本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 密钥类型引用
<a name="symm-asymm-compare"></a>

AWS KMS 支持不同*类型*的 KMS 密钥的不同功能。例如，只能使用[对称加密 KMS 密钥](symm-asymm-choose-key-spec.md#symmetric-cmks)来[生成对称数据密钥](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html)和[非对称数据密钥对](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairs.html)。此外，仅对称加密 KMS 密钥支持[导入密钥材料](importing-keys.md)和[自动密钥轮换](rotate-keys.md)，并且在[自定义密钥存储](key-store-overview.md#custom-key-store-overview)中只能创建对称加密 KMS 密钥。

此参考包括两个表。
+ [密钥类型表](#key-type-table)列出了对称加密 KMS 密钥、非对称 KMS 密钥和 HMAC KMS 密钥有效的 AWS KMS 操作。
+ [特殊功能表](#special-features-table)列出了对多区域 KMS 密钥、包含导入的密钥材料的 KMS 密钥，以及自定义密钥存储中的 KMS 密钥有效的 AWS KMS 操作。

## 密钥类型表
<a name="key-type-table"></a>

您可能需要水平或垂直滚动才能查看此表中的所有数据。


| AWS KMS API 操作 | 对称加密 KMS 密钥 | HMAC KMS 密钥 | 非对称 KMS 密钥 (ENCRYPT\$1DECRYPT) | 非对称 KMS 密钥 (SIGN\$1VERIFY) | 非对称 KMS 密钥（KEY\$1AGREEMENT） | 
| --- | --- | --- | --- | --- | --- | 
|  [CancelKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html)  |  支持  | 是 |  是  | 是 | 是 | 
|  [CreateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html)  | 是 | 是 | 是 | 是 | 是 | 
|  [CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html)  |  是  | 是 |  是  | 是 | 是 | 
| [CreateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html) |  是  | 是 |  是  |  是  | 是 | 
|  [Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html)  |  是  | 否 |  是  | 否 | 否 | 
|  [DeleteAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html) 仅在包含导入的密钥材料的 KMS 密钥上有效（`Origin` 为 `EXTERNAL`）。  |  支持  | 是 | 是 | 是 | 是 | 
|  [DeriveSharedSecret](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeriveSharedSecret.html)  | 否 | 否 | 否 | 否 | 是 | 
|  [DescribeKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [DisableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html)  |  是 仅对带有密钥材料 (is`AWS_KMS`) `Origin` 的 KMS 密 AWS KMS 钥有效。  | 否 |  否  | 否 | 否 | 
|  [EnableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [EnableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html)  |  是 仅对带有密钥材料 (is`AWS_KMS`) `Origin` 的 KMS 密 AWS KMS 钥有效。  | 否 |  否  | 否 | 否 | 
|  [Encrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html)  |  是  | 否 |  是  | 否 | 否 | 
|  [GenerateDataKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html)  |  是   | 否 |  否  | 否 | 否 | 
|  [GenerateDataKeyPair](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html) 生成受对称加密 KMS 密钥保护的非对称数据密钥对。  | 是 在自定义密钥存储中的 KMS 密钥上无效。 | 否 |  否  | 否 | 否 | 
|  [GenerateDataKeyPairWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html) 生成受对称加密 KMS 密钥保护的非对称数据密钥对。  |  是  在自定义密钥存储中的 KMS 密钥上无效。  | 否 |  否  | 否 | 否 | 
|  [GenerateDataKeyWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html)  |  是  | 否 |  否  | 否 | 否 | 
| [GenerateMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateMac.html) | 否 | 是 | 否 | 否 | 否 | 
|  [GetKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [GetKeyRotationStatus](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html)  |  是  |  是 （`KeyRotationEnabled` 将始终为 `false`。）  |  是 （`KeyRotationEnabled` 将始终为 `false`。）  |  是 （`KeyRotationEnabled` 将始终为 `false`。）  |  是 （`KeyRotationEnabled` 将始终为 `false`。）  | 
|  [GetParametersForImport](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html) 仅在包含导入的密钥材料的 KMS 密钥上有效（`Origin` 为 `EXTERNAL`）。  |  支持  | 是 |  是  | 是 | 是 | 
|  [GetPublicKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html)  |  否  | 否 |  是  | 是 | 是 | 
|  [ImportKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html) 仅在包含导入的密钥材料的 KMS 密钥上有效（`Origin` 为 `EXTERNAL`）。  |  支持  | 是 |  是  | 是 | 是 | 
|  [ListAliases](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [ListGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [ListKeyPolicies](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html)  | 是 | 是 （`Rotations` 字段将始终为 null 或空。） | 是 （`Rotations` 字段将始终为 null 或空。） | 是 （`Rotations` 字段将始终为 null 或空。） | 是 （`Rotations` 字段将始终为 null 或空。） | 
|  [ListResourceTags](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html)  |  支持  | 是 |  是  | 是 | 是 | 
|  [ListRetirableGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [PutKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [ReEncrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html)  |  是  | 否 |  是  | 否 | 否 | 
|  [ReplicateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html) - 仅在多区域密钥上有效  |  支持  | 是 |  是  |  是  | 是 | 
|  [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html)  |  是  | 是 |  是  |  是  | 是 | 
|  [RevokeGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html)  | 是 仅对来源为 `AWS_KMS` 或 `EXTERNAL` 的客户自主管理型对称加密 KMS 密钥有效。 | 否 | 否 | 否 | 否 | 
|  [ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [Sign](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html)  |  否  | 否 |  否  | 是 | 否 | 
|  [TagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [UntagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [UpdateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html) 当前 KMS 密钥和新的 KMS 密钥必须为相同类型（要么都是对称的，要么都是非对称的，要么都是 HMAC），并且它们必须用于相同的[密钥用途](create-keys.md#key-usage)。  | 支持 | 是 |  是  | 是 | 是 | 
|  [UpdateKeyDescription](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html)  |  是  | 是 |  是  | 是 | 是 | 
|  [UpdateReplicaRegion](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateReplicaRegion.html) - 仅在多区域密钥上有效  |  支持  | 是 |  是  |  是  | 是 | 
|  [Verify](https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html)  |  否  | 否 |  否  | 是 | 否 | 
| [VerifyMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_VerifyMac.html) | 否 | 是 | 否 | 否 | 否 | 

