aws-sdk-kms 1.101.0 → 1.118.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +85 -0
  3. data/VERSION +1 -1
  4. data/lib/aws-sdk-kms/client.rb +1102 -740
  5. data/lib/aws-sdk-kms/client_api.rb +38 -1
  6. data/lib/aws-sdk-kms/customizations.rb +0 -8
  7. data/lib/aws-sdk-kms/endpoint_parameters.rb +4 -4
  8. data/lib/aws-sdk-kms/types.rb +709 -326
  9. data/lib/aws-sdk-kms.rb +1 -1
  10. data/sig/client.rbs +39 -17
  11. data/sig/resource.rbs +1 -0
  12. data/sig/types.rbs +47 -16
  13. metadata +4 -4
data/lib/aws-sdk-kms/types.rb CHANGED
@@ -291,7 +291,7 @@ module Aws::KMS
291
291
  #
292
292
  #
293
293
  #
294
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
294
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
295
295
  # @return [String]
296
296
  #
297
297
  # @!attribute [rw] target_key_id
@@ -301,7 +301,7 @@ module Aws::KMS
301
301
  # A valid key ID is required. If you supply a null or empty string
302
302
  # value, this operation returns an error.
303
303
  #
304
- # For help finding the key ID and ARN, see [Finding the Key ID and
304
+ # For help finding the key ID and ARN, see [Find the key ID and key
305
305
  # ARN][2] in the <i> <i>Key Management Service Developer Guide</i>
306
306
  # </i>.
307
307
  #
@@ -319,8 +319,8 @@ module Aws::KMS
319
319
  #
320
320
  #
321
321
  #
322
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
323
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn
322
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
323
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html
324
324
  # @return [String]
325
325
  #
326
326
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateAliasRequest AWS API Documentation
@@ -387,7 +387,7 @@ module Aws::KMS
387
387
  #
388
388
  #
389
389
  #
390
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
390
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
391
391
  # @return [String]
392
392
  #
393
393
  # @!attribute [rw] custom_key_store_type
@@ -485,6 +485,14 @@ module Aws::KMS
485
485
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keystore.html#xks-requirements
486
486
  # @return [String]
487
487
  #
488
+ # @!attribute [rw] xks_proxy_vpc_endpoint_service_owner
489
+ # Specifies the Amazon Web Services account ID that owns the Amazon
490
+ # VPC service endpoint for the interface that is used to communicate
491
+ # with your external key store proxy (XKS proxy). This parameter is
492
+ # optional. If not provided, the Amazon Web Services account ID
493
+ # calling the action will be used.
494
+ # @return [String]
495
+ #
488
496
  # @!attribute [rw] xks_proxy_authentication_credential
489
497
  # Specifies an authentication credential for the external key store
490
498
  # proxy (XKS proxy). This parameter is required for all custom key
@@ -494,7 +502,7 @@ module Aws::KMS
494
502
  # `RawSecretAccessKey`, a secret key, and `AccessKeyId`, a unique
495
503
  # identifier for the `RawSecretAccessKey`. For character requirements,
496
504
  # see
497
- # [XksProxyAuthenticationCredentialType](kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html).
505
+ # [XksProxyAuthenticationCredentialType](API_XksProxyAuthenticationCredentialType.html).
498
506
  #
499
507
  # KMS uses this authentication credential to sign requests to the
500
508
  # external key store proxy on your behalf. This credential is
@@ -535,7 +543,7 @@ module Aws::KMS
535
543
  #
536
544
  #
537
545
  #
538
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity
546
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/choose-xks-connectivity.html
539
547
  # @return [String]
540
548
  #
541
549
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateCustomKeyStoreRequest AWS API Documentation
@@ -549,6 +557,7 @@ module Aws::KMS
549
557
  :xks_proxy_uri_endpoint,
550
558
  :xks_proxy_uri_path,
551
559
  :xks_proxy_vpc_endpoint_service_name,
560
+ :xks_proxy_vpc_endpoint_service_owner,
552
561
  :xks_proxy_authentication_credential,
553
562
  :xks_proxy_connectivity)
554
563
  SENSITIVE = [:key_store_password]
@@ -621,7 +630,7 @@ module Aws::KMS
621
630
  #
622
631
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
623
632
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns
624
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
633
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
625
634
  # @return [String]
626
635
  #
627
636
  # @!attribute [rw] operations
@@ -694,7 +703,7 @@ module Aws::KMS
694
703
  #
695
704
  #
696
705
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
697
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
706
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
698
707
  # @return [Array<String>]
699
708
  #
700
709
  # @!attribute [rw] name
@@ -722,12 +731,12 @@ module Aws::KMS
722
731
  # Checks if your request will succeed. `DryRun` is an optional
723
732
  # parameter.
724
733
  #
725
- # To learn more about how to use this parameter, see [Testing your KMS
726
- # API calls][1] in the *Key Management Service Developer Guide*.
734
+ # To learn more about how to use this parameter, see [Testing your
735
+ # permissions][1] in the *Key Management Service Developer Guide*.
727
736
  #
728
737
  #
729
738
  #
730
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
739
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
731
740
  # @return [Boolean]
732
741
  #
733
742
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateGrantRequest AWS API Documentation
@@ -756,7 +765,7 @@ module Aws::KMS
756
765
  #
757
766
  #
758
767
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
759
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
768
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
760
769
  # @return [String]
761
770
  #
762
771
  # @!attribute [rw] grant_id
@@ -796,22 +805,38 @@ module Aws::KMS
796
805
  # that I make are not always immediately visible][2] in the *Amazon
797
806
  # Web Services Identity and Access Management User Guide*.
798
807
  #
808
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are
809
+ # missing from a key policy statement, the policy statement has no
810
+ # effect. When a key policy statement is missing one of these
811
+ # elements, the KMS console correctly reports an error, but the
812
+ # `CreateKey` and `PutKeyPolicy` API requests succeed, even though the
813
+ # policy statement is ineffective.
814
+ #
815
+ # For more information on required key policy elements, see [Elements
816
+ # in a key policy][3] in the *Key Management Service Developer Guide*.
817
+ #
818
+ # </note>
819
+ #
799
820
  # If you do not provide a key policy, KMS attaches a default key
800
821
  # policy to the KMS key. For more information, see [Default key
801
- # policy][3] in the *Key Management Service Developer Guide*.
822
+ # policy][4] in the *Key Management Service Developer Guide*.
802
823
  #
803
- # The key policy size quota is 32 kilobytes (32768 bytes).
824
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
825
+ # `LimitExceededException`.
826
+ #
827
+ # </note>
804
828
  #
805
829
  # For help writing and formatting a JSON policy document, see the [IAM
806
- # JSON Policy Reference][4] in the <i> <i>Identity and Access
830
+ # JSON Policy Reference][5] in the <i> <i>Identity and Access
807
831
  # Management User Guide</i> </i>.
808
832
  #
809
833
  #
810
834
  #
811
835
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
812
836
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
813
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
814
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
837
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
838
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
839
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
815
840
  # @return [String]
816
841
  #
817
842
  # @!attribute [rw] description
@@ -831,8 +856,11 @@ module Aws::KMS
831
856
  # Determines the [cryptographic operations][1] for which you can use
832
857
  # the KMS key. The default value is `ENCRYPT_DECRYPT`. This parameter
833
858
  # is optional when you are creating a symmetric encryption KMS key;
834
- # otherwise, it is required. You can't change the `KeyUsage` value
835
- # after the KMS key is created.
859
+ # otherwise, it is required. You can't change the [ `KeyUsage` ][2]
860
+ # value after the KMS key is created. Each KMS key can have only one
861
+ # key usage. This follows key usage best practices according to [NIST
862
+ # SP 800-57 Recommendations for Key Management][3], section 5.2, Key
863
+ # usage.
836
864
  #
837
865
  # Select only one valid value.
838
866
  #
@@ -844,10 +872,13 @@ module Aws::KMS
844
872
  # * For asymmetric KMS keys with RSA key pairs, specify
845
873
  # `ENCRYPT_DECRYPT` or `SIGN_VERIFY`.
846
874
  #
847
- # * For asymmetric KMS keys with NIST-recommended elliptic curve key
875
+ # * For asymmetric KMS keys with NIST-standard elliptic curve key
848
876
  # pairs, specify `SIGN_VERIFY` or `KEY_AGREEMENT`.
849
877
  #
850
- # * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs specify
878
+ # * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs, specify
879
+ # `SIGN_VERIFY`.
880
+ #
881
+ # * For asymmetric KMS keys with ML-DSA key pairs, specify
851
882
  # `SIGN_VERIFY`.
852
883
  #
853
884
  # * For asymmetric KMS keys with SM2 key pairs (China Regions only),
@@ -855,7 +886,9 @@ module Aws::KMS
855
886
  #
856
887
  #
857
888
  #
858
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
889
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
890
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html#key-usage
891
+ # [3]: https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final
859
892
  # @return [String]
860
893
  #
861
894
  # @!attribute [rw] customer_master_key_spec
@@ -872,8 +905,8 @@ module Aws::KMS
872
905
  # `SYMMETRIC_DEFAULT`, creates a KMS key with a 256-bit AES-GCM key
873
906
  # that is used for encryption and decryption, except in China Regions,
874
907
  # where it creates a 128-bit symmetric key that uses SM4 encryption.
875
- # For help choosing a key spec for your KMS key, see [Choosing a KMS
876
- # key type][1] in the <i> <i>Key Management Service Developer
908
+ # For a detailed description of all supported key specs, see [Key spec
909
+ # reference][1] in the <i> <i>Key Management Service Developer
877
910
  # Guide</i> </i>.
878
911
  #
879
912
  # The `KeySpec` determines whether the KMS key contains a symmetric
@@ -882,10 +915,11 @@ module Aws::KMS
882
915
  # KMS key is created. To further restrict the algorithms that can be
883
916
  # used with the KMS key, use a condition key in its key policy or IAM
884
917
  # policy. For more information, see [kms:EncryptionAlgorithm][2],
885
- # [kms:MacAlgorithm][3] or [kms:Signing Algorithm][4] in the <i>
886
- # <i>Key Management Service Developer Guide</i> </i>.
918
+ # [kms:MacAlgorithm][3], [kms:KeyAgreementAlgorithm][4], or
919
+ # [kms:SigningAlgorithm][5] in the <i> <i>Key Management Service
920
+ # Developer Guide</i> </i>.
