aws-sdk-kms 1.101.0 → 1.106.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +25 -0
  3. data/VERSION +1 -1
  4. data/lib/aws-sdk-kms/client.rb +773 -545
  5. data/lib/aws-sdk-kms/client_api.rb +34 -1
  6. data/lib/aws-sdk-kms/types.rb +492 -207
  7. data/lib/aws-sdk-kms.rb +1 -1
  8. data/sig/client.rbs +32 -13
  9. data/sig/types.rbs +40 -12
  10. metadata +4 -4
data/lib/aws-sdk-kms/client.rb CHANGED
@@ -503,7 +503,7 @@ module Aws::KMS
503
503
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
504
504
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
505
505
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
506
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
506
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
507
507
  #
508
508
  # @option params [required, String] :key_id
509
509
  # Identifies the KMS key whose deletion is being canceled.
@@ -575,9 +575,9 @@ module Aws::KMS
575
575
  # custom key store is connected. To get the connection state of the
576
576
  # custom key store, use the DescribeCustomKeyStores operation.
577
577
  #
578
- # This operation is part of the [custom key stores][1] feature in KMS,
579
- # which combines the convenience and extensive integration of KMS with
580
- # the isolation and control of a key store that you own and manage.
578
+ # This operation is part of the custom key stores feature in KMS, which
579
+ # combines the convenience and extensive integration of KMS with the
580
+ # isolation and control of a key store that you own and manage.
581
581
  #
582
582
  # The `ConnectCustomKeyStore` operation might fail for various reasons.
583
583
  # To find the reason, use the DescribeCustomKeyStores operation and see
@@ -651,14 +651,14 @@ module Aws::KMS
651
651
  #
652
652
  #
653
653
  #
654
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
654
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
655
655
  # [2]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html
656
656
  # [3]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html
657
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
657
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
658
658
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
659
659
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
660
660
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
661
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
661
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
662
662
  #
663
663
  # @option params [required, String] :custom_key_store_id
664
664
  # Enter the key store ID of the custom key store that you want to
@@ -720,7 +720,7 @@ module Aws::KMS
720
720
  #
721
721
  # The alias must be unique in the account and Region, but you can have
722
722
  # aliases with the same name in different Regions. For detailed
723
- # information about aliases, see [Using aliases][3] in the *Key
723
+ # information about aliases, see [Aliases in KMS][3] in the *Key
724
724
  # Management Service Developer Guide*.
725
725
  #
726
726
  # This operation does not return a response. To get the alias that you
@@ -756,12 +756,12 @@ module Aws::KMS
756
756
  #
757
757
  #
758
758
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
759
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
759
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
760
760
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
761
761
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
762
762
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
763
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
764
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
763
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html
764
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
765
765
  #
766
766
  # @option params [required, String] :alias_name
767
767
  # Specifies the alias name. This value must begin with `alias/` followed
@@ -788,7 +788,7 @@ module Aws::KMS
788
788
  # A valid key ID is required. If you supply a null or empty string
789
789
  # value, this operation returns an error.
790
790
  #
791
- # For help finding the key ID and ARN, see [Finding the Key ID and
791
+ # For help finding the key ID and ARN, see [Find the key ID and key
792
792
  # ARN][2] in the <i> <i>Key Management Service Developer Guide</i> </i>.
793
793
  #
794
794
  # Specify the key ID or key ARN of the KMS key.
@@ -806,7 +806,7 @@ module Aws::KMS
806
806
  #
807
807
  #
808
808
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
809
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn
809
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html
810
810
  #
811
811
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
812
812
  #
@@ -844,9 +844,9 @@ module Aws::KMS
844
844
  # stores][4] backed by an external key store proxy and external key
845
845
  # manager outside of Amazon Web Services.
846
846
  #
847
- # This operation is part of the [custom key stores][1] feature in KMS,
848
- # which combines the convenience and extensive integration of KMS with
849
- # the isolation and control of a key store that you own and manage.
847
+ # This operation is part of the custom key stores feature in KMS, which
848
+ # combines the convenience and extensive integration of KMS with the
849
+ # isolation and control of a key store that you own and manage.
850
850
  #
851
851
  # Before you create the custom key store, the required elements must be
852
852
  # in place and operational. We recommend that you use the test tools
@@ -899,9 +899,6 @@ module Aws::KMS
899
899
  # immediately, you might want to connect it to verify that all settings
900
900
  # are correct and then disconnect it until you are ready to use it.
901
901
  #
902
- # For help with failures, see [Troubleshooting a custom key store][7] in
903
- # the *Key Management Service Developer Guide*.
904
- #
905
902
  # **Cross-account use**: No. You cannot perform this operation on a
906
903
  # custom key store in a different Amazon Web Services account.
907
904
  #
@@ -924,7 +921,7 @@ module Aws::KMS
924
921
  #
925
922
  #
926
923
  #
927
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
924
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
928
925
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
929
926
  # [3]: https://docs.aws.amazon.com/cloudhsm/latest/userguide/clusters.html
930
927
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
@@ -933,7 +930,7 @@ module Aws::KMS
933
930
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
934
931
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
935
932
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
936
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
933
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
937
934
  #
938
935
  # @option params [required, String] :custom_key_store_name
939
936
  # Specifies a friendly name for the custom key store. The name must be
@@ -987,7 +984,7 @@ module Aws::KMS
987
984
  #
988
985
  #
989
986
  #
990
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
987
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
991
988
  #
992
989
  # @option params [String] :custom_key_store_type
993
990
  # Specifies the type of custom key store. The default value is
@@ -1088,7 +1085,7 @@ module Aws::KMS
1088
1085
  # `RawSecretAccessKey`, a secret key, and `AccessKeyId`, a unique
1089
1086
  # identifier for the `RawSecretAccessKey`. For character requirements,
1090
1087
  # see
1091
- # [XksProxyAuthenticationCredentialType](kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html).
1088
+ # [XksProxyAuthenticationCredentialType](API_XksProxyAuthenticationCredentialType.html).
1092
1089
  #
1093
1090
  # KMS uses this authentication credential to sign requests to the
1094
1091
  # external key store proxy on your behalf. This credential is unrelated
@@ -1128,7 +1125,7 @@ module Aws::KMS
1128
1125
  #
1129
1126
  #
1130
1127
  #
1131
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity
1128
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/choose-xks-connectivity.html
1132
1129
  #
1133
1130
  # @return [Types::CreateCustomKeyStoreResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
1134
1131
  #
@@ -1237,8 +1234,9 @@ module Aws::KMS
1237
1234
  #
1238
1235
  # For detailed information about grants, including grant terminology,
1239
1236
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
1240
- # Guide</i> </i>. For examples of working with grants in several
1241
- # programming languages, see [Programming grants][2].
1237
+ # Guide</i> </i>. For examples of creating grants in several programming
1238
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
1239
+ # CLI][2].
1242
1240
  #
1243
1241
  # The `CreateGrant` operation returns a `GrantToken` and a `GrantId`.
1244
1242
  #
@@ -1284,11 +1282,11 @@ module Aws::KMS
1284
1282
  #
1285
1283
  #
1286
1284
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
1287
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
1288
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1285
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
1286
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1289
1287
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
1290
1288
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1291
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
1289
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
1292
1290
  #
1293
1291
  # @option params [required, String] :key_id
1294
1292
  # Identifies the KMS key for the grant. The grant gives principals
@@ -1341,7 +1339,7 @@ module Aws::KMS
1341
1339
  #
1342
1340
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
1343
1341
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns
1344
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
1342
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
1345
1343
  #
1346
1344
  # @option params [required, Array<String>] :operations
1347
1345
  # A list of operations that the grant permits.
@@ -1410,7 +1408,7 @@ module Aws::KMS
1410
1408
  #
1411
1409
  #
1412
1410
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
1413
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1411
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1414
1412
  #
1415
1413
  # @option params [String] :name
1416
1414
  # A friendly name for the grant. Use this value to prevent the
@@ -1436,12 +1434,12 @@ module Aws::KMS
1436
1434
  # Checks if your request will succeed. `DryRun` is an optional
1437
1435
  # parameter.
1438
1436
  #
1439
- # To learn more about how to use this parameter, see [Testing your KMS
1440
- # API calls][1] in the *Key Management Service Developer Guide*.
1437
+ # To learn more about how to use this parameter, see [Testing your
1438
+ # permissions][1] in the *Key Management Service Developer Guide*.
1441
1439
  #
1442
1440
  #
1443
1441
  #
1444
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
1442
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
1445
1443
  #
1446
1444
  # @return [Types::CreateGrantResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
1447
1445
  #
@@ -1511,8 +1509,7 @@ module Aws::KMS
1511
1509
  # A KMS key is a logical representation of a cryptographic key. In
1512
1510
  # addition to the key material used in cryptographic operations, a KMS
1513
1511
  # key includes metadata, such as the key ID, key policy, creation date,
1514
- # description, and key state. For details, see [Managing keys][2] in the
1515
- # *Key Management Service Developer Guide*
1512
+ # description, and key state.
1516
1513
  #
1517
1514
  # Use the parameters of `CreateKey` to specify the type of KMS key, the
1518
1515
  # source of its key material, its key policy, description, tags, and
@@ -1558,20 +1555,21 @@ module Aws::KMS
1558
1555
  # properties after the KMS key is created.
1559
1556
  #
1560
1557
  # Asymmetric KMS keys contain an RSA key pair, Elliptic Curve (ECC)
1561
- # key pair, or an SM2 key pair (China Regions only). The private key
1562
- # in an asymmetric KMS key never leaves KMS unencrypted. However, you
1563
- # can use the GetPublicKey operation to download the public key so it
1564
- # can be used outside of KMS. Each KMS key can have only one key
1565
- # usage. KMS keys with RSA key pairs can be used to encrypt and
1566
- # decrypt data or sign and verify messages (but not both). KMS keys
1567
- # with NIST-recommended ECC key pairs can be used to sign and verify
1568
- # messages or derive shared secrets (but not both). KMS keys with
1569
- # `ECC_SECG_P256K1` can be used only to sign and verify messages. KMS
1570
- # keys with SM2 key pairs (China Regions only) can be used to either
1571
- # encrypt and decrypt data, sign and verify messages, or derive shared
1572
- # secrets (you must choose one key usage type). For information about
1573
- # asymmetric KMS keys, see [Asymmetric KMS keys][3] in the *Key
1574
- # Management Service Developer Guide*.
1558
+ # key pair, ML-DSA key pair or an SM2 key pair (China Regions only).
1559
+ # The private key in an asymmetric KMS key never leaves KMS
1560
+ # unencrypted. However, you can use the GetPublicKey operation to
1561
+ # download the public key so it can be used outside of KMS. Each KMS
1562
+ # key can have only one key usage. KMS keys with RSA key pairs can be
1563
+ # used to encrypt and decrypt data or sign and verify messages (but
1564
+ # not both). KMS keys with NIST-recommended ECC key pairs can be used
1565
+ # to sign and verify messages or derive shared secrets (but not both).
1566
+ # KMS keys with `ECC_SECG_P256K1` can be used only to sign and verify
1567
+ # messages. KMS keys with ML-DSA key pairs can be used to sign and
1568
+ # verify messages. KMS keys with SM2 key pairs (China Regions only)
1569
+ # can be used to either encrypt and decrypt data, sign and verify
1570
+ # messages, or derive shared secrets (you must choose one key usage
1571
+ # type). For information about asymmetric KMS keys, see [Asymmetric
1572
+ # KMS keys][2] in the *Key Management Service Developer Guide*.
1575
1573
  #
1576
1574
  #
1577
1575
  #
@@ -1614,7 +1612,7 @@ module Aws::KMS
1614
1612
  # to encrypt data in one Amazon Web Services Region and decrypt it in
1615
1613
  # a different Amazon Web Services Region without re-encrypting the
1616
1614
  # data or making a cross-Region call. For more information about
1617
- # multi-Region keys, see [Multi-Region keys in KMS][4] in the *Key
1615
+ # multi-Region keys, see [Multi-Region keys in KMS][3] in the *Key
1618
1616
  # Management Service Developer Guide*.
1619
1617
  #
1620
1618
  #
@@ -1626,7 +1624,7 @@ module Aws::KMS
1626
1624
  # token. Use the wrapping public key to encrypt your key material.
1627
1625
  # Then, use ImportKeyMaterial with your import token to import the key
1628
1626
  # material. For step-by-step instructions, see [Importing Key
1629
- # Material][5] in the <i> <i>Key Management Service Developer
1627
+ # Material][4] in the <i> <i>Key Management Service Developer
1630
1628
  # Guide</i> </i>.
1631
1629
  #
1632
1630
  # You can import key material into KMS keys of all supported KMS key
@@ -1639,23 +1637,22 @@ module Aws::KMS
1639
1637
  # the `Origin` parameter of `CreateKey` with a value of `EXTERNAL` and
1640
1638
  # the `MultiRegion` parameter with a value of `True`. To create
1641
1639
  # replicas of the multi-Region primary key, use the ReplicateKey
1642
- # operation. For instructions, see [Importing key material into
1643
- # multi-Region keys][6]. For more information about multi-Region keys,
1644
- # see [Multi-Region keys in KMS][4] in the *Key Management Service
1645
- # Developer Guide*.
1640
+ # operation. For instructions, see [Importing key material step 1][5].
1641
+ # For more information about multi-Region keys, see [Multi-Region keys
1642
+ # in KMS][3] in the *Key Management Service Developer Guide*.
1646
1643
  #
1647
1644
  #
1648
1645
  #
1649
1646
  # Custom key store
1650
1647
  #
1651
- # : A [custom key store][7] lets you protect your Amazon Web Services
1648
+ # : A [custom key store][6] lets you protect your Amazon Web Services
1652
1649
  # resources using keys in a backing key store that you own and manage.
1653
1650
  # When you request a cryptographic operation with a KMS key in a
1654
1651
  # custom key store, the operation is performed in the backing key
1655
1652
  # store using its cryptographic keys.
1656
1653
  #
1657
- # KMS supports [CloudHSM key stores][8] backed by an CloudHSM cluster
1658
- # and [external key stores][9] backed by an external key manager
1654
+ # KMS supports [CloudHSM key stores][7] backed by an CloudHSM cluster
1655
+ # and [external key stores][8] backed by an external key manager
1659
1656
  # outside of Amazon Web Services. When you create a KMS key in an
1660
1657
  # CloudHSM key store, KMS generates an encryption key in the CloudHSM
1661
1658
  # cluster and associates it with the KMS key. When you create a KMS
@@ -1680,13 +1677,13 @@ module Aws::KMS
1680
1677
  # `ENCRYPT_DECRYPT` to create a symmetric encryption key. No other key
1681
1678
  # type is supported in a custom key store.
1682
1679
  #
1683
- # To create a KMS key in an [CloudHSM key store][8], use the `Origin`
1680
+ # To create a KMS key in an [CloudHSM key store][9], use the `Origin`
1684
1681
  # parameter with a value of `AWS_CLOUDHSM`. The CloudHSM cluster that
1685
1682
  # is associated with the custom key store must have at least two
1686
1683
  # active HSMs in different Availability Zones in the Amazon Web
1687
1684
  # Services Region.
1688
1685
  #
1689
- # To create a KMS key in an [external key store][9], use the `Origin`
1686
+ # To create a KMS key in an [external key store][10], use the `Origin`
1690
1687
  # parameter with a value of `EXTERNAL_KEY_STORE` and an `XksKeyId`
1691
1688
  # parameter that identifies an existing external key.
1692
1689
  #
@@ -1699,10 +1696,10 @@ module Aws::KMS
1699
1696
  # **Cross-account use**: No. You cannot use this operation to create a
1700
1697
  # KMS key in a different Amazon Web Services account.
1701
1698
  #
1702
- # **Required permissions**: [kms:CreateKey][10] (IAM policy). To use the
1703
- # `Tags` parameter, [kms:TagResource][10] (IAM policy). For examples and
1699
+ # **Required permissions**: [kms:CreateKey][11] (IAM policy). To use the
1700
+ # `Tags` parameter, [kms:TagResource][11] (IAM policy). For examples and
1704
1701
  # information about related permissions, see [Allow a user to create KMS
1705
- # keys][11] in the *Key Management Service Developer Guide*.
1702
+ # keys][12] in the *Key Management Service Developer Guide*.
1706
1703
  #
1707
1704
  # **Related operations:**
1708
1705
  #
@@ -1713,22 +1710,23 @@ module Aws::KMS
1713
1710
  # * ScheduleKeyDeletion
1714
1711
  #
1715
1712
  # **Eventual consistency**: The KMS API follows an eventual consistency
1716
- # model. For more information, see [KMS eventual consistency][12].
1713
+ # model. For more information, see [KMS eventual consistency][13].
1717
1714
  #
1718
1715
  #
1719
1716
  #
1720
1717
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys
1721
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html
1722
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
1723
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
1724
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
1725
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html
1726
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1727
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
1728
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1729
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1730
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html#iam-policy-example-create-key
1731
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
1718
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
1719
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
1720
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
1721
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html
1722
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1723
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
1724
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1725
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html
1726
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html
1727
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1728
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/customer-managed-policies.html#iam-policy-example-create-key
1729
+ # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
1732
1730
  #
1733
1731
  # @option params [String] :policy
1734
1732
  # The key policy to attach to the KMS key.
@@ -1750,22 +1748,38 @@ module Aws::KMS
1750
1748
  # not always immediately visible][2] in the *Amazon Web Services
1751
1749
  # Identity and Access Management User Guide*.
1752
1750
  #
1751
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are missing
1752
+ # from a key policy statement, the policy statement has no effect. When
1753
+ # a key policy statement is missing one of these elements, the KMS
1754
+ # console correctly reports an error, but the `CreateKey` and
1755
+ # `PutKeyPolicy` API requests succeed, even though the policy statement
1756
+ # is ineffective.
1757
+ #
1758
+ # For more information on required key policy elements, see [Elements in
1759
+ # a key policy][3] in the *Key Management Service Developer Guide*.
