aws-sdk-kms 1.101.0 → 1.112.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +55 -0
  3. data/VERSION +1 -1
  4. data/lib/aws-sdk-kms/client.rb +816 -581
  5. data/lib/aws-sdk-kms/client_api.rb +34 -1
  6. data/lib/aws-sdk-kms/types.rb +497 -212
  7. data/lib/aws-sdk-kms.rb +1 -1
  8. data/sig/client.rbs +33 -13
  9. data/sig/resource.rbs +1 -0
  10. data/sig/types.rbs +40 -12
  11. metadata +4 -4
data/lib/aws-sdk-kms/client.rb CHANGED
@@ -95,8 +95,8 @@ module Aws::KMS
95
95
  # class name or an instance of a plugin class.
96
96
  #
97
97
  # @option options [required, Aws::CredentialProvider] :credentials
98
- # Your AWS credentials. This can be an instance of any one of the
99
- # following classes:
98
+ # Your AWS credentials used for authentication. This can be any class that includes and implements
99
+ # `Aws::CredentialProvider`, or instance of any one of the following classes:
100
100
  #
101
101
  # * `Aws::Credentials` - Used for configuring static, non-refreshing
102
102
  # credentials.
@@ -124,22 +124,24 @@ module Aws::KMS
124
124
  # * `Aws::CognitoIdentityCredentials` - Used for loading credentials
125
125
  # from the Cognito Identity service.
126
126
  #
127
- # When `:credentials` are not configured directly, the following
128
- # locations will be searched for credentials:
127
+ # When `:credentials` are not configured directly, the following locations will be searched for credentials:
129
128
  #
130
129
  # * `Aws.config[:credentials]`
130
+ #
131
131
  # * The `:access_key_id`, `:secret_access_key`, `:session_token`, and
132
132
  # `:account_id` options.
133
- # * ENV['AWS_ACCESS_KEY_ID'], ENV['AWS_SECRET_ACCESS_KEY'],
134
- # ENV['AWS_SESSION_TOKEN'], and ENV['AWS_ACCOUNT_ID']
133
+ #
134
+ # * `ENV['AWS_ACCESS_KEY_ID']`, `ENV['AWS_SECRET_ACCESS_KEY']`,
135
+ # `ENV['AWS_SESSION_TOKEN']`, and `ENV['AWS_ACCOUNT_ID']`.
136
+ #
135
137
  # * `~/.aws/credentials`
138
+ #
136
139
  # * `~/.aws/config`
137
- # * EC2/ECS IMDS instance profile - When used by default, the timeouts
138
- # are very aggressive. Construct and pass an instance of
139
- # `Aws::InstanceProfileCredentials` or `Aws::ECSCredentials` to
140
- # enable retries and extended timeouts. Instance profile credential
141
- # fetching can be disabled by setting ENV['AWS_EC2_METADATA_DISABLED']
142
- # to true.
140
+ #
141
+ # * EC2/ECS IMDS instance profile - When used by default, the timeouts are very aggressive.
142
+ # Construct and pass an instance of `Aws::InstanceProfileCredentials` or `Aws::ECSCredentials` to
143
+ # enable retries and extended timeouts. Instance profile credential fetching can be disabled by
144
+ # setting `ENV['AWS_EC2_METADATA_DISABLED']` to `true`.
143
145
  #
144
146
  # @option options [required, String] :region
145
147
  # The AWS region to connect to. The configured `:region` is
@@ -167,6 +169,11 @@ module Aws::KMS
167
169
  # When false, the request will raise a `RetryCapacityNotAvailableError` and will
168
170
  # not retry instead of sleeping.
169
171
  #
172
+ # @option options [Array<String>] :auth_scheme_preference
173
+ # A list of preferred authentication schemes to use when making a request. Supported values are:
174
+ # `sigv4`, `sigv4a`, `httpBearerAuth`, and `noAuth`. When set using `ENV['AWS_AUTH_SCHEME_PREFERENCE']` or in
175
+ # shared config as `auth_scheme_preference`, the value should be a comma-separated list.
176
+ #
170
177
  # @option options [Boolean] :client_side_monitoring (false)
171
178
  # When `true`, client-side metrics will be collected for all API requests from
172
179
  # this client.
@@ -253,8 +260,8 @@ module Aws::KMS
253
260
  # 4 times. Used in `standard` and `adaptive` retry modes.
254
261
  #
255
262
  # @option options [String] :profile ("default")
256
- # Used when loading credentials from the shared credentials file
257
- # at HOME/.aws/credentials. When not specified, 'default' is used.
263
+ # Used when loading credentials from the shared credentials file at `HOME/.aws/credentials`.
264
+ # When not specified, 'default' is used.
258
265
  #
259
266
  # @option options [String] :request_checksum_calculation ("when_supported")
260
267
  # Determines when a checksum will be calculated for request payloads. Values are:
@@ -374,8 +381,8 @@ module Aws::KMS
374
381
  # `Aws::Telemetry::OTelProvider` for telemetry provider.
375
382
  #
376
383
  # @option options [Aws::TokenProvider] :token_provider
377
- # A Bearer Token Provider. This can be an instance of any one of the
378
- # following classes:
384
+ # Your Bearer token used for authentication. This can be any class that includes and implements
385
+ # `Aws::TokenProvider`, or instance of any one of the following classes:
379
386
  #
380
387
  # * `Aws::StaticTokenProvider` - Used for configuring static, non-refreshing
381
388
  # tokens.
@@ -503,7 +510,7 @@ module Aws::KMS
503
510
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
504
511
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
505
512
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
506
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
513
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
507
514
  #
508
515
  # @option params [required, String] :key_id
509
516
  # Identifies the KMS key whose deletion is being canceled.
@@ -575,9 +582,9 @@ module Aws::KMS
575
582
  # custom key store is connected. To get the connection state of the
576
583
  # custom key store, use the DescribeCustomKeyStores operation.
577
584
  #
578
- # This operation is part of the [custom key stores][1] feature in KMS,
579
- # which combines the convenience and extensive integration of KMS with
580
- # the isolation and control of a key store that you own and manage.
585
+ # This operation is part of the custom key stores feature in KMS, which
586
+ # combines the convenience and extensive integration of KMS with the
587
+ # isolation and control of a key store that you own and manage.
581
588
  #
582
589
  # The `ConnectCustomKeyStore` operation might fail for various reasons.
583
590
  # To find the reason, use the DescribeCustomKeyStores operation and see
@@ -651,14 +658,14 @@ module Aws::KMS
651
658
  #
652
659
  #
653
660
  #
654
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
661
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
655
662
  # [2]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html
656
663
  # [3]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html
657
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
664
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
658
665
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
659
666
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
660
667
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
661
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
668
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
662
669
  #
663
670
  # @option params [required, String] :custom_key_store_id
664
671
  # Enter the key store ID of the custom key store that you want to
@@ -720,7 +727,7 @@ module Aws::KMS
720
727
  #
721
728
  # The alias must be unique in the account and Region, but you can have
722
729
  # aliases with the same name in different Regions. For detailed
723
- # information about aliases, see [Using aliases][3] in the *Key
730
+ # information about aliases, see [Aliases in KMS][3] in the *Key
724
731
  # Management Service Developer Guide*.
725
732
  #
726
733
  # This operation does not return a response. To get the alias that you
@@ -756,12 +763,12 @@ module Aws::KMS
756
763
  #
757
764
  #
758
765
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
759
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
766
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
760
767
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
761
768
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
762
769
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
763
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
764
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
770
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html
771
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
765
772
  #
766
773
  # @option params [required, String] :alias_name
767
774
  # Specifies the alias name. This value must begin with `alias/` followed
@@ -779,7 +786,7 @@ module Aws::KMS
779
786
  #
780
787
  #
781
788
  #
782
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
789
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
783
790
  #
784
791
  # @option params [required, String] :target_key_id
785
792
  # Associates the alias with the specified [customer managed key][1]. The
@@ -788,7 +795,7 @@ module Aws::KMS
788
795
  # A valid key ID is required. If you supply a null or empty string
789
796
  # value, this operation returns an error.
790
797
  #
791
- # For help finding the key ID and ARN, see [Finding the Key ID and
798
+ # For help finding the key ID and ARN, see [Find the key ID and key
792
799
  # ARN][2] in the <i> <i>Key Management Service Developer Guide</i> </i>.
793
800
  #
794
801
  # Specify the key ID or key ARN of the KMS key.
@@ -805,8 +812,8 @@ module Aws::KMS
805
812
  #
806
813
  #
807
814
  #
808
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
809
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn
815
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
816
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html
810
817
  #
811
818
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
812
819
  #
@@ -844,9 +851,9 @@ module Aws::KMS
844
851
  # stores][4] backed by an external key store proxy and external key
845
852
  # manager outside of Amazon Web Services.
846
853
  #
847
- # This operation is part of the [custom key stores][1] feature in KMS,
848
- # which combines the convenience and extensive integration of KMS with
849
- # the isolation and control of a key store that you own and manage.
854
+ # This operation is part of the custom key stores feature in KMS, which
855
+ # combines the convenience and extensive integration of KMS with the
856
+ # isolation and control of a key store that you own and manage.
850
857
  #
851
858
  # Before you create the custom key store, the required elements must be
852
859
  # in place and operational. We recommend that you use the test tools
@@ -899,9 +906,6 @@ module Aws::KMS
899
906
  # immediately, you might want to connect it to verify that all settings
900
907
  # are correct and then disconnect it until you are ready to use it.
901
908
  #
902
- # For help with failures, see [Troubleshooting a custom key store][7] in
903
- # the *Key Management Service Developer Guide*.
904
- #
905
909
  # **Cross-account use**: No. You cannot perform this operation on a
906
910
  # custom key store in a different Amazon Web Services account.
907
911
  #
@@ -924,7 +928,7 @@ module Aws::KMS
924
928
  #
925
929
  #
926
930
  #
927
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
931
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
928
932
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
929
933
  # [3]: https://docs.aws.amazon.com/cloudhsm/latest/userguide/clusters.html
930
934
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
@@ -933,7 +937,7 @@ module Aws::KMS
933
937
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
934
938
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
935
939
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
936
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
940
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
937
941
  #
938
942
  # @option params [required, String] :custom_key_store_name
939
943
  # Specifies a friendly name for the custom key store. The name must be
@@ -987,7 +991,7 @@ module Aws::KMS
987
991
  #
988
992
  #
989
993
  #
990
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
994
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
991
995
  #
992
996
  # @option params [String] :custom_key_store_type
993
997
  # Specifies the type of custom key store. The default value is
@@ -1088,7 +1092,7 @@ module Aws::KMS
1088
1092
  # `RawSecretAccessKey`, a secret key, and `AccessKeyId`, a unique
1089
1093
  # identifier for the `RawSecretAccessKey`. For character requirements,
1090
1094
  # see
1091
- # [XksProxyAuthenticationCredentialType](kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html).
1095
+ # [XksProxyAuthenticationCredentialType](API_XksProxyAuthenticationCredentialType.html).
1092
1096
  #
1093
1097
  # KMS uses this authentication credential to sign requests to the
1094
1098
  # external key store proxy on your behalf. This credential is unrelated
@@ -1128,7 +1132,7 @@ module Aws::KMS
1128
1132
  #
1129
1133
  #
1130
1134
  #
1131
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity
1135
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/choose-xks-connectivity.html
1132
1136
  #
1133
1137
  # @return [Types::CreateCustomKeyStoreResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
1134
1138
  #
@@ -1237,8 +1241,9 @@ module Aws::KMS
1237
1241
  #
1238
1242
  # For detailed information about grants, including grant terminology,
1239
1243
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
1240
- # Guide</i> </i>. For examples of working with grants in several
1241
- # programming languages, see [Programming grants][2].
1244
+ # Guide</i> </i>. For examples of creating grants in several programming
1245
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
1246
+ # CLI][2].
1242
1247
  #
1243
1248
  # The `CreateGrant` operation returns a `GrantToken` and a `GrantId`.
1244
1249
  #
@@ -1284,11 +1289,11 @@ module Aws::KMS
1284
1289
  #
1285
1290
  #
1286
1291
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
1287
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
1288
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1292
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
1293
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1289
1294
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
1290
1295
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1291
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
1296
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
1292
1297
  #
1293
1298
  # @option params [required, String] :key_id
1294
1299
  # Identifies the KMS key for the grant. The grant gives principals
@@ -1341,7 +1346,7 @@ module Aws::KMS
1341
1346
  #
1342
1347
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
1343
1348
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns
1344
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
1349
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
1345
1350
  #
1346
1351
  # @option params [required, Array<String>] :operations
1347
1352
  # A list of operations that the grant permits.
@@ -1410,7 +1415,7 @@ module Aws::KMS
1410
1415
  #
1411
1416
  #
1412
1417
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
1413
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1418
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1414
1419
  #
1415
1420
  # @option params [String] :name
1416
1421
  # A friendly name for the grant. Use this value to prevent the
@@ -1436,12 +1441,12 @@ module Aws::KMS
1436
1441
  # Checks if your request will succeed. `DryRun` is an optional
1437
1442
  # parameter.
1438
1443
  #
1439
- # To learn more about how to use this parameter, see [Testing your KMS
1440
- # API calls][1] in the *Key Management Service Developer Guide*.
1444
+ # To learn more about how to use this parameter, see [Testing your
1445
+ # permissions][1] in the *Key Management Service Developer Guide*.
1441
1446
  #
1442
1447
  #
1443
1448
  #
1444
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
1449
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
1445
1450
  #
1446
1451
  # @return [Types::CreateGrantResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
1447
1452
  #
@@ -1511,16 +1516,15 @@ module Aws::KMS
1511
1516
  # A KMS key is a logical representation of a cryptographic key. In
1512
1517
  # addition to the key material used in cryptographic operations, a KMS
1513
1518
  # key includes metadata, such as the key ID, key policy, creation date,
1514
- # description, and key state. For details, see [Managing keys][2] in the
1515
- # *Key Management Service Developer Guide*
1519
+ # description, and key state.
1516
1520
  #
1517
1521
  # Use the parameters of `CreateKey` to specify the type of KMS key, the
1518
1522
  # source of its key material, its key policy, description, tags, and
1519
1523
  # other properties.
1520
1524
  #
1521
- # <note markdown="1"> KMS has replaced the term *customer master key (CMK)* with *KMS key*
1522
- # and *KMS key*. The concept has not changed. To prevent breaking
1523
- # changes, KMS is keeping some variations of this term.
1525
+ # <note markdown="1"> KMS has replaced the term *customer master key (CMK)* with *Key
1526
+ # Management Service key* and *KMS key*. The concept has not changed. To
1527
+ # prevent breaking changes, KMS is keeping some variations of this term.
1524
1528
  #
1525
1529
  # </note>
1526
1530
  #
@@ -1558,20 +1562,21 @@ module Aws::KMS
1558
1562
  # properties after the KMS key is created.
1559
1563
  #
1560
1564
  # Asymmetric KMS keys contain an RSA key pair, Elliptic Curve (ECC)
1561
- # key pair, or an SM2 key pair (China Regions only). The private key
1562
- # in an asymmetric KMS key never leaves KMS unencrypted. However, you
1563
- # can use the GetPublicKey operation to download the public key so it
1564
- # can be used outside of KMS. Each KMS key can have only one key
1565
- # usage. KMS keys with RSA key pairs can be used to encrypt and
1566
- # decrypt data or sign and verify messages (but not both). KMS keys
1567
- # with NIST-recommended ECC key pairs can be used to sign and verify
1568
- # messages or derive shared secrets (but not both). KMS keys with
1569
- # `ECC_SECG_P256K1` can be used only to sign and verify messages. KMS
1570
- # keys with SM2 key pairs (China Regions only) can be used to either
1571
- # encrypt and decrypt data, sign and verify messages, or derive shared
1572
- # secrets (you must choose one key usage type). For information about
1573
- # asymmetric KMS keys, see [Asymmetric KMS keys][3] in the *Key
1574
- # Management Service Developer Guide*.
1565
+ # key pair, ML-DSA key pair or an SM2 key pair (China Regions only).
1566
+ # The private key in an asymmetric KMS key never leaves KMS
1567
+ # unencrypted. However, you can use the GetPublicKey operation to
1568
+ # download the public key so it can be used outside of KMS. Each KMS
1569
+ # key can have only one key usage. KMS keys with RSA key pairs can be
1570
+ # used to encrypt and decrypt data or sign and verify messages (but
1571
+ # not both). KMS keys with NIST-recommended ECC key pairs can be used
1572
+ # to sign and verify messages or derive shared secrets (but not both).
1573
+ # KMS keys with `ECC_SECG_P256K1` can be used only to sign and verify
1574
+ # messages. KMS keys with ML-DSA key pairs can be used to sign and
1575
+ # verify messages. KMS keys with SM2 key pairs (China Regions only)
1576
+ # can be used to either encrypt and decrypt data, sign and verify
1577
+ # messages, or derive shared secrets (you must choose one key usage
1578
+ # type). For information about asymmetric KMS keys, see [Asymmetric
1579
+ # KMS keys][2] in the *Key Management Service Developer Guide*.
1575
1580
  #
1576
1581
  #
1577
1582
  #
@@ -1614,7 +1619,7 @@ module Aws::KMS
1614
1619
  # to encrypt data in one Amazon Web Services Region and decrypt it in
1615
1620
  # a different Amazon Web Services Region without re-encrypting the
1616
1621
  # data or making a cross-Region call. For more information about
1617
- # multi-Region keys, see [Multi-Region keys in KMS][4] in the *Key
1622
+ # multi-Region keys, see [Multi-Region keys in KMS][3] in the *Key
1618
1623
  # Management Service Developer Guide*.
1619
1624
  #
1620
1625
  #
@@ -1626,7 +1631,7 @@ module Aws::KMS
1626
1631
  # token. Use the wrapping public key to encrypt your key material.
1627
1632
  # Then, use ImportKeyMaterial with your import token to import the key
1628
1633
  # material. For step-by-step instructions, see [Importing Key
1629
- # Material][5] in the <i> <i>Key Management Service Developer
1634
+ # Material][4] in the <i> <i>Key Management Service Developer
1630
1635
  # Guide</i> </i>.
1631
1636
  #
1632
1637
  # You can import key material into KMS keys of all supported KMS key
@@ -1639,23 +1644,22 @@ module Aws::KMS
1639
1644
  # the `Origin` parameter of `CreateKey` with a value of `EXTERNAL` and
1640
1645
  # the `MultiRegion` parameter with a value of `True`. To create
1641
1646
  # replicas of the multi-Region primary key, use the ReplicateKey
1642
- # operation. For instructions, see [Importing key material into
1643
- # multi-Region keys][6]. For more information about multi-Region keys,
1644
- # see [Multi-Region keys in KMS][4] in the *Key Management Service
1645
- # Developer Guide*.
1647
+ # operation. For instructions, see [Importing key material step 1][5].
