aws-sdk-kms 1.101.0 → 1.106.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +25 -0
- data/VERSION +1 -1
- data/lib/aws-sdk-kms/client.rb +773 -545
- data/lib/aws-sdk-kms/client_api.rb +34 -1
- data/lib/aws-sdk-kms/types.rb +492 -207
- data/lib/aws-sdk-kms.rb +1 -1
- data/sig/client.rbs +32 -13
- data/sig/types.rbs +40 -12
- metadata +4 -4
data/lib/aws-sdk-kms/types.rb
CHANGED
|
@@ -301,7 +301,7 @@ module Aws::KMS
|
|
|
301
301
|
# A valid key ID is required. If you supply a null or empty string
|
|
302
302
|
# value, this operation returns an error.
|
|
303
303
|
#
|
|
304
|
-
# For help finding the key ID and ARN, see [
|
|
304
|
+
# For help finding the key ID and ARN, see [Find the key ID and key
|
|
305
305
|
# ARN][2] in the <i> <i>Key Management Service Developer Guide</i>
|
|
306
306
|
# </i>.
|
|
307
307
|
#
|
|
@@ -320,7 +320,7 @@ module Aws::KMS
|
|
|
320
320
|
#
|
|
321
321
|
#
|
|
322
322
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
|
|
323
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
323
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html
|
|
324
324
|
# @return [String]
|
|
325
325
|
#
|
|
326
326
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateAliasRequest AWS API Documentation
|
|
@@ -387,7 +387,7 @@ module Aws::KMS
|
|
|
387
387
|
#
|
|
388
388
|
#
|
|
389
389
|
#
|
|
390
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
390
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
|
|
391
391
|
# @return [String]
|
|
392
392
|
#
|
|
393
393
|
# @!attribute [rw] custom_key_store_type
|
|
@@ -494,7 +494,7 @@ module Aws::KMS
|
|
|
494
494
|
# `RawSecretAccessKey`, a secret key, and `AccessKeyId`, a unique
|
|
495
495
|
# identifier for the `RawSecretAccessKey`. For character requirements,
|
|
496
496
|
# see
|
|
497
|
-
# [XksProxyAuthenticationCredentialType](
|
|
497
|
+
# [XksProxyAuthenticationCredentialType](API_XksProxyAuthenticationCredentialType.html).
|
|
498
498
|
#
|
|
499
499
|
# KMS uses this authentication credential to sign requests to the
|
|
500
500
|
# external key store proxy on your behalf. This credential is
|
|
@@ -535,7 +535,7 @@ module Aws::KMS
|
|
|
535
535
|
#
|
|
536
536
|
#
|
|
537
537
|
#
|
|
538
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
538
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/choose-xks-connectivity.html
|
|
539
539
|
# @return [String]
|
|
540
540
|
#
|
|
541
541
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateCustomKeyStoreRequest AWS API Documentation
|
|
@@ -621,7 +621,7 @@ module Aws::KMS
|
|
|
621
621
|
#
|
|
622
622
|
# [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
|
|
623
623
|
# [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns
|
|
624
|
-
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-
|
|
624
|
+
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
|
|
625
625
|
# @return [String]
|
|
626
626
|
#
|
|
627
627
|
# @!attribute [rw] operations
|
|
@@ -694,7 +694,7 @@ module Aws::KMS
|
|
|
694
694
|
#
|
|
695
695
|
#
|
|
696
696
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
697
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
697
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
698
698
|
# @return [Array<String>]
|
|
699
699
|
#
|
|
700
700
|
# @!attribute [rw] name
|
|
@@ -722,12 +722,12 @@ module Aws::KMS
|
|
|
722
722
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
723
723
|
# parameter.
|
|
724
724
|
#
|
|
725
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
726
|
-
#
|
|
725
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
726
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
727
727
|
#
|
|
728
728
|
#
|
|
729
729
|
#
|
|
730
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
730
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
731
731
|
# @return [Boolean]
|
|
732
732
|
#
|
|
733
733
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateGrantRequest AWS API Documentation
