kmsKeyId

The identifier for your AWS Key Management Service key (AWS KMS key). You can supply the Amazon Resource Name (ARN) of your KMS key, the ID of your KMS key, an alias for your KMS key, or an alias ARN. The key is used to encrypt training images, test images, and manifest files copied into the service for the project version. Your source images are unaffected. The key is also used to encrypt training results and manifest files written to the output Amazon S3 bucket (OutputConfig).

If you choose to use your own KMS key, you need the following permissions on the KMS key.

• kms:CreateGrant

• kms:DescribeKey

• kms:GenerateDataKey

• kms:Decrypt

If you don't specify a value for KmsKeyId, images copied into the service are encrypted using a key that AWS owns and manages.