1648
+ # For more information about multi-Region keys, see [Multi-Region keys
1649
+ # in KMS][3] in the *Key Management Service Developer Guide*.
1646
1650
  #
1647
1651
  #
1648
1652
  #
1649
1653
  # Custom key store
1650
1654
  #
1651
- # : A [custom key store][7] lets you protect your Amazon Web Services
1655
+ # : A [custom key store][6] lets you protect your Amazon Web Services
1652
1656
  # resources using keys in a backing key store that you own and manage.
1653
1657
  # When you request a cryptographic operation with a KMS key in a
1654
1658
  # custom key store, the operation is performed in the backing key
1655
1659
  # store using its cryptographic keys.
1656
1660
  #
1657
- # KMS supports [CloudHSM key stores][8] backed by an CloudHSM cluster
1658
- # and [external key stores][9] backed by an external key manager
1661
+ # KMS supports [CloudHSM key stores][7] backed by an CloudHSM cluster
1662
+ # and [external key stores][8] backed by an external key manager
1659
1663
  # outside of Amazon Web Services. When you create a KMS key in an
1660
1664
  # CloudHSM key store, KMS generates an encryption key in the CloudHSM
1661
1665
  # cluster and associates it with the KMS key. When you create a KMS
@@ -1680,13 +1684,13 @@ module Aws::KMS
1680
1684
  # `ENCRYPT_DECRYPT` to create a symmetric encryption key. No other key
1681
1685
  # type is supported in a custom key store.
1682
1686
  #
1683
- # To create a KMS key in an [CloudHSM key store][8], use the `Origin`
1687
+ # To create a KMS key in an [CloudHSM key store][9], use the `Origin`
1684
1688
  # parameter with a value of `AWS_CLOUDHSM`. The CloudHSM cluster that
1685
1689
  # is associated with the custom key store must have at least two
1686
1690
  # active HSMs in different Availability Zones in the Amazon Web
1687
1691
  # Services Region.
1688
1692
  #
1689
- # To create a KMS key in an [external key store][9], use the `Origin`
1693
+ # To create a KMS key in an [external key store][10], use the `Origin`
1690
1694
  # parameter with a value of `EXTERNAL_KEY_STORE` and an `XksKeyId`
1691
1695
  # parameter that identifies an existing external key.
1692
1696
  #
@@ -1699,10 +1703,10 @@ module Aws::KMS
1699
1703
  # **Cross-account use**: No. You cannot use this operation to create a
1700
1704
  # KMS key in a different Amazon Web Services account.
1701
1705
  #
1702
- # **Required permissions**: [kms:CreateKey][10] (IAM policy). To use the
1703
- # `Tags` parameter, [kms:TagResource][10] (IAM policy). For examples and
1706
+ # **Required permissions**: [kms:CreateKey][11] (IAM policy). To use the
1707
+ # `Tags` parameter, [kms:TagResource][11] (IAM policy). For examples and
1704
1708
  # information about related permissions, see [Allow a user to create KMS
1705
- # keys][11] in the *Key Management Service Developer Guide*.
1709
+ # keys][12] in the *Key Management Service Developer Guide*.
1706
1710
  #
1707
1711
  # **Related operations:**
1708
1712
  #
@@ -1713,22 +1717,23 @@ module Aws::KMS
1713
1717
  # * ScheduleKeyDeletion
1714
1718
  #
1715
1719
  # **Eventual consistency**: The KMS API follows an eventual consistency
1716
- # model. For more information, see [KMS eventual consistency][12].
1720
+ # model. For more information, see [KMS eventual consistency][13].
1717
1721
  #
1718
1722
  #
1719
1723
  #
1720
1724
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys
1721
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html
1722
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
1723
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
1724
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
1725
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html
1726
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1727
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
1728
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1729
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1730
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html#iam-policy-example-create-key
1731
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
1725
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
1726
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
1727
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
1728
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html
1729
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1730
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
1731
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1732
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html
1733
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html
1734
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1735
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/customer-managed-policies.html#iam-policy-example-create-key
1736
+ # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
1732
1737
  #
1733
1738
  # @option params [String] :policy
1734
1739
  # The key policy to attach to the KMS key.
@@ -1750,22 +1755,38 @@ module Aws::KMS
1750
1755
  # not always immediately visible][2] in the *Amazon Web Services
1751
1756
  # Identity and Access Management User Guide*.
1752
1757
  #
1758
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are missing
1759
+ # from a key policy statement, the policy statement has no effect. When
1760
+ # a key policy statement is missing one of these elements, the KMS
1761
+ # console correctly reports an error, but the `CreateKey` and
1762
+ # `PutKeyPolicy` API requests succeed, even though the policy statement
1763
+ # is ineffective.
1764
+ #
1765
+ # For more information on required key policy elements, see [Elements in
1766
+ # a key policy][3] in the *Key Management Service Developer Guide*.
1767
+ #
1768
+ # </note>
1769
+ #
1753
1770
  # If you do not provide a key policy, KMS attaches a default key policy
1754
- # to the KMS key. For more information, see [Default key policy][3] in
1771
+ # to the KMS key. For more information, see [Default key policy][4] in
1755
1772
  # the *Key Management Service Developer Guide*.
1756
1773
  #
1757
- # The key policy size quota is 32 kilobytes (32768 bytes).
1774
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
1775
+ # `LimitExceededException`.
1776
+ #
1777
+ # </note>
1758
1778
  #
1759
1779
  # For help writing and formatting a JSON policy document, see the [IAM
1760
- # JSON Policy Reference][4] in the <i> <i>Identity and Access Management
1780
+ # JSON Policy Reference][5] in the <i> <i>Identity and Access Management
1761
1781
  # User Guide</i> </i>.
1762
1782
  #
1763
1783
  #
1764
1784
  #
1765
1785
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
1766
1786
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
1767
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
1768
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
1787
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
1788
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
1789
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
1769
1790
  #
1770
1791
  # @option params [String] :description
1771
1792
  # A description of the KMS key. Use a description that helps you decide
@@ -1799,7 +1820,10 @@ module Aws::KMS
1799
1820
  # * For asymmetric KMS keys with NIST-recommended elliptic curve key
1800
1821
  # pairs, specify `SIGN_VERIFY` or `KEY_AGREEMENT`.
1801
1822
  #
1802
- # * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs specify
1823
+ # * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs, specify
1824
+ # `SIGN_VERIFY`.
1825
+ #
1826
+ # * For asymmetric KMS keys with ML-DSA key pairs, specify
1803
1827
  # `SIGN_VERIFY`.
1804
1828
  #
1805
1829
  # * For asymmetric KMS keys with SM2 key pairs (China Regions only),
@@ -1807,7 +1831,7 @@ module Aws::KMS
1807
1831
  #
1808
1832
  #
1809
1833
  #
1810
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
1834
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
1811
1835
  #
1812
1836
  # @option params [String] :customer_master_key_spec
1813
1837
  # Instead, use the `KeySpec` parameter.
@@ -1821,20 +1845,21 @@ module Aws::KMS
1821
1845
  # Specifies the type of KMS key to create. The default value,
1822
1846
  # `SYMMETRIC_DEFAULT`, creates a KMS key with a 256-bit AES-GCM key that
1823
1847
  # is used for encryption and decryption, except in China Regions, where
1824
- # it creates a 128-bit symmetric key that uses SM4 encryption. For help
1825
- # choosing a key spec for your KMS key, see [Choosing a KMS key type][1]
1826
- # in the <i> <i>Key Management Service Developer Guide</i> </i>.
1848
+ # it creates a 128-bit symmetric key that uses SM4 encryption. For a
1849
+ # detailed description of all supported key specs, see [Key spec
1850
+ # reference][1] in the <i> <i>Key Management Service Developer Guide</i>
1851
+ # </i>.
1827
1852
  #
1828
1853
  # The `KeySpec` determines whether the KMS key contains a symmetric key
1829
1854
  # or an asymmetric key pair. It also determines the algorithms that the
1830
1855
  # KMS key supports. You can't change the `KeySpec` after the KMS key is
1831
1856
  # created. To further restrict the algorithms that can be used with the
1832
1857
  # KMS key, use a condition key in its key policy or IAM policy. For more
1833
- # information, see [kms:EncryptionAlgorithm][2], [kms:MacAlgorithm][3]
1834
- # or [kms:Signing Algorithm][4] in the <i> <i>Key Management Service
1835
- # Developer Guide</i> </i>.
1858
+ # information, see [kms:EncryptionAlgorithm][2], [kms:MacAlgorithm][3],
1859
+ # [kms:KeyAgreementAlgorithm][4], or [kms:SigningAlgorithm][5] in the
1860
+ # <i> <i>Key Management Service Developer Guide</i> </i>.
1836
1861
  #
1837
- # [Amazon Web Services services that are integrated with KMS][5] use
1862
+ # [Amazon Web Services services that are integrated with KMS][6] use
1838
1863
  # symmetric encryption KMS keys to protect your data. These services do
1839
1864
  # not support asymmetric KMS keys or HMAC KMS keys.
1840
1865
  #
@@ -1875,6 +1900,13 @@ module Aws::KMS
1875
1900
  # * `ECC_SECG_P256K1` (secp256k1), commonly used for cryptocurrencies.
1876
1901
  #
1877
1902
  # ^
1903
+ # * Asymmetric ML-DSA key pairs (signing and verification)
1904
+ #
1905
+ # * `ML_DSA_44`
1906
+ #
1907
+ # * `ML_DSA_65`
1908
+ #
1909
+ # * `ML_DSA_87`
1878
1910
  # * SM2 key pairs (encryption and decryption -or- signing and
1879
1911
  # verification -or- deriving shared secrets)
1880
1912
  #
@@ -1884,11 +1916,12 @@ module Aws::KMS
1884
1916
  #
1885
1917
  #
1886
1918
  #
1887
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose
1888
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm
1889
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm
1890
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm
1891
- # [5]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
1919
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html
1920
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-algorithm
1921
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-mac-algorithm
1922
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-agreement-algorithm
1923
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-signing-algorithm
1924
+ # [6]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
1892
1925
  #
1893
1926
  # @option params [String] :origin
1894
1927
  # The source of the key material for the KMS key. You cannot change the
@@ -1938,7 +1971,7 @@ module Aws::KMS
1938
1971
  #
1939
1972
  #
1940
1973
  #
1941
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1974
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1942
1975
  #
1943
1976
  # @option params [Boolean] :bypass_policy_lockout_safety_check
1944
1977
  # Skips ("bypasses") the key policy lockout safety check. The default
@@ -1986,7 +2019,7 @@ module Aws::KMS
1986
2019
  # When you add tags to an Amazon Web Services resource, Amazon Web
1987
2020
  # Services generates a cost allocation report with usage and costs
1988
2021
  # aggregated by tags. Tags can also be used to control access to a KMS
1989
- # key. For details, see [Tagging Keys][3].
2022
+ # key. For details, see [Tags in KMS][3].
1990
2023
  #
1991
2024
  #
1992
2025
  #
@@ -2057,7 +2090,7 @@ module Aws::KMS
2057
2090
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
2058
2091
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
2059
2092
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy
2060
- # [4]: https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements
2093
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html#xks-key-requirements
2061
2094
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption
2062
2095
  #
2063
2096
  # @return [Types::CreateKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
@@ -2079,6 +2112,7 @@ module Aws::KMS
2079
2112
  # aws_account_id: "111122223333",
2080
2113
  # arn: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
2081
2114
  # creation_date: Time.parse("2017-07-05T14:04:55-07:00"),
2115
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
2082
2116
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
2083
2117
  # description: "",
2084
2118
  # enabled: true,
@@ -2131,8 +2165,7 @@ module Aws::KMS
2131
2165
  # @example Example: To create an asymmetric elliptic curve KMS key for signing and verification
2132
2166
  #
2133
2167
  # # This example creates a KMS key that contains an asymmetric elliptic curve (ECC) key pair for signing and verification.
2134
- # # The key usage is required even though "SIGN_VERIFY" is the only valid value for ECC KMS keys. The key spec and key usage
2135
- # # can't be changed after the key is created.
2168
+ # # The key spec and key usage can't be changed after the key is created.
2136
2169
  #
2137
2170
  # resp = client.create_key({
2138
2171
  # key_spec: "ECC_NIST_P521", # Describes the type of key material in the KMS key.
@@ -2193,6 +2226,38 @@ module Aws::KMS
2193
2226
  # }, # Detailed information about the KMS key that this operation creates.
2194
2227
  # }
2195
2228
  #
2229
+ # @example Example: To create an asymmetric ML-DSA KMS key for signing and verification
2230
+ #
2231
+ # # This example creates a module-lattice digital signature algorithm (ML-DSA) key for signing and verification. The
2232
+ # # key-usage parameter is required even though SIGN_VERIFY is the only valid value for ML-DSA keys.
2233
+ #
2234
+ # resp = client.create_key({
2235
+ # key_spec: "ML_DSA_65", # Describes the type of key material in the KMS key.
2236
+ # key_usage: "SIGN_VERIFY", # The cryptographic operations for which you can use the KMS key.
2237
+ # })
2238
+ #
2239
+ # resp.to_h outputs the following:
2240
+ # {
2241
+ # key_metadata: {
2242
+ # aws_account_id: "111122223333",
2243
+ # arn: "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
2244
+ # creation_date: Time.parse(1748371316.734),
2245
+ # customer_master_key_spec: "ML_DSA_65",
2246
+ # description: "",
2247
+ # enabled: true,
2248
+ # key_id: "1234abcd-12ab-34cd-56ef-1234567890ab",
2249
+ # key_manager: "CUSTOMER",
2250
+ # key_spec: "ML_DSA_65",
2251
+ # key_state: "Enabled",
2252
+ # key_usage: "SIGN_VERIFY",
2253
+ # multi_region: false,
2254
+ # origin: "AWS_KMS",
2255
+ # signing_algorithms: [
2256
+ # "ML_DSA_SHAKE_256",
2257
+ # ],
2258
+ # }, # Detailed information about the KMS key that this operation creates.
2259
+ # }
2260
+ #
2196
2261
  # @example Example: To create a multi-Region primary KMS key
2197
2262
  #
2198
2263
  # # This example creates a multi-Region primary symmetric encryption key. Because the default values for all parameters
@@ -2208,6 +2273,7 @@ module Aws::KMS
2208
2273
  # aws_account_id: "111122223333",
2209
2274
  # arn: "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef12345678990ab",
2210
2275
  # creation_date: Time.parse("2021-09-02T016:15:21-09:00"),
2276
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
2211
2277
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
2212
2278
  # description: "",
2213
2279
  # enabled: true,
@@ -2344,7 +2410,7 @@ module Aws::KMS
2344
2410
  # description: "DescriptionType",
2345
2411
  # key_usage: "SIGN_VERIFY", # accepts SIGN_VERIFY, ENCRYPT_DECRYPT, GENERATE_VERIFY_MAC, KEY_AGREEMENT
2346
2412
  # customer_master_key_spec: "RSA_2048", # accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, SYMMETRIC_DEFAULT, HMAC_224, HMAC_256, HMAC_384, HMAC_512, SM2
2347
- # key_spec: "RSA_2048", # accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, SYMMETRIC_DEFAULT, HMAC_224, HMAC_256, HMAC_384, HMAC_512, SM2
2413
+ # key_spec: "RSA_2048", # accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, SYMMETRIC_DEFAULT, HMAC_224, HMAC_256, HMAC_384, HMAC_512, SM2, ML_DSA_44, ML_DSA_65, ML_DSA_87
2348
2414
  # origin: "AWS_KMS", # accepts AWS_KMS, EXTERNAL, AWS_CLOUDHSM, EXTERNAL_KEY_STORE
2349
2415
  # custom_key_store_id: "CustomKeyStoreIdType",
2350
2416
  # bypass_policy_lockout_safety_check: false,
@@ -2376,11 +2442,11 @@ module Aws::KMS
2376
2442
  # resp.key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
2377
2443
  # resp.key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
2378
2444
  # resp.key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
2379
- # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
2445
+ # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
2380
2446
  # resp.key_metadata.encryption_algorithms #=> Array
2381
2447
  # resp.key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
2382
2448
  # resp.key_metadata.signing_algorithms #=> Array
2383
- # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
2449
+ # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
2384
2450
  # resp.key_metadata.key_agreement_algorithms #=> Array
2385
2451
  # resp.key_metadata.key_agreement_algorithms[0] #=> String, one of "ECDH"
2386
2452
  # resp.key_metadata.multi_region #=> Boolean
@@ -2394,6 +2460,7 @@ module Aws::KMS
2394
2460
  # resp.key_metadata.mac_algorithms #=> Array
2395
2461
  # resp.key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
2396
2462
  # resp.key_metadata.xks_key_configuration.id #=> String
2463
+ # resp.key_metadata.current_key_material_id #=> String
2397
2464
  #
2398
2465
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateKey AWS API Documentation
2399
2466
  #
@@ -2444,15 +2511,14 @@ module Aws::KMS
2444
2511
  # key that you intend.
2445
2512
  #
2446
2513
  # Whenever possible, use key policies to give users permission to call
2447
- # the `Decrypt` operation on a particular KMS key, instead of using
2448
- # &amp;IAM; policies. Otherwise, you might create an &amp;IAM; policy
2449
- # that gives the user `Decrypt` permission on all KMS keys. This user
2450
- # could decrypt ciphertext that was encrypted by KMS keys in other
2451
- # accounts if the key policy for the cross-account KMS key permits it.
2452
- # If you must use an IAM policy for `Decrypt` permissions, limit the
2453
- # user to particular KMS keys or particular trusted accounts. For
2454
- # details, see [Best practices for IAM policies][4] in the *Key
2455
- # Management Service Developer Guide*.
2514
+ # the `Decrypt` operation on a particular KMS key, instead of using IAM
2515
+ # policies. Otherwise, you might create an IAM policy that gives the
2516
+ # user `Decrypt` permission on all KMS keys. This user could decrypt
2517
+ # ciphertext that was encrypted by KMS keys in other accounts if the key
2518
+ # policy for the cross-account KMS key permits it. If you must use an
2519
+ # IAM policy for `Decrypt` permissions, limit the user to particular KMS
2520
+ # keys or particular trusted accounts. For details, see [Best practices
2521
+ # for IAM policies][4] in the *Key Management Service Developer Guide*.