|
|
@@ -756,7 +756,7 @@ module Aws::KMS
|
|
|
756
756
|
#
|
|
757
757
|
#
|
|
758
758
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
759
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
759
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
760
760
|
# @return [String]
|
|
761
761
|
#
|
|
762
762
|
# @!attribute [rw] grant_id
|
|
@@ -796,22 +796,38 @@ module Aws::KMS
|
|
|
796
796
|
# that I make are not always immediately visible][2] in the *Amazon
|
|
797
797
|
# Web Services Identity and Access Management User Guide*.
|
|
798
798
|
#
|
|
799
|
+
# <note markdown="1"> If either of the required `Resource` or `Action` elements are
|
|
800
|
+
# missing from a key policy statement, the policy statement has no
|
|
801
|
+
# effect. When a key policy statement is missing one of these
|
|
802
|
+
# elements, the KMS console correctly reports an error, but the
|
|
803
|
+
# `CreateKey` and `PutKeyPolicy` API requests succeed, even though the
|
|
804
|
+
# policy statement is ineffective.
|
|
805
|
+
#
|
|
806
|
+
# For more information on required key policy elements, see [Elements
|
|
807
|
+
# in a key policy][3] in the *Key Management Service Developer Guide*.
|
|
808
|
+
#
|
|
809
|
+
# </note>
|
|
810
|
+
#
|
|
799
811
|
# If you do not provide a key policy, KMS attaches a default key
|
|
800
812
|
# policy to the KMS key. For more information, see [Default key
|
|
801
|
-
# policy][
|
|
813
|
+
# policy][4] in the *Key Management Service Developer Guide*.
|
|
802
814
|
#
|
|
803
|
-
#
|
|
815
|
+
# <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
|
|
816
|
+
# `LimitExceededException`.
|
|
817
|
+
#
|
|
818
|
+
# </note>
|
|
804
819
|
#
|
|
805
820
|
# For help writing and formatting a JSON policy document, see the [IAM
|
|
806
|
-
# JSON Policy Reference][
|
|
821
|
+
# JSON Policy Reference][5] in the <i> <i>Identity and Access
|
|
807
822
|
# Management User Guide</i> </i>.
|
|
808
823
|
#
|
|
809
824
|
#
|
|
810
825
|
#
|
|
811
826
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
|
|
812
827
|
# [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
|
|
813
|
-
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-
|
|
814
|
-
# [4]: https://docs.aws.amazon.com/
|
|
828
|
+
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
|
|
829
|
+
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
|
|
830
|
+
# [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
|
|
815
831
|
# @return [String]
|
|
816
832
|
#
|
|
817
833
|
# @!attribute [rw] description
|
|
@@ -847,7 +863,10 @@ module Aws::KMS
|
|
|
847
863
|
# * For asymmetric KMS keys with NIST-recommended elliptic curve key
|
|
848
864
|
# pairs, specify `SIGN_VERIFY` or `KEY_AGREEMENT`.
|
|
849
865
|
#
|
|
850
|
-
# * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs specify
|
|
866
|
+
# * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs, specify
|
|
867
|
+
# `SIGN_VERIFY`.
|
|
868
|
+
#
|
|
869
|
+
# * For asymmetric KMS keys with ML-DSA key pairs, specify
|
|
851
870
|
# `SIGN_VERIFY`.
|
|
852
871
|
#
|
|
853
872
|
# * For asymmetric KMS keys with SM2 key pairs (China Regions only),
|
|
@@ -855,7 +874,7 @@ module Aws::KMS
|
|
|
855
874
|
#
|
|
856
875
|
#
|
|
857
876
|
#
|
|
858
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
877
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
|
|
859
878
|
# @return [String]
|
|
860
879
|
#
|
|
861
880
|
# @!attribute [rw] customer_master_key_spec
|
|
@@ -872,8 +891,8 @@ module Aws::KMS
|
|
|
872
891
|
# `SYMMETRIC_DEFAULT`, creates a KMS key with a 256-bit AES-GCM key
|
|
873
892
|
# that is used for encryption and decryption, except in China Regions,
|
|
874
893
|
# where it creates a 128-bit symmetric key that uses SM4 encryption.
|
|
875
|
-
# For
|
|
876
|
-
#
|
|
894
|
+
# For a detailed description of all supported key specs, see [Key spec
|
|
895
|
+
# reference][1] in the <i> <i>Key Management Service Developer
|
|
877
896
|
# Guide</i> </i>.
|
|
878
897
|
#
|
|
879
898
|
# The `KeySpec` determines whether the KMS key contains a symmetric
|
|
@@ -882,10 +901,11 @@ module Aws::KMS
|
|
|
882
901
|
# KMS key is created. To further restrict the algorithms that can be
|
|
883
902
|
# used with the KMS key, use a condition key in its key policy or IAM
|
|
884
903
|
# policy. For more information, see [kms:EncryptionAlgorithm][2],
|
|
885
|
-
# [kms:MacAlgorithm][3]
|
|
886
|
-
# <i>Key Management Service
|
|
904
|
+
# [kms:MacAlgorithm][3], [kms:KeyAgreementAlgorithm][4], or
|
|
905
|
+
# [kms:SigningAlgorithm][5] in the <i> <i>Key Management Service
|
|
906
|
+
# Developer Guide</i> </i>.
|
|
887
907
|
#
|
|
888
|
-
# [Amazon Web Services services that are integrated with KMS][
|
|
908
|
+
# [Amazon Web Services services that are integrated with KMS][6] use
|
|
889
909
|
# symmetric encryption KMS keys to protect your data. These services
|
|
890
910
|
# do not support asymmetric KMS keys or HMAC KMS keys.
|
|
891
911
|
#
|
|
@@ -928,6 +948,13 @@ module Aws::KMS
|
|
|
928
948
|
# cryptocurrencies.
|
|
929
949
|
#
|
|
930
950
|
# ^
|
|
951
|
+
# * Asymmetric ML-DSA key pairs (signing and verification)
|
|
952
|
+
#
|
|
953
|
+
# * `ML_DSA_44`
|
|
954
|
+
#
|
|
955
|
+
# * `ML_DSA_65`
|
|
956
|
+
#
|
|
957
|
+
# * `ML_DSA_87`
|
|
931
958
|
# * SM2 key pairs (encryption and decryption -or- signing and
|
|
932
959
|
# verification -or- deriving shared secrets)
|
|
933
960
|
#
|
|
@@ -937,11 +964,12 @@ module Aws::KMS
|
|
|
937
964
|
#
|
|
938
965
|
#
|
|
939
966
|
#
|
|
940
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
941
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
942
|
-
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
943
|
-
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
944
|
-
# [5]:
|
|
967
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html
|
|
968
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-algorithm
|
|
969
|
+
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-mac-algorithm
|
|
970
|
+
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-agreement-algorithm
|
|
971
|
+
# [5]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-signing-algorithm
|
|
972
|
+
# [6]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
|
|
945
973
|
# @return [String]
|
|
946
974
|
#
|
|
947
975
|
# @!attribute [rw] origin
|
|
@@ -994,7 +1022,7 @@ module Aws::KMS
|
|
|
994
1022
|
#
|
|
995
1023
|
#
|
|
996
1024
|
#
|
|
997
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
1025
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
|
|
998
1026
|
# @return [String]
|
|
999
1027
|
#
|
|
1000
1028
|
# @!attribute [rw] bypass_policy_lockout_safety_check
|
|
@@ -1045,7 +1073,7 @@ module Aws::KMS
|
|
|
1045
1073
|
# When you add tags to an Amazon Web Services resource, Amazon Web
|
|
1046
1074
|
# Services generates a cost allocation report with usage and costs
|
|
1047
1075
|
# aggregated by tags. Tags can also be used to control access to a KMS
|
|
1048
|
-
# key. For details, see [
|
|
1076
|
+
# key. For details, see [Tags in KMS][3].
|
|
1049
1077
|
#
|
|
1050
1078
|
#
|
|
1051
1079
|
#
|
|
@@ -1118,7 +1146,7 @@ module Aws::KMS
|
|
|
1118
1146
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
|
|
1119
1147
|
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
|
|
1120
1148
|
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy
|
|
1121
|
-
# [4]: https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements
|
|
1149
|
+
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html#xks-key-requirements
|
|
1122
1150
|
# [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption
|
|
1123
1151
|
# @return [String]
|
|
1124
1152
|
#
|
|
@@ -1526,8 +1554,8 @@ module Aws::KMS
|
|
|
1526
1554
|
#
|
|
1527
1555
|
#
|
|
1528
1556
|
#
|
|
1529
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
1530
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
1557
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
|
|
1558
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
|
|
1531
1559
|
# @return [Hash<String,String>]
|
|
1532
1560
|
#
|
|
1533
1561
|
# @!attribute [rw] grant_tokens
|
|
@@ -1541,7 +1569,7 @@ module Aws::KMS
|
|
|
1541
1569
|
#
|
|
1542
1570
|
#
|
|
1543
1571
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
1544
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
1572
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
1545
1573
|
# @return [Array<String>]
|
|
1546
1574
|
#
|
|
1547
1575
|
# @!attribute [rw] key_id
|
|
@@ -1622,12 +1650,12 @@ module Aws::KMS
|
|
|
1622
1650
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
1623
1651
|
# parameter.
|
|
1624
1652
|
#
|
|
1625
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
1626
|
-
#
|
|
1653
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
1654
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
1627
1655
|
#
|
|
1628
1656
|
#
|
|
1629
1657
|
#
|
|
1630
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
1658
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
1631
1659
|
# @return [Boolean]
|
|
1632
1660
|
#
|
|
1633
1661
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DecryptRequest AWS API Documentation
|
|
@@ -1682,13 +1710,21 @@ module Aws::KMS
|
|
|
1682
1710
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
|
|
1683
1711
|
# @return [String]
|
|
1684
1712
|
#
|
|
1713
|
+
# @!attribute [rw] key_material_id
|
|
1714
|
+
# The identifier of the key material used to decrypt the ciphertext.
|
|
1715
|
+
# This field is present only when the operation uses a symmetric
|
|
1716
|
+
# encryption KMS key. This field is omitted if the request includes
|
|
1717
|
+
# the `Recipient` parameter.
|
|
1718
|
+
# @return [String]
|
|
1719
|
+
#
|
|
1685
1720
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DecryptResponse AWS API Documentation
|
|
1686
1721
|
#
|
|
1687
1722
|
class DecryptResponse < Struct.new(
|
|
1688
1723
|
:key_id,
|
|
1689
1724
|
:plaintext,
|
|
1690
1725
|
:encryption_algorithm,
|
|
1691
|
-
:ciphertext_for_recipient
|
|
1726
|
+
:ciphertext_for_recipient,
|
|
1727
|
+
:key_material_id)
|
|
1692
1728
|
SENSITIVE = [:plaintext]
|
|
1693
1729
|
include Aws::Structure
|
|
1694
1730
|
end
|
|
@@ -1740,10 +1776,43 @@ module Aws::KMS
|
|
|
1740
1776
|
# DescribeKey.
|
|
1741
1777
|
# @return [String]
|
|
1742
1778
|
#
|
|
1779
|
+
# @!attribute [rw] key_material_id
|
|
1780
|
+
# Identifies the imported key material you are deleting.
|
|
1781
|
+
#
|
|
1782
|
+
# If no KeyMaterialId is specified, KMS deletes the current key
|
|
1783
|
+
# material.
|
|
1784
|
+
#
|
|
1785
|
+
# To get the list of key material IDs associated with a KMS key, use
|
|
1786
|
+
# ListKeyRotations.
|
|
1787
|
+
# @return [String]
|
|
1788
|
+
#
|
|
1743
1789
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterialRequest AWS API Documentation
|
|
1744
1790
|
#
|
|
1745
1791
|
class DeleteImportedKeyMaterialRequest < Struct.new(
|
|
1746
|
-
:key_id
|
|
1792
|
+
:key_id,
|
|
1793
|
+
:key_material_id)
|
|
1794
|
+
SENSITIVE = []
|
|
1795
|
+
include Aws::Structure
|
|
1796
|
+
end
|
|
1797
|
+
|
|
1798
|
+
# @!attribute [rw] key_id
|
|
1799
|
+
# The Amazon Resource Name ([key ARN][1]) of the KMS key from which
|
|
1800
|
+
# the key material was deleted.
|
|
1801
|
+
#
|
|
1802
|
+
#
|
|
1803
|
+
#
|
|
1804
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
|
|
1805
|
+
# @return [String]
|
|
1806
|
+
#
|
|
1807
|
+
# @!attribute [rw] key_material_id
|
|
1808
|
+
# Identifies the deleted key material.
|
|
1809
|
+
# @return [String]
|
|
1810
|
+
#
|
|
1811
|
+
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterialResponse AWS API Documentation
|
|
1812
|
+
#
|
|
1813
|
+
class DeleteImportedKeyMaterialResponse < Struct.new(
|
|
1814
|
+
:key_id,
|
|
1815
|
+
:key_material_id)
|
|
1747
1816
|
SENSITIVE = []
|
|
1748
1817
|
include Aws::Structure
|
|
1749
1818
|
end
|
|
@@ -1831,19 +1900,19 @@ module Aws::KMS
|
|
|
1831
1900
|
#
|
|
1832
1901
|
#
|
|
1833
1902
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
1834
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
1903
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
1835
1904
|
# @return [Array<String>]
|
|
1836
1905
|
#
|
|
1837
1906
|
# @!attribute [rw] dry_run
|
|
1838
1907
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
1839
1908
|
# parameter.
|
|
1840
1909
|
#
|
|
1841
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
1842
|
-
#
|
|
1910
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
1911
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
1843
1912
|
#
|
|
1844
1913
|
#
|
|
1845
1914
|
#
|
|
1846
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
1915
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
1847
1916
|
# @return [Boolean]
|
|
1848
1917
|
#
|
|
1849
1918
|
# @!attribute [rw] recipient
|
|
@@ -2063,7 +2132,7 @@ module Aws::KMS
|
|
|
2063
2132
|
#
|
|
2064
2133
|
#
|
|
2065
2134
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
2066
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2135
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
2067
2136
|
# @return [Array<String>]
|
|
2068
2137
|
#
|
|
2069
2138
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeKeyRequest AWS API Documentation
|
|
@@ -2134,7 +2203,7 @@ module Aws::KMS
|
|
|
2134
2203
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks
|
|
2135
2204
|
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
|
|
2136
2205
|
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
|
|
2137
|
-
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2206
|
+
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
|
|
2138
2207
|
# @return [String]
|
|
2139
2208
|
#
|
|
2140
2209
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DisableKeyRotationRequest AWS API Documentation
