import_key
Import externally generated keys into AWS Payment Cryptography using TR-31 key blocks or TR-34. Submit key material, KCV algorithm, and enablement flags, then verify Multi-Party Approval status before using the key.
Instructions
Call this to bring an externally generated key into APC via TR-31 key block or TR-34. The key_material dict structure depends on the import method.
IMPORTANT — this call does not always mean the key is imported. If the account has Multi-Party Approval associated with the import operation (see get_mpa_team_association), the response carries an MpaStatus with Status PENDING and the key is NOT yet usable. Approval by the MPA team has to land first. Treat a successful response as "submitted", not "done": check MpaStatus before using the key or reporting the import as complete, and poll get_key until the status clears. A response with no MpaStatus is an ordinary immediate import.
For TR-31 (wrapping an existing key): key_material = { "Tr31KeyBlock": { "WrappingKeyIdentifier": "", "WrappedKeyBlock": "" } }
For TR-34 (distributing a symmetric key using asymmetric techniques): key_material = { "Tr34KeyBlock": { "CertificateAuthorityPublicKeyIdentifier": "", "ImportToken": "", "KeyBlockFormat": "X9_TR34_2012", "WrappingKeyCertificate": "", "SigningKeyCertificate": "", "EncryptedKeyBlock": "" } }
Args: key_material: Import method and wrapped key material key_check_value_algorithm: CMAC, ANSI_X9_24, HMAC, or SHA_1. AES keys must use CMAC (ANSI_X9_24 is rejected here per PCI PIN Annex C); TDES may use either. HMAC keys use HMAC — the construction is fixed but the hash is the one bound to the key at creation, over a zero-length message, so reproducing the KCV outside APC requires knowing that hash. Asymmetric keys use SHA_1. enabled: Activate key immediately after import tags: Optional list of {Key, Value} tag dicts replication_regions: Optional list of regions to replicate the imported key into. Omit to use the account default (see get_default_key_replication_regions). requester_comment: Optional reason for the import, max 200 characters. Shown to Multi-Party Approval reviewers when the import is gated. Appears in CloudTrail in plaintext — no personal or sensitive data.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ||
| enabled | No | ||
| key_material | Yes | ||
| requester_comment | No | ||
| replication_regions | No | ||
| key_check_value_algorithm | No |