All Products
Search

This Product

    Key Management Service:Impact of CMK status on API operations

    Document Center

    Key Management Service:Impact of CMK status on API operations

    Last Updated:Sep 18, 2026

    A customer master key (CMK) can be in one of the following states: Enabled, Disabled, or PendingDeletion. A CMK with imported key material (Bring Your Own Key, or BYOK) can also be in the PendingImport state.

    • In most cases, a newly created CMK starts in the Enabled state.

    • A newly created BYOK-based CMK starts in the PendingImport state. To check whether a CMK uses imported key material, call DescribeKey and verify that Origin is EXTERNAL.

    • Only CMKs in the Enabled state can perform cryptographic operations (encrypt data, decrypt data, or generate data keys).

    • A CMK in the PendingDeletion state is permanently deleted after the scheduled waiting period elapses.

    Each API call returns one of the following results:

    ResultHTTP status code
    Success200
    Rejected.Enabled409
    Rejected.Disabled409
    Rejected.PendingDeletion409
    Rejected.PendingImport409
    Rejected.StateModifiedFailed409

    Common API operations

    API operationEnabledDisabledPendingDeletionPendingImport
    CreateKeySuccessSuccessSuccessSuccess
    GenerateDataKeySuccessRejected.DisabledRejected.PendingDeletionRejected.PendingImport
    GenerateDataKeyWithoutPlaintextSuccessRejected.DisabledRejected.PendingDeletionRejected.PendingImport
    EncryptSuccessRejected.DisabledRejected.PendingDeletionRejected.PendingImport
    DecryptSuccessRejected.DisabledRejected.PendingDeletionRejected.PendingImport
    ListKeysSuccessSuccessSuccessSuccess
    DescribeKeySuccessSuccessSuccessSuccess
    UpdateKeyDescriptionSuccessSuccessRejected.PendingDeletionSuccess
    EnableKeySuccessSuccessRejected.StateModifiedFailedRejected.StateModifiedFailed
    DisableKeySuccessSuccessRejected.StateModifiedFailedRejected.StateModifiedFailed
    ScheduleKeyDeletionSuccessSuccessRejected.StateModifiedFailedSuccess
    CancelKeyDeletionRejected.StateModifiedFailedRejected.StateModifiedFailedSuccessRejected.StateModifiedFailed
    CreateAliasSuccessSuccessRejected.StateModifiedFailedSuccess
    DeleteAliasSuccessSuccessSuccessSuccess
    ListAliasesSuccessSuccessSuccessSuccess
    TagResourceSuccessSuccessRejected.PendingDeletionSuccess
    UntagResourceSuccessSuccessRejected.PendingDeletionSuccess
    ListResourceTagsSuccessSuccessSuccessSuccess
    DescribeKeyVersionSuccessSuccessSuccessSuccess
    ListKeyVersionsSuccessSuccessSuccessSuccess
    UpdateRotationPolicySuccessRejected.DisabledRejected.PendingDeletionRejected.PendingImport
    Note: CancelKeyDeletion succeeds only when the CMK is in the PendingDeletion state, because cancellation is only valid for keys already scheduled for deletion.

    Special API operations

    UpdateAlias — the result depends on the state of the destination CMK, not the source CMK.

    Destination CMK stateResult
    Any state except PendingDeletionSuccess
    PendingDeletionRejected.PendingDeletion

    BYOK-specific API operations

    These operations apply only to CMKs with imported key material (Origin = EXTERNAL).

    API operationEnabledDisabledPendingDeletionPendingImport
    GetParametersForImportSuccessSuccessSuccessSuccess
    ImportKeyMaterialSuccessSuccessRejected.StateModifiedFailedSuccess
    DeleteKeyMaterialSuccessSuccessSuccessSuccess