887
921
  #
888
- # [Amazon Web Services services that are integrated with KMS][5] use
922
+ # [Amazon Web Services services that are integrated with KMS][6] use
889
923
  # symmetric encryption KMS keys to protect your data. These services
890
924
  # do not support asymmetric KMS keys or HMAC KMS keys.
891
925
  #
@@ -913,7 +947,7 @@ module Aws::KMS
913
947
  # * `RSA_3072`
914
948
  #
915
949
  # * `RSA_4096`
916
- # * Asymmetric NIST-recommended elliptic curve key pairs (signing and
950
+ # * Asymmetric NIST-standard elliptic curve key pairs (signing and
917
951
  # verification -or- deriving shared secrets)
918
952
  #
919
953
  # * `ECC_NIST_P256` (secp256r1)
@@ -921,6 +955,19 @@ module Aws::KMS
921
955
  # * `ECC_NIST_P384` (secp384r1)
922
956
  #
923
957
  # * `ECC_NIST_P521` (secp521r1)
958
+ #
959
+ # * `ECC_NIST_EDWARDS25519` (ed25519) - signing and verification
960
+ # only
961
+ #
962
+ # * **Note:** For ECC\_NIST\_EDWARDS25519 KMS keys, the
963
+ # ED25519\_SHA\_512 signing algorithm requires [
964
+ # `MessageType:RAW`
965
+ # ](kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType),
966
+ # while ED25519\_PH\_SHA\_512 requires [ `MessageType:DIGEST`
967
+ # ](kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType).
968
+ # These message types cannot be used interchangeably.
969
+ #
970
+ # ^
924
971
  # * Other asymmetric elliptic curve key pairs (signing and
925
972
  # verification)
926
973
  #
@@ -928,6 +975,13 @@ module Aws::KMS
928
975
  # cryptocurrencies.
929
976
  #
930
977
  # ^
978
+ # * Asymmetric ML-DSA key pairs (signing and verification)
979
+ #
980
+ # * `ML_DSA_44`
981
+ #
982
+ # * `ML_DSA_65`
983
+ #
984
+ # * `ML_DSA_87`
931
985
  # * SM2 key pairs (encryption and decryption -or- signing and
932
986
  # verification -or- deriving shared secrets)
933
987
  #
@@ -937,11 +991,12 @@ module Aws::KMS
937
991
  #
938
992
  #
939
993
  #
940
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose
941
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm
942
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm
943
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm
944
- # [5]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
994
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html
995
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-algorithm
996
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-mac-algorithm
997
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-agreement-algorithm
998
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-signing-algorithm
999
+ # [6]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
945
1000
  # @return [String]
946
1001
  #
947
1002
  # @!attribute [rw] origin
@@ -994,7 +1049,7 @@ module Aws::KMS
994
1049
  #
995
1050
  #
996
1051
  #
997
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1052
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
998
1053
  # @return [String]
999
1054
  #
1000
1055
  # @!attribute [rw] bypass_policy_lockout_safety_check
@@ -1045,7 +1100,7 @@ module Aws::KMS
1045
1100
  # When you add tags to an Amazon Web Services resource, Amazon Web
1046
1101
  # Services generates a cost allocation report with usage and costs
1047
1102
  # aggregated by tags. Tags can also be used to control access to a KMS
1048
- # key. For details, see [Tagging Keys][3].
1103
+ # key. For details, see [Tags in KMS][3].
1049
1104
  #
1050
1105
  #
1051
1106
  #
@@ -1118,7 +1173,7 @@ module Aws::KMS
1118
1173
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
1119
1174
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1120
1175
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy
1121
- # [4]: https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements
1176
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html#xks-key-requirements
1122
1177
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption
1123
1178
  # @return [String]
1124
1179
  #
@@ -1526,8 +1581,8 @@ module Aws::KMS
1526
1581
  #
1527
1582
  #
1528
1583
  #
1529
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
1530
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
1584
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
1585
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
1531
1586
  # @return [Hash<String,String>]
1532
1587
  #
1533
1588
  # @!attribute [rw] grant_tokens
@@ -1541,7 +1596,7 @@ module Aws::KMS
1541
1596
  #
1542
1597
  #
1543
1598
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
1544
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1599
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1545
1600
  # @return [Array<String>]
1546
1601
  #
1547
1602
  # @!attribute [rw] key_id
@@ -1592,42 +1647,44 @@ module Aws::KMS
1592
1647
  #
1593
1648
  # @!attribute [rw] recipient
1594
1649
  # A signed [attestation document][1] from an Amazon Web Services Nitro
1595
- # enclave and the encryption algorithm to use with the enclave's
1596
- # public key. The only valid encryption algorithm is
1597
- # `RSAES_OAEP_SHA_256`.
1650
+ # enclave or NitroTPM, and the encryption algorithm to use with the
1651
+ # public key in the attestation document. The only valid encryption
1652
+ # algorithm is `RSAES_OAEP_SHA_256`.
1598
1653
  #
1599
- # This parameter only supports attestation documents for Amazon Web
1600
- # Services Nitro Enclaves. To include this parameter, use the [Amazon
1601
- # Web Services Nitro Enclaves SDK][2] or any Amazon Web Services SDK.
1654
+ # This parameter supports the [Amazon Web Services Nitro Enclaves
1655
+ # SDK][2] or any Amazon Web Services SDK for Amazon Web Services Nitro
1656
+ # Enclaves. It supports any Amazon Web Services SDK for Amazon Web
1657
+ # Services NitroTPM.
1602
1658
  #
1603
1659
  # When you use this parameter, instead of returning the plaintext
1604
1660
  # data, KMS encrypts the plaintext data with the public key in the
1605
1661
  # attestation document, and returns the resulting ciphertext in the
1606
1662
  # `CiphertextForRecipient` field in the response. This ciphertext can
1607
- # be decrypted only with the private key in the enclave. The
1608
- # `Plaintext` field in the response is null or empty.
1663
+ # be decrypted only with the private key in the attested environment.
1664
+ # The `Plaintext` field in the response is null or empty.
1609
1665
  #
1610
1666
  # For information about the interaction between KMS and Amazon Web
1611
- # Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
1612
- # uses KMS][3] in the *Key Management Service Developer Guide*.
1667
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM, see
1668
+ # [Cryptographic attestation support in KMS][3] in the *Key Management
1669
+ # Service Developer Guide*.
1613
1670
  #
1614
1671
  #
1615
1672
  #
1616
1673
  # [1]: https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave-concepts.html#term-attestdoc
1617
1674
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
1618
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
1675
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
1619
1676
  # @return [Types::RecipientInfo]
1620
1677
  #
1621
1678
  # @!attribute [rw] dry_run
1622
1679
  # Checks if your request will succeed. `DryRun` is an optional
1623
1680
  # parameter.
1624
1681
  #
1625
- # To learn more about how to use this parameter, see [Testing your KMS
1626
- # API calls][1] in the *Key Management Service Developer Guide*.
1682
+ # To learn more about how to use this parameter, see [Testing your
1683
+ # permissions][1] in the *Key Management Service Developer Guide*.
1627
1684
  #
1628
1685
  #
1629
1686
  #
1630
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
1687
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
1631
1688
  # @return [Boolean]
1632
1689
  #
1633
1690
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DecryptRequest AWS API Documentation
@@ -1667,19 +1724,28 @@ module Aws::KMS
1667
1724
  # @return [String]
1668
1725
  #
1669
1726
  # @!attribute [rw] ciphertext_for_recipient
1670
- # The plaintext data encrypted with the public key in the attestation
1671
- # document.
1727
+ # The plaintext data encrypted with the public key from the
1728
+ # attestation document. This ciphertext can be decrypted only by using
1729
+ # a private key from the attested environment.
1672
1730
  #
1673
1731
  # This field is included in the response only when the `Recipient`
1674
1732
  # parameter in the request includes a valid attestation document from
1675
- # an Amazon Web Services Nitro enclave. For information about the
1676
- # interaction between KMS and Amazon Web Services Nitro Enclaves, see
1677
- # [How Amazon Web Services Nitro Enclaves uses KMS][1] in the *Key
1678
- # Management Service Developer Guide*.
1733
+ # an Amazon Web Services Nitro enclave or NitroTPM. For information
1734
+ # about the interaction between KMS and Amazon Web Services Nitro
1735
+ # Enclaves or Amazon Web Services NitroTPM, see [Cryptographic
1736
+ # attestation support in KMS][1] in the *Key Management Service
1737
+ # Developer Guide*.
1738
+ #
1679
1739
  #
1680
1740
  #
1741
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
1742
+ # @return [String]
1681
1743
  #
1682
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
1744
+ # @!attribute [rw] key_material_id
1745
+ # The identifier of the key material used to decrypt the ciphertext.
1746
+ # This field is present only when the operation uses a symmetric
1747
+ # encryption KMS key. This field is omitted if the request includes
1748
+ # the `Recipient` parameter.
1683
1749
  # @return [String]
1684
1750
  #
1685
1751
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DecryptResponse AWS API Documentation
@@ -1688,7 +1754,8 @@ module Aws::KMS
1688
1754
  :key_id,
1689
1755
  :plaintext,
1690
1756
  :encryption_algorithm,
1691
- :ciphertext_for_recipient)
1757
+ :ciphertext_for_recipient,
1758
+ :key_material_id)
1692
1759
  SENSITIVE = [:plaintext]
1693
1760
  include Aws::Structure
1694
1761
  end
@@ -1740,10 +1807,43 @@ module Aws::KMS
1740
1807
  # DescribeKey.
1741
1808
  # @return [String]
1742
1809
  #
1810
+ # @!attribute [rw] key_material_id
1811
+ # Identifies the imported key material you are deleting.
1812
+ #
1813
+ # If no KeyMaterialId is specified, KMS deletes the current key
1814
+ # material.
1815
+ #
1816
+ # To get the list of key material IDs associated with a KMS key, use
1817
+ # ListKeyRotations.
1818
+ # @return [String]
1819
+ #
1743
1820
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterialRequest AWS API Documentation
1744
1821
  #
1745
1822
  class DeleteImportedKeyMaterialRequest < Struct.new(
1746
- :key_id)
1823
+ :key_id,
1824
+ :key_material_id)
1825
+ SENSITIVE = []
1826
+ include Aws::Structure
1827
+ end
1828
+
1829
+ # @!attribute [rw] key_id
1830
+ # The Amazon Resource Name ([key ARN][1]) of the KMS key from which
1831
+ # the key material was deleted.
1832
+ #
1833
+ #
1834
+ #
1835
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
1836
+ # @return [String]
1837
+ #
1838
+ # @!attribute [rw] key_material_id
1839
+ # Identifies the deleted key material.
