// file included in the following:
//
// assembly-aws-kms.adoc

[id='con-aws-kms-key-creation-{context}']
= Creating AWS KMS keys

As the administrator, use either the AWS Console or CLI to
{aws}/kms/latest/developerguide/create-keys.html#create-symmetric-cmk[create] a *Symmetric key* with *Encrypt and decrypt*
usage.  
Multi-region keys are supported.  

NOTE: It is not possible to make use of keys from other AWS accounts. For more information on this limitation, see the issue for link:https://github.com/kroxylicious/kroxylicious/issues/1217[AWS KMS serde improvements^].

Give the key an alias as described in xref:con-aws-kms-setup-{context}[].

If using the CLI, this can be done with commands like this:

[source,shell]
----
KEY_ALIAS="KEK_<name>"
KEY_ID=$(aws kms create-key | jq -r '.KeyMetadata.KeyId')
# the create key command will produce JSON output including the KeyId
aws kms create-alias --alias-name alias/${KEY_ALIAS} --target-key-id ${KEY_ID}
----

Once the key is created, it is recommended to use a key rotation policy.

[source,shell]
----
aws kms enable-key-rotation --key-id ${KEY_ID} --rotation-period-in-days 180
----