|
|
@@ -2237,8 +2306,8 @@ module Aws::KMS
|
|
|
2237
2306
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
|
|
2238
2307
|
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
|
|
2239
2308
|
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
|
|
2240
|
-
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2241
|
-
# [5]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2309
|
+
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
|
|
2310
|
+
# [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
|
|
2242
2311
|
# @return [String]
|
|
2243
2312
|
#
|
|
2244
2313
|
# @!attribute [rw] rotation_period_in_days
|
|
@@ -2324,8 +2393,8 @@ module Aws::KMS
|
|
|
2324
2393
|
#
|
|
2325
2394
|
#
|
|
2326
2395
|
#
|
|
2327
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2328
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2396
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
|
|
2397
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
|
|
2329
2398
|
# @return [Hash<String,String>]
|
|
2330
2399
|
#
|
|
2331
2400
|
# @!attribute [rw] grant_tokens
|
|
@@ -2339,7 +2408,7 @@ module Aws::KMS
|
|
|
2339
2408
|
#
|
|
2340
2409
|
#
|
|
2341
2410
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
2342
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2411
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
2343
2412
|
# @return [Array<String>]
|
|
2344
2413
|
#
|
|
2345
2414
|
# @!attribute [rw] encryption_algorithm
|
|
@@ -2359,12 +2428,12 @@ module Aws::KMS
|
|
|
2359
2428
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
2360
2429
|
# parameter.
|
|
2361
2430
|
#
|
|
2362
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
2363
|
-
#
|
|
2431
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
2432
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
2364
2433
|
#
|
|
2365
2434
|
#
|
|
2366
2435
|
#
|
|
2367
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2436
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
2368
2437
|
# @return [Boolean]
|
|
2369
2438
|
#
|
|
2370
2439
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/EncryptRequest AWS API Documentation
|
|
@@ -2447,7 +2516,7 @@ module Aws::KMS
|
|
|
2447
2516
|
#
|
|
2448
2517
|
#
|
|
2449
2518
|
#
|
|
2450
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2519
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
|
|
2451
2520
|
# @return [Hash<String,String>]
|
|
2452
2521
|
#
|
|
2453
2522
|
# @!attribute [rw] key_id
|
|
@@ -2481,9 +2550,11 @@ module Aws::KMS
|
|
|
2481
2550
|
#
|
|
2482
2551
|
# The KMS rule that restricts the use of asymmetric RSA and SM2 KMS
|
|
2483
2552
|
# keys to encrypt and decrypt or to sign and verify (but not both),
|
|
2484
|
-
#
|
|
2485
|
-
# verify,
|
|
2486
|
-
#
|
|
2553
|
+
# the rule that permits you to use ECC KMS keys only to sign and
|
|
2554
|
+
# verify, and the rule that permits you to use ML-DSA key pairs to
|
|
2555
|
+
# sign and verify only are not effective on data key pairs, which are
|
|
2556
|
+
# used outside of KMS. The SM2 key spec is only available in China
|
|
2557
|
+
# Regions.
|
|
2487
2558
|
# @return [String]
|
|
2488
2559
|
#
|
|
2489
2560
|
# @!attribute [rw] grant_tokens
|
|
@@ -2497,7 +2568,7 @@ module Aws::KMS
|
|
|
2497
2568
|
#
|
|
2498
2569
|
#
|
|
2499
2570
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
2500
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2571
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
2501
2572
|
# @return [Array<String>]
|
|
2502
2573
|
#
|
|
2503
2574
|
# @!attribute [rw] recipient
|
|
@@ -2538,12 +2609,12 @@ module Aws::KMS
|
|
|
2538
2609
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
2539
2610
|
# parameter.
|
|
2540
2611
|
#
|
|
2541
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
2542
|
-
#
|
|
2612
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
2613
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
2543
2614
|
#
|
|
2544
2615
|
#
|
|
2545
2616
|
#
|
|
2546
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2617
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
2547
2618
|
# @return [Boolean]
|
|
2548
2619
|
#
|
|
2549
2620
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairRequest AWS API Documentation
|
|
@@ -2610,6 +2681,10 @@ module Aws::KMS
|
|
|
2610
2681
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
|
|
2611
2682
|
# @return [String]
|
|
2612
2683
|
#
|
|
2684
|
+
# @!attribute [rw] key_material_id
|
|
2685
|
+
# The identifier of the key material used to encrypt the private key.
|
|
2686
|
+
# @return [String]
|
|
2687
|
+
#
|
|
2613
2688
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairResponse AWS API Documentation
|
|
2614
2689
|
#
|
|
2615
2690
|
class GenerateDataKeyPairResponse < Struct.new(
|
|
@@ -2618,7 +2693,8 @@ module Aws::KMS
|
|
|
2618
2693
|
:public_key,
|
|
2619
2694
|
:key_id,
|
|
2620
2695
|
:key_pair_spec,
|
|
2621
|
-
:ciphertext_for_recipient
|
|
2696
|
+
:ciphertext_for_recipient,
|
|
2697
|
+
:key_material_id)
|
|
2622
2698
|
SENSITIVE = [:private_key_plaintext]
|
|
2623
2699
|
include Aws::Structure
|
|
2624
2700
|
end
|
|
@@ -2645,7 +2721,7 @@ module Aws::KMS
|
|
|
2645
2721
|
#
|
|
2646
2722
|
#
|
|
2647
2723
|
#
|
|
2648
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2724
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
|
|
2649
2725
|
# @return [Hash<String,String>]
|
|
2650
2726
|
#
|
|
2651
2727
|
# @!attribute [rw] key_id
|
|
@@ -2679,9 +2755,11 @@ module Aws::KMS
|
|
|
2679
2755
|
#
|
|
2680
2756
|
# The KMS rule that restricts the use of asymmetric RSA and SM2 KMS
|
|
2681
2757
|
# keys to encrypt and decrypt or to sign and verify (but not both),
|
|
2682
|
-
#
|
|
2683
|
-
# verify,
|
|
2684
|
-
#
|
|
2758
|
+
# the rule that permits you to use ECC KMS keys only to sign and
|
|
2759
|
+
# verify, and the rule that permits you to use ML-DSA key pairs to
|
|
2760
|
+
# sign and verify only are not effective on data key pairs, which are
|
|
2761
|
+
# used outside of KMS. The SM2 key spec is only available in China
|
|
2762
|
+
# Regions.
|
|
2685
2763
|
# @return [String]
|
|
2686
2764
|
#
|
|
2687
2765
|
# @!attribute [rw] grant_tokens
|
|
@@ -2695,19 +2773,19 @@ module Aws::KMS
|
|
|
2695
2773
|
#
|
|
2696
2774
|
#
|
|
2697
2775
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
2698
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2776
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
2699
2777
|
# @return [Array<String>]
|
|
2700
2778
|
#
|
|
2701
2779
|
# @!attribute [rw] dry_run
|
|
2702
2780
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
2703
2781
|
# parameter.
|
|
2704
2782
|
#
|
|
2705
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
2706
|
-
#
|
|
2783
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
2784
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
2707
2785
|
#
|
|
2708
2786
|
#
|
|
2709
2787
|
#
|
|
2710
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2788
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
2711
2789
|
# @return [Boolean]
|
|
2712
2790
|
#
|
|
2713
2791
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintextRequest AWS API Documentation
|
|
@@ -2747,13 +2825,18 @@ module Aws::KMS
|
|
|
2747
2825
|
# The type of data key pair that was generated.
|
|
2748
2826
|
# @return [String]
|
|
2749
2827
|
#
|
|
2828
|
+
# @!attribute [rw] key_material_id
|
|
2829
|
+
# The identifier of the key material used to encrypt the private key.
|
|
2830
|
+
# @return [String]
|
|
2831
|
+
#
|
|
2750
2832
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintextResponse AWS API Documentation
|
|
2751
2833
|
#
|
|
2752
2834
|
class GenerateDataKeyPairWithoutPlaintextResponse < Struct.new(
|
|
2753
2835
|
:private_key_ciphertext_blob,
|
|
2754
2836
|
:public_key,
|
|
2755
2837
|
:key_id,
|
|
2756
|
-
:key_pair_spec
|
|
2838
|
+
:key_pair_spec,
|
|
2839
|
+
:key_material_id)
|
|
2757
2840
|
SENSITIVE = []
|
|
2758
2841
|
include Aws::Structure
|
|
2759
2842
|
end
|
|
@@ -2806,7 +2889,7 @@ module Aws::KMS
|
|
|
2806
2889
|
#
|
|
2807
2890
|
#
|
|
2808
2891
|
#
|
|
2809
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2892
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
|
|
2810
2893
|
# @return [Hash<String,String>]
|
|
2811
2894
|
#
|
|
2812
2895
|
# @!attribute [rw] number_of_bytes
|
|
@@ -2839,7 +2922,7 @@ module Aws::KMS
|
|
|
2839
2922
|
#
|
|
2840
2923
|
#
|
|
2841
2924
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
2842
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2925
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
2843
2926
|
# @return [Array<String>]
|
|
2844
2927
|
#
|
|
2845
2928
|
# @!attribute [rw] recipient
|
|
@@ -2876,12 +2959,12 @@ module Aws::KMS
|
|
|
2876
2959
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
2877
2960
|
# parameter.
|
|
2878
2961
|
#
|
|
2879
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
2880
|
-
#
|
|
2962
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
2963
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
2881
2964
|
#
|
|
2882
2965
|
#
|
|
2883
2966
|
#
|
|
2884
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
2967
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
2885
2968
|
# @return [Boolean]
|
|
2886
2969
|
#
|
|
2887
2970
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyRequest AWS API Documentation
|
|
@@ -2940,13 +3023,20 @@ module Aws::KMS
|
|
|
2940
3023
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
|
|
2941
3024
|
# @return [String]
|
|
2942
3025
|
#
|
|
3026
|
+
# @!attribute [rw] key_material_id
|
|
3027
|
+
# The identifier of the key material used to encrypt the data key.
|
|
3028
|
+
# This field is omitted if the request includes the `Recipient`
|
|
3029
|
+
# parameter.
|
|
3030
|
+
# @return [String]
|
|
3031
|
+
#
|
|
2943
3032
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyResponse AWS API Documentation
|
|
2944
3033
|
#
|
|
2945
3034
|
class GenerateDataKeyResponse < Struct.new(
|
|
2946
3035
|
:ciphertext_blob,
|
|
2947
3036
|
:plaintext,
|
|
2948
3037
|
:key_id,
|
|
2949
|
-
:ciphertext_for_recipient
|
|
3038
|
+
:ciphertext_for_recipient,
|
|
3039
|
+
:key_material_id)
|
|
2950
3040
|
SENSITIVE = [:plaintext]