1840
+ # @return [String]
1841
+ #
1842
+ # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterialResponse AWS API Documentation
1843
+ #
1844
+ class DeleteImportedKeyMaterialResponse < Struct.new(
1845
+ :key_id,
1846
+ :key_material_id)
1747
1847
  SENSITIVE = []
1748
1848
  include Aws::Structure
1749
1849
  end
@@ -1763,7 +1863,7 @@ module Aws::KMS
1763
1863
  end
1764
1864
 
1765
1865
  # @!attribute [rw] key_id
1766
- # Identifies an asymmetric NIST-recommended ECC or SM2 (China Regions
1866
+ # Identifies an asymmetric NIST-standard ECC or SM2 (China Regions
1767
1867
  # only) KMS key. KMS uses the private key in the specified key pair to
1768
1868
  # derive the shared secret. The key usage of the KMS key must be
1769
1869
  # `KEY_AGREEMENT`. To find the `KeyUsage` of a KMS key, use the
@@ -1795,7 +1895,7 @@ module Aws::KMS
1795
1895
  # @return [String]
1796
1896
  #
1797
1897
  # @!attribute [rw] public_key
1798
- # Specifies the public key in your peer's NIST-recommended elliptic
1898
+ # Specifies the public key in your peer's NIST-standard elliptic
1799
1899
  # curve (ECC) or SM2 (China Regions only) key pair.
1800
1900
  #
1801
1901
  # The public key must be a DER-encoded X.509 public key, also known as
@@ -1831,54 +1931,58 @@ module Aws::KMS
1831
1931
  #
1832
1932
  #
1833
1933
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
1834
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1934
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1835
1935
  # @return [Array<String>]
1836
1936
  #
1837
1937
  # @!attribute [rw] dry_run
1838
1938
  # Checks if your request will succeed. `DryRun` is an optional
1839
1939
  # parameter.
1840
1940
  #
1841
- # To learn more about how to use this parameter, see [Testing your KMS
1842
- # API calls][1] in the *Key Management Service Developer Guide*.
1941
+ # To learn more about how to use this parameter, see [Testing your
1942
+ # permissions][1] in the *Key Management Service Developer Guide*.
1843
1943
  #
1844
1944
  #
1845
1945
  #
1846
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
1946
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
1847
1947
  # @return [Boolean]
1848
1948
  #
1849
1949
  # @!attribute [rw] recipient
1850
1950
  # A signed [attestation document][1] from an Amazon Web Services Nitro
1851
- # enclave and the encryption algorithm to use with the enclave's
1852
- # public key. The only valid encryption algorithm is
1853
- # `RSAES_OAEP_SHA_256`.
1951
+ # enclave or NitroTPM, and the encryption algorithm to use with the
1952
+ # public key in the attestation document. The only valid encryption
1953
+ # algorithm is `RSAES_OAEP_SHA_256`.
1854
1954
  #
1855
1955
  # This parameter only supports attestation documents for Amazon Web
1856
- # Services Nitro Enclaves. To call DeriveSharedSecret for an Amazon
1857
- # Web Services Nitro Enclaves, use the [Amazon Web Services Nitro
1858
- # Enclaves SDK][2] to generate the attestation document and then use
1859
- # the Recipient parameter from any Amazon Web Services SDK to provide
1860
- # the attestation document for the enclave.
1956
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM. To call
1957
+ # DeriveSharedSecret generate an attestation document use either
1958
+ # [Amazon Web Services Nitro Enclaves SDK][2] for an Amazon Web
1959
+ # Services Nitro Enclaves or [Amazon Web Services NitroTPM tools][3]
1960
+ # for Amazon Web Services NitroTPM. Then use the Recipient parameter
1961
+ # from any Amazon Web Services SDK to provide the attestation document
1962
+ # for the attested environment.
1861
1963
  #
1862
1964
  # When you use this parameter, instead of returning a plaintext copy
1863
1965
  # of the shared secret, KMS encrypts the plaintext shared secret under
1864
1966
  # the public key in the attestation document, and returns the
1865
1967
  # resulting ciphertext in the `CiphertextForRecipient` field in the
1866
1968
  # response. This ciphertext can be decrypted only with the private key
1867
- # in the enclave. The `CiphertextBlob` field in the response contains
1868
- # the encrypted shared secret derived from the KMS key specified by
1869
- # the `KeyId` parameter and public key specified by the `PublicKey`
1870
- # parameter. The `SharedSecret` field in the response is null or
1871
- # empty.
1969
+ # in the attested environment. The `CiphertextBlob` field in the
1970
+ # response contains the encrypted shared secret derived from the KMS
1971
+ # key specified by the `KeyId` parameter and public key specified by
1972
+ # the `PublicKey` parameter. The `SharedSecret` field in the response
1973
+ # is null or empty.
1872
1974
  #
1873
1975
  # For information about the interaction between KMS and Amazon Web
1874
- # Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
1875
- # uses KMS][3] in the *Key Management Service Developer Guide*.
1976
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM, see
1977
+ # [Cryptographic attestation support in KMS][4] in the *Key Management
1978
+ # Service Developer Guide*.
1876
1979
  #
1877
1980
  #
1878
1981
  #
1879
1982
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc
1880
1983
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
1881
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
1984
+ # [3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attestation-get-doc.html
1985
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
1882
1986
  # @return [Types::RecipientInfo]
1883
1987
  #
1884
1988
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeriveSharedSecretRequest AWS API Documentation
@@ -1907,19 +2011,21 @@ module Aws::KMS
1907
2011
  # @return [String]
1908
2012
  #
1909
2013
  # @!attribute [rw] ciphertext_for_recipient
1910
- # The plaintext shared secret encrypted with the public key in the
1911
- # attestation document.
2014
+ # The plaintext shared secret encrypted with the public key from the
2015
+ # attestation document. This ciphertext can be decrypted only by using
2016
+ # a private key from the attested environment.
1912
2017
  #
1913
2018
  # This field is included in the response only when the `Recipient`
1914
2019
  # parameter in the request includes a valid attestation document from
1915
- # an Amazon Web Services Nitro enclave. For information about the
1916
- # interaction between KMS and Amazon Web Services Nitro Enclaves, see
1917
- # [How Amazon Web Services Nitro Enclaves uses KMS][1] in the *Key
1918
- # Management Service Developer Guide*.
2020
+ # an Amazon Web Services Nitro enclave or NitroTPM. For information
2021
+ # about the interaction between KMS and Amazon Web Services Nitro
2022
+ # Enclaves or Amazon Web Services NitroTPM, see [Cryptographic
2023
+ # attestation support in KMS][1] in the *Key Management Service
2024
+ # Developer Guide*.
1919
2025
  #
1920
2026
  #
1921
2027
  #
1922
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2028
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
1923
2029
  # @return [String]
1924
2030
  #
1925
2031
  # @!attribute [rw] key_agreement_algorithm
@@ -2049,7 +2155,7 @@ module Aws::KMS
2049
2155
  #
2050
2156
  #
2051
2157
  #
2052
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html##aws-managed-cmk
2158
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
2053
2159
  # @return [String]
2054
2160
  #
2055
2161
  # @!attribute [rw] grant_tokens
@@ -2063,7 +2169,7 @@ module Aws::KMS
2063
2169
  #
2064
2170
  #
2065
2171
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2066
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2172
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2067
2173
  # @return [Array<String>]
2068
2174
  #
2069
2175
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeKeyRequest AWS API Documentation
@@ -2134,7 +2240,7 @@ module Aws::KMS
2134
2240
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks
2135
2241
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
2136
2242
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
2137
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
2243
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
2138
2244
  # @return [String]
2139
2245
  #
2140
2246
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DisableKeyRotationRequest AWS API Documentation
@@ -2237,8 +2343,8 @@ module Aws::KMS
2237
2343
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
2238
2344
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
2239
2345
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
2240
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
2241
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
2346
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
2347
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
2242
2348
  # @return [String]
2243
2349
  #
2244
2350
  # @!attribute [rw] rotation_period_in_days
@@ -2324,8 +2430,8 @@ module Aws::KMS
2324
2430
  #
2325
2431
  #
2326
2432
  #
2327
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2328
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2433
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2434
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2329
2435
  # @return [Hash<String,String>]
2330
2436
  #
2331
2437
  # @!attribute [rw] grant_tokens
@@ -2339,7 +2445,7 @@ module Aws::KMS
2339
2445
  #
2340
2446
  #
2341
2447
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2342
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2448
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2343
2449
  # @return [Array<String>]
2344
2450
  #
2345
2451
  # @!attribute [rw] encryption_algorithm
@@ -2359,12 +2465,12 @@ module Aws::KMS
2359
2465
  # Checks if your request will succeed. `DryRun` is an optional
2360
2466
  # parameter.
2361
2467
  #
2362
- # To learn more about how to use this parameter, see [Testing your KMS
2363
- # API calls][1] in the *Key Management Service Developer Guide*.
2468
+ # To learn more about how to use this parameter, see [Testing your
2469
+ # permissions][1] in the *Key Management Service Developer Guide*.
2364
2470
  #
2365
2471
  #
2366
2472
  #
2367
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2473
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2368
2474
  # @return [Boolean]
2369
2475
  #
2370
2476
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/EncryptRequest AWS API Documentation
@@ -2447,7 +2553,7 @@ module Aws::KMS
2447
2553
  #
2448
2554
  #
2449
2555
  #
2450
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2556
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2451
2557
  # @return [Hash<String,String>]
2452
2558
  #
2453
2559
  # @!attribute [rw] key_id
@@ -2481,9 +2587,11 @@ module Aws::KMS
2481
2587
  #
2482
2588
  # The KMS rule that restricts the use of asymmetric RSA and SM2 KMS
2483
2589
  # keys to encrypt and decrypt or to sign and verify (but not both),
2484
- # and the rule that permits you to use ECC KMS keys only to sign and
2485
- # verify, are not effective on data key pairs, which are used outside
2486
- # of KMS. The SM2 key spec is only available in China Regions.
2590
+ # the rule that permits you to use ECC KMS keys only to sign and
2591
+ # verify, and the rule that permits you to use ML-DSA key pairs to
2592
+ # sign and verify only are not effective on data key pairs, which are
2593
+ # used outside of KMS. The SM2 key spec is only available in China
2594
+ # Regions.
2487
2595
  # @return [String]
2488
2596
  #
2489
2597
  # @!attribute [rw] grant_tokens
@@ -2497,53 +2605,57 @@ module Aws::KMS
2497
2605
  #
2498
2606
  #
2499
2607
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2500
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2608
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2501
2609
  # @return [Array<String>]
2502
2610
  #
2503
2611
  # @!attribute [rw] recipient
2504
2612
  # A signed [attestation document][1] from an Amazon Web Services Nitro
2505
- # enclave and the encryption algorithm to use with the enclave's
2506
- # public key. The only valid encryption algorithm is
2507
- # `RSAES_OAEP_SHA_256`.
2613
+ # enclave or NitroTPM, and the encryption algorithm to use with the
2614
+ # public key in the attestation document. The only valid encryption
2615
+ # algorithm is `RSAES_OAEP_SHA_256`.
2508
2616
  #
2509
2617
  # This parameter only supports attestation documents for Amazon Web
2510
- # Services Nitro Enclaves. To call DeriveSharedSecret for an Amazon
2511
- # Web Services Nitro Enclaves, use the [Amazon Web Services Nitro
2512
- # Enclaves SDK][2] to generate the attestation document and then use
2513
- # the Recipient parameter from any Amazon Web Services SDK to provide
2514
- # the attestation document for the enclave.