1760
+ #
1761
+ # </note>
1762
+ #
1753
1763
  # If you do not provide a key policy, KMS attaches a default key policy
1754
- # to the KMS key. For more information, see [Default key policy][3] in
1764
+ # to the KMS key. For more information, see [Default key policy][4] in
1755
1765
  # the *Key Management Service Developer Guide*.
1756
1766
  #
1757
- # The key policy size quota is 32 kilobytes (32768 bytes).
1767
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
1768
+ # `LimitExceededException`.
1769
+ #
1770
+ # </note>
1758
1771
  #
1759
1772
  # For help writing and formatting a JSON policy document, see the [IAM
1760
- # JSON Policy Reference][4] in the <i> <i>Identity and Access Management
1773
+ # JSON Policy Reference][5] in the <i> <i>Identity and Access Management
1761
1774
  # User Guide</i> </i>.
1762
1775
  #
1763
1776
  #
1764
1777
  #
1765
1778
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
1766
1779
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
1767
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
1768
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
1780
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
1781
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
1782
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
1769
1783
  #
1770
1784
  # @option params [String] :description
1771
1785
  # A description of the KMS key. Use a description that helps you decide
@@ -1799,7 +1813,10 @@ module Aws::KMS
1799
1813
  # * For asymmetric KMS keys with NIST-recommended elliptic curve key
1800
1814
  # pairs, specify `SIGN_VERIFY` or `KEY_AGREEMENT`.
1801
1815
  #
1802
- # * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs specify
1816
+ # * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs, specify
1817
+ # `SIGN_VERIFY`.
1818
+ #
1819
+ # * For asymmetric KMS keys with ML-DSA key pairs, specify
1803
1820
  # `SIGN_VERIFY`.
1804
1821
  #
1805
1822
  # * For asymmetric KMS keys with SM2 key pairs (China Regions only),
@@ -1807,7 +1824,7 @@ module Aws::KMS
1807
1824
  #
1808
1825
  #
1809
1826
  #
1810
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
1827
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
1811
1828
  #
1812
1829
  # @option params [String] :customer_master_key_spec
1813
1830
  # Instead, use the `KeySpec` parameter.
@@ -1821,20 +1838,21 @@ module Aws::KMS
1821
1838
  # Specifies the type of KMS key to create. The default value,
1822
1839
  # `SYMMETRIC_DEFAULT`, creates a KMS key with a 256-bit AES-GCM key that
1823
1840
  # is used for encryption and decryption, except in China Regions, where
1824
- # it creates a 128-bit symmetric key that uses SM4 encryption. For help
1825
- # choosing a key spec for your KMS key, see [Choosing a KMS key type][1]
1826
- # in the <i> <i>Key Management Service Developer Guide</i> </i>.
1841
+ # it creates a 128-bit symmetric key that uses SM4 encryption. For a
1842
+ # detailed description of all supported key specs, see [Key spec
1843
+ # reference][1] in the <i> <i>Key Management Service Developer Guide</i>
1844
+ # </i>.
1827
1845
  #
1828
1846
  # The `KeySpec` determines whether the KMS key contains a symmetric key
1829
1847
  # or an asymmetric key pair. It also determines the algorithms that the
1830
1848
  # KMS key supports. You can't change the `KeySpec` after the KMS key is
1831
1849
  # created. To further restrict the algorithms that can be used with the
1832
1850
  # KMS key, use a condition key in its key policy or IAM policy. For more
1833
- # information, see [kms:EncryptionAlgorithm][2], [kms:MacAlgorithm][3]
1834
- # or [kms:Signing Algorithm][4] in the <i> <i>Key Management Service
1835
- # Developer Guide</i> </i>.
1851
+ # information, see [kms:EncryptionAlgorithm][2], [kms:MacAlgorithm][3],
1852
+ # [kms:KeyAgreementAlgorithm][4], or [kms:SigningAlgorithm][5] in the
1853
+ # <i> <i>Key Management Service Developer Guide</i> </i>.
1836
1854
  #
1837
- # [Amazon Web Services services that are integrated with KMS][5] use
1855
+ # [Amazon Web Services services that are integrated with KMS][6] use
1838
1856
  # symmetric encryption KMS keys to protect your data. These services do
1839
1857
  # not support asymmetric KMS keys or HMAC KMS keys.
1840
1858
  #
@@ -1875,6 +1893,13 @@ module Aws::KMS
1875
1893
  # * `ECC_SECG_P256K1` (secp256k1), commonly used for cryptocurrencies.
1876
1894
  #
1877
1895
  # ^
1896
+ # * Asymmetric ML-DSA key pairs (signing and verification)
1897
+ #
1898
+ # * `ML_DSA_44`
1899
+ #
1900
+ # * `ML_DSA_65`
1901
+ #
1902
+ # * `ML_DSA_87`
1878
1903
  # * SM2 key pairs (encryption and decryption -or- signing and
1879
1904
  # verification -or- deriving shared secrets)
1880
1905
  #
@@ -1884,11 +1909,12 @@ module Aws::KMS
1884
1909
  #
1885
1910
  #
1886
1911
  #
1887
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose
1888
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm
1889
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm
1890
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm
1891
- # [5]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
1912
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html
1913
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-algorithm
1914
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-mac-algorithm
1915
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-agreement-algorithm
1916
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-signing-algorithm
1917
+ # [6]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
1892
1918
  #
1893
1919
  # @option params [String] :origin
1894
1920
  # The source of the key material for the KMS key. You cannot change the
@@ -1938,7 +1964,7 @@ module Aws::KMS
1938
1964
  #
1939
1965
  #
1940
1966
  #
1941
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1967
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1942
1968
  #
1943
1969
  # @option params [Boolean] :bypass_policy_lockout_safety_check
1944
1970
  # Skips ("bypasses") the key policy lockout safety check. The default
@@ -1986,7 +2012,7 @@ module Aws::KMS
1986
2012
  # When you add tags to an Amazon Web Services resource, Amazon Web
1987
2013
  # Services generates a cost allocation report with usage and costs
1988
2014
  # aggregated by tags. Tags can also be used to control access to a KMS
1989
- # key. For details, see [Tagging Keys][3].
2015
+ # key. For details, see [Tags in KMS][3].
1990
2016
  #
1991
2017
  #
1992
2018
  #
@@ -2057,7 +2083,7 @@ module Aws::KMS
2057
2083
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
2058
2084
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
2059
2085
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy
2060
- # [4]: https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements
2086
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html#xks-key-requirements
2061
2087
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption
2062
2088
  #
2063
2089
  # @return [Types::CreateKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
@@ -2079,6 +2105,7 @@ module Aws::KMS
2079
2105
  # aws_account_id: "111122223333",
2080
2106
  # arn: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
2081
2107
  # creation_date: Time.parse("2017-07-05T14:04:55-07:00"),
2108
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
2082
2109
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
2083
2110
  # description: "",
2084
2111
  # enabled: true,
@@ -2131,8 +2158,7 @@ module Aws::KMS
2131
2158
  # @example Example: To create an asymmetric elliptic curve KMS key for signing and verification
2132
2159
  #
2133
2160
  # # This example creates a KMS key that contains an asymmetric elliptic curve (ECC) key pair for signing and verification.
2134
- # # The key usage is required even though "SIGN_VERIFY" is the only valid value for ECC KMS keys. The key spec and key usage
2135
- # # can't be changed after the key is created.
2161
+ # # The key spec and key usage can't be changed after the key is created.
2136
2162
  #
2137
2163
  # resp = client.create_key({
2138
2164
  # key_spec: "ECC_NIST_P521", # Describes the type of key material in the KMS key.
@@ -2193,6 +2219,38 @@ module Aws::KMS
2193
2219
  # }, # Detailed information about the KMS key that this operation creates.
2194
2220
  # }
2195
2221
  #
2222
+ # @example Example: To create an asymmetric ML-DSA KMS key for signing and verification
2223
+ #
2224
+ # # This example creates a module-lattice digital signature algorithm (ML-DSA) key for signing and verification. The
2225
+ # # key-usage parameter is required even though SIGN_VERIFY is the only valid value for ML-DSA keys.
2226
+ #
2227
+ # resp = client.create_key({
2228
+ # key_spec: "ML_DSA_65", # Describes the type of key material in the KMS key.
2229
+ # key_usage: "SIGN_VERIFY", # The cryptographic operations for which you can use the KMS key.
2230
+ # })
2231
+ #
2232
+ # resp.to_h outputs the following:
2233
+ # {
2234
+ # key_metadata: {
2235
+ # aws_account_id: "111122223333",
2236
+ # arn: "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
2237
+ # creation_date: Time.parse(1748371316.734),
2238
+ # customer_master_key_spec: "ML_DSA_65",
2239
+ # description: "",
2240
+ # enabled: true,
2241
+ # key_id: "1234abcd-12ab-34cd-56ef-1234567890ab",
2242
+ # key_manager: "CUSTOMER",
2243
+ # key_spec: "ML_DSA_65",
2244
+ # key_state: "Enabled",
2245
+ # key_usage: "SIGN_VERIFY",
2246
+ # multi_region: false,
2247
+ # origin: "AWS_KMS",
2248
+ # signing_algorithms: [
2249
+ # "ML_DSA_SHAKE_256",
2250
+ # ],
2251
+ # }, # Detailed information about the KMS key that this operation creates.
2252
+ # }
2253
+ #
2196
2254
  # @example Example: To create a multi-Region primary KMS key
2197
2255
  #
2198
2256
  # # This example creates a multi-Region primary symmetric encryption key. Because the default values for all parameters
@@ -2208,6 +2266,7 @@ module Aws::KMS
2208
2266
  # aws_account_id: "111122223333",
2209
2267
  # arn: "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef12345678990ab",
2210
2268
  # creation_date: Time.parse("2021-09-02T016:15:21-09:00"),
2269
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
2211
2270
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
2212
2271
  # description: "",
2213
2272
  # enabled: true,
@@ -2344,7 +2403,7 @@ module Aws::KMS
2344
2403
  # description: "DescriptionType",
2345
2404
  # key_usage: "SIGN_VERIFY", # accepts SIGN_VERIFY, ENCRYPT_DECRYPT, GENERATE_VERIFY_MAC, KEY_AGREEMENT
2346
2405
  # customer_master_key_spec: "RSA_2048", # accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, SYMMETRIC_DEFAULT, HMAC_224, HMAC_256, HMAC_384, HMAC_512, SM2
2347
- # key_spec: "RSA_2048", # accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, SYMMETRIC_DEFAULT, HMAC_224, HMAC_256, HMAC_384, HMAC_512, SM2
2406
+ # key_spec: "RSA_2048", # accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, SYMMETRIC_DEFAULT, HMAC_224, HMAC_256, HMAC_384, HMAC_512, SM2, ML_DSA_44, ML_DSA_65, ML_DSA_87
2348
2407
  # origin: "AWS_KMS", # accepts AWS_KMS, EXTERNAL, AWS_CLOUDHSM, EXTERNAL_KEY_STORE
2349
2408
  # custom_key_store_id: "CustomKeyStoreIdType",
2350
2409
  # bypass_policy_lockout_safety_check: false,
@@ -2376,11 +2435,11 @@ module Aws::KMS
2376
2435
  # resp.key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
2377
2436
  # resp.key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
2378
2437
  # resp.key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
2379
- # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
2438
+ # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
2380
2439
  # resp.key_metadata.encryption_algorithms #=> Array
2381
2440
  # resp.key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
2382
2441
  # resp.key_metadata.signing_algorithms #=> Array
2383
- # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
2442
+ # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
2384
2443
  # resp.key_metadata.key_agreement_algorithms #=> Array
2385
2444
  # resp.key_metadata.key_agreement_algorithms[0] #=> String, one of "ECDH"
2386
2445
  # resp.key_metadata.multi_region #=> Boolean
@@ -2394,6 +2453,7 @@ module Aws::KMS
2394
2453
  # resp.key_metadata.mac_algorithms #=> Array
2395
2454
  # resp.key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
2396
2455
  # resp.key_metadata.xks_key_configuration.id #=> String
2456
+ # resp.key_metadata.current_key_material_id #=> String
2397
2457
  #
2398
2458
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateKey AWS API Documentation
2399
2459
  #
@@ -2444,15 +2504,14 @@ module Aws::KMS
2444
2504
  # key that you intend.
2445
2505
  #
2446
2506
  # Whenever possible, use key policies to give users permission to call
2447
- # the `Decrypt` operation on a particular KMS key, instead of using
2448
- # &amp;IAM; policies. Otherwise, you might create an &amp;IAM; policy
2449
- # that gives the user `Decrypt` permission on all KMS keys. This user
2450
- # could decrypt ciphertext that was encrypted by KMS keys in other
2451
- # accounts if the key policy for the cross-account KMS key permits it.
2452
- # If you must use an IAM policy for `Decrypt` permissions, limit the
2453
- # user to particular KMS keys or particular trusted accounts. For
2454
- # details, see [Best practices for IAM policies][4] in the *Key
2455
- # Management Service Developer Guide*.
2507
+ # the `Decrypt` operation on a particular KMS key, instead of using IAM
2508
+ # policies. Otherwise, you might create an IAM policy that gives the
2509
+ # user `Decrypt` permission on all KMS keys. This user could decrypt
2510
+ # ciphertext that was encrypted by KMS keys in other accounts if the key
2511
+ # policy for the cross-account KMS key permits it. If you must use an
2512
+ # IAM policy for `Decrypt` permissions, limit the user to particular KMS
2513
+ # keys or particular trusted accounts. For details, see [Best practices
2514
+ # for IAM policies][4] in the *Key Management Service Developer Guide*.
2456
2515
  #
2457
2516
  # `Decrypt` also supports [Amazon Web Services Nitro Enclaves][5], which
2458
2517
  # provide an isolated compute environment in Amazon EC2. To call
@@ -2500,7 +2559,7 @@ module Aws::KMS
2500
2559
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2501
2560
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
2502
2561
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2503
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2562
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2504
2563
  #
2505
2564
  # @option params [required, String, StringIO, File] :ciphertext_blob
2506
2565
  # Ciphertext to be decrypted. The blob includes metadata.
@@ -2525,8 +2584,8 @@ module Aws::KMS
2525
2584
  #
2526
2585
  #
2527
2586
  #
2528
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2529
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2587
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2588
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2530
2589
  #
2531
2590
  # @option params [Array<String>] :grant_tokens
2532
2591
  # A list of grant tokens.
@@ -2539,7 +2598,7 @@ module Aws::KMS
2539
2598
  #
2540
2599
  #
2541
2600
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2542
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2601
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2543
2602
  #
2544
2603
  # @option params [String] :key_id
2545
2604
  # Specifies the KMS key that KMS uses to decrypt the ciphertext.
@@ -2615,12 +2674,12 @@ module Aws::KMS
2615
2674
  # Checks if your request will succeed. `DryRun` is an optional
2616
2675
  # parameter.
2617
2676
  #
2618
- # To learn more about how to use this parameter, see [Testing your KMS
2619
- # API calls][1] in the *Key Management Service Developer Guide*.
2677
+ # To learn more about how to use this parameter, see [Testing your
2678
+ # permissions][1] in the *Key Management Service Developer Guide*.
2620
2679
  #
2621
2680
  #
2622
2681
  #
2623
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2682
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2624
2683
  #
2625
2684
  # @return [Types::DecryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
2626
2685
  #
@@ -2628,6 +2687,7 @@ module Aws::KMS
2628
2687
  # * {Types::DecryptResponse#plaintext #plaintext} => String
2629
2688
  # * {Types::DecryptResponse#encryption_algorithm #encryption_algorithm} => String
2630
2689
  # * {Types::DecryptResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
2690
+ # * {Types::DecryptResponse#key_material_id #key_material_id} => String
2631
2691
  #
2632
2692
  #
2633
2693
  # @example Example: To decrypt data with a symmetric encryption KMS key
@@ -2644,6 +2704,7 @@ module Aws::KMS
2644
2704
  # {
2645
2705
  # encryption_algorithm: "SYMMETRIC_DEFAULT", # The encryption algorithm that was used to decrypt the ciphertext. SYMMETRIC_DEFAULT is the only valid value for symmetric encryption in AWS KMS.
2646
2706
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The Amazon Resource Name (ARN) of the KMS key that was used to decrypt the data.
2707
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to decrypt the ciphertext.
2647
2708
  # plaintext: "<binary data>", # The decrypted (plaintext) data.
2648
2709
  # }
2649
2710
  #
@@ -2710,6 +2771,7 @@ module Aws::KMS
2710
2771
  # resp.plaintext #=> String
2711
2772
  # resp.encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
2712
2773
  # resp.ciphertext_for_recipient #=> String
2774
+ # resp.key_material_id #=> String
2713
2775
  #
2714
2776
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Decrypt AWS API Documentation
2715
2777
  #
@@ -2766,7 +2828,7 @@ module Aws::KMS
2766
2828
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
2767
2829
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2768
2830
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
2769
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2831
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2770
2832
  #
2771
2833
  # @option params [required, String] :alias_name
2772
2834
  # The alias to be deleted. The alias name must begin with `alias/`
@@ -2805,9 +2867,9 @@ module Aws::KMS
2805
2867
  # does not affect the external key store proxy, external key manager, or
2806
2868
  # any external keys.
2807
2869
  #
2808
- # This operation is part of the [custom key stores][1] feature in KMS,
2809
- # which combines the convenience and extensive integration of KMS with
2810
- # the isolation and control of a key store that you own and manage.
2870
+ # This operation is part of the custom key stores feature in KMS, which
2871
+ # combines the convenience and extensive integration of KMS with the
2872
+ # isolation and control of a key store that you own and manage.
