create_key
Create a new cryptographic key for AWS Payment Cryptography, specifying algorithm, TR-31 usage, key class, exportability, and KCV method. Ensures compliance for AES using CMAC.
Instructions
Call this when creating a new cryptographic key — BDK, ZPK, CVK, MAC key, KEK, etc. Call explain_key_usage first to confirm the right key usage code — APC keys are typed at creation and the type cannot change.
AES keys must use CMAC for KCV (not ANSI_X9_24). Enforced here.
Args: key_algorithm: AES_128, AES_256, TDES_3KEY, RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, etc. key_usage: TR-31 key usage code, e.g. TR31_P0_PIN_ENCRYPTION_KEY key_class: SYMMETRIC_KEY, ASYMMETRIC_KEY_PAIR, or PRIVATE_KEY exportable: Whether the key can be exported via TR-31 or TR-34 enabled: Whether the key is immediately active (default true) key_check_value_algorithm: CMAC, ANSI_X9_24, HMAC, or SHA_1. AES keys must use CMAC (ANSI_X9_24 is rejected here per PCI PIN Annex C); TDES may use either. HMAC keys use HMAC — the construction is fixed but the hash is the one bound to the key at creation, over a zero-length message, so reproducing the KCV outside APC requires knowing that hash. Asymmetric keys use SHA_1. tags: Optional list of {Key, Value} tag dicts derive_key_usage: For a BDK (B0) only — the TR-31 usage the derived DUKPT working keys will carry, e.g. TR31_P0_PIN_ENCRYPTION_KEY. APC binds this at creation, so a BDK created without it cannot later derive keys of that usage. replication_regions: Optional list of regions to replicate this key into, e.g. ["us-west-2", "eu-west-1"]. Omit to use the account default (see get_default_key_replication_regions). Replication is a property of the key, so set it here or via add_key_replication_regions afterwards.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ||
| enabled | No | ||
| key_class | Yes | ||
| key_usage | Yes | ||
| exportable | Yes | ||
| key_algorithm | Yes | ||
| derive_key_usage | No | ||
| replication_regions | No | ||
| key_check_value_algorithm | No |