Skip to main content

ReEncrypt

Decrypts ciphertext and then re-encrypts it entirely within QKMS.

Description​

The `ReEncrypt` operation decrypts ciphertext and then re-encrypts it entirely within QKMS. You can use this operation to change the KMS key under which data is encrypted, such as when you want to manually rotate a key or move encrypted data from one region to another.

note
  • The source and destination KMS keys must be symmetric encryption KMS keys.
  • The source and destination KMS keys must be enabled.
  • The ciphertext and the destination KMS key must be in the same region.
  • The operation never exposes the plaintext data outside of QKMS.
  • You can use different encryption contexts for encryption and decryption.

Request Syntax​

Headers​

NameDescriptionRequiredType
Content-TypeMust be "application/x-amz-json-1.1"Yesstring
X-Amz-TargetMust be "TrentService.ReEncrypt"Yesstring

Request Body​

NameDescriptionRequiredType
CiphertextBlobThe ciphertext of the data to re-encrypt.Yesblob
SourceKeyIdSpecifies the KMS key that was used to encrypt the ciphertext. This can be the key ID or key ARN of the KMS key.Nostring
DestinationKeyIdSpecifies the KMS key that will be used to re-encrypt the data. This can be the key ID or key ARN of the KMS key.Yesstring
SourceEncryptionContextSpecifies the encryption context to use when decrypting the data. Must match the encryption context used when the data was encrypted.Noobject
DestinationEncryptionContextSpecifies the encryption context to use when re-encrypting the data.Noobject
SourceEncryptionAlgorithmThe encryption algorithm that was used to encrypt the ciphertext.Nostring
DestinationEncryptionAlgorithmThe encryption algorithm that will be used to re-encrypt the data.Nostring
GrantTokensA list of grant tokens that represent grants that can be used to decrypt the ciphertext and re-encrypt it with the destination KMS key.Noarray
POST / HTTP/1.1
Content-Type: application/x-amz-json-1.1
X-Amz-Target: TrentService.ReEncrypt
{ "CiphertextBlob": "AQICAHiWj6qDgGqSQXkNHcsbq8Q3+q6lThTZqXXRRXYtGhEQXwEH5qV5eN9LQI6CtDwBUvNVAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM6v4DhjrVUqgdqVEuAgEQgDsgli8KqqW4qp0g9ZWnHdRGYc3ZJzpV3xH9qVGFRwzVVKJNK/Ey/fGS2tl4TOQXLcTYJMEOxR8gPjA=", "SourceKeyId": "1234abcd-12ab-34cd-56ef-1234567890ab", "DestinationKeyId": "0987dcba-09fe-87dc-65ba-ab0987654321", "SourceEncryptionContext": { "Department": "Finance" }, "DestinationEncryptionContext": { "Purpose": "Test" }, "SourceEncryptionAlgorithm": "SYMMETRIC_DEFAULT", "DestinationEncryptionAlgorithm": "SYMMETRIC_DEFAULT", "GrantTokens": [ "AQpAM2RhZTk1MGMyNTk2ZmZmMzEyYWVhOWViN2I1MWM4Mzc0MWFiYjc0ZDE1ODkyNGFlNTIzODZhMzgyZjBlNDkxOAF4" ] }
Values in italics indicate user input and should be replaced with actual values.

Response Elements​

NameDescriptionRequiredType
CiphertextBlobThe re-encrypted data.NoString
SourceKeyIdThe Amazon Resource Name (ARN) of the KMS key that was used to decrypt the data.NoString
KeyIdThe Amazon Resource Name (ARN) of the KMS key that was used to re-encrypt the data.NoString
SourceEncryptionAlgorithmThe encryption algorithm that was used to decrypt the ciphertext.NoString
DestinationEncryptionAlgorithmThe encryption algorithm that was used to re-encrypt the data.NoString

Examples​

Example 1: Re-encrypt data with a new KMS key​

POST / HTTP/1.1
Content-Type: application/x-amz-json-1.1
X-Amz-Target: TrentService.ReEncrypt
{ "CiphertextBlob": "AQICAHiWj6qDgGqSQXkNHcsbq8Q3+q6lThTZqXXRRXYtGhEQXwEH5qV5eN9LQI6CtDwBUvNVAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM6v4DhjrVUqgdqVEuAgEQgDsgli8KqqW4qp0g9ZWnHdRGYc3ZJzpV3xH9qVGFRwzVVKJNK/Ey/fGS2tl4TOQXLcTYJMEOxR8gPjA=", "SourceKeyId": "1234abcd-12ab-34cd-56ef-1234567890ab", "DestinationKeyId": "0987dcba-09fe-87dc-65ba-ab0987654321", "SourceEncryptionContext": { "Department": "Finance" }, "DestinationEncryptionContext": { "Purpose": "Test" } }
Values in italics indicate user input and should be replaced with actual values.
HTTP/1.1 200 OK
Content-Type: application/x-amz-json-1.1
{ "CiphertextBlob": "AQICAHiWj6qDgGqSQXkNHcsbq8Q3+q6lThTZqXXRRXYtGhEQXwEH5qV5eN9LQI6CtDwBUvNVAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM6v4DhjrVUqgdqVEuAgEQgDsgli8KqqW4qp0g9ZWnHdRGYc3ZJzpV3xH9qVGFRwzVVKJNK/Ey/fGS2tl4TOQXLcTYJMEOxR8gPjA=", "SourceKeyId": "arn:verenc:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", "KeyId": "arn:verenc:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321", "SourceEncryptionAlgorithm": "SYMMETRIC_DEFAULT", "DestinationEncryptionAlgorithm": "SYMMETRIC_DEFAULT" }
Values in italics indicate variable response values.

Special Errors​

Error CodeDescription
DependencyTimeoutExceptionThe system timed out while trying to fulfill the request.
DisabledExceptionThe request was rejected because the specified KMS key is disabled.
InvalidCiphertextExceptionThe request was rejected because the specified ciphertext has been corrupted or is otherwise invalid.
InvalidGrantTokenExceptionThe request was rejected because the specified grant token is not valid.
InvalidKeyUsageExceptionThe request was rejected because the specified KeyId value cannot be used for this operation.
KeyUnavailableExceptionThe request was rejected because the specified KMS key was not available.
KMSInternalExceptionAn internal error occurred.
KMSInvalidStateExceptionThe request was rejected because the key state is not valid for this operation.
NotFoundExceptionThe request was rejected because the specified entity or resource could not be found.

Permissions​

To use the `ReEncrypt` operation, you must have the following permissions:

  • `kms:ReEncryptFrom` on the source KMS key (specified in the policy)
  • `kms:ReEncryptTo` on the destination KMS key (specified in the policy)

Try It Out​

Test ReEncrypt

Re-encrypt data with a new KMS key.

Coming Soon

This feature is currently under development and will be available soon.