|
|
2951
3041
|
include Aws::Structure
|
|
2952
3042
|
end
|
|
@@ -2999,7 +3089,7 @@ module Aws::KMS
|
|
|
2999
3089
|
#
|
|
3000
3090
|
#
|
|
3001
3091
|
#
|
|
3002
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3092
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
|
|
3003
3093
|
# @return [Hash<String,String>]
|
|
3004
3094
|
#
|
|
3005
3095
|
# @!attribute [rw] key_spec
|
|
@@ -3025,19 +3115,19 @@ module Aws::KMS
|
|
|
3025
3115
|
#
|
|
3026
3116
|
#
|
|
3027
3117
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
3028
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3118
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
3029
3119
|
# @return [Array<String>]
|
|
3030
3120
|
#
|
|
3031
3121
|
# @!attribute [rw] dry_run
|
|
3032
3122
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
3033
3123
|
# parameter.
|
|
3034
3124
|
#
|
|
3035
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
3036
|
-
#
|
|
3125
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
3126
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
3037
3127
|
#
|
|
3038
3128
|
#
|
|
3039
3129
|
#
|
|
3040
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3130
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
3041
3131
|
# @return [Boolean]
|
|
3042
3132
|
#
|
|
3043
3133
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintextRequest AWS API Documentation
|
|
@@ -3068,11 +3158,16 @@ module Aws::KMS
|
|
|
3068
3158
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
|
|
3069
3159
|
# @return [String]
|
|
3070
3160
|
#
|
|
3161
|
+
# @!attribute [rw] key_material_id
|
|
3162
|
+
# The identifier of the key material used to encrypt the data key.
|
|
3163
|
+
# @return [String]
|
|
3164
|
+
#
|
|
3071
3165
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintextResponse AWS API Documentation
|
|
3072
3166
|
#
|
|
3073
3167
|
class GenerateDataKeyWithoutPlaintextResponse < Struct.new(
|
|
3074
3168
|
:ciphertext_blob,
|
|
3075
|
-
:key_id
|
|
3169
|
+
:key_id,
|
|
3170
|
+
:key_material_id)
|
|
3076
3171
|
SENSITIVE = []
|
|
3077
3172
|
include Aws::Structure
|
|
3078
3173
|
end
|
|
@@ -3117,19 +3212,19 @@ module Aws::KMS
|
|
|
3117
3212
|
#
|
|
3118
3213
|
#
|
|
3119
3214
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
3120
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3215
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
3121
3216
|
# @return [Array<String>]
|
|
3122
3217
|
#
|
|
3123
3218
|
# @!attribute [rw] dry_run
|
|
3124
3219
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
3125
3220
|
# parameter.
|
|
3126
3221
|
#
|
|
3127
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
3128
|
-
#
|
|
3222
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
3223
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
3129
3224
|
#
|
|
3130
3225
|
#
|
|
3131
3226
|
#
|
|
3132
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3227
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
3133
3228
|
# @return [Boolean]
|
|
3134
3229
|
#
|
|
3135
3230
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateMacRequest AWS API Documentation
|
|
@@ -3355,15 +3450,12 @@ module Aws::KMS
|
|
|
3355
3450
|
# Identifies the date and time that an in progress on-demand rotation
|
|
3356
3451
|
# was initiated.
|
|
3357
3452
|
#
|
|
3358
|
-
#
|
|
3359
|
-
#
|
|
3360
|
-
#
|
|
3361
|
-
#
|
|
3362
|
-
# ListKeyRotations to view the details of the on-demand
|
|
3363
|
-
#
|
|
3364
|
-
#
|
|
3365
|
-
#
|
|
3366
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
|
|
3453
|
+
# KMS uses a background process to perform rotations. As a result,
|
|
3454
|
+
# there might be a slight delay between initiating on-demand key
|
|
3455
|
+
# rotation and the rotation's completion. Once the on-demand rotation
|
|
3456
|
+
# is complete, KMS removes this field from the response. You can use
|
|
3457
|
+
# ListKeyRotations to view the details of the completed on-demand
|
|
3458
|
+
# rotation.
|
|
3367
3459
|
# @return [Time]
|
|
3368
3460
|
#
|
|
3369
3461
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GetKeyRotationStatusResponse AWS API Documentation
|
|
@@ -3403,9 +3495,8 @@ module Aws::KMS
|
|
|
3403
3495
|
# @!attribute [rw] wrapping_algorithm
|
|
3404
3496
|
# The algorithm you will use with the RSA public key (`PublicKey`) in
|
|
3405
3497
|
# the response to protect your key material during import. For more
|
|
3406
|
-
# information, see [Select a wrapping
|
|
3407
|
-
#
|
|
3408
|
-
# in the *Key Management Service Developer Guide*.
|
|
3498
|
+
# information, see [Select a wrapping algorithm][1] in the *Key
|
|
3499
|
+
# Management Service Developer Guide*.
|
|
3409
3500
|
#
|
|
3410
3501
|
# For RSA\_AES wrapping algorithms, you encrypt your key material with
|
|
3411
3502
|
# an AES key that you generate, then encrypt your AES key with the RSA
|
|
@@ -3437,6 +3528,10 @@ module Aws::KMS
|
|
|
3437
3528
|
#
|
|
3438
3529
|
# * **RSAES\_PKCS1\_V1\_5** (Deprecated) — As of October 10, 2023, KMS
|
|
3439
3530
|
# does not support the RSAES\_PKCS1\_V1\_5 wrapping algorithm.
|
|
3531
|
+
#
|
|
3532
|
+
#
|
|
3533
|
+
#
|
|
3534
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm
|
|
3440
3535
|
# @return [String]
|
|
3441
3536
|
#
|
|
3442
3537
|
# @!attribute [rw] wrapping_key_spec
|
|
@@ -3532,7 +3627,7 @@ module Aws::KMS
|
|
|
3532
3627
|
#
|
|
3533
3628
|
#
|
|
3534
3629
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
3535
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3630
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
3536
3631
|
# @return [Array<String>]
|
|
3537
3632
|
#
|
|
3538
3633
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GetPublicKeyRequest AWS API Documentation
|
|
@@ -3634,9 +3729,9 @@ module Aws::KMS
|
|
|
3634
3729
|
#
|
|
3635
3730
|
# KMS applies the grant constraints only to cryptographic operations
|
|
3636
3731
|
# that support an encryption context, that is, all cryptographic
|
|
3637
|
-
# operations with a
|
|
3638
|
-
#
|
|
3639
|
-
#
|
|
3732
|
+
# operations with a symmetric KMS key. Grant constraints are not applied
|
|
3733
|
+
# to operations that do not support an encryption context, such as
|
|
3734
|
+
# cryptographic operations with asymmetric KMS keys and management
|
|
3640
3735
|
# operations, such as DescribeKey or RetireGrant.
|
|
3641
3736
|
#
|
|
3642
3737
|
# In a cryptographic operation, the encryption context in the decryption
|
|
@@ -3651,15 +3746,14 @@ module Aws::KMS
|
|
|
3651
3746
|
# differ only by case. To require a fully case-sensitive encryption
|
|
3652
3747
|
# context, use the `kms:EncryptionContext:` and
|
|
3653
3748
|
# `kms:EncryptionContextKeys` conditions in an IAM or key policy. For
|
|
3654
|
-
# details, see [kms:EncryptionContext:][
|
|
3655
|
-
# Service Developer Guide</i> </i>.
|
|
3749
|
+
# details, see [kms:EncryptionContext:context-key][3] in the <i> <i>Key
|
|
3750
|
+
# Management Service Developer Guide</i> </i>.
|
|
3656
3751
|
#
|
|
3657
3752
|
#
|
|
3658
3753
|
#
|
|
3659
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3660
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3661
|
-
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3662
|
-
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-context
|
|
3754
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
|
|
3755
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
|
|
3756
|
+
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-context
|
|
3663
3757
|
#
|
|
3664
3758
|
# @!attribute [rw] encryption_context_subset
|
|
3665
3759
|
# A list of key-value pairs that must be included in the encryption
|
|
@@ -3670,7 +3764,7 @@ module Aws::KMS
|
|
|
3670
3764
|
#
|
|
3671
3765
|
#
|
|
3672
3766
|
#
|
|
3673
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3767
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
|
|
3674
3768
|
# @return [Hash<String,String>]
|
|
3675
3769
|
#
|
|
3676
3770
|
# @!attribute [rw] encryption_context_equals
|
|
@@ -3681,7 +3775,7 @@ module Aws::KMS
|
|
|
3681
3775
|
#
|
|
3682
3776
|
#
|
|
3683
3777
|
#
|
|
3684
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
3778
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
|
|
3685
3779
|
# @return [Hash<String,String>]
|
|
3686
3780
|
#
|
|
3687
3781
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GrantConstraints AWS API Documentation
