[ aws . kms ]

list-resource-tags

Description

Returns all tags on the specified KMS key.

For general information about tags, including the format and syntax, see Tagging Amazon Web Services resources in the Amazon Web Services General Reference . For information about using tags in KMS, see Tagging keys .

Cross-account use : No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.

Required permissions : kms:ListResourceTags (key policy)

Related operations:

• CreateKey

• ReplicateKey

• TagResource

• UntagResource

See also: AWS API Documentation

See ‘aws help’ for descriptions of global parameters.

Synopsis

  list-resource-tags
--key-id <value>
[--limit <value>]
[--marker <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]

Options

--key-id (string)

Gets tags on the specified KMS key.

Specify the key ID or key ARN of the KMS key.

For example:

• Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab

• Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey .

--limit (integer)

Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.

This value is optional. If you include a value, it must be between 1 and 50, inclusive. If you do not include a value, it defaults to 50.

--marker (string)

Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of NextMarker from the truncated response you just received.

Do not attempt to construct this value. Use only the value of NextMarker from the truncated response you just received.

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

See ‘aws help’ for descriptions of global parameters.

Examples

To get the tags on an AWS KMS CMK

The following list-resource-tags example gets the tags for a CMK. To add or replace resource tags on CMKs, use the tag-resource command. The output shows that this CMK has two resource tags, each of which is comprised of a key and value.

To specify the CMK, use the key-id parameter. This example uses a key ID value, but you can use a key ID or key ARN in this command.

aws kms list-resource-tags \
    --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

Output:

{
    "Tags": [
    {
        "TagKey": "Dept",
        "TagValue": "IT"
    },
    {
        "TagKey": "Purpose",
        "TagValue": "Test"
    }
    ],
    "Truncated": false
}

For more information about using tags in AWS KMS, see Tagging Keys in the AWS Key Management Service Developer Guide.

Output

Tags -> (list)

A list of tags. Each tag consists of a tag key and a tag value.

Note

Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see Using ABAC in KMS in the Key Management Service Developer Guide .

(structure)

A key-value pair. A tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.

For information about the rules that apply to tag keys and tag values, see User-Defined Tag Restrictions in the Amazon Web Services Billing and Cost Management User Guide .

TagKey -> (string)

The key of the tag.

TagValue -> (string)

The value of the tag.

NextMarker -> (string)

When Truncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent request.

Do not assume or infer any information from this value.

Truncated -> (boolean)

A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the NextMarker element in thisresponse to the Marker parameter in a subsequent request.