Key Management Service (KMS) integrates with ActionTrail and Simple Log Service to record events that occur when your keys and secrets are used. You can use these records for troubleshooting, security monitoring, and auditing. This topic describes how to query the usage records of your keys and secrets.
Background information
Events for keys and secrets are categorized into two types: management operation and cryptographic operation. A management operation includes creating or deleting a key, creating or deleting a secret, and modifying a key alias. A cryptographic operation includes using a key for encryption or decryption and retrieving the value of a secret. The method to query these events varies based on the type of event and your use case.
Keys and secrets in a KMS instance
Resource type | Event type | Query method |
Key | Management operation | ActionTrail |
Cryptographic operation |
| |
Secret | Management operation | ActionTrail |
Cryptographic operation (retrieving a secret value) |
|
Non-instance keys and secrets
Keys not in a KMS instance are called default keys. Older KMS versions allowed users to create secrets without a purchased KMS instance. This feature is no longer supported.
Resource type | Event type | Query method |
Key | Management operation | ActionTrail |
Cryptographic operation | ActionTrail | |
Secret | Management operation | ActionTrail |
Cryptographic operation (retrieving a secret value) | ActionTrail or Simple Log Service Note You can retrieve the secret value only through a KMS service endpoint. |
Usage notes
When you query events related to keys, you can use ActionTrail to query event records for keys in all states. However, Simple Log Service can query event records only for keys that are in the enabled state.
Query events by using ActionTrail
You can query events on the Event Query and Advanced Query pages of the ActionTrail console. For a list of auditable events in Key Management Service, see Auditable events for Key Management Service.
Event Query: Allows you to query events from the last 90 days. This feature is provided by ActionTrail at no additional cost.
Advanced Event Query: You must first create a trail and deliver events to Simple Log Service (SLS). You can query only events that occurred after you created the trail. For more information, see Overview of single-account trails and Overview of multi-account trails. To query events from the 90 days before the trail was created, see Create a historical event delivery task.
NoteYou are charged for storing events in SLS when you create a trail to deliver events to SLS.
Method 1: Use the Event Query page
Log on to the ActionTrail console.
In the left-side navigation pane, click .
Select Resource Name, enter the key or secret ID, select a time range, and then click the
icon.Find the target event and click View Event Details in the Actions column.
Method 2: Use the Advanced Event Query page
Log on to the ActionTrail console.
In the left-side navigation pane, click Events > Advanced Event Query.
Select a trail name, turn off Simple Mode in the upper-right corner, and enter a query statement.
You can use the following sample query statements:
Query events for a specific key:
* AND (event.serviceName: "Kms") AND (event.eventRW: "Read") AND "key-szz63dc8c429ermur****". Replacekey-szz63dc8c429ermur****with the actual key ID.Query events for a disabled key:
* AND (event.serviceName: "Kms") AND (event.errorCode:"Rejected.Disabled").Query events for a key in the Pending Deletion state:
* AND (event.serviceName: "Kms") AND (event.errorCode:"Rejected.PendingDeletion").Query events for keys in an expired instance:
* AND (event.serviceName: "Kms") AND (event.errorCode:"Rejected.Unavailable").NoteFor more error codes related to key states, see Common error codes.
Query events for a specific secret:
* AND (event.serviceName: "Kms") AND (event.eventName: "GetSecretValue") AND "SecretName". ReplaceSecretNamewith the actual secret name.
Find the target event and click View Event Details in the Actions column.
Query events by using Simple Log Service
Log on to the KMS console. In the top navigation bar, select a region. In the left-side navigation pane, click .
On the Simple Log Service for KMS page, select an instance ID, and enter the key ID or secret ID in the Key/Secret ID field.
Set a time range and click Search & Analyze.
NoteLogs are retained for 180 days. Logs older than 180 days are deleted. You can query data only from the last 180 days.
Query results may differ from the specified time range by up to 1 minute.
These query and analysis operations are free of charge.