Why

• Dependency footprint is just viem and @aws-sdk/client-kms.
• TypeScript-native implementation built with Deno.
• Uses Deno hardening like frozen lockfiles, minimumDependencyAge, and nodeModulesDir: "none".
• Includes a small in-house DER parser for the exact ASN.1 KMS returns, so there is no extra ASN.1 dependency.
• Your private key stays in AWS KMS, but you still get a normal viem account.

Usage

import { createKmsAccount } from "kms-viem-account-mini";
import { createWalletClient, http } from "viem";
import { sepolia } from "viem/chains";

const account = await createKmsAccount({
  keyId: process.env.AWS_KMS_KEY_ID!,
  region: "ap-northeast-1",
});

const walletClient = createWalletClient({
  account,
  chain: sepolia,
  transport: http("https://ethereum-sepolia-rpc.publicnode.com"),
});

const message = "hello from AWS KMS";
const signature = await walletClient.signMessage({
  account,
  message,
});

console.log({
  address: account.address,
  message,
  signature,
});

Quick Start

1. Login to AWS

aws sso login

Your principal needs kms:GetPublicKey and kms:Sign on the target key.

2. Create a secp256k1 KMS key

aws kms create-key \
  --region ap-northeast-1 \
  --key-spec ECC_SECG_P256K1 \
  --key-usage SIGN_VERIFY

Copy KeyMetadata.KeyId.

3. Export the key id

export AWS_KMS_KEY_ID=your-key-id

4. Clone this repo

git clone https://github.com/posaune0423/kms-viem-account-mini.git

5. Go to the Bun example

cd kms-viem-account-mini/examples/minimum-bun

6. Install dependencies and run it

bun install
bun run index.ts

Example output:

{
  address: "0xC4902B92CC048194D3cD59047a99347B506FFaeE",
  message: "hello from AWS KMS",
  signature: "0x5b6b4c305b3f207f0a8c54ad462ee462fcc5ade246e7f4d03fc83f1e995c4eb0298e304ebbcc505e223534036ee33648a2d5fd241dd267846e792ef87556920f1b",
}

If it works, you have:

• created a KMS-backed Ethereum account
• connected it to viem
• produced your first testnet-context signature

The runnable sample is in:

• examples/minimum-bun/index.ts

API

createKmsAccount() returns a viem-compatible account with:

• sign({ hash })
• signMessage({ message })
• signTypedData(...)
• signTransaction(...)