How to get External KMS Keys using BOTO3?

Question

I am writing a python script which will iterate through the AWS accounts and fetch all Encryption key details.
In BOTO3 i can see only AWS_KMS key api.
My question is how can I fetch information of the Imported Keys from external KMS using BOTO3?

Niko · Accepted Answer

To double down on what Alatech said , u can use this as a sample code(I quickly typed in my editor so please take this as your starting point  )

```
import boto3

# create an instance of the boto3 KMS client
kms_client = boto3.client('kms')

# call the list_keys() method to fetch all the external keys
response = kms_client.list_keys()

# extract the external key ids from the response
key_ids = [key['KeyId'] for key in response['Keys'] if not key['Origin'] == 'AWS_KMS']

# print the external key ids
print(key_ids)
```

Antonio_Lagrotteria · Answer

Hi,

you can try using https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/kms/client/describe_key.html which contains an Origin field containing information about a key being external: 'Origin': 'AWS_KMS'|'EXTERNAL'|'AWS_CLOUDHSM'|'EXTERNAL_KEY_STORE'.

See below example:

```
import boto3
kms_client = boto3.client('kms')
keyList = kms_client.list_keys()

for key in keyList['Keys']:
    key_id = key['KeyId']
    info = kms_client.describe_key(KeyId=key_id)
    
    if info['KeyMetadata']['Origin'] == 'EXTERNAL':
        print('Do your magic’)
```

Hope it helps.

How to get External KMS Keys using BOTO3?

Relevant content