2618
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM. To call
2619
+ # GenerateDataKeyPair generate an attestation document use either
2620
+ # [Amazon Web Services Nitro Enclaves SDK][2] for an Amazon Web
2621
+ # Services Nitro Enclaves or [Amazon Web Services NitroTPM tools][3]
2622
+ # for Amazon Web Services NitroTPM. Then use the Recipient parameter
2623
+ # from any Amazon Web Services SDK to provide the attestation document
2624
+ # for the attested environment.
2515
2625
  #
2516
2626
  # When you use this parameter, instead of returning a plaintext copy
2517
2627
  # of the private data key, KMS encrypts the plaintext private data key
2518
2628
  # under the public key in the attestation document, and returns the
2519
2629
  # resulting ciphertext in the `CiphertextForRecipient` field in the
2520
2630
  # response. This ciphertext can be decrypted only with the private key
2521
- # in the enclave. The `CiphertextBlob` field in the response contains
2522
- # a copy of the private data key encrypted under the KMS key specified
2523
- # by the `KeyId` parameter. The `PrivateKeyPlaintext` field in the
2524
- # response is null or empty.
2631
+ # in the attested environment. The `CiphertextBlob` field in the
2632
+ # response contains a copy of the private data key encrypted under the
2633
+ # KMS key specified by the `KeyId` parameter. The
2634
+ # `PrivateKeyPlaintext` field in the response is null or empty.
2525
2635
  #
2526
2636
  # For information about the interaction between KMS and Amazon Web
2527
- # Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
2528
- # uses KMS][3] in the *Key Management Service Developer Guide*.
2637
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM, see
2638
+ # [Cryptographic attestation support in KMS][4] in the *Key Management
2639
+ # Service Developer Guide*.
2529
2640
  #
2530
2641
  #
2531
2642
  #
2532
2643
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc
2533
2644
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
2534
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2645
+ # [3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attestation-get-doc.html
2646
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
2535
2647
  # @return [Types::RecipientInfo]
2536
2648
  #
2537
2649
  # @!attribute [rw] dry_run
2538
2650
  # Checks if your request will succeed. `DryRun` is an optional
2539
2651
  # parameter.
2540
2652
  #
2541
- # To learn more about how to use this parameter, see [Testing your KMS
2542
- # API calls][1] in the *Key Management Service Developer Guide*.
2653
+ # To learn more about how to use this parameter, see [Testing your
2654
+ # permissions][1] in the *Key Management Service Developer Guide*.
2543
2655
  #
2544
2656
  #
2545
2657
  #
2546
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2658
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2547
2659
  # @return [Boolean]
2548
2660
  #
2549
2661
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairRequest AWS API Documentation
@@ -2595,19 +2707,24 @@ module Aws::KMS
2595
2707
  #
2596
2708
  # @!attribute [rw] ciphertext_for_recipient
2597
2709
  # The plaintext private data key encrypted with the public key from
2598
- # the Nitro enclave. This ciphertext can be decrypted only by using a
2599
- # private key in the Nitro enclave.
2710
+ # the attestation document. This ciphertext can be decrypted only by
2711
+ # using a private key from the attested environment.
2600
2712
  #
2601
2713
  # This field is included in the response only when the `Recipient`
2602
2714
  # parameter in the request includes a valid attestation document from
2603
- # an Amazon Web Services Nitro enclave. For information about the
2604
- # interaction between KMS and Amazon Web Services Nitro Enclaves, see
2605
- # [How Amazon Web Services Nitro Enclaves uses KMS][1] in the *Key
2606
- # Management Service Developer Guide*.
2715
+ # an Amazon Web Services Nitro enclave or NitroTPM. For information
2716
+ # about the interaction between KMS and Amazon Web Services Nitro
2717
+ # Enclaves or Amazon Web Services NitroTPM, see [Cryptographic
2718
+ # attestation support in KMS][1] in the *Key Management Service
2719
+ # Developer Guide*.
2720
+ #
2607
2721
  #
2608
2722
  #
2723
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
2724
+ # @return [String]
2609
2725
  #
2610
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2726
+ # @!attribute [rw] key_material_id
2727
+ # The identifier of the key material used to encrypt the private key.
2611
2728
  # @return [String]
2612
2729
  #
2613
2730
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairResponse AWS API Documentation
@@ -2618,7 +2735,8 @@ module Aws::KMS
2618
2735
  :public_key,
2619
2736
  :key_id,
2620
2737
  :key_pair_spec,
2621
- :ciphertext_for_recipient)
2738
+ :ciphertext_for_recipient,
2739
+ :key_material_id)
2622
2740
  SENSITIVE = [:private_key_plaintext]
2623
2741
  include Aws::Structure
2624
2742
  end
@@ -2645,7 +2763,7 @@ module Aws::KMS
2645
2763
  #
2646
2764
  #
2647
2765
  #
2648
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2766
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2649
2767
  # @return [Hash<String,String>]
2650
2768
  #
2651
2769
  # @!attribute [rw] key_id
@@ -2679,9 +2797,11 @@ module Aws::KMS
2679
2797
  #
2680
2798
  # The KMS rule that restricts the use of asymmetric RSA and SM2 KMS
2681
2799
  # keys to encrypt and decrypt or to sign and verify (but not both),
2682
- # and the rule that permits you to use ECC KMS keys only to sign and
2683
- # verify, are not effective on data key pairs, which are used outside
2684
- # of KMS. The SM2 key spec is only available in China Regions.
2800
+ # the rule that permits you to use ECC KMS keys only to sign and
2801
+ # verify, and the rule that permits you to use ML-DSA key pairs to
2802
+ # sign and verify only are not effective on data key pairs, which are
2803
+ # used outside of KMS. The SM2 key spec is only available in China
2804
+ # Regions.
2685
2805
  # @return [String]
2686
2806
  #
2687
2807
  # @!attribute [rw] grant_tokens
@@ -2695,19 +2815,19 @@ module Aws::KMS
2695
2815
  #
2696
2816
  #
2697
2817
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2698
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2818
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2699
2819
  # @return [Array<String>]
2700
2820
  #
2701
2821
  # @!attribute [rw] dry_run
2702
2822
  # Checks if your request will succeed. `DryRun` is an optional
2703
2823
  # parameter.
2704
2824
  #
2705
- # To learn more about how to use this parameter, see [Testing your KMS
2706
- # API calls][1] in the *Key Management Service Developer Guide*.
2825
+ # To learn more about how to use this parameter, see [Testing your
2826
+ # permissions][1] in the *Key Management Service Developer Guide*.
2707
2827
  #
2708
2828
  #
2709
2829
  #
2710
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2830
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2711
2831
  # @return [Boolean]
2712
2832
  #
2713
2833
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintextRequest AWS API Documentation
@@ -2747,13 +2867,18 @@ module Aws::KMS
2747
2867
  # The type of data key pair that was generated.
2748
2868
  # @return [String]
2749
2869
  #
2870
+ # @!attribute [rw] key_material_id
2871
+ # The identifier of the key material used to encrypt the private key.
2872
+ # @return [String]
2873
+ #
2750
2874
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintextResponse AWS API Documentation
2751
2875
  #
2752
2876
  class GenerateDataKeyPairWithoutPlaintextResponse < Struct.new(
2753
2877
  :private_key_ciphertext_blob,
2754
2878
  :public_key,
2755
2879
  :key_id,
2756
- :key_pair_spec)
2880
+ :key_pair_spec,
2881
+ :key_material_id)
2757
2882
  SENSITIVE = []
2758
2883
  include Aws::Structure
2759
2884
  end
@@ -2806,7 +2931,7 @@ module Aws::KMS
2806
2931
  #
2807
2932
  #
2808
2933
  #
2809
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2934
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2810
2935
  # @return [Hash<String,String>]
2811
2936
  #
2812
2937
  # @!attribute [rw] number_of_bytes
@@ -2839,18 +2964,19 @@ module Aws::KMS
2839
2964
  #
2840
2965
  #
2841
2966
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2842
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2967
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2843
2968
  # @return [Array<String>]
2844
2969
  #
2845
2970
  # @!attribute [rw] recipient
2846
2971
  # A signed [attestation document][1] from an Amazon Web Services Nitro
2847
- # enclave and the encryption algorithm to use with the enclave's
2848
- # public key. The only valid encryption algorithm is
2849
- # `RSAES_OAEP_SHA_256`.
2972
+ # enclave or NitroTPM, and the encryption algorithm to use with the
2973
+ # public key in the attestation document. The only valid encryption
2974
+ # algorithm is `RSAES_OAEP_SHA_256`.
2850
2975
  #
2851
- # This parameter only supports attestation documents for Amazon Web
2852
- # Services Nitro Enclaves. To include this parameter, use the [Amazon
2853
- # Web Services Nitro Enclaves SDK][2] or any Amazon Web Services SDK.
2976
+ # This parameter supports the [Amazon Web Services Nitro Enclaves
2977
+ # SDK][2] or any Amazon Web Services SDK for Amazon Web Services Nitro
2978
+ # Enclaves. It supports any Amazon Web Services SDK for Amazon Web
2979
+ # Services NitroTPM.
2854
2980
  #
2855
2981
  # When you use this parameter, instead of returning the plaintext data
2856
2982
  # key, KMS encrypts the plaintext data key under the public key in the
@@ -2862,26 +2988,27 @@ module Aws::KMS
2862
2988
  # The `Plaintext` field in the response is null or empty.
2863
2989
  #
2864
2990
  # For information about the interaction between KMS and Amazon Web
2865
- # Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
2866
- # uses KMS][3] in the *Key Management Service Developer Guide*.
2991
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM, see
2992
+ # [Cryptographic attestation support in KMS][3] in the *Key Management
2993
+ # Service Developer Guide*.
2867
2994
  #
2868
2995
  #
2869
2996
  #
2870
2997
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc
2871
2998
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
2872
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2999
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
2873
3000
  # @return [Types::RecipientInfo]
2874
3001
  #
2875
3002
  # @!attribute [rw] dry_run
2876
3003
  # Checks if your request will succeed. `DryRun` is an optional
2877
3004
  # parameter.
2878
3005
  #
2879
- # To learn more about how to use this parameter, see [Testing your KMS
2880
- # API calls][1] in the *Key Management Service Developer Guide*.
3006
+ # To learn more about how to use this parameter, see [Testing your
3007
+ # permissions][1] in the *Key Management Service Developer Guide*.
2881
3008
  #
2882
3009
  #
2883
3010
  #
2884
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3011
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2885
3012
  # @return [Boolean]
2886
3013
  #
2887
3014
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyRequest AWS API Documentation
@@ -2924,20 +3051,27 @@ module Aws::KMS
2924
3051
  # @return [String]
2925
3052
  #
2926
3053
  # @!attribute [rw] ciphertext_for_recipient
2927
- # The plaintext data key encrypted with the public key from the Nitro
2928
- # enclave. This ciphertext can be decrypted only by using a private
2929
- # key in the Nitro enclave.