|
|
@@ -3770,11 +3864,9 @@ module Aws::KMS
|
|
|
3770
3864
|
#
|
|
3771
3865
|
# The KMS key can be a symmetric encryption KMS key, HMAC KMS key,
|
|
3772
3866
|
# asymmetric encryption KMS key, or asymmetric signing KMS key,
|
|
3773
|
-
# including a [multi-Region
|
|
3774
|
-
# key
|
|
3775
|
-
#
|
|
3776
|
-
# in a custom key store, or on a KMS key in a different Amazon Web
|
|
3777
|
-
# Services account.
|
|
3867
|
+
# including a [multi-Region key][1] of any supported type. You cannot
|
|
3868
|
+
# perform this operation on a KMS key in a custom key store, or on a
|
|
3869
|
+
# KMS key in a different Amazon Web Services account.
|
|
3778
3870
|
#
|
|
3779
3871
|
# Specify the key ID or key ARN of the KMS key.
|
|
3780
3872
|
#
|
|
@@ -3787,6 +3879,10 @@ module Aws::KMS
|
|
|
3787
3879
|
#
|
|
3788
3880
|
# To get the key ID and key ARN for a KMS key, use ListKeys or
|
|
3789
3881
|
# DescribeKey.
|
|
3882
|
+
#
|
|
3883
|
+
#
|
|
3884
|
+
#
|
|
3885
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
|
|
3790
3886
|
# @return [String]
|
|
3791
3887
|
#
|
|
3792
3888
|
# @!attribute [rw] import_token
|
|
@@ -3838,7 +3934,46 @@ module Aws::KMS
|
|
|
3838
3934
|
#
|
|
3839
3935
|
#
|
|
3840
3936
|
#
|
|
3841
|
-
# [1]: https://docs.aws.amazon.com/
|
|
3937
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
|
|
3938
|
+
# @return [String]
|
|
3939
|
+
#
|
|
3940
|
+
# @!attribute [rw] import_type
|
|
3941
|
+
# Indicates whether the key material being imported is previously
|
|
3942
|
+
# associated with this KMS key or not. This parameter is optional and
|
|
3943
|
+
# only usable with symmetric encryption keys. If no key material has
|
|
3944
|
+
# ever been imported into the KMS key, and this parameter is omitted,
|
|
3945
|
+
# the parameter defaults to `NEW_KEY_MATERIAL`. After the first key
|
|
3946
|
+
# material is imported, if this parameter is omitted then the
|
|
3947
|
+
# parameter defaults to `EXISTING_KEY_MATERIAL`.
|
|
3948
|
+
# @return [String]
|
|
3949
|
+
#
|
|
3950
|
+
# @!attribute [rw] key_material_description
|
|
3951
|
+
# Description for the key material being imported. This parameter is
|
|
3952
|
+
# optional and only usable with symmetric encryption keys. If you do
|
|
3953
|
+
# not specify a key material description, KMS retains the value you
|
|
3954
|
+
# specified when you last imported the same key material into this KMS
|
|
3955
|
+
# key.
|
|
3956
|
+
# @return [String]
|
|
3957
|
+
#
|
|
3958
|
+
# @!attribute [rw] key_material_id
|
|
3959
|
+
# Identifies the key material being imported. This parameter is
|
|
3960
|
+
# optional and only usable with symmetric encryption keys. You cannot
|
|
3961
|
+
# specify a key material ID with `ImportType` set to
|
|
3962
|
+
# `NEW_KEY_MATERIAL`. Whenever you import key material into a
|
|
3963
|
+
# symmetric encryption key, KMS assigns a unique identifier to the key
|
|
3964
|
+
# material based on the KMS key ID and the imported key material. When
|
|
3965
|
+
# you re-import key material with a specified key material ID, KMS:
|
|
3966
|
+
#
|
|
3967
|
+
# * Computes the identifier for the key material
|
|
3968
|
+
#
|
|
3969
|
+
# * Matches the computed identifier against the specified key material
|
|
3970
|
+
# ID
|
|
3971
|
+
#
|
|
3972
|
+
# * Verifies that the key material ID is already associated with the
|
|
3973
|
+
# KMS key
|
|
3974
|
+
#
|
|
3975
|
+
# To get the list of key material IDs associated with a KMS key, use
|
|
3976
|
+
# ListKeyRotations.
|
|
3842
3977
|
# @return [String]
|
|
3843
3978
|
#
|
|
3844
3979
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterialRequest AWS API Documentation
|
|
@@ -3848,14 +3983,35 @@ module Aws::KMS
|
|
|
3848
3983
|
:import_token,
|
|
3849
3984
|
:encrypted_key_material,
|
|
3850
3985
|
:valid_to,
|
|
3851
|
-
:expiration_model
|
|
3986
|
+
:expiration_model,
|
|
3987
|
+
:import_type,
|
|
3988
|
+
:key_material_description,
|
|
3989
|
+
:key_material_id)
|
|
3852
3990
|
SENSITIVE = []
|
|
3853
3991
|
include Aws::Structure
|
|
3854
3992
|
end
|
|
3855
3993
|
|
|
3994
|
+
# @!attribute [rw] key_id
|
|
3995
|
+
# The Amazon Resource Name ([key ARN][1]) of the KMS key into which
|
|
3996
|
+
# key material was imported.
|
|
3997
|
+
#
|
|
3998
|
+
#
|
|
3999
|
+
#
|
|
4000
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
|
|
4001
|
+
# @return [String]
|
|
4002
|
+
#
|
|
4003
|
+
# @!attribute [rw] key_material_id
|
|
4004
|
+
# Identifies the imported key material.
|
|
4005
|
+
# @return [String]
|
|
4006
|
+
#
|
|
3856
4007
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterialResponse AWS API Documentation
|
|
3857
4008
|
#
|
|
3858
|
-
class ImportKeyMaterialResponse <
|
|
4009
|
+
class ImportKeyMaterialResponse < Struct.new(
|
|
4010
|
+
:key_id,
|
|
4011
|
+
:key_material_id)
|
|
4012
|
+
SENSITIVE = []
|
|
4013
|
+
include Aws::Structure
|
|
4014
|
+
end
|
|
3859
4015
|
|
|
3860
4016
|
# The request was rejected because the specified KMS key cannot decrypt
|
|
3861
4017
|
# the data. The `KeyId` in a Decrypt request and the `SourceKeyId` in a
|
|
@@ -3874,8 +4030,10 @@ module Aws::KMS
|
|
|
3874
4030
|
end
|
|
3875
4031
|
|
|
3876
4032
|
# The request was rejected because the key material in the request is,
|
|
3877
|
-
# expired, invalid, or
|
|
3878
|
-
# imported
|
|
4033
|
+
# expired, invalid, or does not meet expectations. For example, it is
|
|
4034
|
+
# not the same key material that was previously imported or KMS expected
|
|
4035
|
+
# new key material but the key material being imported is already
|
|
4036
|
+
# associated with the KMS key.
|
|
3879
4037
|
#
|
|
3880
4038
|
# @!attribute [rw] message
|
|
3881
4039
|
# @return [String]
|
|
@@ -4182,7 +4340,7 @@ module Aws::KMS
|
|
|
4182
4340
|
#
|
|
4183
4341
|
#
|
|
4184
4342
|
#
|
|
4185
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
4343
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
|
|
4186
4344
|
# @return [String]
|
|
4187
4345
|
#
|
|
4188
4346
|
# @!attribute [rw] key_state
|
|
@@ -4209,11 +4367,12 @@ module Aws::KMS
|
|
|
4209
4367
|
# @return [Time]
|
|
4210
4368
|
#
|
|
4211
4369
|
# @!attribute [rw] valid_to
|
|
4212
|
-
# The time at which
|
|
4213
|
-
#
|
|
4214
|
-
#
|
|
4215
|
-
# `Origin` is `EXTERNAL` and
|
|
4216
|
-
# `KEY_MATERIAL_EXPIRES`, otherwise this
|
|
4370
|
+
# The earliest time at which any imported key material permanently
|
|
4371
|
+
# associated with this KMS key expires. When a key material expires,
|
|
4372
|
+
# KMS deletes the key material and the KMS key becomes unusable. This
|
|
4373
|
+
# value is present only for KMS keys whose `Origin` is `EXTERNAL` and
|
|
4374
|
+
# the `ExpirationModel` is `KEY_MATERIAL_EXPIRES`, otherwise this
|
|
4375
|
+
# value is omitted.
|
|
4217
4376
|
# @return [Time]
|
|
4218
4377
|
#
|
|
4219
4378
|
# @!attribute [rw] origin
|
|
@@ -4232,7 +4391,7 @@ module Aws::KMS
|
|
|
4232
4391
|
#
|
|
4233
4392
|
#
|
|
4234
4393
|
#
|
|
4235
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
4394
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
|
|
4236
4395
|
# @return [String]
|
|
4237
4396
|
#
|
|
4238
4397
|
# @!attribute [rw] cloud_hsm_cluster_id
|
|
@@ -4244,7 +4403,7 @@ module Aws::KMS
|
|
|
4244
4403
|
#
|
|
4245
4404
|
#
|
|
4246
4405
|
#
|
|
4247
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
4406
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
|
|
4248
4407
|
# @return [String]
|
|
4249
4408
|
#
|
|
4250
4409
|
# @!attribute [rw] expiration_model
|
|
@@ -4367,6 +4526,16 @@ module Aws::KMS
|
|
|
4367
4526
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
|
|
4368
4527
|
# @return [Types::XksKeyConfigurationType]
|
|
4369
4528
|
#
|
|
4529
|
+
# @!attribute [rw] current_key_material_id
|
|
4530
|
+
# Identifies the current key material. This value is present for
|
|
4531
|
+
# symmetric encryption keys with `AWS_KMS` origin and single-Region,
|
|
4532
|
+
# symmetric encryption keys with `EXTERNAL` origin. These KMS keys
|
|
4533
|
+
# support automatic or on-demand key rotation and can have multiple
|
|
4534
|
+
# key materials associated with them. KMS uses the current key
|
|
4535
|
+
# material for both encryption and decryption, and the non-current key
|
|
4536
|
+
# material for decryption operations only.
|
|
4537
|
+
# @return [String]
|
|
4538
|
+
#
|
|
4370
4539
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/KeyMetadata AWS API Documentation
|
|
4371
4540
|
#
|
|
4372
4541
|
class KeyMetadata < Struct.new(
|
|
@@ -4394,7 +4563,8 @@ module Aws::KMS
|
|
|
4394
4563
|
:multi_region_configuration,
|
|
4395
4564
|
:pending_deletion_window_in_days,
|
|
4396
4565
|
:mac_algorithms,
|
|
4397
|
-
:xks_key_configuration
|
|
4566
|
+
:xks_key_configuration,
|
|
4567
|
+
:current_key_material_id)
|
|
4398
4568
|
SENSITIVE = []