## 特殊功能表
<a name="special-features-table"></a>

下表显示了每种类型的*特殊用途密钥*支持的 AWS KMS API 操作。

在阅读此表时，请注意以下交互：
+ [多区域密钥](multi-region-keys-overview.md)：
  + 多区域密钥可以是对称加密 KMS 密钥、非对称 KMS 密钥、HMAC KMS 密钥，以及包含导入的密钥材料的 KMS 密钥。
  + 您不能在自定义密钥存储中创建多区域密钥。
+ [导入的密钥材料](importing-keys.md)
  + 您可以导入对称加密 KMS 密钥、非对称 KMS 密钥和 HMAC KMS 密钥的密钥材料。
  + 您可创建[具有导入密钥材料的多区域密钥](multi-region-keys-overview.md)。
  + 您不能在自定义密钥存储中使用导入的密钥材料创建密钥。
  + 带有导入密钥材料的 KMS 密钥不支持自动密钥轮换 (`EnableKeyRotation`、`DisableKeyRotation`)。
  + 使用导入的密钥材料对称加密 KMS 密钥支持按需密钥轮换 (`RotateKeyOnDemand`)。
+ [自定义密钥存储](key-store-overview.md#custom-key-store-overview)
  + 自定义密钥存储仅支持对称加密 KMS 密钥。
  + 自定义密钥存储中的 KMS 密钥不支持对非对称密钥对（`GenerateDataKeyPair`、`GenerateDataKeyPairWithoutPlaintext`）进行对称操作。
  + 自定义密钥存储中的 KMS 密钥不支持自动密钥转换 (`EnableKeyRotation`、`DisableKeyRotation`)。
  + 您不能在自定义密钥存储中创建多区域密钥。