2456
2522
  #
2457
2523
  # `Decrypt` also supports [Amazon Web Services Nitro Enclaves][5], which
2458
2524
  # provide an isolated compute environment in Amazon EC2. To call
@@ -2500,7 +2566,7 @@ module Aws::KMS
2500
2566
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2501
2567
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
2502
2568
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2503
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2569
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2504
2570
  #
2505
2571
  # @option params [required, String, StringIO, File] :ciphertext_blob
2506
2572
  # Ciphertext to be decrypted. The blob includes metadata.
@@ -2525,8 +2591,8 @@ module Aws::KMS
2525
2591
  #
2526
2592
  #
2527
2593
  #
2528
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2529
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2594
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2595
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2530
2596
  #
2531
2597
  # @option params [Array<String>] :grant_tokens
2532
2598
  # A list of grant tokens.
@@ -2539,7 +2605,7 @@ module Aws::KMS
2539
2605
  #
2540
2606
  #
2541
2607
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2542
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2608
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2543
2609
  #
2544
2610
  # @option params [String] :key_id
2545
2611
  # Specifies the KMS key that KMS uses to decrypt the ciphertext.
@@ -2615,12 +2681,12 @@ module Aws::KMS
2615
2681
  # Checks if your request will succeed. `DryRun` is an optional
2616
2682
  # parameter.
2617
2683
  #
2618
- # To learn more about how to use this parameter, see [Testing your KMS
2619
- # API calls][1] in the *Key Management Service Developer Guide*.
2684
+ # To learn more about how to use this parameter, see [Testing your
2685
+ # permissions][1] in the *Key Management Service Developer Guide*.
2620
2686
  #
2621
2687
  #
2622
2688
  #
2623
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2689
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2624
2690
  #
2625
2691
  # @return [Types::DecryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
2626
2692
  #
@@ -2628,6 +2694,7 @@ module Aws::KMS
2628
2694
  # * {Types::DecryptResponse#plaintext #plaintext} => String
2629
2695
  # * {Types::DecryptResponse#encryption_algorithm #encryption_algorithm} => String
2630
2696
  # * {Types::DecryptResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
2697
+ # * {Types::DecryptResponse#key_material_id #key_material_id} => String
2631
2698
  #
2632
2699
  #
2633
2700
  # @example Example: To decrypt data with a symmetric encryption KMS key
@@ -2644,6 +2711,7 @@ module Aws::KMS
2644
2711
  # {
2645
2712
  # encryption_algorithm: "SYMMETRIC_DEFAULT", # The encryption algorithm that was used to decrypt the ciphertext. SYMMETRIC_DEFAULT is the only valid value for symmetric encryption in AWS KMS.
2646
2713
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The Amazon Resource Name (ARN) of the KMS key that was used to decrypt the data.
2714
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to decrypt the ciphertext.
2647
2715
  # plaintext: "<binary data>", # The decrypted (plaintext) data.
2648
2716
  # }
2649
2717
  #
@@ -2710,6 +2778,7 @@ module Aws::KMS
2710
2778
  # resp.plaintext #=> String
2711
2779
  # resp.encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
2712
2780
  # resp.ciphertext_for_recipient #=> String
2781
+ # resp.key_material_id #=> String
2713
2782
  #
2714
2783
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Decrypt AWS API Documentation
2715
2784
  #
@@ -2766,7 +2835,7 @@ module Aws::KMS
2766
2835
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
2767
2836
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2768
2837
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
2769
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2838
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2770
2839
  #
2771
2840
  # @option params [required, String] :alias_name
2772
2841
  # The alias to be deleted. The alias name must begin with `alias/`
@@ -2805,9 +2874,9 @@ module Aws::KMS
2805
2874
  # does not affect the external key store proxy, external key manager, or
2806
2875
  # any external keys.
2807
2876
  #
2808
- # This operation is part of the [custom key stores][1] feature in KMS,
2809
- # which combines the convenience and extensive integration of KMS with
2810
- # the isolation and control of a key store that you own and manage.
2877
+ # This operation is part of the custom key stores feature in KMS, which
2878
+ # combines the convenience and extensive integration of KMS with the
2879
+ # isolation and control of a key store that you own and manage.
2811
2880
  #
2812
2881
  # The custom key store that you delete cannot contain any [KMS keys][2].
2813
2882
  # Before deleting the key store, verify that you will never need to use
@@ -2858,12 +2927,12 @@ module Aws::KMS
2858
2927
  #
2859
2928
  #
2860
2929
  #
2861
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
2930
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
2862
2931
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys
2863
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2932
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2864
2933
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
2865
2934
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2866
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2935
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2867
2936
  #
2868
2937
  # @option params [required, String] :custom_key_store_id
2869
2938
  # Enter the ID of the custom key store you want to delete. To find the
@@ -2925,6 +2994,8 @@ module Aws::KMS
2925
2994
  #
2926
2995
  # * GetParametersForImport
2927
2996
  #
2997
+ # * ListKeyRotations
2998
+ #
2928
2999
  # * ImportKeyMaterial
2929
3000
  #
2930
3001
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -2935,7 +3006,7 @@ module Aws::KMS
2935
3006
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
2936
3007
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
2937
3008
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2938
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3009
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2939
3010
  #
2940
3011
  # @option params [required, String] :key_id
2941
3012
  # Identifies the KMS key from which you are deleting imported key
@@ -2953,7 +3024,19 @@ module Aws::KMS
2953
3024
  # To get the key ID and key ARN for a KMS key, use ListKeys or
2954
3025
  # DescribeKey.
2955
3026
  #
2956
- # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
3027
+ # @option params [String] :key_material_id
3028
+ # Identifies the imported key material you are deleting.
3029
+ #
3030
+ # If no KeyMaterialId is specified, KMS deletes the current key
3031
+ # material.
3032
+ #
3033
+ # To get the list of key material IDs associated with a KMS key, use
3034
+ # ListKeyRotations.
3035
+ #
3036
+ # @return [Types::DeleteImportedKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
3037
+ #
3038
+ # * {Types::DeleteImportedKeyMaterialResponse#key_id #key_id} => String
3039
+ # * {Types::DeleteImportedKeyMaterialResponse#key_material_id #key_material_id} => String
2957
3040
  #
2958
3041
  #
2959
3042
  # @example Example: To delete imported key material
@@ -2962,14 +3045,21 @@ module Aws::KMS
2962
3045
  #
2963
3046
  # resp = client.delete_imported_key_material({
2964
3047
  # key_id: "1234abcd-12ab-34cd-56ef-1234567890ab", # The identifier of the KMS key whose imported key material you are deleting. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
3048
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # Identifies the deleted key material.
2965
3049
  # })
2966
3050
  #
2967
3051
  # @example Request syntax with placeholder values
2968
3052
  #
2969
3053
  # resp = client.delete_imported_key_material({
2970
3054
  # key_id: "KeyIdType", # required
3055
+ # key_material_id: "BackingKeyIdType",
2971
3056
  # })
2972
3057
  #
3058
+ # @example Response structure
3059
+ #
3060
+ # resp.key_id #=> String
3061
+ # resp.key_material_id #=> String
3062
+ #
2973
3063
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterial AWS API Documentation
2974
3064
  #
2975
3065
  # @overload delete_imported_key_material(params = {})
@@ -3072,7 +3162,7 @@ module Aws::KMS
3072
3162
  # [2]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf
3073
3163
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3074
3164
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3075
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3165
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3076
3166
  #
3077
3167
  # @option params [required, String] :key_id
3078
3168
  # Identifies an asymmetric NIST-recommended ECC or SM2 (China Regions
@@ -3140,18 +3230,18 @@ module Aws::KMS
3140
3230
  #
3141
3231
  #
3142
3232
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3143
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3233
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3144
3234
  #
3145
3235
  # @option params [Boolean] :dry_run
3146
3236
  # Checks if your request will succeed. `DryRun` is an optional
3147
3237
  # parameter.
3148
3238
  #
3149
- # To learn more about how to use this parameter, see [Testing your KMS
3150
- # API calls][1] in the *Key Management Service Developer Guide*.
3239
+ # To learn more about how to use this parameter, see [Testing your
3240
+ # permissions][1] in the *Key Management Service Developer Guide*.
3151
3241
  #
3152
3242
  #
3153
3243
  #
3154
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3244
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
3155
3245
  #
3156
3246
  # @option params [Types::RecipientInfo] :recipient
3157
3247
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -3246,9 +3336,9 @@ module Aws::KMS
3246
3336
  # Gets information about [custom key stores][1] in the account and
3247
3337
  # Region.
3248
3338
  #
3249
- # This operation is part of the [custom key stores][1] feature in KMS,
3250
- # which combines the convenience and extensive integration of KMS with
3251
- # the isolation and control of a key store that you own and manage.
3339
+ # This operation is part of the custom key stores feature in KMS, which
3340
+ # combines the convenience and extensive integration of KMS with the
3341
+ # isolation and control of a key store that you own and manage.
3252
3342
  #
3253
3343
  # By default, this operation returns information about all custom key
3254
3344
  # stores in the account and Region. To get only information about a
@@ -3301,11 +3391,11 @@ module Aws::KMS
3301
3391
  #
3302
3392
  #
3303
3393
  #
3304
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
3394
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
3305
3395
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
3306
3396
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
3307
3397
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3308
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3398
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3309
3399
  #
3310
3400
  # @option params [String] :custom_key_store_id
3311
3401
  # Gets only information about the specified custom key store. Enter the
@@ -3503,8 +3593,8 @@ module Aws::KMS
3503
3593
  # * Whether automatic key rotation is enabled on the KMS key. To get
3504
3594
  # this information, use GetKeyRotationStatus. Also, some key states
3505
3595
  # prevent a KMS key from being automatically rotated. For details, see
3506
- # [How Automatic Key Rotation Works][6] in the *Key Management Service
3507
- # Developer Guide*.
3596
+ # [How key rotation works][6] in the *Key Management Service Developer
3597
+ # Guide*.
3508
3598
  #
3509
3599
  # * Tags on the KMS key. To get this information, use ListResourceTags.
3510
3600
  #
@@ -3543,14 +3633,14 @@ module Aws::KMS
3543
3633
  #
3544
3634
  #
3545
3635
  #
3546
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
3547
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
3636
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
3637
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
3548
3638
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
3549
3639
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
3550
3640
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
3551
3641
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-how-it-works
3552
3642
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3553
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3643
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3554
3644
  #
3555
3645
  # @option params [required, String] :key_id
3556
3646
  # Describes the specified KMS key.
@@ -3581,7 +3671,7 @@ module Aws::KMS
3581
3671
  #
3582
3672
  #
3583
3673
  #
3584
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html##aws-managed-cmk
3674
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
3585
3675
  #
3586
3676
  # @option params [Array<String>] :grant_tokens
3587
3677
  # A list of grant tokens.
@@ -3594,7 +3684,7 @@ module Aws::KMS
3594
3684
  #
3595
3685
  #
3596
3686
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3597
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3687
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3598
3688
  #
3599
3689
  # @return [Types::DescribeKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
3600
3690
  #
@@ -3615,6 +3705,7 @@ module Aws::KMS
3615
3705
  # aws_account_id: "111122223333",
3616
3706
  # arn: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
3617
3707
  # creation_date: Time.parse("2017-07-05T14:04:55-07:00"),
3708
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
3618
3709
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
3619
3710
  # description: "",
3620
3711
  # enabled: true,
@@ -3681,6 +3772,7 @@ module Aws::KMS
3681
3772
  # aws_account_id: "111122223333",
3682
3773
  # arn: "arn:aws:kms:ap-northeast-1:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab",
3683
3774
  # creation_date: Time.parse(1586329200.918),
3775
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
3684
3776
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
3685
3777
  # description: "",
3686
3778
  # enabled: true,
@@ -3837,11 +3929,11 @@ module Aws::KMS
3837
3929
  # resp.key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
3838
3930
  # resp.key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
3839
3931
  # resp.key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
3840
- # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
3932
+ # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
3841
3933
  # resp.key_metadata.encryption_algorithms #=> Array
3842
3934
  # resp.key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
3843
3935
  # resp.key_metadata.signing_algorithms #=> Array
3844
- # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
3936
+ # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
3845
3937
  # resp.key_metadata.key_agreement_algorithms #=> Array
3846
3938
  # resp.key_metadata.key_agreement_algorithms[0] #=> String, one of "ECDH"
3847
3939
  # resp.key_metadata.multi_region #=> Boolean
@@ -3855,6 +3947,7 @@ module Aws::KMS
3855
3947
  # resp.key_metadata.mac_algorithms #=> Array
3856
3948
  # resp.key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
3857
3949
  # resp.key_metadata.xks_key_configuration.id #=> String
3950
+ # resp.key_metadata.current_key_material_id #=> String
3858
3951
  #
3859
3952
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeKey AWS API Documentation
3860
3953
  #
@@ -3868,13 +3961,10 @@ module Aws::KMS
3868
3961
  # Sets the state of a KMS key to disabled. This change temporarily
3869
3962
  # prevents use of the KMS key for [cryptographic operations][1].
3870
3963
  #
3871
- # For more information about how key state affects the use of a KMS key,
3872
- # see [Key states of KMS keys][2] in the <i> <i>Key Management Service
3873
- # Developer Guide</i> </i>.
3874
- #
3875
3964
  # The KMS key that you use for this operation must be in a compatible
3876
- # key state. For details, see [Key states of KMS keys][2] in the *Key
3877
- # Management Service Developer Guide*.
3965
+ # key state. For more information about how key state affects the use of
3966
+ # a KMS key, see [Key states of KMS keys][2] in the <i> <i>Key
3967
+ # Management Service Developer Guide</i> </i>.
3878
3968
  #
3879
3969
  # **Cross-account use**: No. You cannot perform this operation on a KMS
3880
3970
  # key in a different Amazon Web Services account.
@@ -3888,10 +3978,10 @@ module Aws::KMS
3888
3978
  #
3889
3979
  #
3890
3980
  #
3891
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3981
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3892
3982
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3893
3983
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3894
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3984
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3895
3985
  #
3896
3986
  # @option params [required, String] :key_id
3897
3987
  # Identifies the KMS key to disable.
@@ -3980,18 +4070,18 @@ module Aws::KMS
3980
4070
  #
3981
4071
  #
3982
4072
  #
3983
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
4073
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
3984
4074
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
3985
4075
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
3986
4076
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
3987
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
3988
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
3989
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
3990
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
3991
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
4077
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4078
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4079
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
4080
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
4081
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key
3992
4082
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3993
4083
  # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3994
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4084
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3995
4085
  #
3996
4086
  # @option params [required, String] :key_id
3997
4087
  # Identifies a symmetric encryption KMS key. You cannot enable or
@@ -4016,7 +4106,7 @@ module Aws::KMS
4016
4106
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks
4017
4107
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4018
4108
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4019
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4109
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4020
4110
  #
4021
4111
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
4022
4112
  #
@@ -4050,9 +4140,9 @@ module Aws::KMS
4050
4140
  # external key store proxy that communicates with your external key
4051
4141
  # manager.
4052
4142
  #
4053
- # This operation is part of the [custom key stores][1] feature in KMS,
4054
- # which combines the convenience and extensive integration of KMS with
4055
- # the isolation and control of a key store that you own and manage.
4143
+ # This operation is part of the custom key stores feature in KMS, which
4144
+ # combines the convenience and extensive integration of KMS with the
4145
+ # isolation and control of a key store that you own and manage.
4056
4146
  #
4057
4147
  # While a custom key store is disconnected, you can manage the custom
4058
4148
  # key store and its KMS keys, but you cannot create or use its KMS keys.
@@ -4096,10 +4186,10 @@ module Aws::KMS
4096
4186
  #
4097
4187
  #
4098
4188
  #
4099
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4100
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4189
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4190
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4101
4191
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4102
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4192
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4103
4193
  #
4104
4194
  # @option params [required, String] :custom_key_store_id
4105
4195
  # Enter the ID of the custom key store you want to disconnect. To find
@@ -4158,10 +4248,10 @@ module Aws::KMS
4158
4248
  #
4159
4249
  #
4160
4250
  #
4161
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4251
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4162
4252
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4163
4253
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4164
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4254
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4165
4255
  #
4166
4256
  # @option params [required, String] :key_id
4167
4257
  # Identifies the KMS key to enable.
@@ -4222,17 +4312,17 @@ module Aws::KMS
4222
4312
  # any in progress rotations. You can use the ListKeyRotations operation
4223
4313
  # to view the details of completed rotations.
4224
4314
  #
4225
- # Automatic key rotation is supported only on [symmetric encryption KMS
4226
- # keys][3]. You cannot enable automatic rotation of [asymmetric KMS
4227
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
4228
- # material][6], or KMS keys in a [custom key store][7]. To enable or
4229
- # disable automatic rotation of a set of related [multi-Region keys][8],
4315
+ # Automatic key rotation is supported only on symmetric encryption KMS
4316
+ # keys. You cannot enable automatic rotation of [asymmetric KMS
4317
+ # keys][3], [HMAC KMS keys][4], KMS keys with [imported key
4318
+ # material][5], or KMS keys in a [custom key store][6]. To enable or
4319
+ # disable automatic rotation of a set of related [multi-Region keys][7],
4230
4320
  # set the property on the primary key.
4231
4321
  #
4232
4322
  # You cannot enable or disable automatic rotation of [Amazon Web
4233
- # Services managed KMS keys][9]. KMS always rotates the key material of
4323
+ # Services managed KMS keys][8]. KMS always rotates the key material of
4234
4324
  # Amazon Web Services managed keys every year. Rotation of [Amazon Web
4235
- # Services owned KMS keys][10] is managed by the Amazon Web Services
4325
+ # Services owned KMS keys][9] is managed by the Amazon Web Services
4236
4326
  # service that owns the key.
4237
4327
  #
4238
4328
  # <note markdown="1"> In May 2022, KMS changed the rotation schedule for Amazon Web Services
@@ -4248,13 +4338,13 @@ module Aws::KMS
4248
4338
  # </note>
4249
4339
  #
4250
4340
  # The KMS key that you use for this operation must be in a compatible
4251
- # key state. For details, see [Key states of KMS keys][11] in the *Key
4341
+ # key state. For details, see [Key states of KMS keys][10] in the *Key
4252
4342
  # Management Service Developer Guide*.
4253
4343
  #
4254
4344
  # **Cross-account use**: No. You cannot perform this operation on a KMS
4255
4345
  # key in a different Amazon Web Services account.
4256
4346
  #
4257
- # **Required permissions**: [kms:EnableKeyRotation][12] (key policy)
4347
+ # **Required permissions**: [kms:EnableKeyRotation][11] (key policy)
4258
4348
  #
4259
4349
  # **Related operations:**
4260
4350
  #
@@ -4273,23 +4363,22 @@ module Aws::KMS
4273
4363
  # </note>
4274
4364
  #
4275
4365
  # **Eventual consistency**: The KMS API follows an eventual consistency
4276
- # model. For more information, see [KMS eventual consistency][13].
4366
+ # model. For more information, see [KMS eventual consistency][12].
