A KMS key can be referenced two different ways in an ARN — by its permanent key ID (a UUID assigned at creation) or by a friendly alias that points at a key and can be repointed later — and the two produce ARNs that look almost identical except for one word: key/ versus alias/. KMS Key ARN Generator builds either form from region, account id, a key-vs-alias toggle, and a value, with one specific guard rail: if you type the alias field with a leading alias/ that you copied from somewhere else, the tool strips it before reapplying the prefix exactly once, so you never end up with a doubled alias/alias/ segment.
Toggle to Key ID and the value field expects the key’s UUID — something like 1234abcd-12ab-34cd-56ef-1234567890ab — producing arn:aws:kms:region:account:key/1234abcd-.... This is the permanent, unambiguous reference to one specific KMS key; it never changes for the life of the key. Toggle to Alias and the value field expects just the alias name without any prefix — my-key-alias, not alias/my-key-alias — producing arn:aws:kms:region:account:alias/my-key-alias. Aliases exist precisely so you can reference a key by a stable, meaningful name in policies, application configuration, and CloudFormation templates while retaining the ability to repoint that name at a different underlying key later — for a key rotation strategy, or when promoting a freshly created key into production — without touching every place the alias is referenced.
The alias-prefix guard rail exists because it’s an extremely common copy-paste mistake: someone copies an alias value out of the KMS console or an existing ARN, where it already reads alias/my-key-alias, and pastes the whole thing into a field that’s only supposed to hold the name portion. Typed that way into a naive form, you’d get alias/alias/my-key-alias in the resulting ARN — subtly broken, and easy to miss on a quick read. This tool detects a leading alias/ in the value you typed, strips it, and reapplies the prefix exactly once, so the same input either way — my-key-alias or alias/my-key-alias — produces the identical, correct ARN.
Like every other regional AWS service in this tool family, KMS keys and aliases are scoped to a specific region and account, so both fields are required and checked at build time for a real-looking region code and a 12-digit account id. The key ID field itself isn’t validated against the UUID format, deliberately — you may be filling in a template placeholder or working from a key ID captured in a different context, and the tool would rather build the ARN than block on a format guess it can’t be fully sure about.
Once the required fields are filled, a live preview shows the ARN updating as you type. Clicking Build runs the result through the shared structural validator and reveals a one-click Copy button. A Load sample button fills in a realistic region, account, and alias so you can see the guard rail in action; Clear resets everything. As with every tool here, key IDs, aliases, and account ids never leave your browser.