|
|
4399
4569
|
include Aws::Structure
|
|
4400
4570
|
end
|
|
@@ -4413,9 +4583,9 @@ module Aws::KMS
|
|
|
4413
4583
|
include Aws::Structure
|
|
4414
4584
|
end
|
|
4415
4585
|
|
|
4416
|
-
# The request was rejected because a
|
|
4417
|
-
# information, see [Quotas][1] in the *Key Management
|
|
4418
|
-
# Guide*.
|
|
4586
|
+
# The request was rejected because a length constraint or quota was
|
|
4587
|
+
# exceeded. For more information, see [Quotas][1] in the *Key Management
|
|
4588
|
+
# Service Developer Guide*.
|
|
4419
4589
|
#
|
|
4420
4590
|
#
|
|
4421
4591
|
#
|
|
@@ -4673,6 +4843,18 @@ module Aws::KMS
|
|
|
4673
4843
|
# DescribeKey.
|
|
4674
4844
|
# @return [String]
|
|
4675
4845
|
#
|
|
4846
|
+
# @!attribute [rw] include_key_material
|
|
4847
|
+
# Use this optional parameter to control which key materials
|
|
4848
|
+
# associated with this key are listed in the response. The default
|
|
4849
|
+
# value of this parameter is `ROTATIONS_ONLY`. If you omit this
|
|
4850
|
+
# parameter, KMS returns information on the key materials created by
|
|
4851
|
+
# automatic or on-demand key rotation. When you specify a value of
|
|
4852
|
+
# `ALL_KEY_MATERIAL`, KMS adds the first key material and any imported
|
|
4853
|
+
# key material pending rotation to the response. This parameter can
|
|
4854
|
+
# only be used with KMS keys that support automatic or on-demand key
|
|
4855
|
+
# rotation.
|
|
4856
|
+
# @return [String]
|
|
4857
|
+
#
|
|
4676
4858
|
# @!attribute [rw] limit
|
|
4677
4859
|
# Use this parameter to specify the maximum number of items to return.
|
|
4678
4860
|
# When this value is present, KMS does not return more than the
|
|
@@ -4693,6 +4875,7 @@ module Aws::KMS
|
|
|
4693
4875
|
#
|
|
4694
4876
|
class ListKeyRotationsRequest < Struct.new(
|
|
4695
4877
|
:key_id,
|
|
4878
|
+
:include_key_material,
|
|
4696
4879
|
:limit,
|
|
4697
4880
|
:marker)
|
|
4698
4881
|
SENSITIVE = []
|
|
@@ -4700,7 +4883,10 @@ module Aws::KMS
|
|
|
4700
4883
|
end
|
|
4701
4884
|
|
|
4702
4885
|
# @!attribute [rw] rotations
|
|
4703
|
-
# A list of completed key material rotations.
|
|
4886
|
+
# A list of completed key material rotations. When the optional input
|
|
4887
|
+
# parameter `IncludeKeyMaterial` is specified with a value of
|
|
4888
|
+
# `ALL_KEY_MATERIAL`, this list includes the first key material and
|
|
4889
|
+
# any imported key material pending rotation.
|
|
4704
4890
|
# @return [Array<Types::RotationsListEntry>]
|
|
4705
4891
|
#
|
|
4706
4892
|
# @!attribute [rw] next_marker
|
|
@@ -5023,6 +5209,18 @@ module Aws::KMS
|
|
|
5023
5209
|
# that I make are not always immediately visible][2] in the *Amazon
|
|
5024
5210
|
# Web Services Identity and Access Management User Guide*.
|
|
5025
5211
|
#
|
|
5212
|
+
# <note markdown="1"> If either of the required `Resource` or `Action` elements are
|
|
5213
|
+
# missing from a key policy statement, the policy statement has no
|
|
5214
|
+
# effect. When a key policy statement is missing one of these
|
|
5215
|
+
# elements, the KMS console correctly reports an error, but the
|
|
5216
|
+
# `PutKeyPolicy` API request succeeds, even though the policy
|
|
5217
|
+
# statement is ineffective.
|
|
5218
|
+
#
|
|
5219
|
+
# For more information on required key policy elements, see [Elements
|
|
5220
|
+
# in a key policy][3] in the *Key Management Service Developer Guide*.
|
|
5221
|
+
#
|
|
5222
|
+
# </note>
|
|
5223
|
+
#
|
|
5026
5224
|
# A key policy document can include only the following characters:
|
|
5027
5225
|
#
|
|
5028
5226
|
# * Printable ASCII characters from the space character (`\u0020`)
|
|
@@ -5034,18 +5232,24 @@ module Aws::KMS
|
|
|
5034
5232
|
# * The tab (`\u0009`), line feed (`\u000A`), and carriage return
|
|
5035
5233
|
# (`\u000D`) special characters
|
|
5036
5234
|
#
|
|
5037
|
-
#
|
|
5235
|
+
# <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
|
|
5236
|
+
# `LimitExceededException`.
|
|
5237
|
+
#
|
|
5238
|
+
# </note>
|
|
5239
|
+
#
|
|
5240
|
+
# For information about key policies, see [Key policies in KMS][4] in
|
|
5038
5241
|
# the *Key Management Service Developer Guide*.For help writing and
|
|
5039
5242
|
# formatting a JSON policy document, see the [IAM JSON Policy
|
|
5040
|
-
# Reference][
|
|
5243
|
+
# Reference][5] in the <i> <i>Identity and Access Management User
|
|
5041
5244
|
# Guide</i> </i>.
|
|
5042
5245
|
#
|
|
5043
5246
|
#
|
|
5044
5247
|
#
|
|
5045
5248
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
|
|
5046
5249
|
# [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
|
|
5047
|
-
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-
|
|
5048
|
-
# [4]: https://docs.aws.amazon.com/
|
|
5250
|
+
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
|
|
5251
|
+
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
|
|
5252
|
+
# [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
|
|
5049
5253
|
# @return [String]
|
|
5050
5254
|
#
|
|
5051
5255
|
# @!attribute [rw] bypass_policy_lockout_safety_check
|
|
@@ -5103,7 +5307,7 @@ module Aws::KMS
|
|
|
5103
5307
|
#
|
|
5104
5308
|
#
|
|
5105
5309
|
#
|
|
5106
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
5310
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
|
|
5107
5311
|
# @return [Hash<String,String>]
|
|
5108
5312
|
#
|
|
5109
5313
|
# @!attribute [rw] source_key_id
|
|
@@ -5193,7 +5397,7 @@ module Aws::KMS
|
|
|
5193
5397
|
#
|
|
5194
5398
|
#
|
|
5195
5399
|
#
|
|
5196
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
5400
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
|
|
5197
5401
|
# @return [Hash<String,String>]
|
|
5198
5402
|
#
|
|
5199
5403
|
# @!attribute [rw] source_encryption_algorithm
|
|
@@ -5230,19 +5434,19 @@ module Aws::KMS
|
|
|
5230
5434
|
#
|
|
5231
5435
|
#
|
|
5232
5436
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
5233
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
5437
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
5234
5438
|
# @return [Array<String>]
|
|
5235
5439
|
#
|
|
5236
5440
|
# @!attribute [rw] dry_run
|
|
5237
5441
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
5238
5442
|
# parameter.
|
|
5239
5443
|
#
|
|
5240
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
5241
|
-
#
|
|
5444
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
5445
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
5242
5446
|
#
|
|
5243
5447
|
#
|
|
5244
5448
|
#
|
|
5245
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
5449
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
5246
5450
|
# @return [Boolean]
|
|
5247
5451
|
#
|
|
5248
5452
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncryptRequest AWS API Documentation
|
|
@@ -5290,6 +5494,18 @@ module Aws::KMS
|
|
|
5290
5494
|
# The encryption algorithm that was used to reencrypt the data.
|
|
5291
5495
|
# @return [String]
|
|
5292
5496
|
#
|
|
5497
|
+
# @!attribute [rw] source_key_material_id
|
|
5498
|
+
# The identifier of the key material used to originally encrypt the
|
|
5499
|
+
# data. This field is present only when the original encryption used a
|
|
5500
|
+
# symmetric encryption KMS key.
|
|
5501
|
+
# @return [String]
|
|
5502
|
+
#
|
|
5503
|
+
# @!attribute [rw] destination_key_material_id
|
|
5504
|
+
# The identifier of the key material used to reencrypt the data. This
|
|
5505
|
+
# field is present only when data is reencrypted using a symmetric
|
|
5506
|
+
# encryption KMS key.
|
|
5507
|
+
# @return [String]
|
|
5508
|
+
#
|
|
5293
5509
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncryptResponse AWS API Documentation
|
|
5294
5510
|
#
|
|
5295
5511
|
class ReEncryptResponse < Struct.new(
|
|
@@ -5297,7 +5513,9 @@ module Aws::KMS
|
|
|
5297
5513
|
:source_key_id,
|
|
5298
5514
|
:key_id,
|
|
5299
5515
|
:source_encryption_algorithm,
|
|
5300
|
-
:destination_encryption_algorithm
|
|
5516
|
+
:destination_encryption_algorithm,
|
|
5517
|
+
:source_key_material_id,
|
|
5518
|
+
:destination_key_material_id)
|
|
5301
5519
|
SENSITIVE = []