4277
4367
  #
4278
4368
  #
4279
4369
  #
4280
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
4281
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
4282
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
4283
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4284
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4285
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4286
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4287
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4288
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
4289
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
4290
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4291
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4292
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4370
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
4371
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
4372
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4373
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4374
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4375
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4376
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4377
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
4378
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key
4379
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4380
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4381
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4293
4382
  #
4294
4383
  # @option params [required, String] :key_id
4295
4384
  # Identifies a symmetric encryption KMS key. You cannot enable automatic
@@ -4315,8 +4404,8 @@ module Aws::KMS
4315
4404
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4316
4405
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4317
4406
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4318
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4319
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4407
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4408
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4320
4409
  #
4321
4410
  # @option params [Integer] :rotation_period_in_days
4322
4411
  # Use this parameter to specify a custom period of time between each
@@ -4448,10 +4537,10 @@ module Aws::KMS
4448
4537
  #
4449
4538
  #
4450
4539
  #
4451
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4540
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4452
4541
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4453
4542
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4454
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4543
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4455
4544
  #
4456
4545
  # @option params [required, String] :key_id
4457
4546
  # Identifies the KMS key to use in the encryption operation. The KMS key
@@ -4504,8 +4593,8 @@ module Aws::KMS
4504
4593
  #
4505
4594
  #
4506
4595
  #
4507
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4508
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4596
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4597
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4509
4598
  #
4510
4599
  # @option params [Array<String>] :grant_tokens
4511
4600
  # A list of grant tokens.
@@ -4518,7 +4607,7 @@ module Aws::KMS
4518
4607
  #
4519
4608
  #
4520
4609
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
4521
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
4610
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
4522
4611
  #
4523
4612
  # @option params [String] :encryption_algorithm
4524
4613
  # Specifies the encryption algorithm that KMS will use to encrypt the
@@ -4536,12 +4625,12 @@ module Aws::KMS
4536
4625
  # Checks if your request will succeed. `DryRun` is an optional
4537
4626
  # parameter.
4538
4627
  #
4539
- # To learn more about how to use this parameter, see [Testing your KMS
4540
- # API calls][1] in the *Key Management Service Developer Guide*.
4628
+ # To learn more about how to use this parameter, see [Testing your
4629
+ # permissions][1] in the *Key Management Service Developer Guide*.
4541
4630
  #
4542
4631
  #
4543
4632
  #
4544
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
4633
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
4545
4634
  #
4546
4635
  # @return [Types::EncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
4547
4636
  #
@@ -4716,7 +4805,7 @@ module Aws::KMS
4716
4805
  #
4717
4806
  #
4718
4807
  #
4719
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4808
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4720
4809
  # [2]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
4721
4810
  # [3]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
4722
4811
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
@@ -4725,7 +4814,7 @@ module Aws::KMS
4725
4814
  # [7]: https://docs.aws.amazon.com/dynamodb-encryption-client/latest/devguide/
4726
4815
  # [8]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
4727
4816
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4728
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4817
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4729
4818
  #
4730
4819
  # @option params [required, String] :key_id
4731
4820
  # Specifies the symmetric encryption KMS key that encrypts the data key.
@@ -4773,7 +4862,7 @@ module Aws::KMS
4773
4862
  #
4774
4863
  #
4775
4864
  #
4776
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4865
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4777
4866
  #
4778
4867
  # @option params [Integer] :number_of_bytes
4779
4868
  # Specifies the length of the data key in bytes. For example, use the
@@ -4803,7 +4892,7 @@ module Aws::KMS
4803
4892
  #
4804
4893
  #
4805
4894
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
4806
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
4895
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
4807
4896
  #
4808
4897
  # @option params [Types::RecipientInfo] :recipient
4809
4898
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -4837,12 +4926,12 @@ module Aws::KMS
4837
4926
  # Checks if your request will succeed. `DryRun` is an optional
4838
4927
  # parameter.
4839
4928
  #
4840
- # To learn more about how to use this parameter, see [Testing your KMS
4841
- # API calls][1] in the *Key Management Service Developer Guide*.
4929
+ # To learn more about how to use this parameter, see [Testing your
4930
+ # permissions][1] in the *Key Management Service Developer Guide*.
4842
4931
  #
4843
4932
  #
4844
4933
  #
4845
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
4934
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
4846
4935
  #
4847
4936
  # @return [Types::GenerateDataKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
4848
4937
  #
@@ -4850,6 +4939,7 @@ module Aws::KMS
4850
4939
  # * {Types::GenerateDataKeyResponse#plaintext #plaintext} => String
4851
4940
  # * {Types::GenerateDataKeyResponse#key_id #key_id} => String
4852
4941
  # * {Types::GenerateDataKeyResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
4942
+ # * {Types::GenerateDataKeyResponse#key_material_id #key_material_id} => String
4853
4943
  #
4854
4944
  #
4855
4945
  # @example Example: To generate a data key
@@ -4866,6 +4956,7 @@ module Aws::KMS
4866
4956
  # {
4867
4957
  # ciphertext_blob: "<binary data>", # The encrypted data key.
4868
4958
  # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the KMS key that was used to encrypt the data key.
4959
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the data key.
4869
4960
  # plaintext: "<binary data>", # The unencrypted (plaintext) data key.
4870
4961
  # }
4871
4962
  #
@@ -4917,6 +5008,7 @@ module Aws::KMS
4917
5008
  # resp.plaintext #=> String
4918
5009
  # resp.key_id #=> String
4919
5010
  # resp.ciphertext_for_recipient #=> String
5011
+ # resp.key_material_id #=> String
4920
5012
  #
4921
5013
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKey AWS API Documentation
4922
5014
  #
@@ -5025,10 +5117,10 @@ module Aws::KMS
5025
5117
  # [3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
5026
5118
  # [4]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
5027
5119
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5028
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5120
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5029
5121
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5030
5122
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5031
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5123
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5032
5124
  #
5033
5125
  # @option params [Hash<String,String>] :encryption_context
5034
5126
  # Specifies the encryption context that will be used when encrypting the
@@ -5051,7 +5143,7 @@ module Aws::KMS
5051
5143
  #
5052
5144
  #
5053
5145
  #
5054
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5146
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5055
5147
  #
5056
5148
  # @option params [required, String] :key_id
5057
5149
  # Specifies the symmetric encryption KMS key that encrypts the private
@@ -5082,10 +5174,11 @@ module Aws::KMS
5082
5174
  # Determines the type of data key pair that is generated.
5083
5175
  #
5084
5176
  # The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys
5085
- # to encrypt and decrypt or to sign and verify (but not both), and the
5086
- # rule that permits you to use ECC KMS keys only to sign and verify, are
5087
- # not effective on data key pairs, which are used outside of KMS. The
5088
- # SM2 key spec is only available in China Regions.
5177
+ # to encrypt and decrypt or to sign and verify (but not both), the rule
5178
+ # that permits you to use ECC KMS keys only to sign and verify, and the
5179
+ # rule that permits you to use ML-DSA key pairs to sign and verify only
5180
+ # are not effective on data key pairs, which are used outside of KMS.
5181
+ # The SM2 key spec is only available in China Regions.
5089
5182
  #
5090
5183
  # @option params [Array<String>] :grant_tokens
5091
5184
  # A list of grant tokens.
@@ -5098,7 +5191,7 @@ module Aws::KMS
5098
5191
  #
5099
5192
  #
5100
5193
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5101
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5194
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5102
5195
  #
5103
5196
  # @option params [Types::RecipientInfo] :recipient
5104
5197
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -5136,12 +5229,12 @@ module Aws::KMS
5136
5229
  # Checks if your request will succeed. `DryRun` is an optional
5137
5230
  # parameter.
5138
5231
  #
5139
- # To learn more about how to use this parameter, see [Testing your KMS
5140
- # API calls][1] in the *Key Management Service Developer Guide*.
5232
+ # To learn more about how to use this parameter, see [Testing your
5233
+ # permissions][1] in the *Key Management Service Developer Guide*.
5141
5234
  #
5142
5235
  #
5143
5236
  #
5144
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5237
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5145
5238
  #
5146
5239
  # @return [Types::GenerateDataKeyPairResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5147
5240
  #
@@ -5151,6 +5244,7 @@ module Aws::KMS
5151
5244
  # * {Types::GenerateDataKeyPairResponse#key_id #key_id} => String
5152
5245
  # * {Types::GenerateDataKeyPairResponse#key_pair_spec #key_pair_spec} => String
5153
5246
  # * {Types::GenerateDataKeyPairResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
5247
+ # * {Types::GenerateDataKeyPairResponse#key_material_id #key_material_id} => String
5154
5248
  #
5155
5249
  #
5156
5250
  # @example Example: To generate an RSA key pair for encryption and decryption
@@ -5166,6 +5260,7 @@ module Aws::KMS
5166
5260
  # resp.to_h outputs the following:
5167
5261
  # {
5168
5262
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The key ARN of the symmetric encryption KMS key that was used to encrypt the private key.
5263
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the private key.
5169
5264
  # key_pair_spec: "RSA_3072", # The actual key spec of the RSA data key pair.
5170
5265
  # private_key_ciphertext_blob: "<binary data>", # The encrypted private key of the RSA data key pair.
5171
5266
  # private_key_plaintext: "<binary data>", # The plaintext private key of the RSA data key pair.
@@ -5193,6 +5288,7 @@ module Aws::KMS
5193
5288
  # {
5194
5289
  # ciphertext_for_recipient: "<binary data>", # The private key of the RSA data key pair encrypted by the public key from the attestation document
5195
5290
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The key ARN of the symmetric encryption KMS key that was used to encrypt the PrivateKeyCiphertextBlob.
5291
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the private key.
5196
5292
  # key_pair_spec: "RSA_3072", # The actual key spec of the RSA data key pair.
5197
5293
  # private_key_ciphertext_blob: "<binary data>", # The private key of the RSA data key pair encrypted by the KMS key.
5198
5294
  # private_key_plaintext: "", # This field is null or empty
@@ -5223,6 +5319,7 @@ module Aws::KMS
5223
5319
  # resp.key_id #=> String
5224
5320
  # resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SM2"
5225
5321
  # resp.ciphertext_for_recipient #=> String
5322
+ # resp.key_material_id #=> String
5226
5323
  #
5227
5324
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPair AWS API Documentation
5228
5325
  #
@@ -5301,10 +5398,10 @@ module Aws::KMS
5301
5398
  #
5302
5399
  #
5303
5400
  # [1]: https://tools.ietf.org/html/rfc5280
5304
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5401
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5305
5402
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5306
5403
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5307
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5404
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5308
5405
  #
5309
5406
  # @option params [Hash<String,String>] :encryption_context
5310
5407
  # Specifies the encryption context that will be used when encrypting the
@@ -5327,7 +5424,7 @@ module Aws::KMS
5327
5424
  #
5328
5425
  #
5329
5426
  #
5330
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5427
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5331
5428
  #
5332
5429
  # @option params [required, String] :key_id
5333
5430
  # Specifies the symmetric encryption KMS key that encrypts the private
@@ -5358,10 +5455,11 @@ module Aws::KMS
5358
5455
  # Determines the type of data key pair that is generated.
5359
5456
  #
5360
5457
  # The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys
5361
- # to encrypt and decrypt or to sign and verify (but not both), and the
5362
- # rule that permits you to use ECC KMS keys only to sign and verify, are
5363
- # not effective on data key pairs, which are used outside of KMS. The
5364
- # SM2 key spec is only available in China Regions.
5458
+ # to encrypt and decrypt or to sign and verify (but not both), the rule
5459
+ # that permits you to use ECC KMS keys only to sign and verify, and the
5460
+ # rule that permits you to use ML-DSA key pairs to sign and verify only
5461
+ # are not effective on data key pairs, which are used outside of KMS.
5462
+ # The SM2 key spec is only available in China Regions.
5365
5463
  #
5366
5464
  # @option params [Array<String>] :grant_tokens
5367
5465
  # A list of grant tokens.
@@ -5374,18 +5472,18 @@ module Aws::KMS
5374
5472
  #
5375
5473
  #
5376
5474
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5377
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5475
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5378
5476
  #
5379
5477
  # @option params [Boolean] :dry_run
5380
5478
  # Checks if your request will succeed. `DryRun` is an optional
5381
5479
  # parameter.
5382
5480
  #
5383
- # To learn more about how to use this parameter, see [Testing your KMS
5384
- # API calls][1] in the *Key Management Service Developer Guide*.
5481
+ # To learn more about how to use this parameter, see [Testing your
5482
+ # permissions][1] in the *Key Management Service Developer Guide*.
5385
5483
  #
5386
5484
  #
5387
5485
  #
5388
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5486
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5389
5487
  #
5390
5488
  # @return [Types::GenerateDataKeyPairWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5391
5489
  #
@@ -5393,6 +5491,7 @@ module Aws::KMS
5393
5491
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#public_key #public_key} => String
5394
5492
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_id #key_id} => String
5395
5493
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_pair_spec #key_pair_spec} => String
5494
+ # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_material_id #key_material_id} => String
5396
5495
  #
5397
5496
  #
5398
5497
  # @example Example: To generate an asymmetric data key pair without a plaintext key
@@ -5408,6 +5507,7 @@ module Aws::KMS
5408
5507
  # resp.to_h outputs the following:
5409
5508
  # {
5410
5509
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The key ARN of the symmetric encryption KMS key that encrypted the private key in the ECC asymmetric data key pair.
5510
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the private key.
5411
5511
  # key_pair_spec: "ECC_NIST_P521", # The actual key spec of the ECC asymmetric data key pair.
5412
5512
  # private_key_ciphertext_blob: "<binary data>", # The encrypted private key of the asymmetric ECC data key pair.
5413
5513
  # public_key: "<binary data>", # The public key (plaintext).
@@ -5431,6 +5531,7 @@ module Aws::KMS
5431
5531
  # resp.public_key #=> String
5432
5532
  # resp.key_id #=> String
5433
5533
  # resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SM2"
5534
+ # resp.key_material_id #=> String
5434
5535
  #
5435
5536
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintext AWS API Documentation
5436
5537
  #
@@ -5520,10 +5621,10 @@ module Aws::KMS
5520
5621
  #
5521
5622
  #
5522
5623
  #
5523
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5624
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5524
5625
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5525
5626
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5526
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5627
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5527
5628
  #
5528
5629
  # @option params [required, String] :key_id
5529
5630
  # Specifies the symmetric encryption KMS key that encrypts the data key.
@@ -5571,7 +5672,7 @@ module Aws::KMS
5571
5672
  #
5572
5673
  #
5573
5674
  #
5574
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5675
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5575
5676
  #
5576
5677
  # @option params [String] :key_spec
5577
5678
  # The length of the data key. Use `AES_128` to generate a 128-bit
@@ -5594,23 +5695,24 @@ module Aws::KMS
5594
5695
  #
5595
5696
  #
5596
5697
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5597
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5698
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5598
5699
  #
5599
5700
  # @option params [Boolean] :dry_run
5600
5701
  # Checks if your request will succeed. `DryRun` is an optional
5601
5702
  # parameter.
5602
5703
  #
5603
- # To learn more about how to use this parameter, see [Testing your KMS
5604
- # API calls][1] in the *Key Management Service Developer Guide*.
5704
+ # To learn more about how to use this parameter, see [Testing your
5705
+ # permissions][1] in the *Key Management Service Developer Guide*.
5605
5706
  #
5606
5707
  #
5607
5708
  #
5608
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5709
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5609
5710
  #
5610
5711
  # @return [Types::GenerateDataKeyWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5611
5712
  #
5612
5713
  # * {Types::GenerateDataKeyWithoutPlaintextResponse#ciphertext_blob #ciphertext_blob} => String
5613
5714
  # * {Types::GenerateDataKeyWithoutPlaintextResponse#key_id #key_id} => String
5715
+ # * {Types::GenerateDataKeyWithoutPlaintextResponse#key_material_id #key_material_id} => String
5614
5716
  #
5615
5717
  #
5616
5718
  # @example Example: To generate an encrypted data key
@@ -5627,6 +5729,7 @@ module Aws::KMS
5627
5729
  # {
5628
5730
  # ciphertext_blob: "<binary data>", # The encrypted data key.
5629
5731
  # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the KMS key that was used to encrypt the data key.
5732
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the data key.
5630
5733
  # }
5631
5734
  #
5632
5735
  # @example Request syntax with placeholder values
@@ -5646,6 +5749,7 @@ module Aws::KMS
5646
5749
  #
5647
5750
  # resp.ciphertext_blob #=> String
5648
5751
  # resp.key_id #=> String
5752
+ # resp.key_material_id #=> String
5649
5753
  #
5650
5754
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintext AWS API Documentation
5651
5755
  #
@@ -5700,7 +5804,7 @@ module Aws::KMS
5700
5804
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
5701
5805
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5702
5806
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5703
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5807
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5704
5808
  #
5705
5809
  # @option params [required, String, StringIO, File] :message
5706
5810
  # The message to be hashed. Specify a message of up to 4,096 bytes.
@@ -5739,18 +5843,18 @@ module Aws::KMS
5739
5843
  #
5740
5844
  #
5741
5845
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5742
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5846
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5743
5847
  #
5744
5848
  # @option params [Boolean] :dry_run
5745
5849
  # Checks if your request will succeed. `DryRun` is an optional
5746
5850
  # parameter.
5747
5851
  #
5748
- # To learn more about how to use this parameter, see [Testing your KMS
5749
- # API calls][1] in the *Key Management Service Developer Guide*.
5852
+ # To learn more about how to use this parameter, see [Testing your
5853
+ # permissions][1] in the *Key Management Service Developer Guide*.
5750
5854
  #
5751
5855
  #
5752
5856
  #
5753
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5857
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5754
5858
  #
5755
5859
  # @return [Types::GenerateMacResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5756
5860
  #
@@ -5824,7 +5928,8 @@ module Aws::KMS
5824
5928
  # Management Service Developer Guide*.
5825
5929
  #
5826
5930
  # For more information about entropy and random number generation, see
5827
- # [Key Management Service Cryptographic Details][4].
5931
+ # [Entropy and random number generation][4] in the *Key Management
5932
+ # Service Developer Guide*.
5828
5933
  #
5829
5934
  # **Cross-account use**: Not applicable. `GenerateRandom` does not use
5830
5935
  # any account-specific resources, such as KMS keys.
@@ -5839,9 +5944,9 @@ module Aws::KMS
5839
5944
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
5840
5945
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
5841
5946
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5842
- # [4]: https://docs.aws.amazon.com/kms/latest/cryptographic-details/
5947
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#entropy-and-random-numbers
5843
5948
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5844
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5949
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5845
5950
  #
5846
5951
  # @option params [Integer] :number_of_bytes
5847
5952
  # The length of the random byte string. This parameter is required.
@@ -5961,7 +6066,7 @@ module Aws::KMS
5961
6066
  #
5962
6067
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5963
6068
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
5964
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6069
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5965
6070
  #
5966
6071
  # @option params [required, String] :key_id
5967
6072
  # Gets the key policy for the specified KMS key.
@@ -6029,16 +6134,16 @@ module Aws::KMS
6029
6134
  # enabled for the specified KMS key, the [rotation period][2], and the
6030
6135
  # next scheduled rotation date.
6031
6136
  #
6032
- # Automatic key rotation is supported only on [symmetric encryption KMS
6033
- # keys][3]. You cannot enable automatic rotation of [asymmetric KMS
6034
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
6035
- # material][6], or KMS keys in a [custom key store][7]. To enable or
6036
- # disable automatic rotation of a set of related [multi-Region keys][8],
6037
- # set the property on the primary key..
