---
id: aws-cdk-aws-kms
version: "1.204.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# aws-cdk.aws-kms — The CDK Construct Library for AWS::KMS

License: permissive · Maintenance: active · Downloads: 184.0K/mo

## What it is and what it does

This is the AWS CDK Construct Library for KMS, a Python module that lets you define AWS Key Management Service keys, aliases, and access policies using infrastructure-as-code. It wraps KMS API operations into high-level constructs so you can create encryption keys, set rotation policies, manage aliases, and control key access through IAM and key policies—all declaratively within your CDK application.

The package depends on aws-cdk.core, aws-cdk.aws-iam, constructs, jsii, and several other CDK modules. It is classified as Inactive (Development Status 7) because AWS CDK v1 reached End-of-Support on 2023-06-01; the package is no longer being updated, and AWS recommends migrating to AWS CDK v2 for ongoing support and new features.

Use it for:

- Define and provision KMS keys with rotation enabled as part of an AWS CDK stack deployment.
- Create KMS key aliases and manage key policies to control which IAM principals can encrypt, decrypt, or administer keys.
- Share KMS keys between multiple CDK stacks by passing key constructs across stack boundaries.
- Import existing KMS keys (by ARN or alias) into a CDK application to reference them in other constructs without recreating them.
- Specify key spec and key usage (e.g., ECC_SECG_P256K1 for signing) when creating keys with non-default cryptographic properties.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides AWS CDK constructs for defining and managing AWS Key Management Service (KMS) keys, aliases, and key policies in infrastructure-as-code.

No—do not install for new projects. This package is end-of-support as of 2023-06-01 and classified as Inactive. AWS CDK v2 is the current supported version and should be used instead. Only consider installing if you are maintaining an existing v1 CDK application that cannot yet migrate, and understand that you will not receive updates or security patches.

## Install

pip install aws-cdk-aws-kms
uv add aws-cdk-aws-kms
poetry add aws-cdk-aws-kms

## Installing aws-cdk.aws-kms

Before you install: Low friction install with 8 runtime dependencies. Active repository with recent commits, but package is classified as Inactive (Development Status 7) and reached End-of-Support on 2023-06-01; users should migrate to AWS CDK v2.

License in practice: Licensed under Apache-2.0 (permissive), allowing commercial use, modification, and distribution with minimal restrictions.

Quickstart:

pip install aws-cdk.aws-kms

import aws_cdk as cdk
from aws_cdk import aws_kms as kms

class MyStack(cdk.Stack):
    def __init__(self, scope, id, **kwargs):
        super().__init__(scope, id, **kwargs)
        key = kms.Key(self, "MyKey", enable_key_rotation=True)
        key.add_alias("alias/my-key")

Requires AWS CDK v1 runtime; this package is end-of-support as of 2023-06-01 and AWS CDK v2 is the current supported version.

Verify before relying:

- Whether existing v1 projects can safely remain on this package or if migration to v2 is mandatory for security/stability.
- Performance characteristics or limits when managing large numbers of KMS keys or aliases through CDK constructs.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 184.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

AWS KMS key management CDK, KMS construct library Python, AWS CDK encryption key, KMS key policy automation, infrastructure as code KMS, AWS CDK key rotation, KMS alias management, aws-cdk, end-of-support, infrastructure-as-code

[View on SkillFed](https://skillfed.io/packages/aws-cdk-aws-kms) · [View on PyPI](https://pypi.org/project/aws-cdk-aws-kms/)