---
title: "POST /#X-Amz-Target=TrentService.TagResource"
method: POST
path: "/#X-Amz-Target=TrentService.TagResource"
---

# POST /#X-Amz-Target=TrentService.TagResource

`POST /#X-Amz-Target=TrentService.TagResource`

Adds or edits tags on a [customer managed key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk).

Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see [ABAC for KMS](https://docs.aws.amazon.com/kms/latest/developerguide/abac.html) in the _Key Management Service Developer Guide_.

Each tag consists of a tag key and a tag value, both of which are case-sensitive strings. The tag value can be an empty (null) string. To add a tag, specify a new tag key and a tag value. To edit a tag, specify an existing tag key and a new tag value.

You can use this operation to tag a [customer managed key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk), but you cannot tag an [Amazon Web Services managed key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk), an [Amazon Web Services owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk), a [custom key store](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#keystore-concept), or an [alias](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#alias-concept).

You can also add tags to a KMS key while creating it (CreateKey) or replicating it (ReplicateKey).

For information about using tags in KMS, see [Tagging keys](https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html). For general information about tags, including the format and syntax, see [Tagging Amazon Web Services resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) in the _Amazon Web Services General Reference_.

The KMS key that you use for this operation must be in a compatible key state. For details, see [Key states of KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html) in the _Key Management Service Developer Guide_.

**Cross-account use**: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.

**Required permissions**: [kms:TagResource](https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html) (key policy)

**Related operations**

*   CreateKey
    
*   ListResourceTags
    
*   ReplicateKey
    
*   UntagResource

## Headers

- `X-Amz-Target` 'TrentService.TagResource', required

## Request body

- TagResourceRequest
  - `KeyId` string, required — <p>Identifies a customer managed key in the account and Region.</p> <p>Specify the key ID or key ARN of the KMS key.</p> <p>For example:</p> <ul> <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> </ul> <p>To get the key ID and key ARN for a KMS key, use <a>ListKeys</a> or <a>DescribeKey</a>.</p>
  - `Tags` Tag[], required — <p>One or more tags. </p> <p>Each tag consists of a tag key and a tag value. The tag value can be an empty (null) string. </p> <p>You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
    - `TagKey` string, required — The key of the tag.
    - `TagValue` string, required — The value of the tag.

## Response `200`

Success

## Other responses

- `480` — KMSInternalException
- `481` — NotFoundException
- `482` — InvalidArnException
- `483` — KMSInvalidStateException
- `484` — LimitExceededException
- `485` — TagException

---

[API](https://skmtc.net/aws/apis/kms.md) · [All operations](https://skmtc.net/aws/apis/kms/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/kms/versions/f92d678d2025/schema)