|
|
5302
5520
|
include Aws::Structure
|
|
5303
5521
|
end
|
|
@@ -5363,33 +5581,23 @@ module Aws::KMS
|
|
|
5363
5581
|
# [KMS service endpoints][1] in the *Amazon Web Services General
|
|
5364
5582
|
# Reference*.
|
|
5365
5583
|
#
|
|
5366
|
-
# <note markdown="1"> HMAC KMS keys are not supported in all Amazon Web Services Regions.
|
|
5367
|
-
# If you try to replicate an HMAC KMS key in an Amazon Web Services
|
|
5368
|
-
# Region in which HMAC keys are not supported, the `ReplicateKey`
|
|
5369
|
-
# operation returns an `UnsupportedOperationException`. For a list of
|
|
5370
|
-
# Regions in which HMAC KMS keys are supported, see [HMAC keys in
|
|
5371
|
-
# KMS][2] in the *Key Management Service Developer Guide*.
|
|
5372
|
-
#
|
|
5373
|
-
# </note>
|
|
5374
|
-
#
|
|
5375
5584
|
# The replica must be in a different Amazon Web Services Region than
|
|
5376
5585
|
# its primary key and other replicas of that primary key, but in the
|
|
5377
5586
|
# same Amazon Web Services partition. KMS must be available in the
|
|
5378
5587
|
# replica Region. If the Region is not enabled by default, the Amazon
|
|
5379
5588
|
# Web Services account must be enabled in the Region. For information
|
|
5380
5589
|
# about Amazon Web Services partitions, see [Amazon Resource Names
|
|
5381
|
-
# (ARNs)][
|
|
5590
|
+
# (ARNs)][2] in the *Amazon Web Services General Reference*. For
|
|
5382
5591
|
# information about enabling and disabling Regions, see [Enabling a
|
|
5383
|
-
# Region][
|
|
5592
|
+
# Region][3] and [Disabling a Region][4] in the *Amazon Web Services
|
|
5384
5593
|
# General Reference*.
|
|
5385
5594
|
#
|
|
5386
5595
|
#
|
|
5387
5596
|
#
|
|
5388
5597
|
# [1]: https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region
|
|
5389
|
-
# [2]: https://docs.aws.amazon.com/
|
|
5390
|
-
# [3]: https://docs.aws.amazon.com/general/latest/gr/
|
|
5391
|
-
# [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-
|
|
5392
|
-
# [5]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
|
|
5598
|
+
# [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
|
|
5599
|
+
# [3]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
|
|
5600
|
+
# [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
|
|
5393
5601
|
# @return [String]
|
|
5394
5602
|
#
|
|
5395
5603
|
# @!attribute [rw] policy
|
|
@@ -5439,7 +5647,7 @@ module Aws::KMS
|
|
|
5439
5647
|
#
|
|
5440
5648
|
#
|
|
5441
5649
|
#
|
|
5442
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-
|
|
5650
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
|
|
5443
5651
|
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
|
|
5444
5652
|
# [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
|
|
5445
5653
|
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
|
|
@@ -5512,7 +5720,7 @@ module Aws::KMS
|
|
|
5512
5720
|
# When you add tags to an Amazon Web Services resource, Amazon Web
|
|
5513
5721
|
# Services generates a cost allocation report with usage and costs
|
|
5514
5722
|
# aggregated by tags. Tags can also be used to control access to a KMS
|
|
5515
|
-
# key. For details, see [
|
|
5723
|
+
# key. For details, see [Tags in KMS][3].
|
|
5516
5724
|
#
|
|
5517
5725
|
#
|
|
5518
5726
|
#
|
|
@@ -5603,12 +5811,12 @@ module Aws::KMS
|
|
|
5603
5811
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
5604
5812
|
# parameter.
|
|
5605
5813
|
#
|
|
5606
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
5607
|
-
#
|
|
5814
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
5815
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
5608
5816
|
#
|
|
5609
5817
|
#
|
|
5610
5818
|
#
|
|
5611
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
5819
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
5612
5820
|
# @return [Boolean]
|
|
5613
5821
|
#
|
|
5614
5822
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RetireGrantRequest AWS API Documentation
|
|
@@ -5651,12 +5859,12 @@ module Aws::KMS
|
|
|
5651
5859
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
5652
5860
|
# parameter.
|
|
5653
5861
|
#
|
|
5654
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
5655
|
-
#
|
|
5862
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
5863
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
5656
5864
|
#
|
|
5657
5865
|
#
|
|
5658
5866
|
#
|
|
5659
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
5867
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
5660
5868
|
# @return [Boolean]
|
|
5661
5869
|
#
|
|
5662
5870
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RevokeGrantRequest AWS API Documentation
|
|
@@ -5672,10 +5880,10 @@ module Aws::KMS
|
|
|
5672
5880
|
# @!attribute [rw] key_id
|
|
5673
5881
|
# Identifies a symmetric encryption KMS key. You cannot perform
|
|
5674
5882
|
# on-demand rotation of [asymmetric KMS keys][1], [HMAC KMS keys][2],
|
|
5675
|
-
# KMS keys with [imported key material][3], or KMS keys
|
|
5676
|
-
# key store][4]. To perform on-demand rotation of a set
|
|
5677
|
-
# [multi-Region keys][5], invoke the on-demand rotation on
|
|
5678
|
-
# key.
|
|
5883
|
+
# multi-Region KMS keys with [imported key material][3], or KMS keys
|
|
5884
|
+
# in a [custom key store][4]. To perform on-demand rotation of a set
|
|
5885
|
+
# of related [multi-Region keys][5], invoke the on-demand rotation on
|
|
5886
|
+
# the primary key.
|
|
5679
5887
|
#
|
|
5680
5888
|
# Specify the key ID or key ARN of the KMS key.
|
|
5681
5889
|
#
|
|
@@ -5694,8 +5902,8 @@ module Aws::KMS
|
|
|
5694
5902
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
|
|
5695
5903
|
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
|
|
5696
5904
|
# [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
|
|
5697
|
-
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
5698
|
-
# [5]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
5905
|
+
# [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
|
|
5906
|
+
# [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
|
|
5699
5907
|
# @return [String]
|
|
5700
5908
|
#
|
|
5701
5909
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RotateKeyOnDemandRequest AWS API Documentation
|
|
@@ -5719,31 +5927,88 @@ module Aws::KMS
|
|
|
5719
5927
|
include Aws::Structure
|
|
5720
5928
|
end
|
|
5721
5929
|
|
|
5722
|
-
#
|
|
5930
|
+
# Each entry contains information about one of the key materials
|
|
5931
|
+
# associated with a KMS key.
|
|
5723
5932
|
#
|
|
5724
5933
|
# @!attribute [rw] key_id
|
|
5725
5934
|
# Unique identifier of the key.
|
|
5726
5935
|
# @return [String]
|
|
5727
5936
|
#
|
|
5937
|
+
# @!attribute [rw] key_material_id
|
|
5938
|
+
# Unique identifier of the key material.
|
|
5939
|
+
# @return [String]
|
|
5940
|
+
#
|
|
5941
|
+
# @!attribute [rw] key_material_description
|
|
5942
|
+
# User-specified description of the key material. This field is only
|
|
5943
|
+
# present for symmetric encryption KMS keys with `EXTERNAL` origin.
|
|
5944
|
+
# @return [String]
|
|
5945
|
+
#
|
|
5946
|
+
# @!attribute [rw] import_state
|
|
5947
|
+
# Indicates if the key material is currently imported into KMS. It has
|
|
5948
|
+
# two possible values: `IMPORTED` or `PENDING_IMPORT`. This field is
|
|
5949
|
+
# only present for symmetric encryption KMS keys with `EXTERNAL`
|
|
5950
|
+
# origin.
|
|
5951
|
+
# @return [String]
|
|
5952
|
+
#
|
|
5953
|
+
# @!attribute [rw] key_material_state
|
|
5954
|
+
# There are three possible values for this field: `CURRENT`,
|
|
5955
|
+
# `NON_CURRENT` and `PENDING_ROTATION`. KMS uses `CURRENT` key
|
|
5956
|
+
# material for both encryption and decryption and `NON_CURRENT` key
|
|
5957
|
+
# material only for decryption. `PENDING_ROTATION` identifies key
|
|
5958
|
+
# material that has been imported for on-demand key rotation but the
|
|
5959
|
+
# rotation hasn't completed. Key material in `PENDING_ROTATION` is
|
|
5960
|
+
# not permanently associated with the KMS key. You can delete this key
|
|
5961
|
+
# material and import different key material in its place. The
|
|
5962
|
+
# `PENDING_ROTATION` value is only used in symmetric encryption keys
|
|
5963
|
+
# with imported key material. The other values, `CURRENT` and
|
|
5964
|
+
# `NON_CURRENT`, are used for all KMS keys that support automatic or
|
|
5965
|
+
# on-demand key rotation.
|
|
5966
|
+
# @return [String]
|
|
5967
|
+
#
|
|
5968
|
+
# @!attribute [rw] expiration_model
|
|
5969
|
+
# Indicates if the key material is configured to automatically expire.
|
|
5970
|
+
# There are two possible values for this field: `KEY_MATERIAL_EXPIRES`
|
|
5971
|
+
# and `KEY_MATERIAL_DOES_NOT_EXPIRE`. For any key material that
|
|
5972
|
+
# expires, the expiration date and time is indicated in `ValidTo`.
|
|
5973
|
+
# This field is only present for symmetric encryption KMS keys with
|
|
5974
|
+
# `EXTERNAL` origin.
|
|
5975
|
+
# @return [String]
|
|
5976
|
+
#
|
|
5977
|
+
# @!attribute [rw] valid_to
|
|
5978
|
+
# Date and time at which the key material expires. This field is only
|
|
5979
|
+
# present for symmetric encryption KMS keys with `EXTERNAL` origin in
|
|
5980
|
+
# rotation list entries with an `ExpirationModel` value of
|
|
5981
|
+
# `KEY_MATERIAL_EXPIRES`.
|
|
5982
|
+
# @return [Time]
|
|
5983
|
+
#
|
|
5728
5984
|
# @!attribute [rw] rotation_date
|
|
5729
5985
|
# Date and time that the key material rotation completed. Formatted as
|
|
5730
|
-
# Unix time.
|
|
5986
|
+
# Unix time. This field is not present for the first key material or
|
|
5987
|
+
# an imported key material in `PENDING_ROTATION` state.
|
|
5731
5988
|
# @return [Time]
|
|
5732
5989
|
#
|
|
5733
5990
|
# @!attribute [rw] rotation_type
|
|
5734
5991
|
# Identifies whether the key material rotation was a scheduled
|
|
5735
|
-
# [automatic rotation][1] or an [on-demand rotation][2].
|
|
5992
|
+
# [automatic rotation][1] or an [on-demand rotation][2]. This field is
|
|
5993
|
+
# not present for the first key material or an imported key material
|
|
5994
|
+
# in `PENDING_ROTATION` state.
|
|
5736
5995
|
#
|
|
5737
5996
|
#
|
|
5738
5997
|
#
|
|
5739
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
5740
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
5998
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
|
|
5999
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html
|
|
5741
6000
|
# @return [String]
|
|
5742
6001
|
#
|
|
5743
6002
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RotationsListEntry AWS API Documentation
|
|
5744
6003
|
#
|
|
5745
6004
|
class RotationsListEntry < Struct.new(
|
|
5746
6005
|
:key_id,
|
|
6006
|
+
:key_material_id,
|
|
6007
|
+
:key_material_description,
|
|
6008
|
+
:import_state,
|
|
6009
|
+
:key_material_state,
|
|
6010
|
+
:expiration_model,
|
|
6011
|
+
:valid_to,
|
|
5747
6012
|
:rotation_date,
|
|
5748
6013
|
:rotation_type)
|
|
5749
6014
|
SENSITIVE = []