3054
+ # The plaintext data key encrypted with the public key from the
3055
+ # attestation document. This ciphertext can be decrypted only by using
3056
+ # a private key from the attested environment.
2930
3057
  #
2931
3058
  # This field is included in the response only when the `Recipient`
2932
3059
  # parameter in the request includes a valid attestation document from
2933
- # an Amazon Web Services Nitro enclave. For information about the
2934
- # interaction between KMS and Amazon Web Services Nitro Enclaves, see
2935
- # [How Amazon Web Services Nitro Enclaves uses KMS][1] in the *Key
2936
- # Management Service Developer Guide*.
3060
+ # an Amazon Web Services Nitro enclave or NitroTPM. For information
3061
+ # about the interaction between KMS and Amazon Web Services Nitro
3062
+ # Enclaves or Amazon Web Services NitroTPM, see [Cryptographic
3063
+ # attestation support in KMS][1] in the *Key Management Service
3064
+ # Developer Guide*.
3065
+ #
2937
3066
  #
2938
3067
  #
3068
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
3069
+ # @return [String]
2939
3070
  #
2940
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
3071
+ # @!attribute [rw] key_material_id
3072
+ # The identifier of the key material used to encrypt the data key.
3073
+ # This field is omitted if the request includes the `Recipient`
3074
+ # parameter.
2941
3075
  # @return [String]
2942
3076
  #
2943
3077
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyResponse AWS API Documentation
@@ -2946,7 +3080,8 @@ module Aws::KMS
2946
3080
  :ciphertext_blob,
2947
3081
  :plaintext,
2948
3082
  :key_id,
2949
- :ciphertext_for_recipient)
3083
+ :ciphertext_for_recipient,
3084
+ :key_material_id)
2950
3085
  SENSITIVE = [:plaintext]
2951
3086
  include Aws::Structure
2952
3087
  end
@@ -2999,7 +3134,7 @@ module Aws::KMS
2999
3134
  #
3000
3135
  #
3001
3136
  #
3002
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
3137
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
3003
3138
  # @return [Hash<String,String>]
3004
3139
  #
3005
3140
  # @!attribute [rw] key_spec
@@ -3025,19 +3160,19 @@ module Aws::KMS
3025
3160
  #
3026
3161
  #
3027
3162
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3028
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3163
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3029
3164
  # @return [Array<String>]
3030
3165
  #
3031
3166
  # @!attribute [rw] dry_run
3032
3167
  # Checks if your request will succeed. `DryRun` is an optional
3033
3168
  # parameter.
3034
3169
  #
3035
- # To learn more about how to use this parameter, see [Testing your KMS
3036
- # API calls][1] in the *Key Management Service Developer Guide*.
3170
+ # To learn more about how to use this parameter, see [Testing your
3171
+ # permissions][1] in the *Key Management Service Developer Guide*.
3037
3172
  #
3038
3173
  #
3039
3174
  #
3040
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3175
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
3041
3176
  # @return [Boolean]
3042
3177
  #
3043
3178
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintextRequest AWS API Documentation
@@ -3068,11 +3203,16 @@ module Aws::KMS
3068
3203
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
3069
3204
  # @return [String]
3070
3205
  #
3206
+ # @!attribute [rw] key_material_id
3207
+ # The identifier of the key material used to encrypt the data key.
3208
+ # @return [String]
3209
+ #
3071
3210
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintextResponse AWS API Documentation
3072
3211
  #
3073
3212
  class GenerateDataKeyWithoutPlaintextResponse < Struct.new(
3074
3213
  :ciphertext_blob,
3075
- :key_id)
3214
+ :key_id,
3215
+ :key_material_id)
3076
3216
  SENSITIVE = []
3077
3217
  include Aws::Structure
3078
3218
  end
@@ -3117,19 +3257,19 @@ module Aws::KMS
3117
3257
  #
3118
3258
  #
3119
3259
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3120
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3260
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3121
3261
  # @return [Array<String>]
3122
3262
  #
3123
3263
  # @!attribute [rw] dry_run
3124
3264
  # Checks if your request will succeed. `DryRun` is an optional
3125
3265
  # parameter.
3126
3266
  #
3127
- # To learn more about how to use this parameter, see [Testing your KMS
3128
- # API calls][1] in the *Key Management Service Developer Guide*.
3267
+ # To learn more about how to use this parameter, see [Testing your
3268
+ # permissions][1] in the *Key Management Service Developer Guide*.
3129
3269
  #
3130
3270
  #
3131
3271
  #
3132
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3272
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
3133
3273
  # @return [Boolean]
3134
3274
  #
3135
3275
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateMacRequest AWS API Documentation
@@ -3189,30 +3329,32 @@ module Aws::KMS
3189
3329
  #
3190
3330
  # @!attribute [rw] recipient
3191
3331
  # A signed [attestation document][1] from an Amazon Web Services Nitro
3192
- # enclave and the encryption algorithm to use with the enclave's
3193
- # public key. The only valid encryption algorithm is
3194
- # `RSAES_OAEP_SHA_256`.
3332
+ # enclave or NitroTPM, and the encryption algorithm to use with the
3333
+ # public key in the attestation document. The only valid encryption
3334
+ # algorithm is `RSAES_OAEP_SHA_256`.
3195
3335
  #
3196
- # This parameter only supports attestation documents for Amazon Web
3197
- # Services Nitro Enclaves. To include this parameter, use the [Amazon
3198
- # Web Services Nitro Enclaves SDK][2] or any Amazon Web Services SDK.
3336
+ # This parameter supports the [Amazon Web Services Nitro Enclaves
3337
+ # SDK][2] or any Amazon Web Services SDK for Amazon Web Services Nitro
3338
+ # Enclaves. It supports any Amazon Web Services SDK for Amazon Web
3339
+ # Services NitroTPM.
3199
3340
  #
3200
3341
  # When you use this parameter, instead of returning plaintext bytes,
3201
3342
  # KMS encrypts the plaintext bytes under the public key in the
3202
3343
  # attestation document, and returns the resulting ciphertext in the
3203
3344
  # `CiphertextForRecipient` field in the response. This ciphertext can
3204
- # be decrypted only with the private key in the enclave. The
3205
- # `Plaintext` field in the response is null or empty.
3345
+ # be decrypted only with the private key in the attested environment.
3346
+ # The `Plaintext` field in the response is null or empty.
3206
3347
  #
3207
3348
  # For information about the interaction between KMS and Amazon Web
3208
- # Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
3209
- # uses KMS][3] in the *Key Management Service Developer Guide*.
3349
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM, see
3350
+ # [Cryptographic attestation support in KMS][3] in the *Key Management
3351
+ # Service Developer Guide*.
3210
3352
  #
3211
3353
  #
3212
3354
  #
3213
3355
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc
3214
3356
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
3215
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
3357
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
3216
3358
  # @return [Types::RecipientInfo]
3217
3359
  #
3218
3360
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateRandomRequest AWS API Documentation
@@ -3236,19 +3378,20 @@ module Aws::KMS
3236
3378
  #
3237
3379
  # @!attribute [rw] ciphertext_for_recipient
3238
3380
  # The plaintext random bytes encrypted with the public key from the
3239
- # Nitro enclave. This ciphertext can be decrypted only by using a
3240
- # private key in the Nitro enclave.
3381
+ # attestation document. This ciphertext can be decrypted only by using
3382
+ # a private key from the attested environment.
3241
3383
  #
3242
3384
  # This field is included in the response only when the `Recipient`
3243
3385
  # parameter in the request includes a valid attestation document from
3244
- # an Amazon Web Services Nitro enclave. For information about the
3245
- # interaction between KMS and Amazon Web Services Nitro Enclaves, see
3246
- # [How Amazon Web Services Nitro Enclaves uses KMS][1] in the *Key
3247
- # Management Service Developer Guide*.
3386
+ # an Amazon Web Services Nitro enclave or NitroTPM. For information
3387
+ # about the interaction between KMS and Amazon Web Services Nitro
3388
+ # Enclaves or Amazon Web Services NitroTPM, see [Cryptographic
3389
+ # attestation support in KMS][1] in the *Key Management Service
3390
+ # Developer Guide*.
3248
3391
  #
3249
3392
  #
3250
3393
  #
3251
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
3394
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
3252
3395
  # @return [String]
3253
3396
  #
3254
3397
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateRandomResponse AWS API Documentation
@@ -3355,15 +3498,12 @@ module Aws::KMS
3355
3498
  # Identifies the date and time that an in progress on-demand rotation
3356
3499
  # was initiated.
3357
3500
  #
3358
- # The KMS API follows an [eventual consistency][1] model due to the
3359
- # distributed nature of the system. As a result, there might be a
3360
- # slight delay between initiating on-demand key rotation and the
3361
- # rotation's completion. Once the on-demand rotation is complete, use
3362
- # ListKeyRotations to view the details of the on-demand rotation.
3363
- #
3364
- #
3365
- #
3366
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3501
+ # KMS uses a background process to perform rotations. As a result,
3502
+ # there might be a slight delay between initiating on-demand key
3503
+ # rotation and the rotation's completion. Once the on-demand rotation
3504
+ # is complete, KMS removes this field from the response. You can use
3505
+ # ListKeyRotations to view the details of the completed on-demand
3506
+ # rotation.
3367
3507
  # @return [Time]
3368
3508
  #
3369
3509
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GetKeyRotationStatusResponse AWS API Documentation
@@ -3403,9 +3543,8 @@ module Aws::KMS
3403
3543
  # @!attribute [rw] wrapping_algorithm
3404
3544
  # The algorithm you will use with the RSA public key (`PublicKey`) in
3405
3545
  # the response to protect your key material during import. For more
3406
- # information, see [Select a wrapping
3407
- # algorithm](kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm)
3408
- # in the *Key Management Service Developer Guide*.
3546
+ # information, see [Select a wrapping algorithm][1] in the *Key
3547
+ # Management Service Developer Guide*.
