AWS Customer Managed KMS replica - key material import

I am doing it via console. it is symmetric key I am having an issue to import key material to replica which is in Pending Import status

I tried to download wrapping key and import token from replica, import primary key material (the one I used in primary KMS key in Ohio) and import token that I downloaded from replica KMS key (because they are described as unique per region?) but I am getting InvalidCyphertext Exception error message when trying to import.

The steps I took to replicate:

1. Went to Regional section, chose region for replica- us-east-1
2. Switched to us-east-1 - the replica showed up in status "Pending Import"
3. Went to Key Material, clicked on Import Key:
4. Downloaded Wrapping Public Key and Import Token
5. Imported primary key material generated for the base key from Ohio Region. Uploaded Import token previously downloaded from replica key in N.Virginia region
6. Upload failed with InvalidCyphertext Exception error

Can you please make sure, if you are exactly following step3 from Creating a replica key with imported key material. It says that "Use the public key to encrypt the primary key's key material, and then import the primary key's key material in the replica key. You need a different public key and import token for each replica key." Let me know if you are still facing the problem.

Thank you for confirming my doubts. I finally resolved the issue. I was not sure why this command below wasn't doing the job - I lost my plain_text_aes.bin during initial creation of the key material.

I recreated the KMS primary key, did it from scratch alltogether and it worked. Thank you very much for your support!

openssl pkeyutl -in plain_text_aes_key.bin -inkey <your-wrappingKey...> -pubin -keyform DER -encrypt -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -out enc.aes.key

I'm glad you were able to resolve the issue.