2811
2873
  #
2812
2874
  # The custom key store that you delete cannot contain any [KMS keys][2].
2813
2875
  # Before deleting the key store, verify that you will never need to use
@@ -2858,12 +2920,12 @@ module Aws::KMS
2858
2920
  #
2859
2921
  #
2860
2922
  #
2861
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
2923
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
2862
2924
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys
2863
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2925
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2864
2926
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
2865
2927
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2866
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2928
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2867
2929
  #
2868
2930
  # @option params [required, String] :custom_key_store_id
2869
2931
  # Enter the ID of the custom key store you want to delete. To find the
@@ -2925,6 +2987,8 @@ module Aws::KMS
2925
2987
  #
2926
2988
  # * GetParametersForImport
2927
2989
  #
2990
+ # * ListKeyRotations
2991
+ #
2928
2992
  # * ImportKeyMaterial
2929
2993
  #
2930
2994
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -2935,7 +2999,7 @@ module Aws::KMS
2935
2999
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
2936
3000
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
2937
3001
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2938
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3002
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2939
3003
  #
2940
3004
  # @option params [required, String] :key_id
2941
3005
  # Identifies the KMS key from which you are deleting imported key
@@ -2953,7 +3017,19 @@ module Aws::KMS
2953
3017
  # To get the key ID and key ARN for a KMS key, use ListKeys or
2954
3018
  # DescribeKey.
2955
3019
  #
2956
- # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
3020
+ # @option params [String] :key_material_id
3021
+ # Identifies the imported key material you are deleting.
3022
+ #
3023
+ # If no KeyMaterialId is specified, KMS deletes the current key
3024
+ # material.
3025
+ #
3026
+ # To get the list of key material IDs associated with a KMS key, use
3027
+ # ListKeyRotations.
3028
+ #
3029
+ # @return [Types::DeleteImportedKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
3030
+ #
3031
+ # * {Types::DeleteImportedKeyMaterialResponse#key_id #key_id} => String
3032
+ # * {Types::DeleteImportedKeyMaterialResponse#key_material_id #key_material_id} => String
2957
3033
  #
2958
3034
  #
2959
3035
  # @example Example: To delete imported key material
@@ -2962,14 +3038,21 @@ module Aws::KMS
2962
3038
  #
2963
3039
  # resp = client.delete_imported_key_material({
2964
3040
  # key_id: "1234abcd-12ab-34cd-56ef-1234567890ab", # The identifier of the KMS key whose imported key material you are deleting. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
3041
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # Identifies the deleted key material.
2965
3042
  # })
2966
3043
  #
2967
3044
  # @example Request syntax with placeholder values
2968
3045
  #
2969
3046
  # resp = client.delete_imported_key_material({
2970
3047
  # key_id: "KeyIdType", # required
3048
+ # key_material_id: "BackingKeyIdType",
2971
3049
  # })
2972
3050
  #
3051
+ # @example Response structure
3052
+ #
3053
+ # resp.key_id #=> String
3054
+ # resp.key_material_id #=> String
3055
+ #
2973
3056
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterial AWS API Documentation
2974
3057
  #
2975
3058
  # @overload delete_imported_key_material(params = {})
@@ -3072,7 +3155,7 @@ module Aws::KMS
3072
3155
  # [2]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf
3073
3156
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3074
3157
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3075
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3158
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3076
3159
  #
3077
3160
  # @option params [required, String] :key_id
3078
3161
  # Identifies an asymmetric NIST-recommended ECC or SM2 (China Regions
@@ -3140,18 +3223,18 @@ module Aws::KMS
3140
3223
  #
3141
3224
  #
3142
3225
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3143
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3226
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3144
3227
  #
3145
3228
  # @option params [Boolean] :dry_run
3146
3229
  # Checks if your request will succeed. `DryRun` is an optional
3147
3230
  # parameter.
3148
3231
  #
3149
- # To learn more about how to use this parameter, see [Testing your KMS
3150
- # API calls][1] in the *Key Management Service Developer Guide*.
3232
+ # To learn more about how to use this parameter, see [Testing your
3233
+ # permissions][1] in the *Key Management Service Developer Guide*.
3151
3234
  #
3152
3235
  #
3153
3236
  #
3154
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3237
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
3155
3238
  #
3156
3239
  # @option params [Types::RecipientInfo] :recipient
3157
3240
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -3246,9 +3329,9 @@ module Aws::KMS
3246
3329
  # Gets information about [custom key stores][1] in the account and
3247
3330
  # Region.
3248
3331
  #
3249
- # This operation is part of the [custom key stores][1] feature in KMS,
3250
- # which combines the convenience and extensive integration of KMS with
3251
- # the isolation and control of a key store that you own and manage.
3332
+ # This operation is part of the custom key stores feature in KMS, which
3333
+ # combines the convenience and extensive integration of KMS with the
3334
+ # isolation and control of a key store that you own and manage.
3252
3335
  #
3253
3336
  # By default, this operation returns information about all custom key
3254
3337
  # stores in the account and Region. To get only information about a
@@ -3301,11 +3384,11 @@ module Aws::KMS
3301
3384
  #
3302
3385
  #
3303
3386
  #
3304
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
3387
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
3305
3388
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
3306
3389
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
3307
3390
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3308
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3391
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3309
3392
  #
3310
3393
  # @option params [String] :custom_key_store_id
3311
3394
  # Gets only information about the specified custom key store. Enter the
@@ -3503,8 +3586,8 @@ module Aws::KMS
3503
3586
  # * Whether automatic key rotation is enabled on the KMS key. To get
3504
3587
  # this information, use GetKeyRotationStatus. Also, some key states
3505
3588
  # prevent a KMS key from being automatically rotated. For details, see
3506
- # [How Automatic Key Rotation Works][6] in the *Key Management Service
3507
- # Developer Guide*.
3589
+ # [How key rotation works][6] in the *Key Management Service Developer
3590
+ # Guide*.
3508
3591
  #
3509
3592
  # * Tags on the KMS key. To get this information, use ListResourceTags.
3510
3593
  #
@@ -3550,7 +3633,7 @@ module Aws::KMS
3550
3633
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
3551
3634
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-how-it-works
3552
3635
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3553
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3636
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3554
3637
  #
3555
3638
  # @option params [required, String] :key_id
3556
3639
  # Describes the specified KMS key.
@@ -3594,7 +3677,7 @@ module Aws::KMS
3594
3677
  #
3595
3678
  #
3596
3679
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3597
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3680
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3598
3681
  #
3599
3682
  # @return [Types::DescribeKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
3600
3683
  #
@@ -3615,6 +3698,7 @@ module Aws::KMS
3615
3698
  # aws_account_id: "111122223333",
3616
3699
  # arn: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
3617
3700
  # creation_date: Time.parse("2017-07-05T14:04:55-07:00"),
3701
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
3618
3702
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
3619
3703
  # description: "",
3620
3704
  # enabled: true,
@@ -3681,6 +3765,7 @@ module Aws::KMS
3681
3765
  # aws_account_id: "111122223333",
3682
3766
  # arn: "arn:aws:kms:ap-northeast-1:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab",
3683
3767
  # creation_date: Time.parse(1586329200.918),
3768
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
3684
3769
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
3685
3770
  # description: "",
3686
3771
  # enabled: true,
@@ -3837,11 +3922,11 @@ module Aws::KMS
3837
3922
  # resp.key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
3838
3923
  # resp.key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
3839
3924
  # resp.key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
3840
- # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
3925
+ # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
3841
3926
  # resp.key_metadata.encryption_algorithms #=> Array
3842
3927
  # resp.key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
3843
3928
  # resp.key_metadata.signing_algorithms #=> Array
3844
- # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
3929
+ # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
3845
3930
  # resp.key_metadata.key_agreement_algorithms #=> Array
3846
3931
  # resp.key_metadata.key_agreement_algorithms[0] #=> String, one of "ECDH"
3847
3932
  # resp.key_metadata.multi_region #=> Boolean
@@ -3855,6 +3940,7 @@ module Aws::KMS
3855
3940
  # resp.key_metadata.mac_algorithms #=> Array
3856
3941
  # resp.key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
3857
3942
  # resp.key_metadata.xks_key_configuration.id #=> String
3943
+ # resp.key_metadata.current_key_material_id #=> String
3858
3944
  #
3859
3945
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeKey AWS API Documentation
3860
3946
  #
@@ -3868,13 +3954,10 @@ module Aws::KMS
3868
3954
  # Sets the state of a KMS key to disabled. This change temporarily
3869
3955
  # prevents use of the KMS key for [cryptographic operations][1].
3870
3956
  #
3871
- # For more information about how key state affects the use of a KMS key,
3872
- # see [Key states of KMS keys][2] in the <i> <i>Key Management Service
3873
- # Developer Guide</i> </i>.
3874
- #
3875
3957
  # The KMS key that you use for this operation must be in a compatible
3876
- # key state. For details, see [Key states of KMS keys][2] in the *Key
3877
- # Management Service Developer Guide*.
3958
+ # key state. For more information about how key state affects the use of
3959
+ # a KMS key, see [Key states of KMS keys][2] in the <i> <i>Key
3960
+ # Management Service Developer Guide</i> </i>.
3878
3961
  #
3879
3962
  # **Cross-account use**: No. You cannot perform this operation on a KMS
3880
3963
  # key in a different Amazon Web Services account.
@@ -3888,10 +3971,10 @@ module Aws::KMS
3888
3971
  #
3889
3972
  #
3890
3973
  #
3891
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3974
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3892
3975
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3893
3976
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3894
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3977
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3895
3978
  #
3896
3979
  # @option params [required, String] :key_id
3897
3980
  # Identifies the KMS key to disable.
@@ -3980,18 +4063,18 @@ module Aws::KMS
3980
4063
  #
3981
4064
  #
3982
4065
  #
3983
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
4066
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
3984
4067
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
3985
4068
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
3986
4069
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
3987
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
3988
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4070
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4071
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
3989
4072
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
3990
4073
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
3991
4074
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
3992
4075
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3993
4076
  # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3994
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4077
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3995
4078
  #
3996
4079
  # @option params [required, String] :key_id
3997
4080
  # Identifies a symmetric encryption KMS key. You cannot enable or
@@ -4016,7 +4099,7 @@ module Aws::KMS
4016
4099
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks
4017
4100
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4018
4101
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4019
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4102
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4020
4103
  #
4021
4104
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
4022
4105
  #
@@ -4050,9 +4133,9 @@ module Aws::KMS
4050
4133
  # external key store proxy that communicates with your external key
4051
4134
  # manager.
4052
4135
  #
4053
- # This operation is part of the [custom key stores][1] feature in KMS,
4054
- # which combines the convenience and extensive integration of KMS with
4055
- # the isolation and control of a key store that you own and manage.
4136
+ # This operation is part of the custom key stores feature in KMS, which
4137
+ # combines the convenience and extensive integration of KMS with the
4138
+ # isolation and control of a key store that you own and manage.
4056
4139
  #
4057
4140
  # While a custom key store is disconnected, you can manage the custom
4058
4141
  # key store and its KMS keys, but you cannot create or use its KMS keys.
@@ -4096,10 +4179,10 @@ module Aws::KMS
4096
4179
  #
4097
4180
  #
4098
4181
  #
4099
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4100
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4182
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4183
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4101
4184
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4102
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4185
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4103
4186
  #
4104
4187
  # @option params [required, String] :custom_key_store_id
4105
4188
  # Enter the ID of the custom key store you want to disconnect. To find
@@ -4158,10 +4241,10 @@ module Aws::KMS
4158
4241
  #
4159
4242
  #
4160
4243
  #
4161
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4244
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4162
4245
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4163
4246
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4164
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4247
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4165
4248
  #
4166
4249
  # @option params [required, String] :key_id
4167
4250
  # Identifies the KMS key to enable.
@@ -4222,17 +4305,17 @@ module Aws::KMS
4222
4305
  # any in progress rotations. You can use the ListKeyRotations operation
4223
4306
  # to view the details of completed rotations.
4224
4307
  #
4225
- # Automatic key rotation is supported only on [symmetric encryption KMS
4226
- # keys][3]. You cannot enable automatic rotation of [asymmetric KMS
4227
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
4228
- # material][6], or KMS keys in a [custom key store][7]. To enable or
4229
- # disable automatic rotation of a set of related [multi-Region keys][8],
4308
+ # Automatic key rotation is supported only on symmetric encryption KMS
4309
+ # keys. You cannot enable automatic rotation of [asymmetric KMS
4310
+ # keys][3], [HMAC KMS keys][4], KMS keys with [imported key
4311
+ # material][5], or KMS keys in a [custom key store][6]. To enable or
4312
+ # disable automatic rotation of a set of related [multi-Region keys][7],
4230
4313
  # set the property on the primary key.
4231
4314
  #
4232
4315
  # You cannot enable or disable automatic rotation of [Amazon Web
4233
- # Services managed KMS keys][9]. KMS always rotates the key material of
4316
+ # Services managed KMS keys][8]. KMS always rotates the key material of
4234
4317
  # Amazon Web Services managed keys every year. Rotation of [Amazon Web
4235
- # Services owned KMS keys][10] is managed by the Amazon Web Services
4318
+ # Services owned KMS keys][9] is managed by the Amazon Web Services
4236
4319
  # service that owns the key.
4237
4320
  #
4238
4321
  # <note markdown="1"> In May 2022, KMS changed the rotation schedule for Amazon Web Services
@@ -4248,13 +4331,13 @@ module Aws::KMS
4248
4331
  # </note>
4249
4332
  #
4250
4333
  # The KMS key that you use for this operation must be in a compatible
4251
- # key state. For details, see [Key states of KMS keys][11] in the *Key
4334
+ # key state. For details, see [Key states of KMS keys][10] in the *Key
4252
4335
  # Management Service Developer Guide*.
4253
4336
  #
4254
4337
  # **Cross-account use**: No. You cannot perform this operation on a KMS
4255
4338
  # key in a different Amazon Web Services account.
4256
4339
  #
4257
- # **Required permissions**: [kms:EnableKeyRotation][12] (key policy)
4340
+ # **Required permissions**: [kms:EnableKeyRotation][11] (key policy)
4258
4341
  #
4259
4342
  # **Related operations:**
4260
4343
  #
@@ -4273,23 +4356,22 @@ module Aws::KMS
4273
4356
  # </note>
4274
4357
  #
4275
4358
  # **Eventual consistency**: The KMS API follows an eventual consistency
4276
- # model. For more information, see [KMS eventual consistency][13].
4359
+ # model. For more information, see [KMS eventual consistency][12].
4277
4360
  #
4278
4361
  #
4279
4362
  #
4280
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
4363
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
4281
4364
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
4282
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
4283
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4284
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4285
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4286
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4287
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4288
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
4289
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
4290
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4291
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4292
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4365
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4366
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4367
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4368
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4369
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4370
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
4371
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
4372
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4373
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4374
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4293
4375
  #
4294
4376
  # @option params [required, String] :key_id
4295
4377
  # Identifies a symmetric encryption KMS key. You cannot enable automatic
@@ -4315,8 +4397,8 @@ module Aws::KMS
4315
4397
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4316
4398
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4317
4399
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4318
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4319
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4400
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4401
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4320
4402
  #
4321
4403
  # @option params [Integer] :rotation_period_in_days
4322
4404
  # Use this parameter to specify a custom period of time between each
@@ -4448,10 +4530,10 @@ module Aws::KMS
4448
4530
  #
4449
4531
  #
4450
4532
  #
4451
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4533
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4452
4534
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4453
4535
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4454
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4536
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4455
4537
  #
4456
4538
  # @option params [required, String] :key_id
4457
4539
  # Identifies the KMS key to use in the encryption operation. The KMS key
@@ -4504,8 +4586,8 @@ module Aws::KMS
4504
4586
  #
4505
4587
  #
4506
4588
  #
4507
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4508
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4589
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4590
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4509
4591
  #
4510
4592
  # @option params [Array<String>] :grant_tokens
4511
4593
  # A list of grant tokens.
@@ -4518,7 +4600,7 @@ module Aws::KMS
4518
4600
  #
4519
4601
  #
4520
4602
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
4521
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
4603
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
4522
4604
  #
4523
4605
  # @option params [String] :encryption_algorithm
4524
4606
  # Specifies the encryption algorithm that KMS will use to encrypt the
@@ -4536,12 +4618,12 @@ module Aws::KMS
4536
4618
  # Checks if your request will succeed. `DryRun` is an optional
4537
4619
  # parameter.
4538
4620
  #
4539
- # To learn more about how to use this parameter, see [Testing your KMS
4540
- # API calls][1] in the *Key Management Service Developer Guide*.
4621
+ # To learn more about how to use this parameter, see [Testing your
4622
+ # permissions][1] in the *Key Management Service Developer Guide*.
4541
4623
  #
4542
4624
  #
4543
4625
  #
4544
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
4626
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
4545
4627
  #
4546
4628
  # @return [Types::EncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
4547
4629
  #
@@ -4716,7 +4798,7 @@ module Aws::KMS
4716
4798
  #
4717
4799
  #
4718
4800
  #
4719
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4801
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4720
4802
  # [2]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
4721
4803
  # [3]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
4722
4804
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
@@ -4725,7 +4807,7 @@ module Aws::KMS
4725
4807
  # [7]: https://docs.aws.amazon.com/dynamodb-encryption-client/latest/devguide/
4726
4808
  # [8]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
4727
4809
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4728
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4810
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4729
4811
  #
4730
4812
  # @option params [required, String] :key_id
4731
4813
  # Specifies the symmetric encryption KMS key that encrypts the data key.
@@ -4773,7 +4855,7 @@ module Aws::KMS
4773
4855
  #
4774
4856
  #
4775
4857
  #
4776
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4858
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4777
4859
  #
4778
4860
  # @option params [Integer] :number_of_bytes
4779
4861
  # Specifies the length of the data key in bytes. For example, use the
@@ -4803,7 +4885,7 @@ module Aws::KMS
4803
4885
  #
4804
4886
  #
4805
4887
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
4806
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
4888
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
4807
4889
  #
4808
4890
  # @option params [Types::RecipientInfo] :recipient
4809
4891
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -4837,12 +4919,12 @@ module Aws::KMS
4837
4919
  # Checks if your request will succeed. `DryRun` is an optional
4838
4920
  # parameter.
4839
4921
  #
4840
- # To learn more about how to use this parameter, see [Testing your KMS
4841
- # API calls][1] in the *Key Management Service Developer Guide*.
4922
+ # To learn more about how to use this parameter, see [Testing your
4923
+ # permissions][1] in the *Key Management Service Developer Guide*.
