Container for the parameters to the GetKeyLastUsage operation. Returns usage information about the last successful cryptographic operation performed with a specified KMS key, including the operation type, timestamp, and associated CloudTrail event ID.
The TrackingStartDate in the GetKeyLastUsage response indicates the
date from which KMS began recording cryptographic activity for a given key. Use this
value together with KeyCreationDate to understand the key's usage history:
If the
KeyLastUsageresponse element is present, the key has been used for a successful cryptographic operation since theTrackingStartDate. The response includes the operation type, timestamp, and associated CloudTrail event ID.If the
KeyLastUsageresponse element is empty andKeyCreationDateis on or afterTrackingStartDate, the key has not been used for a successful cryptographic operation since it was created.If the
KeyLastUsageresponse element is empty andKeyCreationDateis beforeTrackingStartDate, there is no record of the key being used for a successful cryptographic operation since theTrackingStartDate. However, the key may have been used before tracking began. To determine whether the key was used before theTrackingStartDate, examine your past CloudTrail logs.
For multi-Region KMS keys, primary and replica keys track last usage independently. Each key in a multi-Region key set maintains its own usage information.
The ReEncrypt operation uses two keys: a source key for decryption and a destination
key for encryption. Usage information is recorded for both keys independently, each
with the CloudTrail event ID from the respective key owner's account.
Do not use GetKeyLastUsage as the sole indicator when scheduling a key for
deletion. Instead, first disable
the key and monitor CloudTrail for DisabledException entries, as there
could be infrequent workflows that are dependent on the key. By looking for this exception,
you can identify potential dependencies and workload failures before they occur.
Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.
Required permissions: kms:GetKeyLastUsage (key policy)
Related operations:
Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.
In this article ▶
Inheritance Hierarchy
Amazon.Runtime.AmazonWebServiceRequest
Amazon.KeyManagementService.AmazonKeyManagementServiceRequest
Amazon.KeyManagementService.Model.GetKeyLastUsageRequest
Namespace: Amazon.KeyManagementService.Model
Assembly: AWSSDK.KeyManagementService.dll
Version: 3.x.y.z
Syntax
public class GetKeyLastUsageRequest : AmazonKeyManagementServiceRequest IAmazonWebServiceRequest
The GetKeyLastUsageRequest type exposes the following members
Constructors
| Name | Description | |
|---|---|---|
|
GetKeyLastUsageRequest() |
Properties
| Name | Type | Description | |
|---|---|---|---|
|
|
KeyId | System.String |
Gets and sets the property KeyId. Identifies the KMS key to get usage information for. To specify a KMS key, use its key ID or key ARN. Alias names are not supported. Specify the key ID or key ARN of the KMS key. For example:
To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey. |
Examples
The following example retrieves usage information about the last successful cryptographic operation performed with the specified KMS key, including the operation type, timestamp, and associated AWS CloudTrail event ID.
To retrieve the last usage for a KMS key
var client = new AmazonKeyManagementServiceClient();
var response = client.GetKeyLastUsage(new GetKeyLastUsageRequest
{
KeyId = "1234abcd-12ab-34cd-56ef-1234567890ab" // The identifier of the KMS key to get usage information for. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key. Alias names are not supported.
});
DateTime keyCreationDate = response.KeyCreationDate; // The date and time when the KMS key was created.
string keyId = response.KeyId; // The globally unique identifier for the KMS key.
KeyLastUsageData keyLastUsage = response.KeyLastUsage; // Contains usage information about the last time the KMS key was used for a successful cryptographic operation.
DateTime trackingStartDate = response.TrackingStartDate; // The date from which AWS KMS began recording cryptographic activity for this key, or the date the KMS key was created, whichever is later.
Version Information
.NET:
Supported in: 8.0 and newer, Core 3.1
.NET Standard:
Supported in: 2.0
.NET Framework:
Supported in: 4.7.2 and newer