{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Sign With AWS KMS","siteUrl":"https://opensource.ripple.com/","meta":[{"name":"google-site-verification","content":"bLwyBi1imklcIuQxZ7JeI_kRF5Mg7yfr6arpEQV2nsE"}],"llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]},"description":"Sign transactions with a secp256k1 key held in AWS KMS using the simplexrpl/aws-kms adapter; the private key never leaves KMS."},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"sign-with-aws-kms","__idx":0},"children":["Sign With AWS KMS"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["simpleXRPL"]}," ships an ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://docs.aws.amazon.com/kms/latest/developerguide/overview.html"},"children":["AWS KMS"]}," adapter as a subpath import (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["simplexrpl/aws-kms"]},"). The private key stays in KMS and never enters the process — the SDK hands KMS a digest and assembles the signature."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"ts","header":{"controls":{"copy":{}}},"source":"/**\n * Sign with a key held in AWS KMS.\n *\n * simpleXRPL ships an AWS KMS adapter as a subpath import. The private key\n * stays in KMS and never enters the process: the SDK hands KMS a digest and\n * assembles the signature. Requires the optional peer dependency\n * `@aws-sdk/client-kms` and an `ECC_SECG_P256K1` (secp256k1) KMS key.\n *\n * Credentials come from the standard AWS chain (env vars, shared profile, or an\n * instance/role). This drops into your app once those and the key id are set.\n */\nimport { AwsKmsSigner } from 'simplexrpl/aws-kms'\nimport { ExternalSigner, SimpleXRPL } from 'simplexrpl'\n\n// The KMS-backed signer. Its XRPL account is derived from the key's public key.\nconst signer = AwsKmsSigner.create({\n  keyId: process.env.AWS_KMS_KEY_ID ?? '',\n  region: process.env.AWS_REGION ?? 'us-east-1',\n})\nconst custody = await ExternalSigner.create({ signer })\n\nconst client = await SimpleXRPL.init({\n  xrpldUrl: 'wss://s.altnet.rippletest.net:51233', // XRPL Testnet\n  signers: [custody],\n})\n\n// The KMS account signs like any other connector — build, sign (in KMS), submit.\n// Replace with a real, funded destination r-address.\nconst result = await client.xrp.transfer({\n  to: 'rPT1Sjq2YGrBMTttX4GZHjKu9dyfzbpAYe',\n  amount: '10',\n})\nconsole.log('submitted via KMS-held key:', result.txHash)\n\nawait client.disconnect()\n","lang":"ts"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"see-also","__idx":1},"children":["See Also"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/docs/simplexrpl/references/verticals/xrp/transfer"},"children":["xrp.transfer()"]}]}]}]},"headings":[{"value":"Sign With AWS KMS","id":"sign-with-aws-kms","depth":1},{"value":"See Also","id":"see-also","depth":2}],"frontmatter":{"seo":{"description":"Sign transactions with a secp256k1 key held in AWS KMS using the simplexrpl/aws-kms adapter; the private key never leaves KMS.","title":"Sign With AWS KMS"},"labels":["simpleXRPL","SDK"]},"editPage":{"to":"https://github.com/ripple/opensource.ripple.com/tree/main/docs/simpleXRPL/tutorials/implement-aws-kms-signer.md"},"lastModified":"2026-07-30T22:30:51.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/simplexrpl/tutorials/implement-aws-kms-signer","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}