All Products
Search

This Product

    Key Management Service:Impact of CMK status on API operations

    Document Center

    Key Management Service:Impact of CMK status on API operations

    Last Updated:Mar 31, 2026

    A customer master key (CMK) in Key Management Service (KMS) can be in one of the following states: Enabled, Disabled, or PendingDeletion. Bring Your Own Key (BYOK) CMKs have an additional state: PendingImport.

    Only CMKs in the Enabled state support cryptographic operations such as encrypting and decrypting data or data keys. For all other API operations, the result depends on the CMK state, as shown in the tables below.

    State overview

    StateApplies toWhen a CMK enters this state
    EnabledAll CMKsDefault state when a CMK is created
    DisabledAll CMKsAfter you call DisableKey
    PendingDeletionAll CMKsAfter you call ScheduleKeyDeletion; the CMK is permanently deleted after the waiting period
    PendingImportBYOK CMKs onlyDefault state when a BYOK CMK is created

    To check whether a CMK is BYOK-based, call DescribeKey and check whether the Origin field value is EXTERNAL.

    Result codes

    All rejected results return HTTP status code 409. A successful operation returns 200.

    ResultHTTP status code
    Success200
    Rejected.Enabled409
    Rejected.Disabled409
    Rejected.PendingDeletion409
    Rejected.PendingImport409
    Rejected.StateModifiedFailed409

    Common API operations

    The following table shows the expected result for each API operation based on CMK state.

    API operationEnabledDisabledPendingDeletionPendingImport
    GenerateDataKeySuccessRejected.DisabledRejected.PendingDeletionRejected.PendingImport
    GenerateDataKeyWithoutPlaintextSuccessRejected.DisabledRejected.PendingDeletionRejected.PendingImport
    EncryptSuccessRejected.DisabledRejected.PendingDeletionRejected.PendingImport
    DecryptSuccessRejected.DisabledRejected.PendingDeletionRejected.PendingImport
    UpdateRotationPolicySuccessRejected.DisabledRejected.PendingDeletionRejected.PendingImport
    UpdateKeyDescriptionSuccessSuccessRejected.PendingDeletionSuccess
    TagResourceSuccessSuccessRejected.PendingDeletionSuccess
    UntagResourceSuccessSuccessRejected.PendingDeletionSuccess
    EnableKeySuccessSuccessRejected.StateModifiedFailedRejected.StateModifiedFailed
    DisableKeySuccessSuccessRejected.StateModifiedFailedRejected.StateModifiedFailed
    ScheduleKeyDeletionSuccessSuccessRejected.StateModifiedFailedSuccess
    CancelKeyDeletionRejected.StateModifiedFailedRejected.StateModifiedFailedSuccessRejected.StateModifiedFailed
    CreateAliasSuccessSuccessRejected.StateModifiedFailedSuccess
    DeleteAliasSuccessSuccessSuccessSuccess
    ListAliasesSuccessSuccessSuccessSuccess
    ListKeysSuccessSuccessSuccessSuccess
    DescribeKeySuccessSuccessSuccessSuccess
    ListResourceTagsSuccessSuccessSuccessSuccess
    DescribeKeyVersionSuccessSuccessSuccessSuccess
    ListKeyVersionsSuccessSuccessSuccessSuccess
    CreateKeySuccessSuccessSuccessSuccess

    Special cases

    UpdateAlias — The result depends only on the state of the destination CMK, not the source CMK.

    • If the destination CMK is in the PendingDeletion state: Rejected.PendingDeletion

    • All other destination CMK states: Success

    BYOK-specific API operations

    API operationEnabledDisabledPendingDeletionPendingImport
    GetParametersForImportSuccessSuccessSuccessSuccess
    ImportKeyMaterialSuccessSuccessRejected.StateModifiedFailedSuccess
    DeleteKeyMaterialSuccessSuccessSuccessSuccess