Integration

AWS KMS integration

AWS Key Management Service API for creating and managing cryptographic keys. Encrypt and decrypt data, generate data keys, manage key policies, rotate keys, and integrate envelope encryption with AWS services.

Connect AWS KMS How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in AWS KMS.Built from the 35 AWS KMS tools below, on the connection you add once.

Common AWS KMS use cases

automate key management
automate alias management
automate operation management
automate grant management
automate resource management
automate key deletion management
automate key rotation management
set key access policy
list key programmatically
retrieve key access policy

What you can do with AWS KMS

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Key, 5 operations

create_keyCreate keyPOSTCreates a unique customer managed KMS key in your AWS account and Region. You can use the key to encrypt and decrypt data, generate data keys, create aliases, and more.
describe_keyDescribe keyPOSTProvides detailed information about a KMS key including its creation date, key state, key spec, key usage, and key policy.
disable_keyDisable keyPOSTSets the key state of a KMS key to disabled. This prevents the KMS key from being used in cryptographic operations.
enable_keyEnable keyPOSTSets the key state of a KMS key to enabled. This allows you to use the KMS key for cryptographic operations.
list_keysList keysPOSTGets a list of all KMS keys in the caller's AWS account and Region.

Alias, 4 operations

create_aliasCreate aliasPOSTCreates a friendly name for a KMS key. Aliases must begin with alias/ followed by a name. They cannot begin with alias/aws/.
delete_aliasDelete aliasPOSTDeletes the specified alias. Deleting an alias does not delete the underlying KMS key.
list_aliasesList aliasesPOSTGets a list of aliases in the caller's AWS account and Region. You can filter by KMS key or list all aliases.
update_aliasUpdate aliasPOSTAssociates an existing AWS KMS alias with a different KMS key. Each alias is associated with only one KMS key at a time.

Operation, 4 operations

decryptDecryptPOSTDecrypts ciphertext that was encrypted by a KMS key using any of the following operations: Encrypt, GenerateDataKey, GenerateDataKeyPair, or GenerateDataKeyWithoutPlaintext.
encryptEncryptPOSTEncrypts plaintext of up to 4096 bytes using a KMS key. You can use a symmetric or asymmetric KMS key with a KeyUsage of ENCRYPT_DECRYPT.
signSignPOSTCreates a digital signature for a message or message digest by using the private key in an asymmetric signing KMS key.
verifyVerifyPOSTVerifies a digital signature that was generated by the Sign operation. Returns a Boolean value that indicates whether the signature is valid.

Grant, 3 operations

create_grantCreate grantPOSTAdds a grant to a KMS key. A grant is a policy instrument that allows AWS principals to use KMS keys in cryptographic operations.
list_grantsList grantsPOSTGets a list of all grants for the specified KMS key. You can filter the list by grant ID or grantee principal.
revoke_grantRevoke grantPOSTDeletes the specified grant. You can revoke a grant to actively deny operations that depend on it.

Key deletion, 2 operations

cancel_key_deletionCancel key deletionPOSTCancels the deletion of a KMS key. When this operation succeeds, the key state is Disabled.
schedule_key_deletionSchedule key deletionPOSTSchedules the deletion of a KMS key. By default the key is deleted after 30 days, but you can specify a waiting period of 7-30 days.

Key policy, 2 operations

get_key_policyGet key policyPOSTGets a key policy attached to the specified KMS key, returning the policy document in JSON format.
put_key_policyPut key policyPOSTAttaches or replaces a key policy on a KMS key to control access permissions.

Key rotation, 2 operations

disable_key_rotationDisable key rotationPOSTDisables automatic rotation of the key material of the specified symmetric encryption KMS key.
enable_key_rotationEnable key rotationPOSTEnables automatic rotation of the key material of the specified symmetric encryption KMS key. AWS KMS rotates the key material every year.

Mac, 2 operations

generate_macGenerate macPOSTGenerates an HMAC for a message using an HMAC KMS key. The resulting MAC can be verified with VerifyMac to prove message integrity.
verify_macVerify macPOSTVerifies an HMAC for a message using an HMAC KMS key. Returns a Boolean indicating whether the HMAC is valid.

Resource, 2 operations

tag_resourceTag resourcePOSTAdds or edits tags on a customer managed key. Tags are optional key-value pairs that can help you track the usage or purpose of a KMS key.
untag_resourceUntag resourcePOSTDeletes tags from a customer managed key. To delete a tag, specify the tag key and the KMS key.

Data key pair, 1 operation

generate_data_key_pair_without_plaintextGenerate data key pair without plaintextPOSTReturns a unique asymmetric data key pair for use outside of AWS KMS, returning a plaintext public key and an encrypted private key without the plaintext private key.

Generate data key, 1 operation

generate_data_keyGenerate data keyPOSTReturns a unique symmetric data key for use outside of AWS KMS. This operation returns a plaintext copy and an encrypted copy of the data key.

Generate data key pair, 1 operation

generate_data_key_pairGenerate data key pairPOSTReturns a unique asymmetric data key pair for use outside of AWS KMS. Returns both plaintext and encrypted private key plus the public key.

Generate data key without plaintext, 1 operation

generate_data_key_without_plaintextGenerate data key without plaintextPOSTReturns a unique symmetric data key in encrypted form. Unlike GenerateDataKey, this operation returns only the encrypted copy of the data key.

Generate random, 1 operation

generate_randomGenerate randomPOSTReturns a random byte string that is cryptographically secure. By default, the random byte string is generated in AWS KMS.

Key description, 1 operation

update_key_descriptionUpdate key descriptionPOSTUpdates the description of a KMS key. To see the description of a KMS key, use DescribeKey.

Key rotation status, 1 operation

get_key_rotation_statusGet key rotation statusPOSTGets a Boolean value that indicates whether automatic rotation of the key material is enabled for the specified KMS key.

Public key, 1 operation

get_public_keyGet public keyPOSTReturns the public key of an asymmetric KMS key for use outside of AWS KMS in encryption, signature verification, or key agreement.

Re encrypt, 1 operation

re_encryptRe encryptPOSTDecrypts ciphertext and then re-encrypts it entirely within AWS KMS. You can use this operation to change the KMS key under which data is encrypted.

Use AWS KMS from Claude Code, Cursor or Codex

Connect AWS KMS in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its AWS KMS operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect AWS KMS

Create your workspace
Sign up free. Nothing to install.
Connect AWS KMS once
Add your AWS KMS connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

AWS KMS integration FAQ

What can you do with the AWS KMS integration?

LiveContext exposes 35 operations on AWS KMS, covering key, alias, operation and grant. Common uses include automate key management, automate alias management and automate operation management.