4842
4924
  #
4843
4925
  #
4844
4926
  #
4845
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
4927
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
4846
4928
  #
4847
4929
  # @return [Types::GenerateDataKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
4848
4930
  #
@@ -4850,6 +4932,7 @@ module Aws::KMS
4850
4932
  # * {Types::GenerateDataKeyResponse#plaintext #plaintext} => String
4851
4933
  # * {Types::GenerateDataKeyResponse#key_id #key_id} => String
4852
4934
  # * {Types::GenerateDataKeyResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
4935
+ # * {Types::GenerateDataKeyResponse#key_material_id #key_material_id} => String
4853
4936
  #
4854
4937
  #
4855
4938
  # @example Example: To generate a data key
@@ -4866,6 +4949,7 @@ module Aws::KMS
4866
4949
  # {
4867
4950
  # ciphertext_blob: "<binary data>", # The encrypted data key.
4868
4951
  # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the KMS key that was used to encrypt the data key.
4952
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the data key.
4869
4953
  # plaintext: "<binary data>", # The unencrypted (plaintext) data key.
4870
4954
  # }
4871
4955
  #
@@ -4917,6 +5001,7 @@ module Aws::KMS
4917
5001
  # resp.plaintext #=> String
4918
5002
  # resp.key_id #=> String
4919
5003
  # resp.ciphertext_for_recipient #=> String
5004
+ # resp.key_material_id #=> String
4920
5005
  #
4921
5006
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKey AWS API Documentation
4922
5007
  #
@@ -5025,10 +5110,10 @@ module Aws::KMS
5025
5110
  # [3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
5026
5111
  # [4]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
5027
5112
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5028
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5113
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5029
5114
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5030
5115
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5031
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5116
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5032
5117
  #
5033
5118
  # @option params [Hash<String,String>] :encryption_context
5034
5119
  # Specifies the encryption context that will be used when encrypting the
@@ -5051,7 +5136,7 @@ module Aws::KMS
5051
5136
  #
5052
5137
  #
5053
5138
  #
5054
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5139
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5055
5140
  #
5056
5141
  # @option params [required, String] :key_id
5057
5142
  # Specifies the symmetric encryption KMS key that encrypts the private
@@ -5082,10 +5167,11 @@ module Aws::KMS
5082
5167
  # Determines the type of data key pair that is generated.
5083
5168
  #
5084
5169
  # The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys
5085
- # to encrypt and decrypt or to sign and verify (but not both), and the
5086
- # rule that permits you to use ECC KMS keys only to sign and verify, are
5087
- # not effective on data key pairs, which are used outside of KMS. The
5088
- # SM2 key spec is only available in China Regions.
5170
+ # to encrypt and decrypt or to sign and verify (but not both), the rule
5171
+ # that permits you to use ECC KMS keys only to sign and verify, and the
5172
+ # rule that permits you to use ML-DSA key pairs to sign and verify only
5173
+ # are not effective on data key pairs, which are used outside of KMS.
5174
+ # The SM2 key spec is only available in China Regions.
5089
5175
  #
5090
5176
  # @option params [Array<String>] :grant_tokens
5091
5177
  # A list of grant tokens.
@@ -5098,7 +5184,7 @@ module Aws::KMS
5098
5184
  #
5099
5185
  #
5100
5186
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5101
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5187
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5102
5188
  #
5103
5189
  # @option params [Types::RecipientInfo] :recipient
5104
5190
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -5136,12 +5222,12 @@ module Aws::KMS
5136
5222
  # Checks if your request will succeed. `DryRun` is an optional
5137
5223
  # parameter.
5138
5224
  #
5139
- # To learn more about how to use this parameter, see [Testing your KMS
5140
- # API calls][1] in the *Key Management Service Developer Guide*.
5225
+ # To learn more about how to use this parameter, see [Testing your
5226
+ # permissions][1] in the *Key Management Service Developer Guide*.
5141
5227
  #
5142
5228
  #
5143
5229
  #
5144
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5230
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5145
5231
  #
5146
5232
  # @return [Types::GenerateDataKeyPairResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5147
5233
  #
@@ -5151,6 +5237,7 @@ module Aws::KMS
5151
5237
  # * {Types::GenerateDataKeyPairResponse#key_id #key_id} => String
5152
5238
  # * {Types::GenerateDataKeyPairResponse#key_pair_spec #key_pair_spec} => String
5153
5239
  # * {Types::GenerateDataKeyPairResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
5240
+ # * {Types::GenerateDataKeyPairResponse#key_material_id #key_material_id} => String
5154
5241
  #
5155
5242
  #
5156
5243
  # @example Example: To generate an RSA key pair for encryption and decryption
@@ -5166,6 +5253,7 @@ module Aws::KMS
5166
5253
  # resp.to_h outputs the following:
5167
5254
  # {
5168
5255
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The key ARN of the symmetric encryption KMS key that was used to encrypt the private key.
5256
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the private key.
5169
5257
  # key_pair_spec: "RSA_3072", # The actual key spec of the RSA data key pair.
5170
5258
  # private_key_ciphertext_blob: "<binary data>", # The encrypted private key of the RSA data key pair.
5171
5259
  # private_key_plaintext: "<binary data>", # The plaintext private key of the RSA data key pair.
@@ -5193,6 +5281,7 @@ module Aws::KMS
5193
5281
  # {
5194
5282
  # ciphertext_for_recipient: "<binary data>", # The private key of the RSA data key pair encrypted by the public key from the attestation document
5195
5283
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The key ARN of the symmetric encryption KMS key that was used to encrypt the PrivateKeyCiphertextBlob.
5284
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the private key.
5196
5285
  # key_pair_spec: "RSA_3072", # The actual key spec of the RSA data key pair.
5197
5286
  # private_key_ciphertext_blob: "<binary data>", # The private key of the RSA data key pair encrypted by the KMS key.
5198
5287
  # private_key_plaintext: "", # This field is null or empty
@@ -5223,6 +5312,7 @@ module Aws::KMS
5223
5312
  # resp.key_id #=> String
5224
5313
  # resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SM2"
5225
5314
  # resp.ciphertext_for_recipient #=> String
5315
+ # resp.key_material_id #=> String
5226
5316
  #
5227
5317
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPair AWS API Documentation
5228
5318
  #
@@ -5301,10 +5391,10 @@ module Aws::KMS
5301
5391
  #
5302
5392
  #
5303
5393
  # [1]: https://tools.ietf.org/html/rfc5280
5304
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5394
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5305
5395
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5306
5396
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5307
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5397
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5308
5398
  #
5309
5399
  # @option params [Hash<String,String>] :encryption_context
5310
5400
  # Specifies the encryption context that will be used when encrypting the
@@ -5327,7 +5417,7 @@ module Aws::KMS
5327
5417
  #
5328
5418
  #
5329
5419
  #
5330
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5420
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5331
5421
  #
5332
5422
  # @option params [required, String] :key_id
5333
5423
  # Specifies the symmetric encryption KMS key that encrypts the private
@@ -5358,10 +5448,11 @@ module Aws::KMS
5358
5448
  # Determines the type of data key pair that is generated.
5359
5449
  #
5360
5450
  # The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys
5361
- # to encrypt and decrypt or to sign and verify (but not both), and the
5362
- # rule that permits you to use ECC KMS keys only to sign and verify, are
5363
- # not effective on data key pairs, which are used outside of KMS. The
5364
- # SM2 key spec is only available in China Regions.
5451
+ # to encrypt and decrypt or to sign and verify (but not both), the rule
5452
+ # that permits you to use ECC KMS keys only to sign and verify, and the
5453
+ # rule that permits you to use ML-DSA key pairs to sign and verify only
5454
+ # are not effective on data key pairs, which are used outside of KMS.
5455
+ # The SM2 key spec is only available in China Regions.
5365
5456
  #
5366
5457
  # @option params [Array<String>] :grant_tokens
5367
5458
  # A list of grant tokens.
@@ -5374,18 +5465,18 @@ module Aws::KMS
5374
5465
  #
5375
5466
  #
5376
5467
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5377
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5468
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5378
5469
  #
5379
5470
  # @option params [Boolean] :dry_run
5380
5471
  # Checks if your request will succeed. `DryRun` is an optional
5381
5472
  # parameter.
5382
5473
  #
5383
- # To learn more about how to use this parameter, see [Testing your KMS
5384
- # API calls][1] in the *Key Management Service Developer Guide*.
5474
+ # To learn more about how to use this parameter, see [Testing your
5475
+ # permissions][1] in the *Key Management Service Developer Guide*.
5385
5476
  #
5386
5477
  #
5387
5478
  #
5388
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5479
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5389
5480
  #
5390
5481
  # @return [Types::GenerateDataKeyPairWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5391
5482
  #
@@ -5393,6 +5484,7 @@ module Aws::KMS
5393
5484
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#public_key #public_key} => String
5394
5485
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_id #key_id} => String
5395
5486
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_pair_spec #key_pair_spec} => String
5487
+ # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_material_id #key_material_id} => String
5396
5488
  #
5397
5489
  #
5398
5490
  # @example Example: To generate an asymmetric data key pair without a plaintext key
@@ -5408,6 +5500,7 @@ module Aws::KMS
5408
5500
  # resp.to_h outputs the following:
5409
5501
  # {
5410
5502
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The key ARN of the symmetric encryption KMS key that encrypted the private key in the ECC asymmetric data key pair.
5503
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the private key.
5411
5504
  # key_pair_spec: "ECC_NIST_P521", # The actual key spec of the ECC asymmetric data key pair.
5412
5505
  # private_key_ciphertext_blob: "<binary data>", # The encrypted private key of the asymmetric ECC data key pair.
5413
5506
  # public_key: "<binary data>", # The public key (plaintext).
@@ -5431,6 +5524,7 @@ module Aws::KMS
5431
5524
  # resp.public_key #=> String
5432
5525
  # resp.key_id #=> String
5433
5526
  # resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SM2"
5527
+ # resp.key_material_id #=> String
5434
5528
  #
5435
5529
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintext AWS API Documentation
5436
5530
  #
@@ -5520,10 +5614,10 @@ module Aws::KMS
5520
5614
  #
5521
5615
  #
5522
5616
  #
5523
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5617
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5524
5618
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5525
5619
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5526
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5620
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5527
5621
  #
5528
5622
  # @option params [required, String] :key_id
5529
5623
  # Specifies the symmetric encryption KMS key that encrypts the data key.
@@ -5571,7 +5665,7 @@ module Aws::KMS
5571
5665
  #
5572
5666
  #
5573
5667
  #
5574
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5668
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5575
5669
  #
5576
5670
  # @option params [String] :key_spec
5577
5671
  # The length of the data key. Use `AES_128` to generate a 128-bit
@@ -5594,23 +5688,24 @@ module Aws::KMS
5594
5688
  #
5595
5689
  #
5596
5690
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5597
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5691
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5598
5692
  #
5599
5693
  # @option params [Boolean] :dry_run
5600
5694
  # Checks if your request will succeed. `DryRun` is an optional
5601
5695
  # parameter.
5602
5696
  #
5603
- # To learn more about how to use this parameter, see [Testing your KMS
5604
- # API calls][1] in the *Key Management Service Developer Guide*.
5697
+ # To learn more about how to use this parameter, see [Testing your
5698
+ # permissions][1] in the *Key Management Service Developer Guide*.
5605
5699
  #
5606
5700
  #
5607
5701
  #
5608
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5702
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5609
5703
  #
5610
5704
  # @return [Types::GenerateDataKeyWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5611
5705
  #
5612
5706
  # * {Types::GenerateDataKeyWithoutPlaintextResponse#ciphertext_blob #ciphertext_blob} => String
5613
5707
  # * {Types::GenerateDataKeyWithoutPlaintextResponse#key_id #key_id} => String
5708
+ # * {Types::GenerateDataKeyWithoutPlaintextResponse#key_material_id #key_material_id} => String
5614
5709
  #
5615
5710
  #
5616
5711
  # @example Example: To generate an encrypted data key
@@ -5627,6 +5722,7 @@ module Aws::KMS
5627
5722
  # {
5628
5723
  # ciphertext_blob: "<binary data>", # The encrypted data key.
5629
5724
  # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the KMS key that was used to encrypt the data key.
5725
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the data key.
5630
5726
  # }
5631
5727
  #
5632
5728
  # @example Request syntax with placeholder values
@@ -5646,6 +5742,7 @@ module Aws::KMS
5646
5742
  #
5647
5743
  # resp.ciphertext_blob #=> String
5648
5744
  # resp.key_id #=> String
5745
+ # resp.key_material_id #=> String
5649
5746
  #
5650
5747
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintext AWS API Documentation
5651
5748
  #
@@ -5700,7 +5797,7 @@ module Aws::KMS
5700
5797
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
5701
5798
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5702
5799
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5703
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5800
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5704
5801
  #
5705
5802
  # @option params [required, String, StringIO, File] :message
5706
5803
  # The message to be hashed. Specify a message of up to 4,096 bytes.
@@ -5739,18 +5836,18 @@ module Aws::KMS
5739
5836
  #
5740
5837
  #
5741
5838
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5742
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5839
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5743
5840
  #
5744
5841
  # @option params [Boolean] :dry_run
5745
5842
  # Checks if your request will succeed. `DryRun` is an optional
5746
5843
  # parameter.
5747
5844
  #
5748
- # To learn more about how to use this parameter, see [Testing your KMS
5749
- # API calls][1] in the *Key Management Service Developer Guide*.
5845
+ # To learn more about how to use this parameter, see [Testing your
5846
+ # permissions][1] in the *Key Management Service Developer Guide*.
5750
5847
  #
5751
5848
  #
5752
5849
  #
5753
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5850
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5754
5851
  #
5755
5852
  # @return [Types::GenerateMacResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5756
5853
  #
@@ -5824,7 +5921,8 @@ module Aws::KMS
5824
5921
  # Management Service Developer Guide*.
5825
5922
  #
5826
5923
  # For more information about entropy and random number generation, see
5827
- # [Key Management Service Cryptographic Details][4].
5924
+ # [Entropy and random number generation][4] in the *Key Management
5925
+ # Service Developer Guide*.
5828
5926
  #
5829
5927
  # **Cross-account use**: Not applicable. `GenerateRandom` does not use
5830
5928
  # any account-specific resources, such as KMS keys.
@@ -5839,9 +5937,9 @@ module Aws::KMS
5839
5937
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
5840
5938
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
5841
5939
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5842
- # [4]: https://docs.aws.amazon.com/kms/latest/cryptographic-details/
5940
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#entropy-and-random-numbers
5843
5941
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5844
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5942
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5845
5943
  #
5846
5944
  # @option params [Integer] :number_of_bytes
5847
5945
  # The length of the random byte string. This parameter is required.
@@ -5961,7 +6059,7 @@ module Aws::KMS
5961
6059
  #
5962
6060
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5963
6061
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
5964
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6062
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5965
6063
  #
5966
6064
  # @option params [required, String] :key_id
5967
6065
  # Gets the key policy for the specified KMS key.
@@ -6029,16 +6127,16 @@ module Aws::KMS
6029
6127
  # enabled for the specified KMS key, the [rotation period][2], and the
6030
6128
  # next scheduled rotation date.
6031
6129
  #
6032
- # Automatic key rotation is supported only on [symmetric encryption KMS
6033
- # keys][3]. You cannot enable automatic rotation of [asymmetric KMS
6034
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
6035
- # material][6], or KMS keys in a [custom key store][7]. To enable or
6036
- # disable automatic rotation of a set of related [multi-Region keys][8],
6037
- # set the property on the primary key..
6130
+ # Automatic key rotation is supported only on symmetric encryption KMS
6131
+ # keys. You cannot enable automatic rotation of [asymmetric KMS
6132
+ # keys][3], [HMAC KMS keys][4], KMS keys with [imported key
6133
+ # material][5], or KMS keys in a [custom key store][6]. To enable or
6134
+ # disable automatic rotation of a set of related [multi-Region keys][7],
6135
+ # set the property on the primary key.
6038
6136
  #
6039
6137
  # You can enable (EnableKeyRotation) and disable automatic rotation
6040
6138
  # (DisableKeyRotation) of the key material in customer managed KMS keys.
6041
- # Key material rotation of [Amazon Web Services managed KMS keys][9] is
6139
+ # Key material rotation of [Amazon Web Services managed KMS keys][8] is
6042
6140
  # not configurable. KMS always rotates the key material in Amazon Web
6043
6141
  # Services managed KMS keys every year. The key rotation status for
6044
6142
  # Amazon Web Services managed KMS keys is always `true`.
@@ -6057,7 +6155,7 @@ module Aws::KMS
6057
6155
  # </note>
6058
6156
  #
6059
6157
  # The KMS key that you use for this operation must be in a compatible
6060
- # key state. For details, see [Key states of KMS keys][10] in the *Key
6158
+ # key state. For details, see [Key states of KMS keys][9] in the *Key
6061
6159
  # Management Service Developer Guide*.
6062
6160
  #
6063
6161
  # * Disabled: The key rotation status does not change when you disable a
@@ -6078,7 +6176,7 @@ module Aws::KMS
6078
6176
  # a different Amazon Web Services account, specify the key ARN in the
6079
6177
  # value of the `KeyId` parameter.
6080
6178
  #
6081
- # **Required permissions**: [kms:GetKeyRotationStatus][11] (key policy)
6179
+ # **Required permissions**: [kms:GetKeyRotationStatus][10] (key policy)
6082
6180
  #
6083
6181
  # **Related operations:**
6084
6182
  #
@@ -6091,22 +6189,21 @@ module Aws::KMS
6091
6189
  # * RotateKeyOnDemand
6092
6190
  #
6093
6191
  # **Eventual consistency**: The KMS API follows an eventual consistency
6094
- # model. For more information, see [KMS eventual consistency][12].
6192
+ # model. For more information, see [KMS eventual consistency][11].