6137
+ # Automatic key rotation is supported only on symmetric encryption KMS
6138
+ # keys. You cannot enable automatic rotation of [asymmetric KMS
6139
+ # keys][3], [HMAC KMS keys][4], KMS keys with [imported key
6140
+ # material][5], or KMS keys in a [custom key store][6]. To enable or
6141
+ # disable automatic rotation of a set of related [multi-Region keys][7],
6142
+ # set the property on the primary key.
6038
6143
  #
6039
6144
  # You can enable (EnableKeyRotation) and disable automatic rotation
6040
6145
  # (DisableKeyRotation) of the key material in customer managed KMS keys.
6041
- # Key material rotation of [Amazon Web Services managed KMS keys][9] is
6146
+ # Key material rotation of [Amazon Web Services managed KMS keys][8] is
6042
6147
  # not configurable. KMS always rotates the key material in Amazon Web
6043
6148
  # Services managed KMS keys every year. The key rotation status for
6044
6149
  # Amazon Web Services managed KMS keys is always `true`.
@@ -6057,7 +6162,7 @@ module Aws::KMS
6057
6162
  # </note>
6058
6163
  #
6059
6164
  # The KMS key that you use for this operation must be in a compatible
6060
- # key state. For details, see [Key states of KMS keys][10] in the *Key
6165
+ # key state. For details, see [Key states of KMS keys][9] in the *Key
6061
6166
  # Management Service Developer Guide*.
6062
6167
  #
6063
6168
  # * Disabled: The key rotation status does not change when you disable a
@@ -6078,7 +6183,7 @@ module Aws::KMS
6078
6183
  # a different Amazon Web Services account, specify the key ARN in the
6079
6184
  # value of the `KeyId` parameter.
6080
6185
  #
6081
- # **Required permissions**: [kms:GetKeyRotationStatus][11] (key policy)
6186
+ # **Required permissions**: [kms:GetKeyRotationStatus][10] (key policy)
6082
6187
  #
6083
6188
  # **Related operations:**
6084
6189
  #
@@ -6091,22 +6196,21 @@ module Aws::KMS
6091
6196
  # * RotateKeyOnDemand
6092
6197
  #
6093
6198
  # **Eventual consistency**: The KMS API follows an eventual consistency
6094
- # model. For more information, see [KMS eventual consistency][12].
6199
+ # model. For more information, see [KMS eventual consistency][11].
6095
6200
  #
6096
6201
  #
6097
6202
  #
6098
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
6203
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
6099
6204
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotation-period
6100
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
6101
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
6102
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
6103
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6104
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
6105
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
6106
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
6107
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6108
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6109
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6205
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
6206
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
6207
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6208
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6209
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
6210
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
6211
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6212
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6213
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6110
6214
  #
6111
6215
  # @option params [required, String] :key_id
6112
6216
  # Gets the rotation status for the specified KMS key.
@@ -6180,9 +6284,7 @@ module Aws::KMS
6180
6284
  # By default, KMS keys are created with key material that KMS generates.
6181
6285
  # This operation supports [Importing key material][1], an advanced
6182
6286
  # feature that lets you generate and import the cryptographic key
6183
- # material for a KMS key. For more information about importing key
6184
- # material into KMS, see [Importing key material][1] in the *Key
6185
- # Management Service Developer Guide*.
6287
+ # material for a KMS key.
6186
6288
  #
6187
6289
  # Before calling `GetParametersForImport`, use the CreateKey operation
6188
6290
  # with an `Origin` value of `EXTERNAL` to create a KMS key with no key
@@ -6251,11 +6353,11 @@ module Aws::KMS
6251
6353
  #
6252
6354
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6253
6355
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6254
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
6255
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
6356
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6357
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#reimport-key-material
6256
6358
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6257
6359
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6258
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6360
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6259
6361
  #
6260
6362
  # @option params [required, String] :key_id
6261
6363
  # The identifier of the KMS key that will be associated with the
@@ -6279,9 +6381,8 @@ module Aws::KMS
6279
6381
  # @option params [required, String] :wrapping_algorithm
6280
6382
  # The algorithm you will use with the RSA public key (`PublicKey`) in
6281
6383
  # the response to protect your key material during import. For more
6282
- # information, see [Select a wrapping
6283
- # algorithm](kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm)
6284
- # in the *Key Management Service Developer Guide*.
6384
+ # information, see [Select a wrapping algorithm][1] in the *Key
6385
+ # Management Service Developer Guide*.
6285
6386
  #
6286
6387
  # For RSA\_AES wrapping algorithms, you encrypt your key material with
6287
6388
  # an AES key that you generate, then encrypt your AES key with the RSA
@@ -6313,6 +6414,10 @@ module Aws::KMS
6313
6414
  # * **RSAES\_PKCS1\_V1\_5** (Deprecated) — As of October 10, 2023, KMS
6314
6415
  # does not support the RSAES\_PKCS1\_V1\_5 wrapping algorithm.
6315
6416
  #
6417
+ #
6418
+ #
6419
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm
6420
+ #
6316
6421
  # @option params [required, String] :wrapping_key_spec
6317
6422
  # The type of RSA public key to return in the response. You will use
6318
6423
  # this wrapping key with the specified wrapping algorithm to protect
@@ -6460,8 +6565,9 @@ module Aws::KMS
6460
6565
  # * [KeyUsage][3]: Whether the key is used for encryption, signing, or
6461
6566
  # deriving a shared secret.
6462
6567
  #
6463
- # * [EncryptionAlgorithms][4] or [SigningAlgorithms][5]: A list of the
6464
- # encryption algorithms or the signing algorithms for the key.
6568
+ # * [EncryptionAlgorithms][4], [KeyAgreementAlgorithms][5], or
6569
+ # [SigningAlgorithms][6]: A list of the encryption algorithms, key
6570
+ # agreement algorithms, or signing algorithms for the key.
6465
6571
  #
6466
6572
  # Although KMS cannot enforce these restrictions on external operations,
6467
6573
  # it is crucial that you use this information to prevent the public key
@@ -6474,22 +6580,22 @@ module Aws::KMS
6474
6580
  # To verify a signature outside of KMS with an SM2 public key (China
6475
6581
  # Regions only), you must specify the distinguishing ID. By default, KMS
6476
6582
  # uses `1234567812345678` as the distinguishing ID. For more
6477
- # information, see [Offline verification with SM2 key pairs][6].
6583
+ # information, see [Offline verification with SM2 key pairs][7].
6478
6584
  #
6479
6585
  # The KMS key that you use for this operation must be in a compatible
6480
- # key state. For details, see [Key states of KMS keys][7] in the *Key
6586
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
6481
6587
  # Management Service Developer Guide*.
6482
6588
  #
6483
6589
  # **Cross-account use**: Yes. To perform this operation with a KMS key
6484
6590
  # in a different Amazon Web Services account, specify the key ARN or
6485
6591
  # alias ARN in the value of the `KeyId` parameter.
6486
6592
  #
6487
- # **Required permissions**: [kms:GetPublicKey][8] (key policy)
6593
+ # **Required permissions**: [kms:GetPublicKey][9] (key policy)
6488
6594
  #
6489
6595
  # **Related operations**: CreateKey
6490
6596
  #
6491
6597
  # **Eventual consistency**: The KMS API follows an eventual consistency
6492
- # model. For more information, see [KMS eventual consistency][9].
6598
+ # model. For more information, see [KMS eventual consistency][10].
6493
6599
  #
6494
6600
  #
6495
6601
  #
@@ -6497,11 +6603,12 @@ module Aws::KMS
6497
6603
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeySpec
6498
6604
  # [3]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyUsage
6499
6605
  # [4]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-EncryptionAlgorithms
6500
- # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
6501
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
6502
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6503
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6504
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6606
+ # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyAgreementAlgorithms
6607
+ # [6]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
6608
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
6609
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6610
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6611
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6505
6612
  #
6506
6613
  # @option params [required, String] :key_id
6507
6614
  # Identifies the asymmetric KMS key that includes the public key.
@@ -6536,7 +6643,7 @@ module Aws::KMS
6536
6643
  #
6537
6644
  #
6538
6645
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
6539
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6646
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
6540
6647
  #
6541
6648
  # @return [Types::GetPublicKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
6542
6649
  #
@@ -6584,12 +6691,12 @@ module Aws::KMS
6584
6691
  # resp.key_id #=> String
6585
6692
  # resp.public_key #=> String
6586
6693
  # resp.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
6587
- # resp.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
6694
+ # resp.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
6588
6695
  # resp.key_usage #=> String, one of "SIGN_VERIFY", "ENCRYPT_DECRYPT", "GENERATE_VERIFY_MAC", "KEY_AGREEMENT"
6589
6696
  # resp.encryption_algorithms #=> Array
6590
6697
  # resp.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
6591
6698
  # resp.signing_algorithms #=> Array
6592
- # resp.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
6699
+ # resp.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
6593
6700
  # resp.key_agreement_algorithms #=> Array
6594
6701
  # resp.key_agreement_algorithms[0] #=> String, one of "ECDH"
6595
6702
  #
@@ -6603,53 +6710,47 @@ module Aws::KMS
6603
6710
  end
6604
6711
 
6605
6712
  # Imports or reimports key material into an existing KMS key that was
6606
- # created without key material. `ImportKeyMaterial` also sets the
6607
- # expiration model and expiration date of the imported key material.
6608
- #
6609
- # By default, KMS keys are created with key material that KMS generates.
6610
- # This operation supports [Importing key material][1], an advanced
6611
- # feature that lets you generate and import the cryptographic key
6612
- # material for a KMS key. For more information about importing key
6613
- # material into KMS, see [Importing key material][1] in the *Key
6614
- # Management Service Developer Guide*.
6713
+ # created without key material. You can also use this operation to set
6714
+ # or update the expiration model and expiration date of the imported key
6715
+ # material.
6615
6716
  #
6616
- # After you successfully import key material into a KMS key, you can
6617
- # [reimport the same key material][2] into that KMS key, but you cannot
6618
- # import different key material. You might reimport key material to
6619
- # replace key material that expired or key material that you deleted.
6620
- # You might also reimport key material to change the expiration model or
6621
- # expiration date of the key material.
6717
+ # By default, KMS creates KMS keys with key material that it generates.
6718
+ # You can also generate and import your own key material. For more
6719
+ # information about importing key material, see [Importing key
6720
+ # material][1].
6721
+ #
6722
+ # For asymmetric, HMAC and multi-Region keys, you cannot change the key
6723
+ # material after the initial import. You can import multiple key
6724
+ # materials into single-Region, symmetric encryption keys and rotate the
6725
+ # key material on demand using `RotateKeyOnDemand`.
6726
+ #
6727
+ # After you import key material, you can [reimport the same key
6728
+ # material][2] into that KMS key or, if the key supports on-demand
6729
+ # rotation, import new key material. You can use the `ImportType`
6730
+ # parameter to indicate whether you are importing new key material or
6731
+ # re-importing previously imported key material. You might reimport key
6732
+ # material to replace key material that expired or key material that you
6733
+ # deleted. You might also reimport key material to change the expiration
6734
+ # model or expiration date of the key material.
6622
6735
  #
6623
6736
  # Each time you import key material into KMS, you can determine whether
6624
6737
  # (`ExpirationModel`) and when (`ValidTo`) the key material expires. To
6625
6738
  # change the expiration of your key material, you must import it again,
6626
6739
  # either by calling `ImportKeyMaterial` or using the [import
6627
- # features](kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console)
6628
- # of the KMS console.
6740
+ # features][3] of the KMS console.
6629
6741
  #
6630
- # Before calling `ImportKeyMaterial`:
6742
+ # Before you call `ImportKeyMaterial`, complete these steps:
6631
6743
  #
6632
- # * Create or identify a KMS key with no key material. The KMS key must
6633
- # have an `Origin` value of `EXTERNAL`, which indicates that the KMS
6634
- # key is designed for imported key material.
6744
+ # * Create or identify a KMS key with `EXTERNAL` origin, which indicates
6745
+ # that the KMS key is designed for imported key material.
6635
6746
  #
6636
- # To create an new KMS key for imported key material, call the
6747
+ # To create a new KMS key for imported key material, call the
6637
6748
  # CreateKey operation with an `Origin` value of `EXTERNAL`. You can
6638
6749
  # create a symmetric encryption KMS key, HMAC KMS key, asymmetric
6639
- # encryption KMS key, or asymmetric signing KMS key. You can also
6640
- # import key material into a [multi-Region
6641
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of
6642
- # any supported type. However, you can't import key material into a
6643
- # KMS key in a [custom key
6644
- # store](kms/latest/developerguide/custom-key-store-overview.html).
6645
- #
6646
- # * Use the DescribeKey operation to verify that the `KeyState` of the
6647
- # KMS key is `PendingImport`, which indicates that the KMS key has no
6648
- # key material.
6649
- #
6650
- # If you are reimporting the same key material into an existing KMS
6651
- # key, you might need to call the DeleteImportedKeyMaterial to delete
6652
- # its existing key material.
6750
+ # encryption KMS key, asymmetric key agreement key, or asymmetric
6751
+ # signing KMS key. You can also import key material into a
6752
+ # [multi-Region key][4] of any supported type. However, you can't
6753
+ # import key material into a KMS key in a [custom key store][5].
6653
6754
  #
6654
6755
  # * Call the GetParametersForImport operation to get a public key and
6655
6756
  # import token set for importing key material.
@@ -6664,10 +6765,9 @@ module Aws::KMS
6664
6765
  # * The key ID or key ARN of the KMS key to associate with the imported
6665
6766
  # key material. Its `Origin` must be `EXTERNAL` and its `KeyState`
6666
6767
  # must be `PendingImport`. You cannot perform this operation on a KMS
6667
- # key in a [custom key
6668
- # store](kms/latest/developerguide/custom-key-store-overview.html), or
6669
- # on a KMS key in a different Amazon Web Services account. To get the
6670
- # `Origin` and `KeyState` of a KMS key, call DescribeKey.
6768
+ # key in a [custom key store][5], or on a KMS key in a different
6769
+ # Amazon Web Services account. To get the `Origin` and `KeyState` of a
6770
+ # KMS key, call DescribeKey.
6671
6771
  #
6672
6772
  # * The encrypted key material.
6673
6773
  #
@@ -6677,7 +6777,7 @@ module Aws::KMS
6677
6777
  #
6678
6778
  # * Whether the key material expires (`ExpirationModel`) and, if so,
6679
6779
  # when (`ValidTo`). For help with this choice, see [Setting an
6680
- # expiration time][3] in the *Key Management Service Developer Guide*.
6780
+ # expiration time][6] in the *Key Management Service Developer Guide*.
6681
6781
  #
6682
6782
  # If you set an expiration date, KMS deletes the key material from the
6683
6783
  # KMS key on the specified date, making the KMS key unusable. To use
@@ -6689,23 +6789,27 @@ module Aws::KMS
6689
6789
  #
6690
6790
  # When this operation is successful, the key state of the KMS key
6691
6791
  # changes from `PendingImport` to `Enabled`, and you can use the KMS key
6692
- # in cryptographic operations.
6792
+ # in cryptographic operations. For single-Region, symmetric encryption
6793
+ # keys, you will need to import all of the key materials associated with
6794
+ # the KMS key to change its state to `Enabled`. Use the
6795
+ # `ListKeyRotations` operation to list the ID and import state of each
6796
+ # key material associated with a KMS key.
6693
6797
  #
6694
6798
  # If this operation fails, use the exception to help determine the
6695
6799
  # problem. If the error is related to the key material, the import
6696
6800
  # token, or wrapping key, use GetParametersForImport to get a new public
6697
6801
  # key and import token for the KMS key and repeat the import procedure.
6698
- # For help, see [How To Import Key Material][4] in the *Key Management
6699
- # Service Developer Guide*.
6802
+ # For help, see [Create a KMS key with imported key material][7] in the
6803
+ # *Key Management Service Developer Guide*.
6700
6804
  #
6701
6805
  # The KMS key that you use for this operation must be in a compatible
6702
- # key state. For details, see [Key states of KMS keys][5] in the *Key
6806
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
6703
6807
  # Management Service Developer Guide*.
6704
6808
  #
6705
6809
  # **Cross-account use**: No. You cannot perform this operation on a KMS
6706
6810
  # key in a different Amazon Web Services account.
6707
6811
  #
6708
- # **Required permissions**: [kms:ImportKeyMaterial][6] (key policy)
6812
+ # **Required permissions**: [kms:ImportKeyMaterial][9] (key policy)
6709
6813
  #
6710
6814
  # **Related operations:**
6711
6815
  #
@@ -6713,18 +6817,25 @@ module Aws::KMS
6713
6817
  #
6714
6818
  # * GetParametersForImport
6715
6819
  #
6820
+ # * ListKeyRotations
6821
+ #
6822
+ # * RotateKeyOnDemand
6823
+ #
6716
6824
  # **Eventual consistency**: The KMS API follows an eventual consistency
6717
- # model. For more information, see [KMS eventual consistency][7].
6825
+ # model. For more information, see [KMS eventual consistency][10].
6718
6826
  #
6719
6827
  #
6720
6828
  #
6721
6829
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6722
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
6723
- # [3]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
6724
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#importing-keys-overview
6725
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6726
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6727
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6830
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#reimport-key-material
6831
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console
6832
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6833
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6834
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
6835
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-conceptual.html
6836
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6837
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6838
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6728
6839
  #
6729
6840
  # @option params [required, String] :key_id
6730
6841
  # The identifier of the KMS key that will be associated with the
@@ -6735,11 +6846,9 @@ module Aws::KMS
6735
6846
  #
6736
6847
  # The KMS key can be a symmetric encryption KMS key, HMAC KMS key,
6737
6848
  # asymmetric encryption KMS key, or asymmetric signing KMS key,
6738
- # including a [multi-Region
6739
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of any
6740
- # supported type. You cannot perform this operation on a KMS key in a
6741
- # custom key store, or on a KMS key in a different Amazon Web Services
6742
- # account.
6849
+ # including a [multi-Region key][1] of any supported type. You cannot
6850
+ # perform this operation on a KMS key in a custom key store, or on a KMS
6851
+ # key in a different Amazon Web Services account.