|
|
@@ -5881,27 +6146,34 @@ module Aws::KMS
|
|
|
5881
6146
|
# Tells KMS whether the value of the `Message` parameter should be
|
|
5882
6147
|
# hashed as part of the signing algorithm. Use `RAW` for unhashed
|
|
5883
6148
|
# messages; use `DIGEST` for message digests, which are already
|
|
5884
|
-
# hashed
|
|
6149
|
+
# hashed; use `EXTERNAL_MU` for 64-byte representative μ used in
|
|
6150
|
+
# ML-DSA signing as defined in NIST FIPS 204 Section 6.2.
|
|
5885
6151
|
#
|
|
5886
6152
|
# When the value of `MessageType` is `RAW`, KMS uses the standard
|
|
5887
6153
|
# signing algorithm, which begins with a hash function. When the value
|
|
5888
6154
|
# is `DIGEST`, KMS skips the hashing step in the signing algorithm.
|
|
6155
|
+
# When the value is `EXTERNAL_MU` KMS skips the concatenated hashing
|
|
6156
|
+
# of the public key hash and the message done in the ML-DSA signing
|
|
6157
|
+
# algorithm.
|
|
5889
6158
|
#
|
|
5890
|
-
# Use the `DIGEST` value only when the value of the
|
|
5891
|
-
# parameter is a message digest. If you use the `DIGEST`
|
|
5892
|
-
# unhashed message, the security of the signing
|
|
5893
|
-
# compromised.
|
|
6159
|
+
# Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
|
|
6160
|
+
# `Message` parameter is a message digest. If you use the `DIGEST`
|
|
6161
|
+
# value with an unhashed message, the security of the signing
|
|
6162
|
+
# operation can be compromised.
|
|
5894
6163
|
#
|
|
5895
|
-
# When the value of `MessageType`is `DIGEST`, the length of the
|
|
6164
|
+
# When the value of `MessageType` is `DIGEST`, the length of the
|
|
5896
6165
|
# `Message` value must match the length of hashed messages for the
|
|
5897
6166
|
# specified signing algorithm.
|
|
5898
6167
|
#
|
|
6168
|
+
# When the value of `MessageType` is `EXTERNAL_MU` the length of the
|
|
6169
|
+
# `Message` value must be 64 bytes.
|
|
6170
|
+
#
|
|
5899
6171
|
# You can submit a message digest and omit the `MessageType` or
|
|
5900
6172
|
# specify `RAW` so the digest is hashed again while signing. However,
|
|
5901
6173
|
# this can cause verification failures when verifying with a system
|
|
5902
6174
|
# that assumes a single hash.
|
|
5903
6175
|
#
|
|
5904
|
-
# The hashing algorithm
|
|
6176
|
+
# The hashing algorithm that `Sign` uses is based on the
|
|
5905
6177
|
# `SigningAlgorithm` value.
|
|
5906
6178
|
#
|
|
5907
6179
|
# * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
|
|
@@ -5913,12 +6185,15 @@ module Aws::KMS
|
|
|
5913
6185
|
# * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
|
|
5914
6186
|
# algorithm.
|
|
5915
6187
|
#
|
|
6188
|
+
# * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256
|
|
6189
|
+
# hashing algorithm.
|
|
6190
|
+
#
|
|
5916
6191
|
# * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
|
|
5917
6192
|
# verification with SM2 key pairs][1].
|
|
5918
6193
|
#
|
|
5919
6194
|
#
|
|
5920
6195
|
#
|
|
5921
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
6196
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
|
|
5922
6197
|
# @return [String]
|
|
5923
6198
|
#
|
|
5924
6199
|
# @!attribute [rw] grant_tokens
|
|
@@ -5932,7 +6207,7 @@ module Aws::KMS
|
|
|
5932
6207
|
#
|
|
5933
6208
|
#
|
|
5934
6209
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
5935
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
6210
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
5936
6211
|
# @return [Array<String>]
|
|
5937
6212
|
#
|
|
5938
6213
|
# @!attribute [rw] signing_algorithm
|
|
@@ -5948,12 +6223,12 @@ module Aws::KMS
|
|
|
5948
6223
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
5949
6224
|
# parameter.
|
|
5950
6225
|
#
|
|
5951
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
5952
|
-
#
|
|
6226
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
6227
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
5953
6228
|
#
|
|
5954
6229
|
#
|
|
5955
6230
|
#
|
|
5956
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
6231
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
5957
6232
|
# @return [Boolean]
|
|
5958
6233
|
#
|
|
5959
6234
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/SignRequest AWS API Documentation
|
|
@@ -6458,19 +6733,19 @@ module Aws::KMS
|
|
|
6458
6733
|
#
|
|
6459
6734
|
#
|
|
6460
6735
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
6461
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
6736
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
6462
6737
|
# @return [Array<String>]
|
|
6463
6738
|
#
|
|
6464
6739
|
# @!attribute [rw] dry_run
|
|
6465
6740
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
6466
6741
|
# parameter.
|
|
6467
6742
|
#
|
|
6468
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
6469
|
-
#
|
|
6743
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
6744
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
6470
6745
|
#
|
|
6471
6746
|
#
|
|
6472
6747
|
#
|
|
6473
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
6748
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
6474
6749
|
# @return [Boolean]
|
|
6475
6750
|
#
|
|
6476
6751
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/VerifyMacRequest AWS API Documentation
|
|
@@ -6554,28 +6829,35 @@ module Aws::KMS
|
|
|
6554
6829
|
# Tells KMS whether the value of the `Message` parameter should be
|
|
6555
6830
|
# hashed as part of the signing algorithm. Use `RAW` for unhashed
|
|
6556
6831
|
# messages; use `DIGEST` for message digests, which are already
|
|
6557
|
-
# hashed
|
|
6832
|
+
# hashed; use `EXTERNAL_MU` for 64-byte representative μ used in
|
|
6833
|
+
# ML-DSA signing as defined in NIST FIPS 204 Section 6.2.
|
|
6558
6834
|
#
|
|
6559
6835
|
# When the value of `MessageType` is `RAW`, KMS uses the standard
|
|
6560
6836
|
# signing algorithm, which begins with a hash function. When the value
|
|
6561
6837
|
# is `DIGEST`, KMS skips the hashing step in the signing algorithm.
|
|
6838
|
+
# When the value is `EXTERNAL_MU` KMS skips the concatenated hashing
|
|
6839
|
+
# of the public key hash and the message done in the ML-DSA signing
|
|
6840
|
+
# algorithm.
|
|
6562
6841
|
#
|
|
6563
|
-
# Use the `DIGEST` value only when the value of the
|
|
6564
|
-
# parameter is a message digest. If you use the `DIGEST`
|
|
6565
|
-
# unhashed message, the security of the
|
|
6566
|
-
# compromised.
|
|
6842
|
+
# Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
|
|
6843
|
+
# `Message` parameter is a message digest. If you use the `DIGEST`
|
|
6844
|
+
# value with an unhashed message, the security of the signing
|
|
6845
|
+
# operation can be compromised.
|
|
6567
6846
|
#
|
|
6568
|
-
# When the value of `MessageType`is `DIGEST`, the length of the
|
|
6847
|
+
# When the value of `MessageType` is `DIGEST`, the length of the
|
|
6569
6848
|
# `Message` value must match the length of hashed messages for the
|
|
6570
6849
|
# specified signing algorithm.
|
|
6571
6850
|
#
|
|
6851
|
+
# When the value of `MessageType` is `EXTERNAL_MU` the length of the
|
|
6852
|
+
# `Message` value must be 64 bytes.
|
|
6853
|
+
#
|
|
6572
6854
|
# You can submit a message digest and omit the `MessageType` or
|
|
6573
6855
|
# specify `RAW` so the digest is hashed again while signing. However,
|
|
6574
6856
|
# if the signed message is hashed once while signing, but twice while
|
|
6575
6857
|
# verifying, verification fails, even when the message hasn't
|
|
6576
6858
|
# changed.
|
|
6577
6859
|
#
|
|
6578
|
-
# The hashing algorithm
|
|
6860
|
+
# The hashing algorithm that `Verify` uses is based on the
|
|
6579
6861
|
# `SigningAlgorithm` value.
|
|
6580
6862
|
#
|
|
6581
6863
|
# * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
|
|
@@ -6587,12 +6869,15 @@ module Aws::KMS
|
|
|
6587
6869
|
# * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
|
|
6588
6870
|
# algorithm.
|
|
6589
6871
|
#
|
|
6872
|
+
# * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256
|
|
6873
|
+
# hashing algorithm.
|
|
6874
|
+
#
|
|
6590
6875
|
# * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
|
|
6591
6876
|
# verification with SM2 key pairs][1].
|
|
6592
6877
|
#
|
|
6593
6878
|
#
|
|
6594
6879
|
#
|
|
6595
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
6880
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
|
|
6596
6881
|
# @return [String]
|
|
6597
6882
|
#
|
|
6598
6883
|
# @!attribute [rw] signature
|
|
@@ -6615,19 +6900,19 @@ module Aws::KMS
|
|
|
6615
6900
|
#
|
|
6616
6901
|
#
|
|
6617
6902
|
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
|
|
6618
|
-
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
6903
|
+
# [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
|
|
6619
6904
|
# @return [Array<String>]
|
|
6620
6905
|
#
|
|
6621
6906
|
# @!attribute [rw] dry_run
|
|
6622
6907
|
# Checks if your request will succeed. `DryRun` is an optional
|
|
6623
6908
|
# parameter.
|
|
6624
6909
|
#
|
|
6625
|
-
# To learn more about how to use this parameter, see [Testing your
|
|
6626
|
-
#
|
|
6910
|
+
# To learn more about how to use this parameter, see [Testing your
|
|
6911
|
+
# permissions][1] in the *Key Management Service Developer Guide*.
|
|
6627
6912
|
#
|
|
6628
6913
|
#
|
|
6629
6914
|
#
|
|
6630
|
-
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/
|
|
6915
|
+
# [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
|
|
6631
6916
|
# @return [Boolean]
|
|
6632
6917
|
#
|
|
6633
6918
|
# @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/VerifyRequest AWS API Documentation
|