AWS KMS
Identity & SecurityEncrypt, decrypt, and sign data with AWS Key Management Service. Agents protect small payloads, generate data keys for envelope encryption, produce digital signatures with asymmetric keys, and list, describe, and create KMS keys, all via native SigV4 signing.
What This Integration Enables
Most automation platforms treat encryption as something that happens around the workflow: TLS on the wire, encryption at rest, and plaintext everywhere in between. AWS KMS as a FlowRunner connector puts cryptography inside the workflow, as a step. An agent that receives a credential can seal it before storing it. An agent that assembles a payload can sign it before releasing it. The key material itself stays inside KMS, which means the agent exercises the key without ever possessing it, and every use lands in your AWS audit trail. - Encrypt and decrypt secrets, tokens, and configuration values up to 4,096 bytes inline - Generate data keys for envelope encryption of larger payloads client-side - Produce digital signatures with asymmetric keys for payloads that must be verifiable - Inventory and inspect keys on a schedule to catch disabled or misconfigured keys early - Provision new symmetric, asymmetric, or HMAC keys as part of governed workflows
Without FlowRunner
With FlowRunner
Use Case Scenarios
Credentials that are never stored naked
An onboarding flow creates an access key for a new service account in AWS IAM. Before the secret touches any storage, the agent calls Encrypt under the credentials KMS key and persists only the CiphertextBlob. When a downstream workflow needs the credential, it calls Decrypt, uses the plaintext for exactly one request, and discards it. The secret exists in plaintext only inside a running execution, never at rest, and every Decrypt call is attributable in the audit log.
Envelope encryption for the document archive
A workflow archives signed contracts to [Wasabi](/integrations/wasabi). For each document, the agent calls Generate Data Key, encrypts the file client-side with the plaintext key, discards that key, and stores the encrypted document alongside its CiphertextBlob. Retrieval reverses it: Decrypt recovers the data key, the document is decrypted, the key is discarded again. The archive provider holds ciphertext it cannot read, and the ability to decrypt the entire archive reduces to access to one KMS key you control.
The key estate audit that runs weekly
On a schedule, the agent pages through List Keys and calls Describe Key on each result, building a picture of the key estate: key state, spec, usage, supported algorithms. Keys that are disabled or pending deletion get flagged to the security channel in [Slack](/integrations/slack) with their dependent workflows named, and the full inventory lands in [Google Sheets](/integrations/google-sheets) for the compliance file. The question "what keys do we have and what state are they in" gets a standing answer instead of a quarterly scramble.
Human-in-Loop Highlight
Sign is the operation to respect. A signature produced with your asymmetric key is your organization's cryptographic word: the partner who verifies it will act on the payload, move the money, accept the batch. Once the signed artifact is delivered, it cannot be recalled or unsigned. So FlowRunner agents do everything up to the signature, assemble the manifest, reconcile the totals, verify the key with Describe Key, and then stop. The release decision reads: "Settlement manifest for July 28, 1,204 records, totals reconciled against ledger. Sign and deliver?" A finance lead answers, and only then does Sign run. The [human-in-the-loop](/concepts/human-in-the-loop) gate sits exactly where your organization commits.
Agent Capabilities
7 actionsKey Inventory
2- List Keys Lists the KMS keys in the configured account and Region with each key's ID and ARN. Paginated with Limit and Marker for estates of any size. The starting point for audits.
- Describe Key Retrieves a key's full metadata: ARN, creation date, key state, key spec, key usage, and supported algorithms. The preflight check before any encrypt, decrypt, or sign operation.
Encryption
3- Encrypt Encrypts up to 4,096 bytes of Base64-encoded plaintext under a KMS key and returns the CiphertextBlob. The right tool for secrets, tokens, and configuration values.
- Decrypt Recovers plaintext from a CiphertextBlob. Symmetric keys are identified automatically; asymmetric keys require the Key ID. Every call is an auditable use of the key.
- Generate Data Key Returns a fresh symmetric data key twice: as plaintext for immediate client-side use, and encrypted under the KMS key for storage. The primitive behind envelope encryption of payloads larger than the direct limit.
Signing and Provisioning
2- Sign Creates a digital signature over a message or precomputed digest using the private half of an asymmetric SIGN_VERIFY key. The operation this page's human gate exists for.
- Create Key Creates a new customer managed key: symmetric by default, or asymmetric RSA/ECC and HMAC via Key Spec and Key Usage. Returns the full metadata including the new key's ID and ARN. Provisioning a root of trust is a deliberate act, so governed flows pair it with approval.
Frequently Asked Questions
What can FlowRunner do with AWS KMS?
FlowRunner agents can run List Keys, Describe Key, and Encrypt in AWS KMS, plus 4 more actions.
Does connecting AWS KMS to FlowRunner require OAuth?
AWS KMS uses a custom authentication method to connect to FlowRunner.
Can AWS KMS trigger a FlowRunner workflow automatically?
AWS KMS doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger.
Start building with AWS KMS
$100 in credits. No card required. Connect in minutes.