Durability enforcement of cryptographic keys in a key management system

A computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to cause a key management service (KMS) to:

• receive a first request to encrypt a first level key in the form of an application programming interface (API) message, the request including a second level key identification (ID) of a stored encrypted second level key, and a flag indicating a durability level;
• determine that a durability check of the encrypted second level key is required based on the durability level indicated by the flag in the request to encrypt the first level key;
• determine a durability status of the encrypted second level key by comparing storage of the encrypted second level key in one or more storage locations with predetermined storage rules for a durability level of the encrypted second level key, wherein the durability status indicates whether the storage of the encrypted second level key complies with the predetermined storage rules for the durability level;
• and
• send a notification regarding the durability status to the data storage service in response to the first request.

A system comprising:

• a processor, a computer readable memory, one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to cause a data storage service to:
• send a first API request to encrypt a first level key to a key management service (KMS), the first API request including a second level key identification (ID) and a flag indicating a durability type;
• determine, based on the durability type indicated by the flag, that a durability check of the encrypted second level key is required;
• and
• determine, based on a notification received from an API of the KMS and an outcome of the durability check, whether the encrypted second level key meets a user-selected level of durability of the encrypted second level key.