6743
6852
  #
6744
6853
  # Specify the key ID or key ARN of the KMS key.
6745
6854
  #
@@ -6753,6 +6862,10 @@ module Aws::KMS
6753
6862
  # To get the key ID and key ARN for a KMS key, use ListKeys or
6754
6863
  # DescribeKey.
6755
6864
  #
6865
+ #
6866
+ #
6867
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6868
+ #
6756
6869
  # @option params [required, String, StringIO, File] :import_token
6757
6870
  # The import token that you received in the response to a previous
6758
6871
  # GetParametersForImport request. It must be from the same response that
@@ -6797,9 +6910,48 @@ module Aws::KMS
6797
6910
  #
6798
6911
  #
6799
6912
  #
6800
- # [1]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
6913
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
6801
6914
  #
6802
- # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
6915
+ # @option params [String] :import_type
6916
+ # Indicates whether the key material being imported is previously
6917
+ # associated with this KMS key or not. This parameter is optional and
6918
+ # only usable with symmetric encryption keys. If no key material has
6919
+ # ever been imported into the KMS key, and this parameter is omitted,
6920
+ # the parameter defaults to `NEW_KEY_MATERIAL`. After the first key
6921
+ # material is imported, if this parameter is omitted then the parameter
6922
+ # defaults to `EXISTING_KEY_MATERIAL`.
6923
+ #
6924
+ # @option params [String] :key_material_description
6925
+ # Description for the key material being imported. This parameter is
6926
+ # optional and only usable with symmetric encryption keys. If you do not
6927
+ # specify a key material description, KMS retains the value you
6928
+ # specified when you last imported the same key material into this KMS
6929
+ # key.
6930
+ #
6931
+ # @option params [String] :key_material_id
6932
+ # Identifies the key material being imported. This parameter is optional
6933
+ # and only usable with symmetric encryption keys. You cannot specify a
6934
+ # key material ID with `ImportType` set to `NEW_KEY_MATERIAL`. Whenever
6935
+ # you import key material into a symmetric encryption key, KMS assigns a
6936
+ # unique identifier to the key material based on the KMS key ID and the
6937
+ # imported key material. When you re-import key material with a
6938
+ # specified key material ID, KMS:
6939
+ #
6940
+ # * Computes the identifier for the key material
6941
+ #
6942
+ # * Matches the computed identifier against the specified key material
6943
+ # ID
6944
+ #
6945
+ # * Verifies that the key material ID is already associated with the KMS
6946
+ # key
6947
+ #
6948
+ # To get the list of key material IDs associated with a KMS key, use
6949
+ # ListKeyRotations.
6950
+ #
6951
+ # @return [Types::ImportKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
6952
+ #
6953
+ # * {Types::ImportKeyMaterialResponse#key_id #key_id} => String
6954
+ # * {Types::ImportKeyMaterialResponse#key_material_id #key_material_id} => String
6803
6955
  #
6804
6956
  #
6805
6957
  # @example Example: To import key material into a KMS key
@@ -6813,6 +6965,12 @@ module Aws::KMS
6813
6965
  # key_id: "1234abcd-12ab-34cd-56ef-1234567890ab", # The identifier of the KMS key to import the key material into. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
6814
6966
  # })
6815
6967
  #
6968
+ # resp.to_h outputs the following:
6969
+ # {
6970
+ # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The Amazon Resource Name (ARN) of the KMS key into which key material was imported.
6971
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # Identifies the imported key material.
6972
+ # }
6973
+ #
6816
6974
  # @example Example: To import key material into a KMS key
6817
6975
  #
6818
6976
  # # The following example imports key material that expires in 3 days. It might be part of an application that frequently
@@ -6826,6 +6984,12 @@ module Aws::KMS
6826
6984
  # valid_to: Time.parse("2023-09-30T00:00:00-00:00"), # Specifies the date and time when the imported key material expires.
6827
6985
  # })
6828
6986
  #
6987
+ # resp.to_h outputs the following:
6988
+ # {
6989
+ # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The Amazon Resource Name (ARN) of the KMS key into which key material was imported.
6990
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # Identifies the imported key material.
6991
+ # }
6992
+ #
6829
6993
  # @example Request syntax with placeholder values
6830
6994
  #
6831
6995
  # resp = client.import_key_material({
@@ -6834,8 +6998,16 @@ module Aws::KMS
6834
6998
  # encrypted_key_material: "data", # required
6835
6999
  # valid_to: Time.now,
6836
7000
  # expiration_model: "KEY_MATERIAL_EXPIRES", # accepts KEY_MATERIAL_EXPIRES, KEY_MATERIAL_DOES_NOT_EXPIRE
7001
+ # import_type: "NEW_KEY_MATERIAL", # accepts NEW_KEY_MATERIAL, EXISTING_KEY_MATERIAL
7002
+ # key_material_description: "KeyMaterialDescriptionType",
7003
+ # key_material_id: "BackingKeyIdType",
6837
7004
  # })
6838
7005
  #
7006
+ # @example Response structure
7007
+ #
7008
+ # resp.key_id #=> String
7009
+ # resp.key_material_id #=> String
7010
+ #
6839
7011
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterial AWS API Documentation
6840
7012
  #
6841
7013
  # @overload import_key_material(params = {})
@@ -6886,10 +7058,10 @@ module Aws::KMS
6886
7058
  #
6887
7059
  #
6888
7060
  #
6889
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/limits.html#aliases-limit
7061
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/resource-limits.html#aliases-per-key
6890
7062
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6891
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
6892
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7063
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html
7064
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6893
7065
  #
6894
7066
  # @option params [String] :key_id
6895
7067
  # Lists only aliases that are associated with the specified KMS key.
@@ -7021,8 +7193,9 @@ module Aws::KMS
7021
7193
  #
7022
7194
  # For detailed information about grants, including grant terminology,
7023
7195
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
7024
- # Guide</i> </i>. For examples of working with grants in several
7025
- # programming languages, see [Programming grants][2].
7196
+ # Guide</i> </i>. For examples of creating grants in several programming
7197
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
7198
+ # CLI][2].
7026
7199
  #
7027
7200
  # <note markdown="1"> The `GranteePrincipal` field in the `ListGrants` response usually
7028
7201
  # contains the user or role designated as the grantee principal in the
@@ -7055,10 +7228,10 @@ module Aws::KMS
7055
7228
  #
7056
7229
  #
7057
7230
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
7058
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
7231
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
7059
7232
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services
7060
7233
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7061
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7234
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7062
7235
  #
7063
7236
  # @option params [Integer] :limit
7064
7237
  # Use this parameter to specify the maximum number of items to return.
@@ -7234,7 +7407,7 @@ module Aws::KMS
7234
7407
  #
7235
7408
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7236
7409
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
7237
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7410
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7238
7411
  #
7239
7412
  # @option params [required, String] :key_id
7240
7413
  # Gets the names of key policies for the specified KMS key.
@@ -7316,14 +7489,15 @@ module Aws::KMS
7316
7489
  req.send_request(options)
7317
7490
  end
7318
7491
 
7319
- # Returns information about all completed key material rotations for the
7320
- # specified KMS key.
7492
+ # Returns information about the key materials associated with the
7493
+ # specified KMS key. You can use the optional `IncludeKeyMaterial`
7494
+ # parameter to control which key materials are included in the response.
7321
7495
  #
7322
7496
  # You must specify the KMS key in all requests. You can refine the key
7323
7497
  # rotations list by limiting the number of rotations returned.
7324
7498
  #
7325
7499
  # For detailed information about automatic and on-demand key rotations,
7326
- # see [Rotating KMS keys][1] in the *Key Management Service Developer
7500
+ # see [Rotate KMS keys][1] in the *Key Management Service Developer
7327
7501
  # Guide*.
7328
7502
  #
7329
7503
  # **Cross-account use**: No. You cannot perform this operation on a KMS
@@ -7335,10 +7509,14 @@ module Aws::KMS
7335
7509
  #
7336
7510
  # * EnableKeyRotation
7337
7511
  #
7512
+ # * DeleteImportedKeyMaterial
7513
+ #
7338
7514
  # * DisableKeyRotation
7339
7515
  #
7340
7516
  # * GetKeyRotationStatus
7341
7517
  #
7518
+ # * ImportKeyMaterial
7519
+ #
7342
7520
  # * RotateKeyOnDemand
7343
7521
  #
7344
7522
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -7348,7 +7526,7 @@ module Aws::KMS
7348
7526
  #
7349
7527
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
7350
7528
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7351
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7529
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7352
7530
  #
7353
7531
  # @option params [required, String] :key_id
7354
7532
  # Gets the key rotations for the specified KMS key.
@@ -7365,6 +7543,16 @@ module Aws::KMS
7365
7543
  # To get the key ID and key ARN for a KMS key, use ListKeys or
7366
7544
  # DescribeKey.
7367
7545
  #
7546
+ # @option params [String] :include_key_material
7547
+ # Use this optional parameter to control which key materials associated
7548
+ # with this key are listed in the response. The default value of this
7549
+ # parameter is `ROTATIONS_ONLY`. If you omit this parameter, KMS returns
7550
+ # information on the key materials created by automatic or on-demand key
7551
+ # rotation. When you specify a value of `ALL_KEY_MATERIAL`, KMS adds the
7552
+ # first key material and any imported key material pending rotation to
7553
+ # the response. This parameter can only be used with KMS keys that
7554
+ # support automatic or on-demand key rotation.
7555
+ #
7368
7556
  # @option params [Integer] :limit
7369
7557
  # Use this parameter to specify the maximum number of items to return.
7370
7558
  # When this value is present, KMS does not return more than the
@@ -7417,6 +7605,7 @@ module Aws::KMS
7417
7605
  #
7418
7606
  # resp = client.list_key_rotations({
7419
7607
  # key_id: "KeyIdType", # required
7608
+ # include_key_material: "ALL_KEY_MATERIAL", # accepts ALL_KEY_MATERIAL, ROTATIONS_ONLY
7420
7609
  # limit: 1,
7421
7610
  # marker: "MarkerType",
7422
7611
  # })
@@ -7425,6 +7614,12 @@ module Aws::KMS
7425
7614
  #
7426
7615
  # resp.rotations #=> Array
7427
7616
  # resp.rotations[0].key_id #=> String
7617
+ # resp.rotations[0].key_material_id #=> String
7618
+ # resp.rotations[0].key_material_description #=> String
7619
+ # resp.rotations[0].import_state #=> String, one of "IMPORTED", "PENDING_IMPORT"
7620
+ # resp.rotations[0].key_material_state #=> String, one of "NON_CURRENT", "CURRENT", "PENDING_ROTATION"
7621
+ # resp.rotations[0].expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
7622
+ # resp.rotations[0].valid_to #=> Time
7428
7623
  # resp.rotations[0].rotation_date #=> Time
7429
7624
  # resp.rotations[0].rotation_type #=> String, one of "AUTOMATIC", "ON_DEMAND"
7430
7625
  # resp.next_marker #=> String
@@ -7463,7 +7658,7 @@ module Aws::KMS
7463
7658
  #
7464
7659
  #
7465
7660
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7466
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7661
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7467
7662
  #
7468
7663
  # @option params [Integer] :limit
7469
7664
  # Use this parameter to specify the maximum number of items to return.
@@ -7559,7 +7754,7 @@ module Aws::KMS
7559
7754
  # For general information about tags, including the format and syntax,
7560
7755
  # see [Tagging Amazon Web Services resources][1] in the *Amazon Web
7561
7756
  # Services General Reference*. For information about using tags in KMS,
7562
- # see [Tagging keys][2].
7757
+ # see [Tags in KMS][2].
7563
7758
  #
7564
7759
  # **Cross-account use**: No. You cannot perform this operation on a KMS
7565
7760
  # key in a different Amazon Web Services account.
@@ -7584,7 +7779,7 @@ module Aws::KMS
7584
7779
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
7585
7780
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
7586
7781
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7587
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7782
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7588
7783
  #
7589
7784
  # @option params [required, String] :key_id
7590
7785
  # Gets tags on the specified KMS key.
@@ -7689,8 +7884,9 @@ module Aws::KMS
7689
7884
  #
7690
7885
  # For detailed information about grants, including grant terminology,
7691
7886
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
7692
- # Guide</i> </i>. For examples of working with grants in several
7693
- # programming languages, see [Programming grants][2].
7887
+ # Guide</i> </i>. For examples of creating grants in several programming
7888
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
7889
+ # CLI][2].
7694
7890
  #
7695
7891
  # **Cross-account use**: You must specify a principal in your Amazon Web
7696
7892
  # Services account. This operation returns a list of grants where the
@@ -7728,9 +7924,9 @@ module Aws::KMS
7728
7924
  #
7729
7925
  #
7730
7926
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
7731
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
7927
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
7732
7928
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7733
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7929
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7734
7930
  #
7735
7931
  # @option params [Integer] :limit
7736
7932
  # Use this parameter to specify the maximum number of items to return.
@@ -7840,8 +8036,9 @@ module Aws::KMS
7840
8036
  # formatting a JSON policy document, see the [IAM JSON Policy
7841
8037
  # Reference][2] in the <i> <i>Identity and Access Management User
7842
8038
  # Guide</i> </i>. For examples of adding a key policy in multiple
7843
- # programming languages, see [Setting a key policy][3] in the *Key
7844
- # Management Service Developer Guide*.
8039
+ # programming languages, see [Use PutKeyPolicy with an Amazon Web
8040
+ # Services SDK or CLI][3] in the *Key Management Service Developer
8041
+ # Guide*.
7845
8042
  #
7846
8043
  # **Cross-account use**: No. You cannot perform this operation on a KMS
7847
8044
  # key in a different Amazon Web Services account.
@@ -7857,9 +8054,9 @@ module Aws::KMS
7857
8054
  #
7858
8055
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
7859
8056
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
7860
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-key-policies.html#put-policy
8057
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_PutKeyPolicy_section.html
7861
8058
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7862
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8059
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7863
8060
  #
7864
8061
  # @option params [required, String] :key_id
7865
8062
  # Sets the key policy on the specified KMS key.
@@ -7900,6 +8097,17 @@ module Aws::KMS
7900
8097
  # not always immediately visible][2] in the *Amazon Web Services
7901
8098
  # Identity and Access Management User Guide*.
7902
8099
  #
8100
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are missing
8101
+ # from a key policy statement, the policy statement has no effect. When
8102
+ # a key policy statement is missing one of these elements, the KMS
8103
+ # console correctly reports an error, but the `PutKeyPolicy` API request
8104
+ # succeeds, even though the policy statement is ineffective.
8105
+ #
8106
+ # For more information on required key policy elements, see [Elements in
8107
+ # a key policy][3] in the *Key Management Service Developer Guide*.
8108
+ #
8109
+ # </note>
8110
+ #
7903
8111
  # A key policy document can include only the following characters:
7904
8112
  #
7905
8113
  # * Printable ASCII characters from the space character (`\u0020`)
@@ -7911,18 +8119,24 @@ module Aws::KMS
7911
8119
  # * The tab (`\u0009`), line feed (`\u000A`), and carriage return
7912
8120
  # (`\u000D`) special characters
7913
8121
  #
7914
- # For information about key policies, see [Key policies in KMS][3] in
8122
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
8123
+ # `LimitExceededException`.
8124
+ #
8125
+ # </note>
8126
+ #
8127
+ # For information about key policies, see [Key policies in KMS][4] in
7915
8128
  # the *Key Management Service Developer Guide*.For help writing and
7916
8129
  # formatting a JSON policy document, see the [IAM JSON Policy
7917
- # Reference][4] in the <i> <i>Identity and Access Management User
8130
+ # Reference][5] in the <i> <i>Identity and Access Management User
7918
8131
  # Guide</i> </i>.
7919
8132
  #
7920
8133
  #
7921
8134
  #
7922
8135
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
7923
8136
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
7924
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
7925
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
8137
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
8138
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8139
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
7926
8140
  #
7927
8141
  # @option params [Boolean] :bypass_policy_lockout_safety_check
7928
8142
  # Skips ("bypasses") the key policy lockout safety check. The default
@@ -8071,15 +8285,15 @@ module Aws::KMS
8071
8285
  #
8072
8286
  #
8073
8287
  #
8074
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-manually
8075
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8076
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#asymmetric-cmks
8288
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys-manually.html
8289
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8290
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
8077
8291
  # [4]: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/
8078
8292
  # [5]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
8079
8293
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8080
8294
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8081
8295
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8082
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8296
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8083
8297
  #
8084
8298
  # @option params [required, String, StringIO, File] :ciphertext_blob
8085
8299
  # Ciphertext of the data to reencrypt.
@@ -8102,7 +8316,7 @@ module Aws::KMS
8102
8316
  #
8103
8317
  #
8104
8318
  #
8105
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8319
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8106
8320
  #
8107
8321
  # @option params [String] :source_key_id
8108
8322
  # Specifies the KMS key that KMS will use to decrypt the ciphertext
@@ -8188,7 +8402,7 @@ module Aws::KMS
8188
8402
  #
8189
8403
  #
8190
8404
  #
8191
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8405
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8192
8406
  #
8193
8407
  # @option params [String] :source_encryption_algorithm
8194
8408
  # Specifies the encryption algorithm that KMS will use to decrypt the
@@ -8222,18 +8436,18 @@ module Aws::KMS
8222
8436
  #
8223
8437
  #
8224
8438
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
8225
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
8439
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
8226
8440
  #
8227
8441
  # @option params [Boolean] :dry_run
8228
8442
  # Checks if your request will succeed. `DryRun` is an optional
8229
8443
  # parameter.
8230
8444
  #
8231
- # To learn more about how to use this parameter, see [Testing your KMS
8232
- # API calls][1] in the *Key Management Service Developer Guide*.
8445
+ # To learn more about how to use this parameter, see [Testing your
8446
+ # permissions][1] in the *Key Management Service Developer Guide*.
8233
8447
  #
8234
8448
  #
8235
8449
  #
8236
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
8450
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8237
8451
  #
8238
8452
  # @return [Types::ReEncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
8239
8453
  #
@@ -8242,6 +8456,8 @@ module Aws::KMS
8242
8456
  # * {Types::ReEncryptResponse#key_id #key_id} => String
8243
8457
  # * {Types::ReEncryptResponse#source_encryption_algorithm #source_encryption_algorithm} => String
8244
8458
  # * {Types::ReEncryptResponse#destination_encryption_algorithm #destination_encryption_algorithm} => String
8459
+ # * {Types::ReEncryptResponse#source_key_material_id #source_key_material_id} => String
8460
+ # * {Types::ReEncryptResponse#destination_key_material_id #destination_key_material_id} => String
8245
8461
  #
8246
8462
  #
8247
8463
  # @example Example: To reencrypt data
@@ -8256,8 +8472,12 @@ module Aws::KMS
8256
8472
  # resp.to_h outputs the following:
8257
8473
  # {
8258
8474
  # ciphertext_blob: "<binary data>", # The reencrypted data.
8475
+ # destination_encryption_algorithm: "SYMMETRIC_DEFAULT", # The encryption algorithm that was used to reencrypt the data.
8476
+ # destination_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to reencrypt the data.
8259
8477
  # key_id: "arn:aws:kms:us-east-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321", # The ARN of the KMS key that was used to reencrypt the data.
8478
+ # source_encryption_algorithm: "SYMMETRIC_DEFAULT", # The encryption algorithm that was used to decrypt the ciphertext before it was reencrypted.