6095
6193
  #
6096
6194
  #
6097
6195
  #
6098
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
6196
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
6099
6197
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotation-period
6100
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
6101
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
6102
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
6103
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6104
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
6105
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
6106
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
6107
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6108
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6109
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6198
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
6199
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
6200
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6201
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6202
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
6203
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
6204
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6205
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6206
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6110
6207
  #
6111
6208
  # @option params [required, String] :key_id
6112
6209
  # Gets the rotation status for the specified KMS key.
@@ -6180,9 +6277,7 @@ module Aws::KMS
6180
6277
  # By default, KMS keys are created with key material that KMS generates.
6181
6278
  # This operation supports [Importing key material][1], an advanced
6182
6279
  # feature that lets you generate and import the cryptographic key
6183
- # material for a KMS key. For more information about importing key
6184
- # material into KMS, see [Importing key material][1] in the *Key
6185
- # Management Service Developer Guide*.
6280
+ # material for a KMS key.
6186
6281
  #
6187
6282
  # Before calling `GetParametersForImport`, use the CreateKey operation
6188
6283
  # with an `Origin` value of `EXTERNAL` to create a KMS key with no key
@@ -6251,11 +6346,11 @@ module Aws::KMS
6251
6346
  #
6252
6347
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6253
6348
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6254
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
6255
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
6349
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6350
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#reimport-key-material
6256
6351
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6257
6352
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6258
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6353
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6259
6354
  #
6260
6355
  # @option params [required, String] :key_id
6261
6356
  # The identifier of the KMS key that will be associated with the
@@ -6279,9 +6374,8 @@ module Aws::KMS
6279
6374
  # @option params [required, String] :wrapping_algorithm
6280
6375
  # The algorithm you will use with the RSA public key (`PublicKey`) in
6281
6376
  # the response to protect your key material during import. For more
6282
- # information, see [Select a wrapping
6283
- # algorithm](kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm)
6284
- # in the *Key Management Service Developer Guide*.
6377
+ # information, see [Select a wrapping algorithm][1] in the *Key
6378
+ # Management Service Developer Guide*.
6285
6379
  #
6286
6380
  # For RSA\_AES wrapping algorithms, you encrypt your key material with
6287
6381
  # an AES key that you generate, then encrypt your AES key with the RSA
@@ -6313,6 +6407,10 @@ module Aws::KMS
6313
6407
  # * **RSAES\_PKCS1\_V1\_5** (Deprecated) — As of October 10, 2023, KMS
6314
6408
  # does not support the RSAES\_PKCS1\_V1\_5 wrapping algorithm.
6315
6409
  #
6410
+ #
6411
+ #
6412
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm
6413
+ #
6316
6414
  # @option params [required, String] :wrapping_key_spec
6317
6415
  # The type of RSA public key to return in the response. You will use
6318
6416
  # this wrapping key with the specified wrapping algorithm to protect
@@ -6460,8 +6558,9 @@ module Aws::KMS
6460
6558
  # * [KeyUsage][3]: Whether the key is used for encryption, signing, or
6461
6559
  # deriving a shared secret.
6462
6560
  #
6463
- # * [EncryptionAlgorithms][4] or [SigningAlgorithms][5]: A list of the
6464
- # encryption algorithms or the signing algorithms for the key.
6561
+ # * [EncryptionAlgorithms][4], [KeyAgreementAlgorithms][5], or
6562
+ # [SigningAlgorithms][6]: A list of the encryption algorithms, key
6563
+ # agreement algorithms, or signing algorithms for the key.
6465
6564
  #
6466
6565
  # Although KMS cannot enforce these restrictions on external operations,
6467
6566
  # it is crucial that you use this information to prevent the public key
@@ -6474,22 +6573,22 @@ module Aws::KMS
6474
6573
  # To verify a signature outside of KMS with an SM2 public key (China
6475
6574
  # Regions only), you must specify the distinguishing ID. By default, KMS
6476
6575
  # uses `1234567812345678` as the distinguishing ID. For more
6477
- # information, see [Offline verification with SM2 key pairs][6].
6576
+ # information, see [Offline verification with SM2 key pairs][7].
6478
6577
  #
6479
6578
  # The KMS key that you use for this operation must be in a compatible
6480
- # key state. For details, see [Key states of KMS keys][7] in the *Key
6579
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
6481
6580
  # Management Service Developer Guide*.
6482
6581
  #
6483
6582
  # **Cross-account use**: Yes. To perform this operation with a KMS key
6484
6583
  # in a different Amazon Web Services account, specify the key ARN or
6485
6584
  # alias ARN in the value of the `KeyId` parameter.
6486
6585
  #
6487
- # **Required permissions**: [kms:GetPublicKey][8] (key policy)
6586
+ # **Required permissions**: [kms:GetPublicKey][9] (key policy)
6488
6587
  #
6489
6588
  # **Related operations**: CreateKey
6490
6589
  #
6491
6590
  # **Eventual consistency**: The KMS API follows an eventual consistency
6492
- # model. For more information, see [KMS eventual consistency][9].
6591
+ # model. For more information, see [KMS eventual consistency][10].
6493
6592
  #
6494
6593
  #
6495
6594
  #
@@ -6497,11 +6596,12 @@ module Aws::KMS
6497
6596
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeySpec
6498
6597
  # [3]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyUsage
6499
6598
  # [4]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-EncryptionAlgorithms
6500
- # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
6501
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
6502
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6503
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6504
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6599
+ # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyAgreementAlgorithms
6600
+ # [6]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
6601
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
6602
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6603
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6604
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6505
6605
  #
6506
6606
  # @option params [required, String] :key_id
6507
6607
  # Identifies the asymmetric KMS key that includes the public key.
@@ -6536,7 +6636,7 @@ module Aws::KMS
6536
6636
  #
6537
6637
  #
6538
6638
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
6539
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6639
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
6540
6640
  #
6541
6641
  # @return [Types::GetPublicKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
6542
6642
  #
@@ -6584,12 +6684,12 @@ module Aws::KMS
6584
6684
  # resp.key_id #=> String
6585
6685
  # resp.public_key #=> String
6586
6686
  # resp.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
6587
- # resp.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
6687
+ # resp.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
6588
6688
  # resp.key_usage #=> String, one of "SIGN_VERIFY", "ENCRYPT_DECRYPT", "GENERATE_VERIFY_MAC", "KEY_AGREEMENT"
6589
6689
  # resp.encryption_algorithms #=> Array
6590
6690
  # resp.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
6591
6691
  # resp.signing_algorithms #=> Array
6592
- # resp.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
6692
+ # resp.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
6593
6693
  # resp.key_agreement_algorithms #=> Array
6594
6694
  # resp.key_agreement_algorithms[0] #=> String, one of "ECDH"
6595
6695
  #
@@ -6603,53 +6703,47 @@ module Aws::KMS
6603
6703
  end
6604
6704
 
6605
6705
  # Imports or reimports key material into an existing KMS key that was
6606
- # created without key material. `ImportKeyMaterial` also sets the
6607
- # expiration model and expiration date of the imported key material.
6608
- #
6609
- # By default, KMS keys are created with key material that KMS generates.
6610
- # This operation supports [Importing key material][1], an advanced
6611
- # feature that lets you generate and import the cryptographic key
6612
- # material for a KMS key. For more information about importing key
6613
- # material into KMS, see [Importing key material][1] in the *Key
6614
- # Management Service Developer Guide*.
6706
+ # created without key material. You can also use this operation to set
6707
+ # or update the expiration model and expiration date of the imported key
6708
+ # material.
6615
6709
  #
6616
- # After you successfully import key material into a KMS key, you can
6617
- # [reimport the same key material][2] into that KMS key, but you cannot
6618
- # import different key material. You might reimport key material to
6619
- # replace key material that expired or key material that you deleted.
6620
- # You might also reimport key material to change the expiration model or
6621
- # expiration date of the key material.
6710
+ # By default, KMS creates KMS keys with key material that it generates.
6711
+ # You can also generate and import your own key material. For more
6712
+ # information about importing key material, see [Importing key
6713
+ # material][1].
6714
+ #
6715
+ # For asymmetric, HMAC and multi-Region keys, you cannot change the key
6716
+ # material after the initial import. You can import multiple key
6717
+ # materials into single-Region, symmetric encryption keys and rotate the
6718
+ # key material on demand using `RotateKeyOnDemand`.
6719
+ #
6720
+ # After you import key material, you can [reimport the same key
6721
+ # material][2] into that KMS key or, if the key supports on-demand
6722
+ # rotation, import new key material. You can use the `ImportType`
6723
+ # parameter to indicate whether you are importing new key material or
6724
+ # re-importing previously imported key material. You might reimport key
6725
+ # material to replace key material that expired or key material that you
6726
+ # deleted. You might also reimport key material to change the expiration
6727
+ # model or expiration date of the key material.
6622
6728
  #
6623
6729
  # Each time you import key material into KMS, you can determine whether
6624
6730
  # (`ExpirationModel`) and when (`ValidTo`) the key material expires. To
6625
6731
  # change the expiration of your key material, you must import it again,
6626
6732
  # either by calling `ImportKeyMaterial` or using the [import
6627
- # features](kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console)
6628
- # of the KMS console.
6733
+ # features][3] of the KMS console.
6629
6734
  #
6630
- # Before calling `ImportKeyMaterial`:
6735
+ # Before you call `ImportKeyMaterial`, complete these steps:
6631
6736
  #
6632
- # * Create or identify a KMS key with no key material. The KMS key must
6633
- # have an `Origin` value of `EXTERNAL`, which indicates that the KMS
6634
- # key is designed for imported key material.
6737
+ # * Create or identify a KMS key with `EXTERNAL` origin, which indicates
6738
+ # that the KMS key is designed for imported key material.
6635
6739
  #
6636
- # To create an new KMS key for imported key material, call the
6740
+ # To create a new KMS key for imported key material, call the
6637
6741
  # CreateKey operation with an `Origin` value of `EXTERNAL`. You can
6638
6742
  # create a symmetric encryption KMS key, HMAC KMS key, asymmetric
6639
- # encryption KMS key, or asymmetric signing KMS key. You can also
6640
- # import key material into a [multi-Region
6641
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of
6642
- # any supported type. However, you can't import key material into a
6643
- # KMS key in a [custom key
6644
- # store](kms/latest/developerguide/custom-key-store-overview.html).
6645
- #
6646
- # * Use the DescribeKey operation to verify that the `KeyState` of the
6647
- # KMS key is `PendingImport`, which indicates that the KMS key has no
6648
- # key material.
6649
- #
6650
- # If you are reimporting the same key material into an existing KMS
6651
- # key, you might need to call the DeleteImportedKeyMaterial to delete
6652
- # its existing key material.
6743
+ # encryption KMS key, asymmetric key agreement key, or asymmetric
6744
+ # signing KMS key. You can also import key material into a
6745
+ # [multi-Region key][4] of any supported type. However, you can't
6746
+ # import key material into a KMS key in a [custom key store][5].
6653
6747
  #
6654
6748
  # * Call the GetParametersForImport operation to get a public key and
6655
6749
  # import token set for importing key material.
@@ -6664,10 +6758,9 @@ module Aws::KMS
6664
6758
  # * The key ID or key ARN of the KMS key to associate with the imported
6665
6759
  # key material. Its `Origin` must be `EXTERNAL` and its `KeyState`
6666
6760
  # must be `PendingImport`. You cannot perform this operation on a KMS
6667
- # key in a [custom key
6668
- # store](kms/latest/developerguide/custom-key-store-overview.html), or
6669
- # on a KMS key in a different Amazon Web Services account. To get the
6670
- # `Origin` and `KeyState` of a KMS key, call DescribeKey.
6761
+ # key in a [custom key store][5], or on a KMS key in a different
6762
+ # Amazon Web Services account. To get the `Origin` and `KeyState` of a
6763
+ # KMS key, call DescribeKey.
6671
6764
  #
6672
6765
  # * The encrypted key material.
6673
6766
  #
@@ -6677,7 +6770,7 @@ module Aws::KMS
6677
6770
  #
6678
6771
  # * Whether the key material expires (`ExpirationModel`) and, if so,
6679
6772
  # when (`ValidTo`). For help with this choice, see [Setting an
6680
- # expiration time][3] in the *Key Management Service Developer Guide*.
6773
+ # expiration time][6] in the *Key Management Service Developer Guide*.
6681
6774
  #
6682
6775
  # If you set an expiration date, KMS deletes the key material from the
6683
6776
  # KMS key on the specified date, making the KMS key unusable. To use
@@ -6689,23 +6782,27 @@ module Aws::KMS
6689
6782
  #
6690
6783
  # When this operation is successful, the key state of the KMS key
6691
6784
  # changes from `PendingImport` to `Enabled`, and you can use the KMS key
6692
- # in cryptographic operations.
6785
+ # in cryptographic operations. For single-Region, symmetric encryption
6786
+ # keys, you will need to import all of the key materials associated with
6787
+ # the KMS key to change its state to `Enabled`. Use the
6788
+ # `ListKeyRotations` operation to list the ID and import state of each
6789
+ # key material associated with a KMS key.
6693
6790
  #
6694
6791
  # If this operation fails, use the exception to help determine the
6695
6792
  # problem. If the error is related to the key material, the import
6696
6793
  # token, or wrapping key, use GetParametersForImport to get a new public
6697
6794
  # key and import token for the KMS key and repeat the import procedure.
6698
- # For help, see [How To Import Key Material][4] in the *Key Management
6699
- # Service Developer Guide*.
6795
+ # For help, see [Create a KMS key with imported key material][7] in the
6796
+ # *Key Management Service Developer Guide*.
6700
6797
  #
6701
6798
  # The KMS key that you use for this operation must be in a compatible
6702
- # key state. For details, see [Key states of KMS keys][5] in the *Key
6799
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
6703
6800
  # Management Service Developer Guide*.
6704
6801
  #
6705
6802
  # **Cross-account use**: No. You cannot perform this operation on a KMS
6706
6803
  # key in a different Amazon Web Services account.
6707
6804
  #
6708
- # **Required permissions**: [kms:ImportKeyMaterial][6] (key policy)
6805
+ # **Required permissions**: [kms:ImportKeyMaterial][9] (key policy)
6709
6806
  #
6710
6807
  # **Related operations:**
6711
6808
  #
@@ -6713,18 +6810,25 @@ module Aws::KMS
6713
6810
  #
6714
6811
  # * GetParametersForImport
6715
6812
  #
6813
+ # * ListKeyRotations
6814
+ #
6815
+ # * RotateKeyOnDemand
6816
+ #
6716
6817
  # **Eventual consistency**: The KMS API follows an eventual consistency
6717
- # model. For more information, see [KMS eventual consistency][7].
6818
+ # model. For more information, see [KMS eventual consistency][10].
6718
6819
  #
6719
6820
  #
6720
6821
  #
6721
6822
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6722
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
6723
- # [3]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
6724
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#importing-keys-overview
6725
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6726
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6727
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6823
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#reimport-key-material
6824
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console
6825
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6826
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6827
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
6828
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-conceptual.html
6829
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6830
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6831
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6728
6832
  #
6729
6833
  # @option params [required, String] :key_id
6730
6834
  # The identifier of the KMS key that will be associated with the
@@ -6735,11 +6839,9 @@ module Aws::KMS
6735
6839
  #
6736
6840
  # The KMS key can be a symmetric encryption KMS key, HMAC KMS key,
6737
6841
  # asymmetric encryption KMS key, or asymmetric signing KMS key,
6738
- # including a [multi-Region
6739
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of any
6740
- # supported type. You cannot perform this operation on a KMS key in a
6741
- # custom key store, or on a KMS key in a different Amazon Web Services
6742
- # account.
6842
+ # including a [multi-Region key][1] of any supported type. You cannot
6843
+ # perform this operation on a KMS key in a custom key store, or on a KMS
6844
+ # key in a different Amazon Web Services account.
6743
6845
  #
6744
6846
  # Specify the key ID or key ARN of the KMS key.
6745
6847
  #
@@ -6753,6 +6855,10 @@ module Aws::KMS
6753
6855
  # To get the key ID and key ARN for a KMS key, use ListKeys or
6754
6856
  # DescribeKey.
6755
6857
  #
6858
+ #
6859
+ #
6860
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6861
+ #
6756
6862
  # @option params [required, String, StringIO, File] :import_token
6757
6863
  # The import token that you received in the response to a previous
6758
6864
  # GetParametersForImport request. It must be from the same response that
@@ -6797,9 +6903,48 @@ module Aws::KMS
6797
6903
  #
6798
6904
  #
6799
6905
  #
6800
- # [1]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
6906
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
6801
6907
  #
6802
- # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
6908
+ # @option params [String] :import_type
6909
+ # Indicates whether the key material being imported is previously
6910
+ # associated with this KMS key or not. This parameter is optional and
6911
+ # only usable with symmetric encryption keys. If no key material has
6912
+ # ever been imported into the KMS key, and this parameter is omitted,
6913
+ # the parameter defaults to `NEW_KEY_MATERIAL`. After the first key
6914
+ # material is imported, if this parameter is omitted then the parameter
6915
+ # defaults to `EXISTING_KEY_MATERIAL`.
6916
+ #
6917
+ # @option params [String] :key_material_description
6918
+ # Description for the key material being imported. This parameter is
6919
+ # optional and only usable with symmetric encryption keys. If you do not
6920
+ # specify a key material description, KMS retains the value you
6921
+ # specified when you last imported the same key material into this KMS
6922
+ # key.
6923
+ #
6924
+ # @option params [String] :key_material_id
6925
+ # Identifies the key material being imported. This parameter is optional
6926
+ # and only usable with symmetric encryption keys. You cannot specify a
6927
+ # key material ID with `ImportType` set to `NEW_KEY_MATERIAL`. Whenever
6928
+ # you import key material into a symmetric encryption key, KMS assigns a
6929
+ # unique identifier to the key material based on the KMS key ID and the
6930
+ # imported key material. When you re-import key material with a
6931
+ # specified key material ID, KMS:
6932
+ #
6933
+ # * Computes the identifier for the key material
6934
+ #
6935
+ # * Matches the computed identifier against the specified key material
6936
+ # ID
6937
+ #
6938
+ # * Verifies that the key material ID is already associated with the KMS
6939
+ # key
6940
+ #
6941
+ # To get the list of key material IDs associated with a KMS key, use
6942
+ # ListKeyRotations.