3409
3548
  #
3410
3549
  # For RSA\_AES wrapping algorithms, you encrypt your key material with
3411
3550
  # an AES key that you generate, then encrypt your AES key with the RSA
@@ -3437,6 +3576,10 @@ module Aws::KMS
3437
3576
  #
3438
3577
  # * **RSAES\_PKCS1\_V1\_5** (Deprecated) — As of October 10, 2023, KMS
3439
3578
  # does not support the RSAES\_PKCS1\_V1\_5 wrapping algorithm.
3579
+ #
3580
+ #
3581
+ #
3582
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm
3440
3583
  # @return [String]
3441
3584
  #
3442
3585
  # @!attribute [rw] wrapping_key_spec
@@ -3532,7 +3675,7 @@ module Aws::KMS
3532
3675
  #
3533
3676
  #
3534
3677
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3535
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3678
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3536
3679
  # @return [Array<String>]
3537
3680
  #
3538
3681
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GetPublicKeyRequest AWS API Documentation
@@ -3634,9 +3777,9 @@ module Aws::KMS
3634
3777
  #
3635
3778
  # KMS applies the grant constraints only to cryptographic operations
3636
3779
  # that support an encryption context, that is, all cryptographic
3637
- # operations with a [symmetric KMS key][3]. Grant constraints are not
3638
- # applied to operations that do not support an encryption context, such
3639
- # as cryptographic operations with asymmetric KMS keys and management
3780
+ # operations with a symmetric KMS key. Grant constraints are not applied
3781
+ # to operations that do not support an encryption context, such as
3782
+ # cryptographic operations with asymmetric KMS keys and management
3640
3783
  # operations, such as DescribeKey or RetireGrant.
3641
3784
  #
3642
3785
  # In a cryptographic operation, the encryption context in the decryption
@@ -3651,15 +3794,14 @@ module Aws::KMS
3651
3794
  # differ only by case. To require a fully case-sensitive encryption
3652
3795
  # context, use the `kms:EncryptionContext:` and
3653
3796
  # `kms:EncryptionContextKeys` conditions in an IAM or key policy. For
3654
- # details, see [kms:EncryptionContext:][4] in the <i> <i>Key Management
3655
- # Service Developer Guide</i> </i>.
3797
+ # details, see [kms:EncryptionContext:context-key][3] in the <i> <i>Key
3798
+ # Management Service Developer Guide</i> </i>.
3656
3799
  #
3657
3800
  #
3658
3801
  #
3659
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3660
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
3661
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#symmetric-cmks
3662
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-context
3802
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3803
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
3804
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-context
3663
3805
  #
3664
3806
  # @!attribute [rw] encryption_context_subset
3665
3807
  # A list of key-value pairs that must be included in the encryption
@@ -3670,7 +3812,7 @@ module Aws::KMS
3670
3812
  #
3671
3813
  #
3672
3814
  #
3673
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3815
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3674
3816
  # @return [Hash<String,String>]
3675
3817
  #
3676
3818
  # @!attribute [rw] encryption_context_equals
@@ -3681,7 +3823,7 @@ module Aws::KMS
3681
3823
  #
3682
3824
  #
3683
3825
  #
3684
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3826
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3685
3827
  # @return [Hash<String,String>]
3686
3828
  #
3687
3829
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GrantConstraints AWS API Documentation
@@ -3770,11 +3912,9 @@ module Aws::KMS
3770
3912
  #
3771
3913
  # The KMS key can be a symmetric encryption KMS key, HMAC KMS key,
3772
3914
  # asymmetric encryption KMS key, or asymmetric signing KMS key,
3773
- # including a [multi-Region
3774
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of
3775
- # any supported type. You cannot perform this operation on a KMS key
3776
- # in a custom key store, or on a KMS key in a different Amazon Web
3777
- # Services account.
3915
+ # including a [multi-Region key][1] of any supported type. You cannot
3916
+ # perform this operation on a KMS key in a custom key store, or on a
3917
+ # KMS key in a different Amazon Web Services account.
3778
3918
  #
3779
3919
  # Specify the key ID or key ARN of the KMS key.
3780
3920
  #
@@ -3787,6 +3927,10 @@ module Aws::KMS
3787
3927
  #
3788
3928
  # To get the key ID and key ARN for a KMS key, use ListKeys or
3789
3929
  # DescribeKey.
3930
+ #
3931
+ #
3932
+ #
3933
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
3790
3934
  # @return [String]
3791
3935
  #
3792
3936
  # @!attribute [rw] import_token
@@ -3838,7 +3982,53 @@ module Aws::KMS
3838
3982
  #
3839
3983
  #
3840
3984
  #
3841
- # [1]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
3985
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
3986
+ # @return [String]
3987
+ #
3988
+ # @!attribute [rw] import_type
3989
+ # Indicates whether the key material being imported is previously
3990
+ # associated with this KMS key or not. This parameter is optional and
3991
+ # only usable with symmetric encryption keys. If no key material has
3992
+ # ever been imported into the KMS key, and this parameter is omitted,
3993
+ # the parameter defaults to `NEW_KEY_MATERIAL`. After the first key
3994
+ # material is imported, if this parameter is omitted then the
3995
+ # parameter defaults to `EXISTING_KEY_MATERIAL`.
3996
+ #
3997
+ # For multi-Region keys, you must first import new key material into
3998
+ # the primary Region key. You should use the `NEW_KEY_MATERIAL` import
3999
+ # type when importing key material into the primary Region key. Then,
4000
+ # you can import the same key material into the replica Region key.
4001
+ # The import type for the replica Region key should be
4002
+ # `EXISTING_KEY_MATERIAL`.
4003
+ # @return [String]
4004
+ #
4005
+ # @!attribute [rw] key_material_description
4006
+ # Description for the key material being imported. This parameter is
4007
+ # optional and only usable with symmetric encryption keys. If you do
4008
+ # not specify a key material description, KMS retains the value you
4009
+ # specified when you last imported the same key material into this KMS
4010
+ # key.
4011
+ # @return [String]
4012
+ #
4013
+ # @!attribute [rw] key_material_id
4014
+ # Identifies the key material being imported. This parameter is
4015
+ # optional and only usable with symmetric encryption keys. You cannot
4016
+ # specify a key material ID with `ImportType` set to
4017
+ # `NEW_KEY_MATERIAL`. Whenever you import key material into a
4018
+ # symmetric encryption key, KMS assigns a unique identifier to the key
4019
+ # material based on the KMS key ID and the imported key material. When
4020
+ # you re-import key material with a specified key material ID, KMS:
4021
+ #
4022
+ # * Computes the identifier for the key material
4023
+ #
4024
+ # * Matches the computed identifier against the specified key material
4025
+ # ID
4026
+ #
4027
+ # * Verifies that the key material ID is already associated with the
4028
+ # KMS key
4029
+ #
4030
+ # To get the list of key material IDs associated with a KMS key, use
4031
+ # ListKeyRotations.
3842
4032
  # @return [String]
3843
4033
  #
3844
4034
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterialRequest AWS API Documentation
@@ -3848,14 +4038,35 @@ module Aws::KMS
3848
4038
  :import_token,
3849
4039
  :encrypted_key_material,
3850
4040
  :valid_to,
3851
- :expiration_model)
4041
+ :expiration_model,
4042
+ :import_type,
4043
+ :key_material_description,
4044
+ :key_material_id)
3852
4045
  SENSITIVE = []
3853
4046
  include Aws::Structure
3854
4047
  end
3855
4048
 
4049
+ # @!attribute [rw] key_id
4050
+ # The Amazon Resource Name ([key ARN][1]) of the KMS key into which
4051
+ # key material was imported.
4052
+ #
4053
+ #
4054
+ #
4055
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
4056
+ # @return [String]
4057
+ #
4058
+ # @!attribute [rw] key_material_id
4059
+ # Identifies the imported key material.
4060
+ # @return [String]
4061
+ #
3856
4062
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterialResponse AWS API Documentation
3857
4063
  #
3858
- class ImportKeyMaterialResponse < Aws::EmptyStructure; end
4064
+ class ImportKeyMaterialResponse < Struct.new(
4065
+ :key_id,
4066
+ :key_material_id)
4067
+ SENSITIVE = []
4068
+ include Aws::Structure
4069
+ end
3859
4070
 
3860
4071
  # The request was rejected because the specified KMS key cannot decrypt
3861
4072
  # the data. The `KeyId` in a Decrypt request and the `SourceKeyId` in a
@@ -3874,8 +4085,10 @@ module Aws::KMS
3874
4085
  end
3875
4086
 
3876
4087
  # The request was rejected because the key material in the request is,
3877
- # expired, invalid, or is not the same key material that was previously
3878
- # imported into this KMS key.
4088
+ # expired, invalid, or does not meet expectations. For example, it is
4089
+ # not the same key material that was previously imported or KMS expected
4090
+ # new key material but the key material being imported is already
4091
+ # associated with the KMS key.
3879
4092
  #
3880
4093
  # @!attribute [rw] message
3881
4094
  # @return [String]
@@ -4182,7 +4395,7 @@ module Aws::KMS
4182
4395
  #
4183
4396
  #
4184
4397
  #
4185
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4398
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4186
4399
  # @return [String]
4187
4400
  #
4188
4401
  # @!attribute [rw] key_state
@@ -4209,11 +4422,12 @@ module Aws::KMS
4209
4422
  # @return [Time]
4210
4423
  #
4211
4424
  # @!attribute [rw] valid_to
4212
- # The time at which the imported key material expires. When the key
4213
- # material expires, KMS deletes the key material and the KMS key
4214
- # becomes unusable. This value is present only for KMS keys whose
4215
- # `Origin` is `EXTERNAL` and whose `ExpirationModel` is
4216
- # `KEY_MATERIAL_EXPIRES`, otherwise this value is omitted.
4425
+ # The earliest time at which any imported key material permanently
4426
+ # associated with this KMS key expires. When a key material expires,
4427
+ # KMS deletes the key material and the KMS key becomes unusable. This
4428
+ # value is present only for KMS keys whose `Origin` is `EXTERNAL` and
4429
+ # the `ExpirationModel` is `KEY_MATERIAL_EXPIRES`, otherwise this
4430
+ # value is omitted.
4217
4431
  # @return [Time]
4218
4432
  #
4219
4433
  # @!attribute [rw] origin
@@ -4232,7 +4446,7 @@ module Aws::KMS
4232
4446
  #
4233
4447
  #
4234
4448
  #
4235
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4449
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4236
4450
  # @return [String]
4237
4451
  #
4238
4452
  # @!attribute [rw] cloud_hsm_cluster_id
@@ -4244,7 +4458,7 @@ module Aws::KMS
4244
4458
  #
4245
4459
  #
4246
4460
  #
4247
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4461
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4248
4462
  # @return [String]
4249
4463
  #
4250
4464
  # @!attribute [rw] expiration_model
@@ -4367,6 +4581,15 @@ module Aws::KMS
4367
4581
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
4368
4582
  # @return [Types::XksKeyConfigurationType]
4369
4583
  #
4584
+ # @!attribute [rw] current_key_material_id
4585
+ # Identifies the current key material. This value is present for
4586
+ # symmetric encryption keys with `AWS_KMS` or `EXTERNAL` origin. These
4587
+ # KMS keys support automatic or on-demand key rotation and can have
4588
+ # multiple key materials associated with them. KMS uses the current
4589
+ # key material for both encryption and decryption, and the non-current
4590
+ # key material for decryption operations only.