8260
8479
  # source_key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the KMS key that was originally used to encrypt the data.
8480
+ # source_key_material_id: "1c6be7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to originally encrypt the data.
8261
8481
  # }
8262
8482
  #
8263
8483
  # @example Request syntax with placeholder values
@@ -8285,6 +8505,8 @@ module Aws::KMS
8285
8505
  # resp.key_id #=> String
8286
8506
  # resp.source_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8287
8507
  # resp.destination_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8508
+ # resp.source_key_material_id #=> String
8509
+ # resp.destination_key_material_id #=> String
8288
8510
  #
8289
8511
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncrypt AWS API Documentation
8290
8512
  #
@@ -8316,12 +8538,12 @@ module Aws::KMS
8316
8538
  # independently of its primary and peer replica keys. A primary key and
8317
8539
  # its replica keys share properties that make them interoperable. They
8318
8540
  # have the same [key ID][2] and key material. They also have the same
8319
- # [key spec][3], [key usage][4], [key material origin][5], and
8320
- # [automatic key rotation status][6]. KMS automatically synchronizes
8321
- # these shared properties among related multi-Region keys. All other
8322
- # properties of a replica key can differ, including its [key policy][7],
8323
- # [tags][8], [aliases][9], and [Key states of KMS keys][10]. KMS pricing
8324
- # and quotas for KMS keys apply to each primary key and replica key.
8541
+ # key spec, key usage, key material origin, and automatic key rotation
8542
+ # status. KMS automatically synchronizes these shared properties among
8543
+ # related multi-Region keys. All other properties of a replica key can
8544
+ # differ, including its [key policy][3], [tags][4], [aliases][5], and
8545
+ # [key state][6]. KMS pricing and quotas for KMS keys apply to each
8546
+ # primary key and replica key.
8325
8547
  #
8326
8548
  # When this operation completes, the new replica key has a transient key
8327
8549
  # state of `Creating`. This key state changes to `Enabled` (or
@@ -8331,7 +8553,7 @@ module Aws::KMS
8331
8553
  # If you are creating and using the replica key programmatically, retry
8332
8554
  # on `KMSInvalidStateException` or call `DescribeKey` to check its
8333
8555
  # `KeyState` value before using it. For details about the `Creating` key
8334
- # state, see [Key states of KMS keys][10] in the *Key Management Service
8556
+ # state, see [Key states of KMS keys][6] in the *Key Management Service
8335
8557
  # Developer Guide*.
8336
8558
  #
8337
8559
  # You cannot create more than one replica of a primary key in any
@@ -8340,7 +8562,7 @@ module Aws::KMS
8340
8562
  # `AlreadyExistsException` error. If the key state of the existing
8341
8563
  # replica is `PendingDeletion`, you can cancel the scheduled key
8342
8564
  # deletion (CancelKeyDeletion) or wait for the key to be deleted. The
8343
- # new replica key you create will have the same [shared properties][11]
8565
+ # new replica key you create will have the same [shared properties][7]
8344
8566
  # as the original replica key.
8345
8567
  #
8346
8568
  # The CloudTrail log of a `ReplicateKey` operation records a
@@ -8350,8 +8572,6 @@ module Aws::KMS
8350
8572
  # If you replicate a multi-Region primary key with imported key
8351
8573
  # material, the replica key is created with no key material. You must
8352
8574
  # import the same key material that you imported into the primary key.
8353
- # For details, see [Importing key material into multi-Region keys][12]
8354
- # in the *Key Management Service Developer Guide*.
8355
8575
  #
8356
8576
  # To convert a replica key to a primary key, use the UpdatePrimaryRegion
8357
8577
  # operation.
@@ -8382,23 +8602,18 @@ module Aws::KMS
8382
8602
  # * UpdatePrimaryRegion
8383
8603
  #
8384
8604
  # **Eventual consistency**: The KMS API follows an eventual consistency
8385
- # model. For more information, see [KMS eventual consistency][13].
8605
+ # model. For more information, see [KMS eventual consistency][8].
8386
8606
  #
8387
8607
  #
8388
8608
  #
8389
8609
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
8390
8610
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id
8391
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec
8392
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-usage
8393
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-origin
8394
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
8395
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8396
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
8397
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
8398
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8399
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties
8400
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html
8401
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8611
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8612
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
8613
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
8614
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8615
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties
8616
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8402
8617
  #
8403
8618
  # @option params [required, String] :key_id
8404
8619
  # Identifies the multi-Region primary key that is being replicated. To
@@ -8426,33 +8641,23 @@ module Aws::KMS
8426
8641
  # [KMS service endpoints][1] in the *Amazon Web Services General
8427
8642
  # Reference*.
8428
8643
  #
8429
- # <note markdown="1"> HMAC KMS keys are not supported in all Amazon Web Services Regions. If
8430
- # you try to replicate an HMAC KMS key in an Amazon Web Services Region
8431
- # in which HMAC keys are not supported, the `ReplicateKey` operation
8432
- # returns an `UnsupportedOperationException`. For a list of Regions in
8433
- # which HMAC KMS keys are supported, see [HMAC keys in KMS][2] in the
8434
- # *Key Management Service Developer Guide*.
8435
- #
8436
- # </note>
8437
- #
8438
8644
  # The replica must be in a different Amazon Web Services Region than its
8439
8645
  # primary key and other replicas of that primary key, but in the same
8440
8646
  # Amazon Web Services partition. KMS must be available in the replica
8441
8647
  # Region. If the Region is not enabled by default, the Amazon Web
8442
8648
  # Services account must be enabled in the Region. For information about
8443
- # Amazon Web Services partitions, see [Amazon Resource Names (ARNs)][3]
8649
+ # Amazon Web Services partitions, see [Amazon Resource Names (ARNs)][2]
8444
8650
  # in the *Amazon Web Services General Reference*. For information about
8445
- # enabling and disabling Regions, see [Enabling a Region][4] and
8446
- # [Disabling a Region][5] in the *Amazon Web Services General
8651
+ # enabling and disabling Regions, see [Enabling a Region][3] and
8652
+ # [Disabling a Region][4] in the *Amazon Web Services General
8447
8653
  # Reference*.
8448
8654
  #
8449
8655
  #
8450
8656
  #
8451
8657
  # [1]: https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region
8452
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
8453
- # [3]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
8454
- # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
8455
- # [5]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
8658
+ # [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
8659
+ # [3]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
8660
+ # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
8456
8661
  #
8457
8662
  # @option params [String] :policy
8458
8663
  # The key policy to attach to the KMS key. This parameter is optional.
@@ -8500,7 +8705,7 @@ module Aws::KMS
8500
8705
  #
8501
8706
  #
8502
8707
  #
8503
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
8708
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
8504
8709
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
8505
8710
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
8506
8711
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
@@ -8569,7 +8774,7 @@ module Aws::KMS
8569
8774
  # When you add tags to an Amazon Web Services resource, Amazon Web
8570
8775
  # Services generates a cost allocation report with usage and costs
8571
8776
  # aggregated by tags. Tags can also be used to control access to a KMS
8572
- # key. For details, see [Tagging Keys][3].
8777
+ # key. For details, see [Tags in KMS][3].
8573
8778
  #
8574
8779
  #
8575
8780
  #
@@ -8664,11 +8869,11 @@ module Aws::KMS
8664
8869
  # resp.replica_key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
8665
8870
  # resp.replica_key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
8666
8871
  # resp.replica_key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
8667
- # resp.replica_key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
8872
+ # resp.replica_key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
8668
8873
  # resp.replica_key_metadata.encryption_algorithms #=> Array
8669
8874
  # resp.replica_key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8670
8875
  # resp.replica_key_metadata.signing_algorithms #=> Array
8671
- # resp.replica_key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
8876
+ # resp.replica_key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
8672
8877
  # resp.replica_key_metadata.key_agreement_algorithms #=> Array
8673
8878
  # resp.replica_key_metadata.key_agreement_algorithms[0] #=> String, one of "ECDH"
8674
8879
  # resp.replica_key_metadata.multi_region #=> Boolean
@@ -8682,6 +8887,7 @@ module Aws::KMS
8682
8887
  # resp.replica_key_metadata.mac_algorithms #=> Array
8683
8888
  # resp.replica_key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
8684
8889
  # resp.replica_key_metadata.xks_key_configuration.id #=> String
8890
+ # resp.replica_key_metadata.current_key_material_id #=> String
8685
8891
  # resp.replica_policy #=> String
8686
8892
  # resp.replica_tags #=> Array
8687
8893
  # resp.replica_tags[0].tag_key #=> String
@@ -8705,20 +8911,20 @@ module Aws::KMS
8705
8911
  # by the *grantee principal* if the grant allows the `RetireGrant`
8706
8912
  # operation, and by the Amazon Web Services account in which the grant
8707
8913
  # is created. It can also be called by principals to whom permission for
8708
- # retiring a grant is delegated. For details, see [Retiring and revoking
8709
- # grants][2] in the *Key Management Service Developer Guide*.
8914
+ # retiring a grant is delegated.
8710
8915
  #
8711
8916
  # For detailed information about grants, including grant terminology,
8712
- # see [Grants in KMS][3] in the <i> <i>Key Management Service Developer
8713
- # Guide</i> </i>. For examples of working with grants in several
8714
- # programming languages, see [Programming grants][4].
8917
+ # see [Grants in KMS][2] in the <i> <i>Key Management Service Developer
8918
+ # Guide</i> </i>. For examples of creating grants in several programming
8919
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
8920
+ # CLI][3].
8715
8921
  #
8716
8922
  # **Cross-account use**: Yes. You can retire a grant on a KMS key in a
8717
8923
  # different Amazon Web Services account.
8718
8924
  #
8719
8925
  # **Required permissions**: Permission to retire a grant is determined
8720
8926
  # primarily by the grant. For details, see [Retiring and revoking
8721
- # grants][2] in the *Key Management Service Developer Guide*.
8927
+ # grants][4] in the *Key Management Service Developer Guide*.
8722
8928
  #
8723
8929
  # **Related operations:**
8724
8930
  #
@@ -8736,10 +8942,10 @@ module Aws::KMS
8736
8942
  #
8737
8943
  #
8738
8944
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
8739
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
8740
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8741
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
8742
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8945
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8946
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
8947
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
8948
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8743
8949
  #
8744
8950
  # @option params [String] :grant_token
8745
8951
  # Identifies the grant to be retired. You can use a grant token to
@@ -8774,12 +8980,12 @@ module Aws::KMS
8774
8980
  # Checks if your request will succeed. `DryRun` is an optional
8775
8981
  # parameter.
8776
8982
  #
8777
- # To learn more about how to use this parameter, see [Testing your KMS
8778
- # API calls][1] in the *Key Management Service Developer Guide*.
8983
+ # To learn more about how to use this parameter, see [Testing your
8984
+ # permissions][1] in the *Key Management Service Developer Guide*.
8779
8985
  #
8780
8986
  #
8781
8987
  #
8782
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
8988
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8783
8989
  #
8784
8990
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
8785
8991
  #
@@ -8824,8 +9030,9 @@ module Aws::KMS
8824
9030
  #
8825
9031
  # For detailed information about grants, including grant terminology,
8826
9032
  # see [Grants in KMS][3] in the <i> <i>Key Management Service Developer
8827
- # Guide</i> </i>. For examples of working with grants in several
8828
- # programming languages, see [Programming grants][4].
9033
+ # Guide</i> </i>. For examples of creating grants in several programming
9034
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
9035
+ # CLI][4].
8829
9036
  #
8830
9037
  # **Cross-account use**: Yes. To perform this operation on a KMS key in
8831
9038
  # a different Amazon Web Services account, specify the key ARN in the
@@ -8848,12 +9055,12 @@ module Aws::KMS
8848
9055
  #
8849
9056
  #
8850
9057
  #
8851
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
9058
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
8852
9059
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-eventual-consistency
8853
9060
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8854
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
9061
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
8855
9062
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8856
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9063
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8857
9064
  #
8858
9065
  # @option params [required, String] :key_id
8859
9066
  # A unique identifier for the KMS key associated with the grant. To get
@@ -8880,12 +9087,12 @@ module Aws::KMS
8880
9087
  # Checks if your request will succeed. `DryRun` is an optional
8881
9088
  # parameter.
8882
9089
  #
8883
- # To learn more about how to use this parameter, see [Testing your KMS
8884
- # API calls][1] in the *Key Management Service Developer Guide*.
9090
+ # To learn more about how to use this parameter, see [Testing your
9091
+ # permissions][1] in the *Key Management Service Developer Guide*.
8885
9092
  #
8886
9093
  #
8887
9094
  #
8888
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
9095
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8889
9096
  #
8890
9097
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
8891
9098
  #
@@ -8941,10 +9148,15 @@ module Aws::KMS
8941
9148
  # of the key material for your KMS keys in CloudTrail and Amazon
8942
9149
  # CloudWatch.
8943
9150
  #
8944
- # On-demand key rotation is supported only on [symmetric encryption KMS
8945
- # keys][3]. You cannot perform on-demand rotation of [asymmetric KMS
8946
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
8947
- # material][6], or KMS keys in a [custom key store][7]. To perform
9151
+ # On-demand key rotation is supported only on symmetric encryption KMS
9152
+ # keys. You cannot perform on-demand rotation of [asymmetric KMS
9153
+ # keys][3], [HMAC KMS keys][4], multi-Region KMS keys with [imported key
9154
+ # material][5], or KMS keys in a [custom key store][6]. When you
9155
+ # initiate on-demand key rotation on a symmetric encryption KMS key with
9156
+ # imported key material, you must have already imported [new key
9157
+ # material][7] and that key material's state should be
9158
+ # `PENDING_ROTATION`. Use the `ListKeyRotations` operation to check the
9159
+ # state of all key materials associated with a KMS key. To perform
8948
9160
  # on-demand rotation of a set of related [multi-Region keys][8], invoke
8949
9161
  # the on-demand rotation on the primary key.
8950
9162
  #
@@ -8971,6 +9183,8 @@ module Aws::KMS
8971
9183
  #
8972
9184
  # * GetKeyRotationStatus
8973
9185
  #
9186
+ # * ImportKeyMaterial
9187
+ #
8974
9188
  # * ListKeyRotations
8975
9189
  #
8976
9190
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -8978,27 +9192,27 @@ module Aws::KMS
8978
9192
  #
8979
9193
  #
8980
9194
  #
8981
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-on-demand
8982
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
8983
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
8984
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
8985
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
8986
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
8987
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
8988
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
8989
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
8990
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
9195
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html
9196
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
9197
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9198
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
9199
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
9200
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9201
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html
9202
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
9203
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
9204
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key
8991
9205
  # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8992
9206
  # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8993
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9207
+ # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8994
9208
  #
8995
9209
  # @option params [required, String] :key_id
8996
9210
  # Identifies a symmetric encryption KMS key. You cannot perform
8997
9211
  # on-demand rotation of [asymmetric KMS keys][1], [HMAC KMS keys][2],
8998
- # KMS keys with [imported key material][3], or KMS keys in a [custom key
8999
- # store][4]. To perform on-demand rotation of a set of related
9000
- # [multi-Region keys][5], invoke the on-demand rotation on the primary
9001
- # key.
9212
+ # multi-Region KMS keys with [imported key material][3], or KMS keys in
9213
+ # a [custom key store][4]. To perform on-demand rotation of a set of
9214
+ # related [multi-Region keys][5], invoke the on-demand rotation on the
9215
+ # primary key.
9002
9216
  #
9003
9217
  # Specify the key ID or key ARN of the KMS key.
9004
9218
  #
@@ -9017,8 +9231,8 @@ module Aws::KMS
9017
9231
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9018
9232
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
9019
9233
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
9020
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
9021
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
9234
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9235
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
9022
9236
  #
9023
9237
  # @return [Types::RotateKeyOnDemandResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
9024
9238
  #
@@ -9072,9 +9286,8 @@ module Aws::KMS
9072
9286
  # operation. When a KMS key is deleted, all data that was encrypted
9073
9287
  # under the KMS key is unrecoverable. (The only exception is a
9074
9288
  # [multi-Region replica key][1], or an [asymmetric or HMAC KMS key with
9075
- # imported key
9076
- # material](kms/latest/developerguide/importing-keys-managing.html#import-delete-key).)
9077
- # To prevent the use of a KMS key without deleting it, use DisableKey.
9289
+ # imported key material][2].) To prevent the use of a KMS key without
9290
+ # deleting it, use DisableKey.
9078
9291
  #
9079
9292
  # You can schedule the deletion of a multi-Region primary key and its
9080
9293
  # replica keys at any time. However, KMS will not delete a multi-Region
@@ -9085,13 +9298,13 @@ module Aws::KMS
9085
9298
  # the last of its replicas keys is deleted (not just scheduled), the key
9086
9299
  # state of the primary key changes to `PendingDeletion` and its waiting
9087
9300
  # period (`PendingWindowInDays`) begins. For details, see [Deleting
9088
- # multi-Region keys][1] in the *Key Management Service Developer Guide*.
9301
+ # multi-Region keys][3] in the *Key Management Service Developer Guide*.
9089
9302
  #
9090
- # When KMS [deletes a KMS key from an CloudHSM key store][2], it makes a
9303
+ # When KMS [deletes a KMS key from an CloudHSM key store][4], it makes a
9091
9304
  # best effort to delete the associated key material from the associated
9092
9305
  # CloudHSM cluster. However, you might need to manually [delete the
9093
- # orphaned key material][3] from the cluster and its backups. [Deleting
9094
- # a KMS key from an external key store][4] has no effect on the
9306
+ # orphaned key material][5] from the cluster and its backups. [Deleting
9307
+ # a KMS key from an external key store][6] has no effect on the
9095
9308
  # associated external key. However, for both types of custom key stores,
9096
9309
  # deleting a KMS key is destructive and irreversible. You cannot decrypt
9097
9310
  # ciphertext encrypted under the KMS key by using only its associated
@@ -9100,11 +9313,11 @@ module Aws::KMS
9100
9313
  # material.
9101
9314
  #
9102
9315
  # For more information about scheduling a KMS key for deletion, see
9103
- # [Deleting KMS keys][5] in the *Key Management Service Developer
9316
+ # [Deleting KMS keys][7] in the *Key Management Service Developer
9104
9317
  # Guide*.
9105
9318
  #
9106
9319
  # The KMS key that you use for this operation must be in a compatible
9107
- # key state. For details, see [Key states of KMS keys][6] in the *Key
9320
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
9108
9321
  # Management Service Developer Guide*.
9109
9322
  #
9110
9323
  # **Cross-account use**: No. You cannot perform this operation on a KMS
@@ -9119,17 +9332,19 @@ module Aws::KMS
9119
9332
  # * DisableKey
9120
9333
  #
9121
9334
  # **Eventual consistency**: The KMS API follows an eventual consistency
9122
- # model. For more information, see [KMS eventual consistency][7].