6943
+ #
6944
+ # @return [Types::ImportKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
6945
+ #
6946
+ # * {Types::ImportKeyMaterialResponse#key_id #key_id} => String
6947
+ # * {Types::ImportKeyMaterialResponse#key_material_id #key_material_id} => String
6803
6948
  #
6804
6949
  #
6805
6950
  # @example Example: To import key material into a KMS key
@@ -6813,6 +6958,12 @@ module Aws::KMS
6813
6958
  # key_id: "1234abcd-12ab-34cd-56ef-1234567890ab", # The identifier of the KMS key to import the key material into. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
6814
6959
  # })
6815
6960
  #
6961
+ # resp.to_h outputs the following:
6962
+ # {
6963
+ # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The Amazon Resource Name (ARN) of the KMS key into which key material was imported.
6964
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # Identifies the imported key material.
6965
+ # }
6966
+ #
6816
6967
  # @example Example: To import key material into a KMS key
6817
6968
  #
6818
6969
  # # The following example imports key material that expires in 3 days. It might be part of an application that frequently
@@ -6826,6 +6977,12 @@ module Aws::KMS
6826
6977
  # valid_to: Time.parse("2023-09-30T00:00:00-00:00"), # Specifies the date and time when the imported key material expires.
6827
6978
  # })
6828
6979
  #
6980
+ # resp.to_h outputs the following:
6981
+ # {
6982
+ # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The Amazon Resource Name (ARN) of the KMS key into which key material was imported.
6983
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # Identifies the imported key material.
6984
+ # }
6985
+ #
6829
6986
  # @example Request syntax with placeholder values
6830
6987
  #
6831
6988
  # resp = client.import_key_material({
@@ -6834,8 +6991,16 @@ module Aws::KMS
6834
6991
  # encrypted_key_material: "data", # required
6835
6992
  # valid_to: Time.now,
6836
6993
  # expiration_model: "KEY_MATERIAL_EXPIRES", # accepts KEY_MATERIAL_EXPIRES, KEY_MATERIAL_DOES_NOT_EXPIRE
6994
+ # import_type: "NEW_KEY_MATERIAL", # accepts NEW_KEY_MATERIAL, EXISTING_KEY_MATERIAL
6995
+ # key_material_description: "KeyMaterialDescriptionType",
6996
+ # key_material_id: "BackingKeyIdType",
6837
6997
  # })
6838
6998
  #
6999
+ # @example Response structure
7000
+ #
7001
+ # resp.key_id #=> String
7002
+ # resp.key_material_id #=> String
7003
+ #
6839
7004
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterial AWS API Documentation
6840
7005
  #
6841
7006
  # @overload import_key_material(params = {})
@@ -6886,10 +7051,10 @@ module Aws::KMS
6886
7051
  #
6887
7052
  #
6888
7053
  #
6889
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/limits.html#aliases-limit
7054
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/resource-limits.html#aliases-per-key
6890
7055
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6891
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
6892
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7056
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html
7057
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6893
7058
  #
6894
7059
  # @option params [String] :key_id
6895
7060
  # Lists only aliases that are associated with the specified KMS key.
@@ -7021,8 +7186,9 @@ module Aws::KMS
7021
7186
  #
7022
7187
  # For detailed information about grants, including grant terminology,
7023
7188
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
7024
- # Guide</i> </i>. For examples of working with grants in several
7025
- # programming languages, see [Programming grants][2].
7189
+ # Guide</i> </i>. For examples of creating grants in several programming
7190
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
7191
+ # CLI][2].
7026
7192
  #
7027
7193
  # <note markdown="1"> The `GranteePrincipal` field in the `ListGrants` response usually
7028
7194
  # contains the user or role designated as the grantee principal in the
@@ -7055,10 +7221,10 @@ module Aws::KMS
7055
7221
  #
7056
7222
  #
7057
7223
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
7058
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
7224
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
7059
7225
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services
7060
7226
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7061
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7227
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7062
7228
  #
7063
7229
  # @option params [Integer] :limit
7064
7230
  # Use this parameter to specify the maximum number of items to return.
@@ -7234,7 +7400,7 @@ module Aws::KMS
7234
7400
  #
7235
7401
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7236
7402
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
7237
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7403
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7238
7404
  #
7239
7405
  # @option params [required, String] :key_id
7240
7406
  # Gets the names of key policies for the specified KMS key.
@@ -7316,14 +7482,15 @@ module Aws::KMS
7316
7482
  req.send_request(options)
7317
7483
  end
7318
7484
 
7319
- # Returns information about all completed key material rotations for the
7320
- # specified KMS key.
7485
+ # Returns information about the key materials associated with the
7486
+ # specified KMS key. You can use the optional `IncludeKeyMaterial`
7487
+ # parameter to control which key materials are included in the response.
7321
7488
  #
7322
7489
  # You must specify the KMS key in all requests. You can refine the key
7323
7490
  # rotations list by limiting the number of rotations returned.
7324
7491
  #
7325
7492
  # For detailed information about automatic and on-demand key rotations,
7326
- # see [Rotating KMS keys][1] in the *Key Management Service Developer
7493
+ # see [Rotate KMS keys][1] in the *Key Management Service Developer
7327
7494
  # Guide*.
7328
7495
  #
7329
7496
  # **Cross-account use**: No. You cannot perform this operation on a KMS
@@ -7335,10 +7502,14 @@ module Aws::KMS
7335
7502
  #
7336
7503
  # * EnableKeyRotation
7337
7504
  #
7505
+ # * DeleteImportedKeyMaterial
7506
+ #
7338
7507
  # * DisableKeyRotation
7339
7508
  #
7340
7509
  # * GetKeyRotationStatus
7341
7510
  #
7511
+ # * ImportKeyMaterial
7512
+ #
7342
7513
  # * RotateKeyOnDemand
7343
7514
  #
7344
7515
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -7348,7 +7519,7 @@ module Aws::KMS
7348
7519
  #
7349
7520
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
7350
7521
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7351
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7522
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7352
7523
  #
7353
7524
  # @option params [required, String] :key_id
7354
7525
  # Gets the key rotations for the specified KMS key.
@@ -7365,6 +7536,16 @@ module Aws::KMS
7365
7536
  # To get the key ID and key ARN for a KMS key, use ListKeys or
7366
7537
  # DescribeKey.
7367
7538
  #
7539
+ # @option params [String] :include_key_material
7540
+ # Use this optional parameter to control which key materials associated
7541
+ # with this key are listed in the response. The default value of this
7542
+ # parameter is `ROTATIONS_ONLY`. If you omit this parameter, KMS returns
7543
+ # information on the key materials created by automatic or on-demand key
7544
+ # rotation. When you specify a value of `ALL_KEY_MATERIAL`, KMS adds the
7545
+ # first key material and any imported key material pending rotation to
7546
+ # the response. This parameter can only be used with KMS keys that
7547
+ # support automatic or on-demand key rotation.
7548
+ #
7368
7549
  # @option params [Integer] :limit
7369
7550
  # Use this parameter to specify the maximum number of items to return.
7370
7551
  # When this value is present, KMS does not return more than the
@@ -7417,6 +7598,7 @@ module Aws::KMS
7417
7598
  #
7418
7599
  # resp = client.list_key_rotations({
7419
7600
  # key_id: "KeyIdType", # required
7601
+ # include_key_material: "ALL_KEY_MATERIAL", # accepts ALL_KEY_MATERIAL, ROTATIONS_ONLY
7420
7602
  # limit: 1,
7421
7603
  # marker: "MarkerType",
7422
7604
  # })
@@ -7425,6 +7607,12 @@ module Aws::KMS
7425
7607
  #
7426
7608
  # resp.rotations #=> Array
7427
7609
  # resp.rotations[0].key_id #=> String
7610
+ # resp.rotations[0].key_material_id #=> String
7611
+ # resp.rotations[0].key_material_description #=> String
7612
+ # resp.rotations[0].import_state #=> String, one of "IMPORTED", "PENDING_IMPORT"
7613
+ # resp.rotations[0].key_material_state #=> String, one of "NON_CURRENT", "CURRENT", "PENDING_ROTATION"
7614
+ # resp.rotations[0].expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
7615
+ # resp.rotations[0].valid_to #=> Time
7428
7616
  # resp.rotations[0].rotation_date #=> Time
7429
7617
  # resp.rotations[0].rotation_type #=> String, one of "AUTOMATIC", "ON_DEMAND"
7430
7618
  # resp.next_marker #=> String
@@ -7463,7 +7651,7 @@ module Aws::KMS
7463
7651
  #
7464
7652
  #
7465
7653
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7466
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7654
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7467
7655
  #
7468
7656
  # @option params [Integer] :limit
7469
7657
  # Use this parameter to specify the maximum number of items to return.
@@ -7559,7 +7747,7 @@ module Aws::KMS
7559
7747
  # For general information about tags, including the format and syntax,
7560
7748
  # see [Tagging Amazon Web Services resources][1] in the *Amazon Web
7561
7749
  # Services General Reference*. For information about using tags in KMS,
7562
- # see [Tagging keys][2].
7750
+ # see [Tags in KMS][2].
7563
7751
  #
7564
7752
  # **Cross-account use**: No. You cannot perform this operation on a KMS
7565
7753
  # key in a different Amazon Web Services account.
@@ -7584,7 +7772,7 @@ module Aws::KMS
7584
7772
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
7585
7773
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
7586
7774
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7587
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7775
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7588
7776
  #
7589
7777
  # @option params [required, String] :key_id
7590
7778
  # Gets tags on the specified KMS key.
@@ -7689,8 +7877,9 @@ module Aws::KMS
7689
7877
  #
7690
7878
  # For detailed information about grants, including grant terminology,
7691
7879
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
7692
- # Guide</i> </i>. For examples of working with grants in several
7693
- # programming languages, see [Programming grants][2].
7880
+ # Guide</i> </i>. For examples of creating grants in several programming
7881
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
7882
+ # CLI][2].
7694
7883
  #
7695
7884
  # **Cross-account use**: You must specify a principal in your Amazon Web
7696
7885
  # Services account. This operation returns a list of grants where the
@@ -7728,9 +7917,9 @@ module Aws::KMS
7728
7917
  #
7729
7918
  #
7730
7919
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
7731
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
7920
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
7732
7921
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7733
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7922
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7734
7923
  #
7735
7924
  # @option params [Integer] :limit
7736
7925
  # Use this parameter to specify the maximum number of items to return.
@@ -7840,8 +8029,9 @@ module Aws::KMS
7840
8029
  # formatting a JSON policy document, see the [IAM JSON Policy
7841
8030
  # Reference][2] in the <i> <i>Identity and Access Management User
7842
8031
  # Guide</i> </i>. For examples of adding a key policy in multiple
7843
- # programming languages, see [Setting a key policy][3] in the *Key
7844
- # Management Service Developer Guide*.
8032
+ # programming languages, see [Use PutKeyPolicy with an Amazon Web
8033
+ # Services SDK or CLI][3] in the *Key Management Service Developer
8034
+ # Guide*.
7845
8035
  #
7846
8036
  # **Cross-account use**: No. You cannot perform this operation on a KMS
7847
8037
  # key in a different Amazon Web Services account.
@@ -7857,9 +8047,9 @@ module Aws::KMS
7857
8047
  #
7858
8048
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
7859
8049
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
7860
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-key-policies.html#put-policy
8050
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_PutKeyPolicy_section.html
7861
8051
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7862
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8052
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7863
8053
  #
7864
8054
  # @option params [required, String] :key_id
7865
8055
  # Sets the key policy on the specified KMS key.
@@ -7900,6 +8090,17 @@ module Aws::KMS
7900
8090
  # not always immediately visible][2] in the *Amazon Web Services
7901
8091
  # Identity and Access Management User Guide*.
7902
8092
  #
8093
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are missing
8094
+ # from a key policy statement, the policy statement has no effect. When
8095
+ # a key policy statement is missing one of these elements, the KMS
8096
+ # console correctly reports an error, but the `PutKeyPolicy` API request
8097
+ # succeeds, even though the policy statement is ineffective.
8098
+ #
8099
+ # For more information on required key policy elements, see [Elements in
8100
+ # a key policy][3] in the *Key Management Service Developer Guide*.
8101
+ #
8102
+ # </note>
8103
+ #
7903
8104
  # A key policy document can include only the following characters:
7904
8105
  #
7905
8106
  # * Printable ASCII characters from the space character (`\u0020`)
@@ -7911,18 +8112,24 @@ module Aws::KMS
7911
8112
  # * The tab (`\u0009`), line feed (`\u000A`), and carriage return
7912
8113
  # (`\u000D`) special characters
7913
8114
  #
7914
- # For information about key policies, see [Key policies in KMS][3] in
8115
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
8116
+ # `LimitExceededException`.
8117
+ #
8118
+ # </note>
8119
+ #
8120
+ # For information about key policies, see [Key policies in KMS][4] in
7915
8121
  # the *Key Management Service Developer Guide*.For help writing and
7916
8122
  # formatting a JSON policy document, see the [IAM JSON Policy
7917
- # Reference][4] in the <i> <i>Identity and Access Management User
8123
+ # Reference][5] in the <i> <i>Identity and Access Management User
7918
8124
  # Guide</i> </i>.
7919
8125
  #
7920
8126
  #
7921
8127
  #
7922
8128
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
7923
8129
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
7924
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
7925
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
8130
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
8131
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8132
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
7926
8133
  #
7927
8134
  # @option params [Boolean] :bypass_policy_lockout_safety_check
7928
8135
  # Skips ("bypasses") the key policy lockout safety check. The default
@@ -8071,15 +8278,15 @@ module Aws::KMS
8071
8278
  #
8072
8279
  #
8073
8280
  #
8074
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-manually
8075
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8076
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#asymmetric-cmks
8281
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys-manually.html
8282
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8283
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
8077
8284
  # [4]: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/
8078
8285
  # [5]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
8079
8286
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8080
8287
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8081
8288
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8082
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8289
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8083
8290
  #
8084
8291
  # @option params [required, String, StringIO, File] :ciphertext_blob
8085
8292
  # Ciphertext of the data to reencrypt.
@@ -8102,7 +8309,7 @@ module Aws::KMS
8102
8309
  #
8103
8310
  #
8104
8311
  #
8105
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8312
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8106
8313
  #
8107
8314
  # @option params [String] :source_key_id
8108
8315
  # Specifies the KMS key that KMS will use to decrypt the ciphertext
@@ -8188,7 +8395,7 @@ module Aws::KMS
8188
8395
  #
8189
8396
  #
8190
8397
  #
8191
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8398
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8192
8399
  #
8193
8400
  # @option params [String] :source_encryption_algorithm
8194
8401
  # Specifies the encryption algorithm that KMS will use to decrypt the
@@ -8222,18 +8429,18 @@ module Aws::KMS
8222
8429
  #
8223
8430
  #
8224
8431
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
8225
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
8432
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
8226
8433
  #
8227
8434
  # @option params [Boolean] :dry_run
8228
8435
  # Checks if your request will succeed. `DryRun` is an optional
8229
8436
  # parameter.
8230
8437
  #
8231
- # To learn more about how to use this parameter, see [Testing your KMS
8232
- # API calls][1] in the *Key Management Service Developer Guide*.
8438
+ # To learn more about how to use this parameter, see [Testing your
8439
+ # permissions][1] in the *Key Management Service Developer Guide*.
8233
8440
  #
8234
8441
  #
8235
8442
  #
8236
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
8443
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8237
8444
  #
8238
8445
  # @return [Types::ReEncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
8239
8446
  #
@@ -8242,6 +8449,8 @@ module Aws::KMS
8242
8449
  # * {Types::ReEncryptResponse#key_id #key_id} => String
8243
8450
  # * {Types::ReEncryptResponse#source_encryption_algorithm #source_encryption_algorithm} => String
8244
8451
  # * {Types::ReEncryptResponse#destination_encryption_algorithm #destination_encryption_algorithm} => String
8452
+ # * {Types::ReEncryptResponse#source_key_material_id #source_key_material_id} => String
8453
+ # * {Types::ReEncryptResponse#destination_key_material_id #destination_key_material_id} => String
8245
8454
  #
8246
8455
  #
8247
8456
  # @example Example: To reencrypt data
@@ -8256,8 +8465,12 @@ module Aws::KMS
8256
8465
  # resp.to_h outputs the following:
8257
8466
  # {
8258
8467
  # ciphertext_blob: "<binary data>", # The reencrypted data.
8468
+ # destination_encryption_algorithm: "SYMMETRIC_DEFAULT", # The encryption algorithm that was used to reencrypt the data.
8469
+ # destination_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to reencrypt the data.
8259
8470
  # key_id: "arn:aws:kms:us-east-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321", # The ARN of the KMS key that was used to reencrypt the data.
8471
+ # source_encryption_algorithm: "SYMMETRIC_DEFAULT", # The encryption algorithm that was used to decrypt the ciphertext before it was reencrypted.
8260
8472
  # source_key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the KMS key that was originally used to encrypt the data.
8473
+ # source_key_material_id: "1c6be7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to originally encrypt the data.
8261
8474
  # }
8262
8475
  #
8263
8476
  # @example Request syntax with placeholder values
@@ -8285,6 +8498,8 @@ module Aws::KMS
8285
8498
  # resp.key_id #=> String
8286
8499
  # resp.source_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8287
8500
  # resp.destination_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8501
+ # resp.source_key_material_id #=> String
8502
+ # resp.destination_key_material_id #=> String
8288
8503
  #
8289
8504
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncrypt AWS API Documentation
8290
8505
  #
@@ -8316,12 +8531,12 @@ module Aws::KMS
8316
8531
  # independently of its primary and peer replica keys. A primary key and
8317
8532
  # its replica keys share properties that make them interoperable. They
8318
8533
  # have the same [key ID][2] and key material. They also have the same
8319
- # [key spec][3], [key usage][4], [key material origin][5], and
8320
- # [automatic key rotation status][6]. KMS automatically synchronizes
8321
- # these shared properties among related multi-Region keys. All other
8322
- # properties of a replica key can differ, including its [key policy][7],
8323
- # [tags][8], [aliases][9], and [Key states of KMS keys][10]. KMS pricing
8324
- # and quotas for KMS keys apply to each primary key and replica key.