4591
+ # @return [String]
4592
+ #
4370
4593
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/KeyMetadata AWS API Documentation
4371
4594
  #
4372
4595
  class KeyMetadata < Struct.new(
@@ -4394,7 +4617,8 @@ module Aws::KMS
4394
4617
  :multi_region_configuration,
4395
4618
  :pending_deletion_window_in_days,
4396
4619
  :mac_algorithms,
4397
- :xks_key_configuration)
4620
+ :xks_key_configuration,
4621
+ :current_key_material_id)
4398
4622
  SENSITIVE = []
4399
4623
  include Aws::Structure
4400
4624
  end
@@ -4413,9 +4637,9 @@ module Aws::KMS
4413
4637
  include Aws::Structure
4414
4638
  end
4415
4639
 
4416
- # The request was rejected because a quota was exceeded. For more
4417
- # information, see [Quotas][1] in the *Key Management Service Developer
4418
- # Guide*.
4640
+ # The request was rejected because a length constraint or quota was
4641
+ # exceeded. For more information, see [Quotas][1] in the *Key Management
4642
+ # Service Developer Guide*.
4419
4643
  #
4420
4644
  #
4421
4645
  #
@@ -4673,6 +4897,18 @@ module Aws::KMS
4673
4897
  # DescribeKey.
4674
4898
  # @return [String]
4675
4899
  #
4900
+ # @!attribute [rw] include_key_material
4901
+ # Use this optional parameter to control which key materials
4902
+ # associated with this key are listed in the response. The default
4903
+ # value of this parameter is `ROTATIONS_ONLY`. If you omit this
4904
+ # parameter, KMS returns information on the key materials created by
4905
+ # automatic or on-demand key rotation. When you specify a value of
4906
+ # `ALL_KEY_MATERIAL`, KMS adds the first key material and any imported
4907
+ # key material pending rotation to the response. This parameter can
4908
+ # only be used with KMS keys that support automatic or on-demand key
4909
+ # rotation.
4910
+ # @return [String]
4911
+ #
4676
4912
  # @!attribute [rw] limit
4677
4913
  # Use this parameter to specify the maximum number of items to return.
4678
4914
  # When this value is present, KMS does not return more than the
@@ -4693,6 +4929,7 @@ module Aws::KMS
4693
4929
  #
4694
4930
  class ListKeyRotationsRequest < Struct.new(
4695
4931
  :key_id,
4932
+ :include_key_material,
4696
4933
  :limit,
4697
4934
  :marker)
4698
4935
  SENSITIVE = []
@@ -4700,7 +4937,10 @@ module Aws::KMS
4700
4937
  end
4701
4938
 
4702
4939
  # @!attribute [rw] rotations
4703
- # A list of completed key material rotations.
4940
+ # A list of completed key material rotations. When the optional input
4941
+ # parameter `IncludeKeyMaterial` is specified with a value of
4942
+ # `ALL_KEY_MATERIAL`, this list includes the first key material and
4943
+ # any imported key material pending rotation.
4704
4944
  # @return [Array<Types::RotationsListEntry>]
4705
4945
  #
4706
4946
  # @!attribute [rw] next_marker
@@ -5023,6 +5263,18 @@ module Aws::KMS
5023
5263
  # that I make are not always immediately visible][2] in the *Amazon
5024
5264
  # Web Services Identity and Access Management User Guide*.
5025
5265
  #
5266
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are
5267
+ # missing from a key policy statement, the policy statement has no
5268
+ # effect. When a key policy statement is missing one of these
5269
+ # elements, the KMS console correctly reports an error, but the
5270
+ # `PutKeyPolicy` API request succeeds, even though the policy
5271
+ # statement is ineffective.
5272
+ #
5273
+ # For more information on required key policy elements, see [Elements
5274
+ # in a key policy][3] in the *Key Management Service Developer Guide*.
5275
+ #
5276
+ # </note>
5277
+ #
5026
5278
  # A key policy document can include only the following characters:
5027
5279
  #
5028
5280
  # * Printable ASCII characters from the space character (`\u0020`)
@@ -5034,18 +5286,24 @@ module Aws::KMS
5034
5286
  # * The tab (`\u0009`), line feed (`\u000A`), and carriage return
5035
5287
  # (`\u000D`) special characters
5036
5288
  #
5037
- # For information about key policies, see [Key policies in KMS][3] in
5289
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
5290
+ # `LimitExceededException`.
5291
+ #
5292
+ # </note>
5293
+ #
5294
+ # For information about key policies, see [Key policies in KMS][4] in
5038
5295
  # the *Key Management Service Developer Guide*.For help writing and
5039
5296
  # formatting a JSON policy document, see the [IAM JSON Policy
5040
- # Reference][4] in the <i> <i>Identity and Access Management User
5297
+ # Reference][5] in the <i> <i>Identity and Access Management User
5041
5298
  # Guide</i> </i>.
5042
5299
  #
5043
5300
  #
5044
5301
  #
5045
5302
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
5046
5303
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
5047
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
5048
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
5304
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
5305
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
5306
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
5049
5307
  # @return [String]
5050
5308
  #
5051
5309
  # @!attribute [rw] bypass_policy_lockout_safety_check
@@ -5103,7 +5361,7 @@ module Aws::KMS
5103
5361
  #
5104
5362
  #
5105
5363
  #
5106
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5364
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5107
5365
  # @return [Hash<String,String>]
5108
5366
  #
5109
5367
  # @!attribute [rw] source_key_id
@@ -5193,7 +5451,7 @@ module Aws::KMS
5193
5451
  #
5194
5452
  #
5195
5453
  #
5196
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5454
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5197
5455
  # @return [Hash<String,String>]
5198
5456
  #
5199
5457
  # @!attribute [rw] source_encryption_algorithm
@@ -5230,19 +5488,19 @@ module Aws::KMS
5230
5488
  #
5231
5489
  #
5232
5490
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5233
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5491
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5234
5492
  # @return [Array<String>]
5235
5493
  #
5236
5494
  # @!attribute [rw] dry_run
5237
5495
  # Checks if your request will succeed. `DryRun` is an optional
5238
5496
  # parameter.
5239
5497
  #
5240
- # To learn more about how to use this parameter, see [Testing your KMS
5241
- # API calls][1] in the *Key Management Service Developer Guide*.
5498
+ # To learn more about how to use this parameter, see [Testing your
5499
+ # permissions][1] in the *Key Management Service Developer Guide*.
5242
5500
  #
5243
5501
  #
5244
5502
  #
5245
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5503
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5246
5504
  # @return [Boolean]
5247
5505
  #
5248
5506
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncryptRequest AWS API Documentation
@@ -5290,6 +5548,18 @@ module Aws::KMS
5290
5548
  # The encryption algorithm that was used to reencrypt the data.
5291
5549
  # @return [String]
5292
5550
  #
5551
+ # @!attribute [rw] source_key_material_id
5552
+ # The identifier of the key material used to originally encrypt the
5553
+ # data. This field is present only when the original encryption used a
5554
+ # symmetric encryption KMS key.
5555
+ # @return [String]
5556
+ #
5557
+ # @!attribute [rw] destination_key_material_id
5558
+ # The identifier of the key material used to reencrypt the data. This
5559
+ # field is present only when data is reencrypted using a symmetric
5560
+ # encryption KMS key.
5561
+ # @return [String]
5562
+ #
5293
5563
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncryptResponse AWS API Documentation
5294
5564
  #
5295
5565
  class ReEncryptResponse < Struct.new(
@@ -5297,7 +5567,9 @@ module Aws::KMS
5297
5567
  :source_key_id,
5298
5568
  :key_id,
5299
5569
  :source_encryption_algorithm,
5300
- :destination_encryption_algorithm)
5570
+ :destination_encryption_algorithm,
5571
+ :source_key_material_id,
5572
+ :destination_key_material_id)
5301
5573
  SENSITIVE = []
5302
5574
  include Aws::Structure
5303
5575
  end
@@ -5306,24 +5578,26 @@ module Aws::KMS
5306
5578
  # the API operation.
5307
5579
  #
5308
5580
  # This data type is designed to support Amazon Web Services Nitro
5309
- # Enclaves, which lets you create an isolated compute environment in
5310
- # Amazon EC2. For information about the interaction between KMS and
5311
- # Amazon Web Services Nitro Enclaves, see [How Amazon Web Services Nitro
5312
- # Enclaves uses KMS][1] in the *Key Management Service Developer Guide*.
5581
+ # Enclaves and Amazon Web Services NitroTPM, which lets you create an
5582
+ # attested environment in Amazon EC2. For information about the
5583
+ # interaction between KMS and Amazon Web Services Nitro Enclaves or
5584
+ # Amazon Web Services NitroTPM, see [Cryptographic attestation support
5585
+ # in KMS][1] in the *Key Management Service Developer Guide*.
5313
5586
  #
5314
5587
  #
5315
5588
  #
5316
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5589
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
5317
5590
  #
5318
5591
  # @!attribute [rw] key_encryption_algorithm
5319
5592
  # The encryption algorithm that KMS should use with the public key for
5320
- # an Amazon Web Services Nitro Enclave to encrypt plaintext values for
5321
- # the response. The only valid value is `RSAES_OAEP_SHA_256`.
5593
+ # an Amazon Web Services Nitro Enclave or NitroTPM to encrypt
5594
+ # plaintext values for the response. The only valid value is
5595
+ # `RSAES_OAEP_SHA_256`.
5322
5596
  # @return [String]
5323
5597
  #
5324
5598
  # @!attribute [rw] attestation_document
5325
- # The attestation document for an Amazon Web Services Nitro Enclave.
5326
- # This document includes the enclave's public key.
5599
+ # The attestation document for an Amazon Web Services Nitro Enclave or
5600
+ # a NitroTPM. This document includes the enclave's public key.
5327
5601
  # @return [String]
5328
5602
  #
5329
5603
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RecipientInfo AWS API Documentation
@@ -5363,33 +5637,23 @@ module Aws::KMS
5363
5637
  # [KMS service endpoints][1] in the *Amazon Web Services General
5364
5638
  # Reference*.
5365
5639
  #
5366
- # <note markdown="1"> HMAC KMS keys are not supported in all Amazon Web Services Regions.
5367
- # If you try to replicate an HMAC KMS key in an Amazon Web Services
5368
- # Region in which HMAC keys are not supported, the `ReplicateKey`
5369
- # operation returns an `UnsupportedOperationException`. For a list of
5370
- # Regions in which HMAC KMS keys are supported, see [HMAC keys in
5371
- # KMS][2] in the *Key Management Service Developer Guide*.
