KEY_AGREEMENT`)  |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [DescribeKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [DisableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys with AWS KMS key material (`Origin` is `AWS_KMS`).  | ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [EnableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption KMS keys  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [EnableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys with AWS KMS key material (`Origin` is `AWS_KMS`).  | ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [Encrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only when `KeyUsage` is `ENCRYPT_DECRYPT`  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [GenerateDataKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  Valid only on symmetric encryption KMS keys  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [GenerateDataKeyPair](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption KMS keys  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [GenerateDataKeyPairWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption KMS keys  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [GenerateDataKeyWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption KMS keys  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
| [GenerateMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateMac.html)Valid only on HMAC KMS keys |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) | 
|  [GetKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [GetKeyRotationStatus](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) (`KeyRotationEnabled` will always be `false`.)  |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [GetParametersForImport](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only for keys with imported key material (`Origin` is `EXTERNAL`).  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [GetPublicKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html) Valid only for [asymmetric KMS keys](symmetric-asymmetric.md).  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [ImportKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only for keys with imported key material (`Origin` is `EXTERNAL`).  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [ListAliases](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ListGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ListKeyPolicies](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys with `AWS_KMS` or `EXTERNAL` origin.  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys.  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ListResourceTags](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ListRetirableGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [PutKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ReEncrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only when `KeyUsage` is `ENCRYPT_DECRYPT`  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ReplicateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on multi-Region primary keys.  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on multi-Region primary keys.  |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [RevokeGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys with `AWS_KMS` or `EXTERNAL` origin.  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on symmetric encryption keys.  |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [Sign](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html) Valid only on when `KeyUsage` is `SIGN_VERIFY`.  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [TagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [UntagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [UpdateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html) - The current KMS key and the new KMS key must be the same type (both symmetric or both asymmetric or both HMAC) and they must have the same [key usage](create-keys.md#key-usage).  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [UpdateKeyDescription](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | 
|  [UpdateReplicaRegion](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateReplicaRegion.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) Valid only on multi-Region keys.  |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
|  [Verify](https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html) Valid only when `KeyUsage` is `SIGN_VERIFY`.  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png)  | 
| [VerifyMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_VerifyMac.html) Valid only on HMAC KMS keys |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-successful.png) | ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/kms/latest/developerguide/images/icon-failed.png) |