8534
+ # key spec, key usage, key material origin, and automatic key rotation
8535
+ # status. KMS automatically synchronizes these shared properties among
8536
+ # related multi-Region keys. All other properties of a replica key can
8537
+ # differ, including its [key policy][3], [tags][4], [aliases][5], and
8538
+ # [key state][6]. KMS pricing and quotas for KMS keys apply to each
8539
+ # primary key and replica key.
8325
8540
  #
8326
8541
  # When this operation completes, the new replica key has a transient key
8327
8542
  # state of `Creating`. This key state changes to `Enabled` (or
@@ -8331,7 +8546,7 @@ module Aws::KMS
8331
8546
  # If you are creating and using the replica key programmatically, retry
8332
8547
  # on `KMSInvalidStateException` or call `DescribeKey` to check its
8333
8548
  # `KeyState` value before using it. For details about the `Creating` key
8334
- # state, see [Key states of KMS keys][10] in the *Key Management Service
8549
+ # state, see [Key states of KMS keys][6] in the *Key Management Service
8335
8550
  # Developer Guide*.
8336
8551
  #
8337
8552
  # You cannot create more than one replica of a primary key in any
@@ -8340,7 +8555,7 @@ module Aws::KMS
8340
8555
  # `AlreadyExistsException` error. If the key state of the existing
8341
8556
  # replica is `PendingDeletion`, you can cancel the scheduled key
8342
8557
  # deletion (CancelKeyDeletion) or wait for the key to be deleted. The
8343
- # new replica key you create will have the same [shared properties][11]
8558
+ # new replica key you create will have the same [shared properties][7]
8344
8559
  # as the original replica key.
8345
8560
  #
8346
8561
  # The CloudTrail log of a `ReplicateKey` operation records a
@@ -8350,8 +8565,6 @@ module Aws::KMS
8350
8565
  # If you replicate a multi-Region primary key with imported key
8351
8566
  # material, the replica key is created with no key material. You must
8352
8567
  # import the same key material that you imported into the primary key.
8353
- # For details, see [Importing key material into multi-Region keys][12]
8354
- # in the *Key Management Service Developer Guide*.
8355
8568
  #
8356
8569
  # To convert a replica key to a primary key, use the UpdatePrimaryRegion
8357
8570
  # operation.
@@ -8382,23 +8595,18 @@ module Aws::KMS
8382
8595
  # * UpdatePrimaryRegion
8383
8596
  #
8384
8597
  # **Eventual consistency**: The KMS API follows an eventual consistency
8385
- # model. For more information, see [KMS eventual consistency][13].
8598
+ # model. For more information, see [KMS eventual consistency][8].
8386
8599
  #
8387
8600
  #
8388
8601
  #
8389
8602
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
8390
8603
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id
8391
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec
8392
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-usage
8393
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-origin
8394
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
8395
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8396
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
8397
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
8398
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8399
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties
8400
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html
8401
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8604
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8605
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
8606
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
8607
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8608
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties
8609
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8402
8610
  #
8403
8611
  # @option params [required, String] :key_id
8404
8612
  # Identifies the multi-Region primary key that is being replicated. To
@@ -8426,33 +8634,23 @@ module Aws::KMS
8426
8634
  # [KMS service endpoints][1] in the *Amazon Web Services General
8427
8635
  # Reference*.
8428
8636
  #
8429
- # <note markdown="1"> HMAC KMS keys are not supported in all Amazon Web Services Regions. If
8430
- # you try to replicate an HMAC KMS key in an Amazon Web Services Region
8431
- # in which HMAC keys are not supported, the `ReplicateKey` operation
8432
- # returns an `UnsupportedOperationException`. For a list of Regions in
8433
- # which HMAC KMS keys are supported, see [HMAC keys in KMS][2] in the
8434
- # *Key Management Service Developer Guide*.
8435
- #
8436
- # </note>
8437
- #
8438
8637
  # The replica must be in a different Amazon Web Services Region than its
8439
8638
  # primary key and other replicas of that primary key, but in the same
8440
8639
  # Amazon Web Services partition. KMS must be available in the replica
8441
8640
  # Region. If the Region is not enabled by default, the Amazon Web
8442
8641
  # Services account must be enabled in the Region. For information about
8443
- # Amazon Web Services partitions, see [Amazon Resource Names (ARNs)][3]
8642
+ # Amazon Web Services partitions, see [Amazon Resource Names (ARNs)][2]
8444
8643
  # in the *Amazon Web Services General Reference*. For information about
8445
- # enabling and disabling Regions, see [Enabling a Region][4] and
8446
- # [Disabling a Region][5] in the *Amazon Web Services General
8644
+ # enabling and disabling Regions, see [Enabling a Region][3] and
8645
+ # [Disabling a Region][4] in the *Amazon Web Services General
8447
8646
  # Reference*.
8448
8647
  #
8449
8648
  #
8450
8649
  #
8451
8650
  # [1]: https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region
8452
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
8453
- # [3]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
8454
- # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
8455
- # [5]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
8651
+ # [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
8652
+ # [3]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
8653
+ # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
8456
8654
  #
8457
8655
  # @option params [String] :policy
8458
8656
  # The key policy to attach to the KMS key. This parameter is optional.
@@ -8500,7 +8698,7 @@ module Aws::KMS
8500
8698
  #
8501
8699
  #
8502
8700
  #
8503
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
8701
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
8504
8702
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
8505
8703
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
8506
8704
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
@@ -8569,7 +8767,7 @@ module Aws::KMS
8569
8767
  # When you add tags to an Amazon Web Services resource, Amazon Web
8570
8768
  # Services generates a cost allocation report with usage and costs
8571
8769
  # aggregated by tags. Tags can also be used to control access to a KMS
8572
- # key. For details, see [Tagging Keys][3].
8770
+ # key. For details, see [Tags in KMS][3].
8573
8771
  #
8574
8772
  #
8575
8773
  #
@@ -8664,11 +8862,11 @@ module Aws::KMS
8664
8862
  # resp.replica_key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
8665
8863
  # resp.replica_key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
8666
8864
  # resp.replica_key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
8667
- # resp.replica_key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
8865
+ # resp.replica_key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
8668
8866
  # resp.replica_key_metadata.encryption_algorithms #=> Array
8669
8867
  # resp.replica_key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8670
8868
  # resp.replica_key_metadata.signing_algorithms #=> Array
8671
- # resp.replica_key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
8869
+ # resp.replica_key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
8672
8870
  # resp.replica_key_metadata.key_agreement_algorithms #=> Array
8673
8871
  # resp.replica_key_metadata.key_agreement_algorithms[0] #=> String, one of "ECDH"
8674
8872
  # resp.replica_key_metadata.multi_region #=> Boolean
@@ -8682,6 +8880,7 @@ module Aws::KMS
8682
8880
  # resp.replica_key_metadata.mac_algorithms #=> Array
8683
8881
  # resp.replica_key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
8684
8882
  # resp.replica_key_metadata.xks_key_configuration.id #=> String
8883
+ # resp.replica_key_metadata.current_key_material_id #=> String
8685
8884
  # resp.replica_policy #=> String
8686
8885
  # resp.replica_tags #=> Array
8687
8886
  # resp.replica_tags[0].tag_key #=> String
@@ -8705,20 +8904,20 @@ module Aws::KMS
8705
8904
  # by the *grantee principal* if the grant allows the `RetireGrant`
8706
8905
  # operation, and by the Amazon Web Services account in which the grant
8707
8906
  # is created. It can also be called by principals to whom permission for
8708
- # retiring a grant is delegated. For details, see [Retiring and revoking
8709
- # grants][2] in the *Key Management Service Developer Guide*.
8907
+ # retiring a grant is delegated.
8710
8908
  #
8711
8909
  # For detailed information about grants, including grant terminology,
8712
- # see [Grants in KMS][3] in the <i> <i>Key Management Service Developer
8713
- # Guide</i> </i>. For examples of working with grants in several
8714
- # programming languages, see [Programming grants][4].
8910
+ # see [Grants in KMS][2] in the <i> <i>Key Management Service Developer
8911
+ # Guide</i> </i>. For examples of creating grants in several programming
8912
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
8913
+ # CLI][3].
8715
8914
  #
8716
8915
  # **Cross-account use**: Yes. You can retire a grant on a KMS key in a
8717
8916
  # different Amazon Web Services account.
8718
8917
  #
8719
8918
  # **Required permissions**: Permission to retire a grant is determined
8720
8919
  # primarily by the grant. For details, see [Retiring and revoking
8721
- # grants][2] in the *Key Management Service Developer Guide*.
8920
+ # grants][4] in the *Key Management Service Developer Guide*.
8722
8921
  #
8723
8922
  # **Related operations:**
8724
8923
  #
@@ -8736,10 +8935,10 @@ module Aws::KMS
8736
8935
  #
8737
8936
  #
8738
8937
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
8739
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
8740
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8741
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
8742
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8938
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8939
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
8940
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
8941
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8743
8942
  #
8744
8943
  # @option params [String] :grant_token
8745
8944
  # Identifies the grant to be retired. You can use a grant token to
@@ -8774,12 +8973,12 @@ module Aws::KMS
8774
8973
  # Checks if your request will succeed. `DryRun` is an optional
8775
8974
  # parameter.
8776
8975
  #
8777
- # To learn more about how to use this parameter, see [Testing your KMS
8778
- # API calls][1] in the *Key Management Service Developer Guide*.
8976
+ # To learn more about how to use this parameter, see [Testing your
8977
+ # permissions][1] in the *Key Management Service Developer Guide*.
8779
8978
  #
8780
8979
  #
8781
8980
  #
8782
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
8981
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8783
8982
  #
8784
8983
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
8785
8984
  #
@@ -8824,8 +9023,9 @@ module Aws::KMS
8824
9023
  #
8825
9024
  # For detailed information about grants, including grant terminology,
8826
9025
  # see [Grants in KMS][3] in the <i> <i>Key Management Service Developer
8827
- # Guide</i> </i>. For examples of working with grants in several
8828
- # programming languages, see [Programming grants][4].
9026
+ # Guide</i> </i>. For examples of creating grants in several programming
9027
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
9028
+ # CLI][4].
8829
9029
  #
8830
9030
  # **Cross-account use**: Yes. To perform this operation on a KMS key in
8831
9031
  # a different Amazon Web Services account, specify the key ARN in the
@@ -8848,12 +9048,12 @@ module Aws::KMS
8848
9048
  #
8849
9049
  #
8850
9050
  #
8851
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
9051
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
8852
9052
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-eventual-consistency
8853
9053
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8854
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
9054
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
8855
9055
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8856
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9056
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8857
9057
  #
8858
9058
  # @option params [required, String] :key_id
8859
9059
  # A unique identifier for the KMS key associated with the grant. To get
@@ -8880,12 +9080,12 @@ module Aws::KMS
8880
9080
  # Checks if your request will succeed. `DryRun` is an optional
8881
9081
  # parameter.
8882
9082
  #
8883
- # To learn more about how to use this parameter, see [Testing your KMS
8884
- # API calls][1] in the *Key Management Service Developer Guide*.
9083
+ # To learn more about how to use this parameter, see [Testing your
9084
+ # permissions][1] in the *Key Management Service Developer Guide*.
8885
9085
  #
8886
9086
  #
8887
9087
  #
8888
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
9088
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8889
9089
  #
8890
9090
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
8891
9091
  #
@@ -8941,10 +9141,15 @@ module Aws::KMS
8941
9141
  # of the key material for your KMS keys in CloudTrail and Amazon
8942
9142
  # CloudWatch.
8943
9143
  #
8944
- # On-demand key rotation is supported only on [symmetric encryption KMS
8945
- # keys][3]. You cannot perform on-demand rotation of [asymmetric KMS
8946
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
8947
- # material][6], or KMS keys in a [custom key store][7]. To perform
9144
+ # On-demand key rotation is supported only on symmetric encryption KMS
9145
+ # keys. You cannot perform on-demand rotation of [asymmetric KMS
9146
+ # keys][3], [HMAC KMS keys][4], multi-Region KMS keys with [imported key
9147
+ # material][5], or KMS keys in a [custom key store][6]. When you
9148
+ # initiate on-demand key rotation on a symmetric encryption KMS key with
9149
+ # imported key material, you must have already imported [new key
9150
+ # material][7] and that key material's state should be
9151
+ # `PENDING_ROTATION`. Use the `ListKeyRotations` operation to check the
9152
+ # state of all key materials associated with a KMS key. To perform
8948
9153
  # on-demand rotation of a set of related [multi-Region keys][8], invoke
8949
9154
  # the on-demand rotation on the primary key.
8950
9155
  #
@@ -8971,6 +9176,8 @@ module Aws::KMS
8971
9176
  #
8972
9177
  # * GetKeyRotationStatus
8973
9178
  #
9179
+ # * ImportKeyMaterial
9180
+ #
8974
9181
  # * ListKeyRotations
8975
9182
  #
8976
9183
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -8978,27 +9185,27 @@ module Aws::KMS
8978
9185
  #
8979
9186
  #
8980
9187
  #
8981
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-on-demand
8982
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
8983
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
8984
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
8985
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
8986
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
8987
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
8988
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
9188
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html
9189
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
9190
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9191
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
9192
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
9193
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9194
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html
9195
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
8989
9196
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
8990
9197
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
8991
9198
  # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8992
9199
  # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8993
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9200
+ # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8994
9201
  #
8995
9202
  # @option params [required, String] :key_id
8996
9203
  # Identifies a symmetric encryption KMS key. You cannot perform
8997
9204
  # on-demand rotation of [asymmetric KMS keys][1], [HMAC KMS keys][2],
8998
- # KMS keys with [imported key material][3], or KMS keys in a [custom key
8999
- # store][4]. To perform on-demand rotation of a set of related
9000
- # [multi-Region keys][5], invoke the on-demand rotation on the primary
9001
- # key.
9205
+ # multi-Region KMS keys with [imported key material][3], or KMS keys in
9206
+ # a [custom key store][4]. To perform on-demand rotation of a set of
9207
+ # related [multi-Region keys][5], invoke the on-demand rotation on the
9208
+ # primary key.
9002
9209
  #
9003
9210
  # Specify the key ID or key ARN of the KMS key.
9004
9211
  #
@@ -9017,8 +9224,8 @@ module Aws::KMS
9017
9224
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9018
9225
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
9019
9226
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
9020
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
9021
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
9227
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9228
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
9022
9229
  #
9023
9230
  # @return [Types::RotateKeyOnDemandResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
9024
9231
  #
@@ -9072,9 +9279,8 @@ module Aws::KMS
9072
9279
  # operation. When a KMS key is deleted, all data that was encrypted
9073
9280
  # under the KMS key is unrecoverable. (The only exception is a
9074
9281
  # [multi-Region replica key][1], or an [asymmetric or HMAC KMS key with
9075
- # imported key
9076
- # material](kms/latest/developerguide/importing-keys-managing.html#import-delete-key).)
9077
- # To prevent the use of a KMS key without deleting it, use DisableKey.
9282
+ # imported key material][2].) To prevent the use of a KMS key without
9283
+ # deleting it, use DisableKey.
9078
9284
  #
9079
9285
  # You can schedule the deletion of a multi-Region primary key and its
9080
9286
  # replica keys at any time. However, KMS will not delete a multi-Region
@@ -9085,13 +9291,13 @@ module Aws::KMS
9085
9291
  # the last of its replicas keys is deleted (not just scheduled), the key
9086
9292
  # state of the primary key changes to `PendingDeletion` and its waiting
9087
9293
  # period (`PendingWindowInDays`) begins. For details, see [Deleting
9088
- # multi-Region keys][1] in the *Key Management Service Developer Guide*.
9294
+ # multi-Region keys][3] in the *Key Management Service Developer Guide*.
9089
9295
  #
9090
- # When KMS [deletes a KMS key from an CloudHSM key store][2], it makes a
9296
+ # When KMS [deletes a KMS key from an CloudHSM key store][4], it makes a
9091
9297
  # best effort to delete the associated key material from the associated
9092
9298
  # CloudHSM cluster. However, you might need to manually [delete the
9093
- # orphaned key material][3] from the cluster and its backups. [Deleting
9094
- # a KMS key from an external key store][4] has no effect on the
9299
+ # orphaned key material][5] from the cluster and its backups. [Deleting
9300
+ # a KMS key from an external key store][6] has no effect on the
9095
9301
  # associated external key. However, for both types of custom key stores,
9096
9302
  # deleting a KMS key is destructive and irreversible. You cannot decrypt
9097
9303
  # ciphertext encrypted under the KMS key by using only its associated
@@ -9100,11 +9306,11 @@ module Aws::KMS
9100
9306
  # material.
9101
9307
  #
9102
9308
  # For more information about scheduling a KMS key for deletion, see
9103
- # [Deleting KMS keys][5] in the *Key Management Service Developer
9309
+ # [Deleting KMS keys][7] in the *Key Management Service Developer
9104
9310
  # Guide*.
9105
9311
  #
9106
9312
  # The KMS key that you use for this operation must be in a compatible
9107
- # key state. For details, see [Key states of KMS keys][6] in the *Key
9313
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
9108
9314
  # Management Service Developer Guide*.
9109
9315
  #
9110
9316
  # **Cross-account use**: No. You cannot perform this operation on a KMS
@@ -9119,17 +9325,19 @@ module Aws::KMS
9119
9325
  # * DisableKey
9120
9326
  #
9121
9327
  # **Eventual consistency**: The KMS API follows an eventual consistency
9122
- # model. For more information, see [KMS eventual consistency][7].
9328
+ # model. For more information, see [KMS eventual consistency][9].