您可能需要水平或垂直滚动才能查看此表中的所有数据。


| AWS KMS API 操作 | 多区域密钥 | 导入的密钥材料 | 自定义密钥存储中的 KMS 密钥 | 
| --- | --- | --- | --- | 
|  [CancelKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [CreateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) | 
|  [CreateGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
| [ CreateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html) 您可以使用 `CreateKey` 创建多区域主键、包含导入的密钥材料的 KMS 密钥，或自定义密钥存储中的 KMS 密钥。若要创建多区域副本密钥，请使用 `ReplicateKey`。 | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) | 
|  [Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  仅当 `KeyUsage` 为 `ENCRYPT_DECRYPT` 时才有效  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [DeleteAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [DeleteImportedKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅对包含导入的密钥材料的密钥有效（`Origin` 为 `EXTERNAL`）  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) | ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png) | 
|  [DeriveSharedSecret](https://docs.aws.amazon.com/kms/latest/APIReference/API_DeriveSharedSecret.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅在 `KeyUsage` 为 `KEY_AGREEMENT` 时有效）  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅在 `KeyUsage` 为 `KEY_AGREEMENT` 时有效）  |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [DescribeKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [DisableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [DisableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅对带有密钥材料 (`Origin`is`AWS_KMS`) 的对称加密密 AWS KMS 钥有效。  | ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [EnableKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅在对称加密 KMS 密钥上有效  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [EnableKeyRotation](https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅对带有密钥材料 (`Origin`is`AWS_KMS`) 的对称加密密 AWS KMS 钥有效。  | ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [Encrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅当 `KeyUsage` 为 `ENCRYPT_DECRYPT` 时才有效  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [GenerateDataKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  仅在对称加密 KMS 密钥上有效  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [GenerateDataKeyPair](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅在对称加密 KMS 密钥上有效  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [GenerateDataKeyPairWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅在对称加密 KMS 密钥上有效  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [GenerateDataKeyWithoutPlaintext](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅在对称加密 KMS 密钥上有效  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
| [GenerateMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateMac.html)仅在 HMAC KMS 密钥上有效 |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png) | 
|  [GetKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [GetKeyRotationStatus](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) （`KeyRotationEnabled` 将始终为 `false`。）  |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [GetParametersForImport](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅对包含已导入的密钥材料的密钥有效（`Origin` 为 `EXTERNAL`）。  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [GetPublicKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html) 仅对[非对称 KMS 密钥](symmetric-asymmetric.md)有效。  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [ImportKeyMaterial](https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅对包含已导入的密钥材料的密钥有效（`Origin` 为 `EXTERNAL`）。  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [ListAliases](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ListGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ListKeyPolicies](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ListKeyRotations](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅对`EXTERNAL`源自`AWS_KMS`或的对称加密密钥有效。  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅对对称加密密钥有效。  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ListResourceTags](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ListRetirableGrants](https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [PutKeyPolicy](https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ReEncrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅当 `KeyUsage` 为 `ENCRYPT_DECRYPT` 时才有效  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [ReplicateKey](https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅在多区域主键上有效。  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅在多区域主键上有效。  |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [RevokeGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [RotateKeyOnDemand](https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅对`EXTERNAL`源自`AWS_KMS`或的对称加密密钥有效。  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅对对称加密密钥有效。  |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [ScheduleKeyDeletion](https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [Sign](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html) 仅当 `KeyUsage` 为 `SIGN_VERIFY` 时才有效。  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [TagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [UntagResource](https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [UpdateAlias](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html) – 当前 KMS 密钥和新的 KMS 密钥必须为相同类型（要么都是对称的，要么都是非对称的，要么都是 HMAC），并且它们必须用于相同的[密钥用途](create-keys.md#key-usage)。  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [UpdateKeyDescription](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | 
|  [UpdateReplicaRegion](https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateReplicaRegion.html)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) 仅在多区域密钥上有效。  |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
|  [Verify](https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html) 仅当 `KeyUsage` 为 `SIGN_VERIFY` 时才有效。  |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) |  ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png)  | 
| [VerifyMac](https://docs.aws.amazon.com/kms/latest/APIReference/API_VerifyMac.html) 仅在 HMAC KMS 密钥上有效 |  ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png)  | ![\[Green checkmark icon indicating success or completion.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-successful.png) | ![\[Red circle with diagonal line, commonly used to indicate prohibition or "no" symbol.\]](http://docs.aws.amazon.com/zh_cn/kms/latest/developerguide/images/icon-failed.png) |