9335
+ # model. For more information, see [KMS eventual consistency][9].
9123
9336
  #
9124
9337
  #
9125
9338
  #
9126
9339
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-delete.html
9127
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/delete-cmk-keystore.html
9128
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
9129
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/delete-xks-key.html
9130
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
9131
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9132
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9340
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#import-delete-key
9341
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#deleting-mrks
9342
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#delete-cmk-keystore
9343
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
9344
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#delete-xks-key
9345
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
9346
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9347
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9133
9348
  #
9134
9349
  # @option params [required, String] :key_id
9135
9350
  # The unique identifier of the KMS key to delete.
@@ -9218,11 +9433,11 @@ module Aws::KMS
9218
9433
  # Developer Guide*.
9219
9434
  #
9220
9435
  # Digital signatures are generated and verified by using asymmetric key
9221
- # pair, such as an RSA or ECC pair that is represented by an asymmetric
9222
- # KMS key. The key owner (or an authorized user) uses their private key
9223
- # to sign a message. Anyone with the public key can verify that the
9224
- # message was signed with that particular private key and that the
9225
- # message hasn't changed since it was signed.
9436
+ # pair, such as an RSA, ECC, or ML-DSA pair that is represented by an
9437
+ # asymmetric KMS key. The key owner (or an authorized user) uses their
9438
+ # private key to sign a message. Anyone with the public key can verify
9439
+ # that the message was signed with that particular private key and that
9440
+ # the message hasn't changed since it was signed.
9226
9441
  #
9227
9442
  # To use the `Sign` operation, provide the following information:
9228
9443
  #
@@ -9235,8 +9450,8 @@ module Aws::KMS
9235
9450
  # to sign. You can submit messages of up to 4096 bytes. To sign a
9236
9451
  # larger message, generate a hash digest of the message, and then
9237
9452
  # provide the hash digest in the `Message` parameter. To indicate
9238
- # whether the message is a full message or a digest, use the
9239
- # `MessageType` parameter.
9453
+ # whether the message is a full message, a digest, or an ML-DSA
9454
+ # EXTERNAL\_MU, use the `MessageType` parameter.
9240
9455
  #
9241
9456
  # * Choose a signing algorithm that is compatible with the KMS key.
9242
9457
  #
@@ -9278,7 +9493,7 @@ module Aws::KMS
9278
9493
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9279
9494
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9280
9495
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9281
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9496
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9282
9497
  #
9283
9498
  # @option params [required, String] :key_id
9284
9499
  # Identifies an asymmetric KMS key. KMS uses the private key in the
@@ -9316,26 +9531,34 @@ module Aws::KMS
9316
9531
  # @option params [String] :message_type
9317
9532
  # Tells KMS whether the value of the `Message` parameter should be
9318
9533
  # hashed as part of the signing algorithm. Use `RAW` for unhashed
9319
- # messages; use `DIGEST` for message digests, which are already hashed.
9534
+ # messages; use `DIGEST` for message digests, which are already hashed;
9535
+ # use `EXTERNAL_MU` for 64-byte representative μ used in ML-DSA signing
9536
+ # as defined in NIST FIPS 204 Section 6.2.
9320
9537
  #
9321
9538
  # When the value of `MessageType` is `RAW`, KMS uses the standard
9322
9539
  # signing algorithm, which begins with a hash function. When the value
9323
- # is `DIGEST`, KMS skips the hashing step in the signing algorithm.
9540
+ # is `DIGEST`, KMS skips the hashing step in the signing algorithm. When
9541
+ # the value is `EXTERNAL_MU` KMS skips the concatenated hashing of the
9542
+ # public key hash and the message done in the ML-DSA signing algorithm.
9324
9543
  #
9325
- # Use the `DIGEST` value only when the value of the `Message` parameter
9326
- # is a message digest. If you use the `DIGEST` value with an unhashed
9327
- # message, the security of the signing operation can be compromised.
9544
+ # Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
9545
+ # `Message` parameter is a message digest. If you use the `DIGEST` value
9546
+ # with an unhashed message, the security of the signing operation can be
9547
+ # compromised.
9328
9548
  #
9329
- # When the value of `MessageType`is `DIGEST`, the length of the
9549
+ # When the value of `MessageType` is `DIGEST`, the length of the
9330
9550
  # `Message` value must match the length of hashed messages for the
9331
9551
  # specified signing algorithm.
9332
9552
  #
9553
+ # When the value of `MessageType` is `EXTERNAL_MU` the length of the
9554
+ # `Message` value must be 64 bytes.
9555
+ #
9333
9556
  # You can submit a message digest and omit the `MessageType` or specify
9334
9557
  # `RAW` so the digest is hashed again while signing. However, this can
9335
9558
  # cause verification failures when verifying with a system that assumes
9336
9559
  # a single hash.
9337
9560
  #
9338
- # The hashing algorithm in that `Sign` uses is based on the
9561
+ # The hashing algorithm that `Sign` uses is based on the
9339
9562
  # `SigningAlgorithm` value.
9340
9563
  #
9341
9564
  # * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
@@ -9347,12 +9570,15 @@ module Aws::KMS
9347
9570
  # * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
9348
9571
  # algorithm.
9349
9572
  #
9573
+ # * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256 hashing
9574
+ # algorithm.
9575
+ #
9350
9576
  # * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
9351
9577
  # verification with SM2 key pairs][1].
9352
9578
  #
9353
9579
  #
9354
9580
  #
9355
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
9581
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
9356
9582
  #
9357
9583
  # @option params [Array<String>] :grant_tokens
9358
9584
  # A list of grant tokens.
@@ -9365,7 +9591,7 @@ module Aws::KMS
9365
9591
  #
9366
9592
  #
9367
9593
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
9368
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
9594
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
9369
9595
  #
9370
9596
  # @option params [required, String] :signing_algorithm
9371
9597
  # Specifies the signing algorithm to use when signing the message.
@@ -9379,12 +9605,12 @@ module Aws::KMS
9379
9605
  # Checks if your request will succeed. `DryRun` is an optional
9380
9606
  # parameter.
9381
9607
  #
9382
- # To learn more about how to use this parameter, see [Testing your KMS
9383
- # API calls][1] in the *Key Management Service Developer Guide*.
9608
+ # To learn more about how to use this parameter, see [Testing your
9609
+ # permissions][1] in the *Key Management Service Developer Guide*.
9384
9610
  #
9385
9611
  #
9386
9612
  #
9387
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
9613
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
9388
9614
  #
9389
9615
  # @return [Types::SignResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
9390
9616
  #
@@ -9437,9 +9663,9 @@ module Aws::KMS
9437
9663
  # resp = client.sign({
9438
9664
  # key_id: "KeyIdType", # required
9439
9665
  # message: "data", # required
9440
- # message_type: "RAW", # accepts RAW, DIGEST
9666
+ # message_type: "RAW", # accepts RAW, DIGEST, EXTERNAL_MU
9441
9667
  # grant_tokens: ["GrantTokenType"],
9442
- # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA
9668
+ # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA, ML_DSA_SHAKE_256
9443
9669
  # dry_run: false,
9444
9670
  # })
9445
9671
  #
@@ -9447,7 +9673,7 @@ module Aws::KMS
9447
9673
  #
9448
9674
  # resp.key_id #=> String
9449
9675
  # resp.signature #=> String
9450
- # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
9676
+ # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
9451
9677
  #
9452
9678
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Sign AWS API Documentation
9453
9679
  #
@@ -9507,17 +9733,17 @@ module Aws::KMS
9507
9733
  #
9508
9734
  #
9509
9735
  #
9510
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
9736
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
9511
9737
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
9512
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
9513
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
9514
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#keystore-concept
9515
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#alias-concept
9738
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
9739
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key
9740
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9741
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
9516
9742
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
9517
9743
  # [8]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
9518
9744
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9519
9745
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9520
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9746
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9521
9747
  #
9522
9748
  # @option params [required, String] :key_id
9523
9749
  # Identifies a customer managed key in the account and Region.
@@ -9627,13 +9853,13 @@ module Aws::KMS
9627
9853
  #
9628
9854
  #
9629
9855
  #
9630
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
9856
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
9631
9857
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
9632
9858
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
9633
9859
  # [4]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
9634
9860
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9635
9861
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9636
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9862
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9637
9863
  #
9638
9864
  # @option params [required, String] :key_id
9639
9865
  # Identifies the KMS key from which you are removing tags.
@@ -9746,7 +9972,7 @@ module Aws::KMS
9746
9972
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9747
9973
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9748
9974
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
9749
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9975
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9750
9976
  #
9751
9977
  # @option params [required, String] :alias_name
9752
9978
  # Identifies the alias that is changing its KMS key. This value must
@@ -9785,8 +10011,8 @@ module Aws::KMS
9785
10011
  #
9786
10012
  #
9787
10013
  #
9788
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
9789
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
10014
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
10015
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
9790
10016
  #
9791
10017
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
9792
10018
  #
@@ -9826,9 +10052,9 @@ module Aws::KMS
9826
10052
  # verify the updated property values, use the DescribeCustomKeyStores
9827
10053
  # operation.
9828
10054
  #
9829
- # This operation is part of the [custom key stores][1] feature in KMS,
9830
- # which combines the convenience and extensive integration of KMS with
9831
- # the isolation and control of a key store that you own and manage.
10055
+ # This operation is part of the custom key stores feature in KMS, which
10056
+ # combines the convenience and extensive integration of KMS with the
10057
+ # isolation and control of a key store that you own and manage.
9832
10058
  #
9833
10059
  # When updating the properties of an external key store, verify that the
9834
10060
  # updated settings connect your key store, via the external key store
@@ -9898,7 +10124,7 @@ module Aws::KMS
9898
10124
  # **Cross-account use**: No. You cannot perform this operation on a
9899
10125
  # custom key store in a different Amazon Web Services account.
9900
10126
  #
9901
- # **Required permissions**: [kms:UpdateCustomKeyStore][2] (IAM policy)
10127
+ # **Required permissions**: [kms:UpdateCustomKeyStore][1] (IAM policy)
9902
10128
  #
9903
10129
  # **Related operations:**
9904
10130
  #
@@ -9913,13 +10139,12 @@ module Aws::KMS
9913
10139
  # * DisconnectCustomKeyStore
9914
10140
  #
9915
10141
  # **Eventual consistency**: The KMS API follows an eventual consistency
9916
- # model. For more information, see [KMS eventual consistency][3].
10142
+ # model. For more information, see [KMS eventual consistency][2].
9917
10143
  #
9918
10144
  #
9919
10145
  #
9920
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
9921
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9922
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10146
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10147
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9923
10148
  #
9924
10149
  # @option params [required, String] :custom_key_store_id
9925
10150
  # Identifies the custom key store that you want to update. Enter the ID
@@ -10197,7 +10422,7 @@ module Aws::KMS
10197
10422
  #
10198
10423
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10199
10424
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10200
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10425
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10201
10426
  #
10202
10427
  # @option params [required, String] :key_id
10203
10428
  # Updates the description of the specified KMS key.
@@ -10257,8 +10482,8 @@ module Aws::KMS
10257
10482
  # key in `eu-west-2`. If you run `UpdatePrimaryRegion` with a
10258
10483
  # `PrimaryRegion` value of `eu-west-2`, the primary key is now the key
10259
10484
  # in `eu-west-2`, and the key in `us-east-1` becomes a replica key. For
10260
- # details, see [Updating the primary Region][1] in the *Key Management
10261
- # Service Developer Guide*.
10485
+ # details, see [Change the primary key in a set of multi-Region keys][1]
10486
+ # in the *Key Management Service Developer Guide*.
10262
10487
  #
10263
10488
  # This operation supports *multi-Region keys*, an KMS feature that lets
10264
10489
  # you create multiple interoperable KMS keys in different Amazon Web
@@ -10326,7 +10551,7 @@ module Aws::KMS
10326
10551
  #
10327
10552
  #
10328
10553
  #
10329
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-update
10554
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-update.html
10330
10555
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
10331
10556
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id
10332
10557
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec
@@ -10335,7 +10560,7 @@ module Aws::KMS
10335
10560
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
10336
10561
  # [8]: https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html
10337
10562
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10338
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10563
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10339
10564
  #
10340
10565
  # @option params [required, String] :key_id
10341
10566
  # Identifies the current primary key. When the operation completes, this
@@ -10450,10 +10675,10 @@ module Aws::KMS
10450
10675
  #
10451
10676
  #
10452
10677
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
10453
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
10678
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
10454
10679
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10455
10680
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10456
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10681
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10457
10682
  #
10458
10683
  # @option params [required, String] :key_id
10459
10684
  # Identifies the asymmetric KMS key that will be used to verify the
@@ -10492,27 +10717,34 @@ module Aws::KMS
10492
10717
  # @option params [String] :message_type
10493
10718
  # Tells KMS whether the value of the `Message` parameter should be
10494
10719
  # hashed as part of the signing algorithm. Use `RAW` for unhashed
10495
- # messages; use `DIGEST` for message digests, which are already hashed.
10720
+ # messages; use `DIGEST` for message digests, which are already hashed;
10721
+ # use `EXTERNAL_MU` for 64-byte representative μ used in ML-DSA signing
10722
+ # as defined in NIST FIPS 204 Section 6.2.
10496
10723
  #
10497
10724
  # When the value of `MessageType` is `RAW`, KMS uses the standard
10498
10725
  # signing algorithm, which begins with a hash function. When the value
10499
- # is `DIGEST`, KMS skips the hashing step in the signing algorithm.
10726
+ # is `DIGEST`, KMS skips the hashing step in the signing algorithm. When
10727
+ # the value is `EXTERNAL_MU` KMS skips the concatenated hashing of the
10728
+ # public key hash and the message done in the ML-DSA signing algorithm.
10500
10729
  #
10501
- # Use the `DIGEST` value only when the value of the `Message` parameter
10502
- # is a message digest. If you use the `DIGEST` value with an unhashed
10503
- # message, the security of the verification operation can be
10730
+ # Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
10731
+ # `Message` parameter is a message digest. If you use the `DIGEST` value
10732
+ # with an unhashed message, the security of the signing operation can be
10504
10733
  # compromised.
10505
10734
  #
10506
- # When the value of `MessageType`is `DIGEST`, the length of the
10735
+ # When the value of `MessageType` is `DIGEST`, the length of the
10507
10736
  # `Message` value must match the length of hashed messages for the
10508
10737
  # specified signing algorithm.
10509
10738
  #
10739
+ # When the value of `MessageType` is `EXTERNAL_MU` the length of the
10740
+ # `Message` value must be 64 bytes.
10741
+ #
10510
10742
  # You can submit a message digest and omit the `MessageType` or specify
10511
10743
  # `RAW` so the digest is hashed again while signing. However, if the
10512
10744
  # signed message is hashed once while signing, but twice while
10513
10745
  # verifying, verification fails, even when the message hasn't changed.
10514
10746
  #
10515
- # The hashing algorithm in that `Verify` uses is based on the
10747
+ # The hashing algorithm that `Verify` uses is based on the
10516
10748
  # `SigningAlgorithm` value.
10517
10749
  #
10518
10750
  # * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
@@ -10524,12 +10756,15 @@ module Aws::KMS
10524
10756
  # * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
10525
10757
  # algorithm.
10526
10758
  #
10759
+ # * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256 hashing
10760
+ # algorithm.
10761
+ #
10527
10762
  # * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
10528
10763
  # verification with SM2 key pairs][1].
10529
10764
  #
10530
10765
  #
10531
10766
  #
10532
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
10767
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
10533
10768
  #
10534
10769
  # @option params [required, String, StringIO, File] :signature
10535
10770
  # The signature that the `Sign` operation generated.
@@ -10549,18 +10784,18 @@ module Aws::KMS
10549
10784
  #
10550
10785
  #
10551
10786
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
10552
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
10787
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
10553
10788
  #
10554
10789
  # @option params [Boolean] :dry_run
10555
10790
  # Checks if your request will succeed. `DryRun` is an optional
10556
10791
  # parameter.
10557
10792
  #
10558
- # To learn more about how to use this parameter, see [Testing your KMS
10559
- # API calls][1] in the *Key Management Service Developer Guide*.
10793
+ # To learn more about how to use this parameter, see [Testing your
10794
+ # permissions][1] in the *Key Management Service Developer Guide*.
10560
10795
  #
10561
10796
  #
10562
10797
  #
10563
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
10798
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
10564
10799
  #
10565
10800
  # @return [Types::VerifyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
10566
10801
  #
@@ -10615,9 +10850,9 @@ module Aws::KMS
10615
10850
  # resp = client.verify({
10616
10851
  # key_id: "KeyIdType", # required
10617
10852
  # message: "data", # required
10618
- # message_type: "RAW", # accepts RAW, DIGEST
10853
+ # message_type: "RAW", # accepts RAW, DIGEST, EXTERNAL_MU
10619
10854
  # signature: "data", # required
10620
- # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA
10855
+ # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA, ML_DSA_SHAKE_256
10621
10856
  # grant_tokens: ["GrantTokenType"],
10622
10857
  # dry_run: false,
10623
10858
  # })
@@ -10626,7 +10861,7 @@ module Aws::KMS
10626
10861
  #
10627
10862
  # resp.key_id #=> String
10628
10863
  # resp.signature_valid #=> Boolean
10629
- # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
10864
+ # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
10630
10865
  #
10631
10866
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Verify AWS API Documentation
10632
10867
  #
@@ -10674,7 +10909,7 @@ module Aws::KMS
10674
10909
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
10675
10910
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10676
10911
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10677
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10912
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10678
10913
  #
10679
10914
  # @option params [required, String, StringIO, File] :message
10680
10915
  # The message that will be used in the verification. Enter the same
@@ -10712,18 +10947,18 @@ module Aws::KMS
10712
10947
  #
10713
10948
  #
10714
10949
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
10715
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
10950
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
10716
10951
  #
10717
10952
  # @option params [Boolean] :dry_run
10718
10953
  # Checks if your request will succeed. `DryRun` is an optional
10719
10954
  # parameter.
10720
10955
  #
10721
- # To learn more about how to use this parameter, see [Testing your KMS
10722
- # API calls][1] in the *Key Management Service Developer Guide*.
10956
+ # To learn more about how to use this parameter, see [Testing your
10957
+ # permissions][1] in the *Key Management Service Developer Guide*.
10723
10958
  #
10724
10959
  #
10725
10960
  #
10726
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
10961
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
10727
10962
  #
10728
10963
  # @return [Types::VerifyMacResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
10729
10964
  #
@@ -10795,7 +11030,7 @@ module Aws::KMS
10795
11030
  tracer: tracer
10796
11031
  )
10797
11032
  context[:gem_name] = 'aws-sdk-kms'
10798
- context[:gem_version] = '1.101.0'
11033
+ context[:gem_version] = '1.112.0'
10799
11034
  Seahorse::Client::Request.new(handlers, context)
10800
11035
  end
10801
11036