9123
9329
  #
9124
9330
  #
9125
9331
  #
9126
9332
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-delete.html
9127
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/delete-cmk-keystore.html
9128
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
9129
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/delete-xks-key.html
9130
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
9131
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9132
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9333
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#import-delete-key
9334
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#deleting-mrks
9335
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#delete-cmk-keystore
9336
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
9337
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#delete-xks-key
9338
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
9339
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9340
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9133
9341
  #
9134
9342
  # @option params [required, String] :key_id
9135
9343
  # The unique identifier of the KMS key to delete.
@@ -9218,11 +9426,11 @@ module Aws::KMS
9218
9426
  # Developer Guide*.
9219
9427
  #
9220
9428
  # Digital signatures are generated and verified by using asymmetric key
9221
- # pair, such as an RSA or ECC pair that is represented by an asymmetric
9222
- # KMS key. The key owner (or an authorized user) uses their private key
9223
- # to sign a message. Anyone with the public key can verify that the
9224
- # message was signed with that particular private key and that the
9225
- # message hasn't changed since it was signed.
9429
+ # pair, such as an RSA, ECC, or ML-DSA pair that is represented by an
9430
+ # asymmetric KMS key. The key owner (or an authorized user) uses their
9431
+ # private key to sign a message. Anyone with the public key can verify
9432
+ # that the message was signed with that particular private key and that
9433
+ # the message hasn't changed since it was signed.
9226
9434
  #
9227
9435
  # To use the `Sign` operation, provide the following information:
9228
9436
  #
@@ -9235,8 +9443,8 @@ module Aws::KMS
9235
9443
  # to sign. You can submit messages of up to 4096 bytes. To sign a
9236
9444
  # larger message, generate a hash digest of the message, and then
9237
9445
  # provide the hash digest in the `Message` parameter. To indicate
9238
- # whether the message is a full message or a digest, use the
9239
- # `MessageType` parameter.
9446
+ # whether the message is a full message, a digest, or an ML-DSA
9447
+ # EXTERNAL\_MU, use the `MessageType` parameter.
9240
9448
  #
9241
9449
  # * Choose a signing algorithm that is compatible with the KMS key.
9242
9450
  #
@@ -9278,7 +9486,7 @@ module Aws::KMS
9278
9486
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9279
9487
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9280
9488
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9281
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9489
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9282
9490
  #
9283
9491
  # @option params [required, String] :key_id
9284
9492
  # Identifies an asymmetric KMS key. KMS uses the private key in the
@@ -9316,26 +9524,34 @@ module Aws::KMS
9316
9524
  # @option params [String] :message_type
9317
9525
  # Tells KMS whether the value of the `Message` parameter should be
9318
9526
  # hashed as part of the signing algorithm. Use `RAW` for unhashed
9319
- # messages; use `DIGEST` for message digests, which are already hashed.
9527
+ # messages; use `DIGEST` for message digests, which are already hashed;
9528
+ # use `EXTERNAL_MU` for 64-byte representative μ used in ML-DSA signing
9529
+ # as defined in NIST FIPS 204 Section 6.2.
9320
9530
  #
9321
9531
  # When the value of `MessageType` is `RAW`, KMS uses the standard
9322
9532
  # signing algorithm, which begins with a hash function. When the value
9323
- # is `DIGEST`, KMS skips the hashing step in the signing algorithm.
9533
+ # is `DIGEST`, KMS skips the hashing step in the signing algorithm. When
9534
+ # the value is `EXTERNAL_MU` KMS skips the concatenated hashing of the
9535
+ # public key hash and the message done in the ML-DSA signing algorithm.
9324
9536
  #
9325
- # Use the `DIGEST` value only when the value of the `Message` parameter
9326
- # is a message digest. If you use the `DIGEST` value with an unhashed
9327
- # message, the security of the signing operation can be compromised.
9537
+ # Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
9538
+ # `Message` parameter is a message digest. If you use the `DIGEST` value
9539
+ # with an unhashed message, the security of the signing operation can be
9540
+ # compromised.
9328
9541
  #
9329
- # When the value of `MessageType`is `DIGEST`, the length of the
9542
+ # When the value of `MessageType` is `DIGEST`, the length of the
9330
9543
  # `Message` value must match the length of hashed messages for the
9331
9544
  # specified signing algorithm.
9332
9545
  #
9546
+ # When the value of `MessageType` is `EXTERNAL_MU` the length of the
9547
+ # `Message` value must be 64 bytes.
9548
+ #
9333
9549
  # You can submit a message digest and omit the `MessageType` or specify
9334
9550
  # `RAW` so the digest is hashed again while signing. However, this can
9335
9551
  # cause verification failures when verifying with a system that assumes
9336
9552
  # a single hash.
9337
9553
  #
9338
- # The hashing algorithm in that `Sign` uses is based on the
9554
+ # The hashing algorithm that `Sign` uses is based on the
9339
9555
  # `SigningAlgorithm` value.
9340
9556
  #
9341
9557
  # * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
@@ -9347,12 +9563,15 @@ module Aws::KMS
9347
9563
  # * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
9348
9564
  # algorithm.
9349
9565
  #
9566
+ # * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256 hashing
9567
+ # algorithm.
9568
+ #
9350
9569
  # * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
9351
9570
  # verification with SM2 key pairs][1].
9352
9571
  #
9353
9572
  #
9354
9573
  #
9355
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
9574
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
9356
9575
  #
9357
9576
  # @option params [Array<String>] :grant_tokens
9358
9577
  # A list of grant tokens.
@@ -9365,7 +9584,7 @@ module Aws::KMS
9365
9584
  #
9366
9585
  #
9367
9586
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
9368
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
9587
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
9369
9588
  #
9370
9589
  # @option params [required, String] :signing_algorithm
9371
9590
  # Specifies the signing algorithm to use when signing the message.
@@ -9379,12 +9598,12 @@ module Aws::KMS
9379
9598
  # Checks if your request will succeed. `DryRun` is an optional
9380
9599
  # parameter.
9381
9600
  #
9382
- # To learn more about how to use this parameter, see [Testing your KMS
9383
- # API calls][1] in the *Key Management Service Developer Guide*.
9601
+ # To learn more about how to use this parameter, see [Testing your
9602
+ # permissions][1] in the *Key Management Service Developer Guide*.
9384
9603
  #
9385
9604
  #
9386
9605
  #
9387
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
9606
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
9388
9607
  #
9389
9608
  # @return [Types::SignResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
9390
9609
  #
@@ -9437,9 +9656,9 @@ module Aws::KMS
9437
9656
  # resp = client.sign({
9438
9657
  # key_id: "KeyIdType", # required
9439
9658
  # message: "data", # required
9440
- # message_type: "RAW", # accepts RAW, DIGEST
9659
+ # message_type: "RAW", # accepts RAW, DIGEST, EXTERNAL_MU
9441
9660
  # grant_tokens: ["GrantTokenType"],
9442
- # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA
9661
+ # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA, ML_DSA_SHAKE_256
9443
9662
  # dry_run: false,
9444
9663
  # })
9445
9664
  #
@@ -9447,7 +9666,7 @@ module Aws::KMS
9447
9666
  #
9448
9667
  # resp.key_id #=> String
9449
9668
  # resp.signature #=> String
9450
- # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
9669
+ # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
9451
9670
  #
9452
9671
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Sign AWS API Documentation
9453
9672
  #
@@ -9511,13 +9730,13 @@ module Aws::KMS
9511
9730
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
9512
9731
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
9513
9732
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
9514
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#keystore-concept
9515
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#alias-concept
9733
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9734
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
9516
9735
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
9517
9736
  # [8]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
9518
9737
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9519
9738
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9520
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9739
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9521
9740
  #
9522
9741
  # @option params [required, String] :key_id
9523
9742
  # Identifies a customer managed key in the account and Region.
@@ -9633,7 +9852,7 @@ module Aws::KMS
9633
9852
  # [4]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
9634
9853
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9635
9854
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9636
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9855
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9637
9856
  #
9638
9857
  # @option params [required, String] :key_id
9639
9858
  # Identifies the KMS key from which you are removing tags.
@@ -9746,7 +9965,7 @@ module Aws::KMS
9746
9965
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9747
9966
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9748
9967
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
9749
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9968
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9750
9969
  #
9751
9970
  # @option params [required, String] :alias_name
9752
9971
  # Identifies the alias that is changing its KMS key. This value must
@@ -9826,9 +10045,9 @@ module Aws::KMS
9826
10045
  # verify the updated property values, use the DescribeCustomKeyStores
9827
10046
  # operation.
9828
10047
  #
9829
- # This operation is part of the [custom key stores][1] feature in KMS,
9830
- # which combines the convenience and extensive integration of KMS with
9831
- # the isolation and control of a key store that you own and manage.
10048
+ # This operation is part of the custom key stores feature in KMS, which
10049
+ # combines the convenience and extensive integration of KMS with the
10050
+ # isolation and control of a key store that you own and manage.
9832
10051
  #
9833
10052
  # When updating the properties of an external key store, verify that the
9834
10053
  # updated settings connect your key store, via the external key store
@@ -9898,7 +10117,7 @@ module Aws::KMS
9898
10117
  # **Cross-account use**: No. You cannot perform this operation on a
9899
10118
  # custom key store in a different Amazon Web Services account.
9900
10119
  #
9901
- # **Required permissions**: [kms:UpdateCustomKeyStore][2] (IAM policy)
10120
+ # **Required permissions**: [kms:UpdateCustomKeyStore][1] (IAM policy)
9902
10121
  #
9903
10122
  # **Related operations:**
9904
10123
  #
@@ -9913,13 +10132,12 @@ module Aws::KMS
9913
10132
  # * DisconnectCustomKeyStore
9914
10133
  #
9915
10134
  # **Eventual consistency**: The KMS API follows an eventual consistency
9916
- # model. For more information, see [KMS eventual consistency][3].
10135
+ # model. For more information, see [KMS eventual consistency][2].
9917
10136
  #
9918
10137
  #
9919
10138
  #
9920
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
9921
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9922
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10139
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10140
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9923
10141
  #
9924
10142
  # @option params [required, String] :custom_key_store_id
9925
10143
  # Identifies the custom key store that you want to update. Enter the ID
@@ -10197,7 +10415,7 @@ module Aws::KMS
10197
10415
  #
10198
10416
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10199
10417
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10200
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10418
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10201
10419
  #
10202
10420
  # @option params [required, String] :key_id
10203
10421
  # Updates the description of the specified KMS key.
@@ -10257,8 +10475,8 @@ module Aws::KMS
10257
10475
  # key in `eu-west-2`. If you run `UpdatePrimaryRegion` with a
10258
10476
  # `PrimaryRegion` value of `eu-west-2`, the primary key is now the key
10259
10477
  # in `eu-west-2`, and the key in `us-east-1` becomes a replica key. For
10260
- # details, see [Updating the primary Region][1] in the *Key Management
10261
- # Service Developer Guide*.
10478
+ # details, see [Change the primary key in a set of multi-Region keys][1]
10479
+ # in the *Key Management Service Developer Guide*.
10262
10480
  #
10263
10481
  # This operation supports *multi-Region keys*, an KMS feature that lets
10264
10482
  # you create multiple interoperable KMS keys in different Amazon Web
@@ -10326,7 +10544,7 @@ module Aws::KMS
10326
10544
  #
10327
10545
  #
10328
10546
  #
10329
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-update
10547
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-update.html
10330
10548
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
10331
10549
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id
10332
10550
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec
@@ -10335,7 +10553,7 @@ module Aws::KMS
10335
10553
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
10336
10554
  # [8]: https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html
10337
10555
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10338
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10556
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10339
10557
  #
10340
10558
  # @option params [required, String] :key_id
10341
10559
  # Identifies the current primary key. When the operation completes, this
@@ -10450,10 +10668,10 @@ module Aws::KMS
10450
10668
  #
10451
10669
  #
10452
10670
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
10453
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
10671
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
10454
10672
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10455
10673
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10456
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10674
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10457
10675
  #
10458
10676
  # @option params [required, String] :key_id
10459
10677
  # Identifies the asymmetric KMS key that will be used to verify the
@@ -10492,27 +10710,34 @@ module Aws::KMS
10492
10710
  # @option params [String] :message_type
10493
10711
  # Tells KMS whether the value of the `Message` parameter should be
10494
10712
  # hashed as part of the signing algorithm. Use `RAW` for unhashed
10495
- # messages; use `DIGEST` for message digests, which are already hashed.
10713
+ # messages; use `DIGEST` for message digests, which are already hashed;
10714
+ # use `EXTERNAL_MU` for 64-byte representative μ used in ML-DSA signing
10715
+ # as defined in NIST FIPS 204 Section 6.2.
10496
10716
  #
10497
10717
  # When the value of `MessageType` is `RAW`, KMS uses the standard
10498
10718
  # signing algorithm, which begins with a hash function. When the value
10499
- # is `DIGEST`, KMS skips the hashing step in the signing algorithm.
10719
+ # is `DIGEST`, KMS skips the hashing step in the signing algorithm. When
10720
+ # the value is `EXTERNAL_MU` KMS skips the concatenated hashing of the
10721
+ # public key hash and the message done in the ML-DSA signing algorithm.
10500
10722
  #
10501
- # Use the `DIGEST` value only when the value of the `Message` parameter
10502
- # is a message digest. If you use the `DIGEST` value with an unhashed
10503
- # message, the security of the verification operation can be
10723
+ # Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
10724
+ # `Message` parameter is a message digest. If you use the `DIGEST` value
10725
+ # with an unhashed message, the security of the signing operation can be
10504
10726
  # compromised.
10505
10727
  #
10506
- # When the value of `MessageType`is `DIGEST`, the length of the
10728
+ # When the value of `MessageType` is `DIGEST`, the length of the
10507
10729
  # `Message` value must match the length of hashed messages for the
10508
10730
  # specified signing algorithm.
10509
10731
  #
10732
+ # When the value of `MessageType` is `EXTERNAL_MU` the length of the
10733
+ # `Message` value must be 64 bytes.
10734
+ #
10510
10735
  # You can submit a message digest and omit the `MessageType` or specify
10511
10736
  # `RAW` so the digest is hashed again while signing. However, if the
10512
10737
  # signed message is hashed once while signing, but twice while
10513
10738
  # verifying, verification fails, even when the message hasn't changed.
10514
10739
  #
10515
- # The hashing algorithm in that `Verify` uses is based on the
10740
+ # The hashing algorithm that `Verify` uses is based on the
10516
10741
  # `SigningAlgorithm` value.
10517
10742
  #
10518
10743
  # * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
@@ -10524,12 +10749,15 @@ module Aws::KMS
10524
10749
  # * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
10525
10750
  # algorithm.
10526
10751
  #
10752
+ # * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256 hashing
10753
+ # algorithm.
10754
+ #
10527
10755
  # * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
10528
10756
  # verification with SM2 key pairs][1].
10529
10757
  #
10530
10758
  #
10531
10759
  #
10532
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
10760
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
10533
10761
  #
10534
10762
  # @option params [required, String, StringIO, File] :signature
10535
10763
  # The signature that the `Sign` operation generated.
@@ -10549,18 +10777,18 @@ module Aws::KMS
10549
10777
  #
10550
10778
  #
10551
10779
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
10552
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
10780
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
10553
10781
  #
10554
10782
  # @option params [Boolean] :dry_run
10555
10783
  # Checks if your request will succeed. `DryRun` is an optional
10556
10784
  # parameter.
10557
10785
  #
10558
- # To learn more about how to use this parameter, see [Testing your KMS
10559
- # API calls][1] in the *Key Management Service Developer Guide*.
10786
+ # To learn more about how to use this parameter, see [Testing your
10787
+ # permissions][1] in the *Key Management Service Developer Guide*.
10560
10788
  #
10561
10789
  #
10562
10790
  #
10563
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
10791
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
10564
10792
  #
10565
10793
  # @return [Types::VerifyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
10566
10794
  #
@@ -10615,9 +10843,9 @@ module Aws::KMS
10615
10843
  # resp = client.verify({
10616
10844
  # key_id: "KeyIdType", # required
10617
10845
  # message: "data", # required
10618
- # message_type: "RAW", # accepts RAW, DIGEST
10846
+ # message_type: "RAW", # accepts RAW, DIGEST, EXTERNAL_MU
10619
10847
  # signature: "data", # required
10620
- # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA
10848
+ # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA, ML_DSA_SHAKE_256
10621
10849
  # grant_tokens: ["GrantTokenType"],
10622
10850
  # dry_run: false,
10623
10851
  # })
@@ -10626,7 +10854,7 @@ module Aws::KMS
10626
10854
  #
10627
10855
  # resp.key_id #=> String
10628
10856
  # resp.signature_valid #=> Boolean
10629
- # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
10857
+ # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
10630
10858
  #
10631
10859
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Verify AWS API Documentation
10632
10860
  #
@@ -10674,7 +10902,7 @@ module Aws::KMS
10674
10902
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
10675
10903
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10676
10904
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10677
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10905
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10678
10906
  #
10679
10907
  # @option params [required, String, StringIO, File] :message
10680
10908
  # The message that will be used in the verification. Enter the same
@@ -10712,18 +10940,18 @@ module Aws::KMS
10712
10940
  #
10713
10941
  #
10714
10942
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
10715
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
10943
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
10716
10944
  #
10717
10945
  # @option params [Boolean] :dry_run
10718
10946
  # Checks if your request will succeed. `DryRun` is an optional
10719
10947
  # parameter.
10720
10948
  #
10721
- # To learn more about how to use this parameter, see [Testing your KMS
10722
- # API calls][1] in the *Key Management Service Developer Guide*.
10949
+ # To learn more about how to use this parameter, see [Testing your
10950
+ # permissions][1] in the *Key Management Service Developer Guide*.
10723
10951
  #
10724
10952
  #
10725
10953
  #
10726
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
10954
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
10727
10955
  #
10728
10956
  # @return [Types::VerifyMacResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
10729
10957
  #
@@ -10795,7 +11023,7 @@ module Aws::KMS
10795
11023
  tracer: tracer
10796
11024
  )
10797
11025
  context[:gem_name] = 'aws-sdk-kms'
10798
- context[:gem_version] = '1.101.0'
11026
+ context[:gem_version] = '1.106.0'
10799
11027
  Seahorse::Client::Request.new(handlers, context)
10800
11028
  end
10801
11029