5372
- #
5373
- # </note>
5374
- #
5375
5640
  # The replica must be in a different Amazon Web Services Region than
5376
5641
  # its primary key and other replicas of that primary key, but in the
5377
5642
  # same Amazon Web Services partition. KMS must be available in the
5378
5643
  # replica Region. If the Region is not enabled by default, the Amazon
5379
5644
  # Web Services account must be enabled in the Region. For information
5380
5645
  # about Amazon Web Services partitions, see [Amazon Resource Names
5381
- # (ARNs)][3] in the *Amazon Web Services General Reference*. For
5646
+ # (ARNs)][2] in the *Amazon Web Services General Reference*. For
5382
5647
  # information about enabling and disabling Regions, see [Enabling a
5383
- # Region][4] and [Disabling a Region][5] in the *Amazon Web Services
5648
+ # Region][3] and [Disabling a Region][4] in the *Amazon Web Services
5384
5649
  # General Reference*.
5385
5650
  #
5386
5651
  #
5387
5652
  #
5388
5653
  # [1]: https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region
5389
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
5390
- # [3]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
5391
- # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
5392
- # [5]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
5654
+ # [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
5655
+ # [3]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
5656
+ # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
5393
5657
  # @return [String]
5394
5658
  #
5395
5659
  # @!attribute [rw] policy
@@ -5439,7 +5703,7 @@ module Aws::KMS
5439
5703
  #
5440
5704
  #
5441
5705
  #
5442
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
5706
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
5443
5707
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
5444
5708
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
5445
5709
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
@@ -5512,7 +5776,7 @@ module Aws::KMS
5512
5776
  # When you add tags to an Amazon Web Services resource, Amazon Web
5513
5777
  # Services generates a cost allocation report with usage and costs
5514
5778
  # aggregated by tags. Tags can also be used to control access to a KMS
5515
- # key. For details, see [Tagging Keys][3].
5779
+ # key. For details, see [Tags in KMS][3].
5516
5780
  #
5517
5781
  #
5518
5782
  #
@@ -5603,12 +5867,12 @@ module Aws::KMS
5603
5867
  # Checks if your request will succeed. `DryRun` is an optional
5604
5868
  # parameter.
5605
5869
  #
5606
- # To learn more about how to use this parameter, see [Testing your KMS
5607
- # API calls][1] in the *Key Management Service Developer Guide*.
5870
+ # To learn more about how to use this parameter, see [Testing your
5871
+ # permissions][1] in the *Key Management Service Developer Guide*.
5608
5872
  #
5609
5873
  #
5610
5874
  #
5611
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5875
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5612
5876
  # @return [Boolean]
5613
5877
  #
5614
5878
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RetireGrantRequest AWS API Documentation
@@ -5651,12 +5915,12 @@ module Aws::KMS
5651
5915
  # Checks if your request will succeed. `DryRun` is an optional
5652
5916
  # parameter.
5653
5917
  #
5654
- # To learn more about how to use this parameter, see [Testing your KMS
5655
- # API calls][1] in the *Key Management Service Developer Guide*.
5918
+ # To learn more about how to use this parameter, see [Testing your
5919
+ # permissions][1] in the *Key Management Service Developer Guide*.
5656
5920
  #
5657
5921
  #
5658
5922
  #
5659
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5923
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5660
5924
  # @return [Boolean]
5661
5925
  #
5662
5926
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RevokeGrantRequest AWS API Documentation
@@ -5672,10 +5936,10 @@ module Aws::KMS
5672
5936
  # @!attribute [rw] key_id
5673
5937
  # Identifies a symmetric encryption KMS key. You cannot perform
5674
5938
  # on-demand rotation of [asymmetric KMS keys][1], [HMAC KMS keys][2],
5675
- # KMS keys with [imported key material][3], or KMS keys in a [custom
5676
- # key store][4]. To perform on-demand rotation of a set of related
5677
- # [multi-Region keys][5], invoke the on-demand rotation on the primary
5678
- # key.
5939
+ # multi-Region KMS keys with [imported key material][3], or KMS keys
5940
+ # in a [custom key store][4]. To perform on-demand rotation of a set
5941
+ # of related [multi-Region keys][5], invoke the on-demand rotation on
5942
+ # the primary key.
5679
5943
  #
5680
5944
  # Specify the key ID or key ARN of the KMS key.
5681
5945
  #
@@ -5694,8 +5958,8 @@ module Aws::KMS
5694
5958
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
5695
5959
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
5696
5960
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
5697
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
5698
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
5961
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
5962
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
5699
5963
  # @return [String]
5700
5964
  #
5701
5965
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RotateKeyOnDemandRequest AWS API Documentation
@@ -5719,31 +5983,97 @@ module Aws::KMS
5719
5983
  include Aws::Structure
5720
5984
  end
5721
5985
 
5722
- # Contains information about completed key material rotations.
5986
+ # Each entry contains information about one of the key materials
5987
+ # associated with a KMS key.
5723
5988
  #
5724
5989
  # @!attribute [rw] key_id
5725
5990
  # Unique identifier of the key.
5726
5991
  # @return [String]
5727
5992
  #
5993
+ # @!attribute [rw] key_material_id
5994
+ # Unique identifier of the key material.
5995
+ # @return [String]
5996
+ #
5997
+ # @!attribute [rw] key_material_description
5998
+ # User-specified description of the key material. This field is only
5999
+ # present for symmetric encryption KMS keys with `EXTERNAL` origin.
6000
+ # @return [String]
6001
+ #
6002
+ # @!attribute [rw] import_state
6003
+ # Indicates if the key material is currently imported into KMS. It has
6004
+ # two possible values: `IMPORTED` or `PENDING_IMPORT`. This field is
6005
+ # only present for symmetric encryption KMS keys with `EXTERNAL`
6006
+ # origin.
6007
+ # @return [String]
6008
+ #
6009
+ # @!attribute [rw] key_material_state
6010
+ # There are four possible values for this field: `CURRENT`,
6011
+ # `NON_CURRENT`, `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` and
6012
+ # `PENDING_ROTATION`. KMS uses `CURRENT` key material for both
6013
+ # encryption and decryption and `NON_CURRENT` key material only for
6014
+ # decryption. `PENDING_ROTATION` identifies key material that has been
6015
+ # imported for on-demand key rotation but the rotation hasn't
6016
+ # completed. The key material state
6017
+ # `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` is unique to
6018
+ # multi-region, symmetric encryption keys with imported key material.
6019
+ # It indicates key material that has been imported into the primary
6020
+ # Region key but not all of the replica Region keys. When this key
6021
+ # material is imported in to all of the replica Region keys, the key
6022
+ # material state will change to `PENDING_ROTATION`. Key material in
6023
+ # `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` or `PENDING_ROTATION`
6024
+ # state is not permanently associated with the KMS key. You can delete
6025
+ # this key material and import different key material in its place.
6026
+ # The `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` and
6027
+ # `PENDING_ROTATION` values are only used in symmetric encryption keys
6028
+ # with imported key material. The other values, `CURRENT` and
6029
+ # `NON_CURRENT`, are used for all KMS keys that support automatic or
6030
+ # on-demand key rotation.
6031
+ # @return [String]
6032
+ #
6033
+ # @!attribute [rw] expiration_model
6034
+ # Indicates if the key material is configured to automatically expire.
6035
+ # There are two possible values for this field: `KEY_MATERIAL_EXPIRES`
6036
+ # and `KEY_MATERIAL_DOES_NOT_EXPIRE`. For any key material that
6037
+ # expires, the expiration date and time is indicated in `ValidTo`.
6038
+ # This field is only present for symmetric encryption KMS keys with
6039
+ # `EXTERNAL` origin.
6040
+ # @return [String]
6041
+ #
6042
+ # @!attribute [rw] valid_to
6043
+ # Date and time at which the key material expires. This field is only
6044
+ # present for symmetric encryption KMS keys with `EXTERNAL` origin in
6045
+ # rotation list entries with an `ExpirationModel` value of
6046
+ # `KEY_MATERIAL_EXPIRES`.
6047
+ # @return [Time]
6048
+ #
5728
6049
  # @!attribute [rw] rotation_date
5729
6050
  # Date and time that the key material rotation completed. Formatted as
5730
- # Unix time.
6051
+ # Unix time. This field is not present for the first key material or
6052
+ # an imported key material in `PENDING_ROTATION` state.
5731
6053
  # @return [Time]
5732
6054
  #
5733
6055
  # @!attribute [rw] rotation_type
5734
6056
  # Identifies whether the key material rotation was a scheduled
5735
- # [automatic rotation][1] or an [on-demand rotation][2].
6057
+ # [automatic rotation][1] or an [on-demand rotation][2]. This field is
6058
+ # not present for the first key material or an imported key material
6059
+ # in `PENDING_ROTATION` state.
5736
6060
  #
5737
6061
  #
5738
6062
  #
5739
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
5740
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-on-demand
6063
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
6064
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html
5741
6065
  # @return [String]
5742
6066
  #
5743
6067
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RotationsListEntry AWS API Documentation
5744
6068
  #
5745
6069
  class RotationsListEntry < Struct.new(
5746
6070
  :key_id,
6071
+ :key_material_id,
6072
+ :key_material_description,
6073
+ :import_state,
6074
+ :key_material_state,
6075
+ :expiration_model,
6076
+ :valid_to,
5747
6077
  :rotation_date,
5748
6078
  :rotation_type)
5749
6079
  SENSITIVE = []
@@ -5881,27 +6211,41 @@ module Aws::KMS
5881
6211
  # Tells KMS whether the value of the `Message` parameter should be
5882
6212
  # hashed as part of the signing algorithm. Use `RAW` for unhashed
5883
6213
  # messages; use `DIGEST` for message digests, which are already
5884
- # hashed.
6214
+ # hashed; use `EXTERNAL_MU` for 64-byte representative μ used in
6215
+ # ML-DSA signing as defined in NIST FIPS 204 Section 6.2.
5885
6216
  #
5886
6217
  # When the value of `MessageType` is `RAW`, KMS uses the standard
5887
6218
  # signing algorithm, which begins with a hash function. When the value
5888
6219
  # is `DIGEST`, KMS skips the hashing step in the signing algorithm.
6220
+ # When the value is `EXTERNAL_MU` KMS skips the concatenated hashing
6221
+ # of the public key hash and the message done in the ML-DSA signing
6222
+ # algorithm.
5889
6223
  #
5890
- # Use the `DIGEST` value only when the value of the `Message`
5891
- # parameter is a message digest. If you use the `DIGEST` value with an
5892
- # unhashed message, the security of the signing operation can be
5893
- # compromised.
6224
+ # Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
6225
+ # `Message` parameter is a message digest. If you use the `DIGEST`
6226
+ # value with an unhashed message, the security of the signing
6227
+ # operation can be compromised.
5894
6228
  #
5895
- # When the value of `MessageType`is `DIGEST`, the length of the
6229
+ # When using ECC\_NIST\_EDWARDS25519 KMS keys:
6230
+ #
6231
+ # * ED25519\_SHA\_512 signing algorithm requires KMS `MessageType:RAW`
6232
+ #
6233
+ # * ED25519\_PH\_SHA\_512 signing algorithm requires KMS
6234
+ # `MessageType:DIGEST`
6235
+ #
6236
+ # When the value of `MessageType` is `DIGEST`, the length of the
5896
6237
  # `Message` value must match the length of hashed messages for the
5897
6238
  # specified signing algorithm.
5898
6239
  #
6240
+ # When the value of `MessageType` is `EXTERNAL_MU` the length of the
6241
+ # `Message` value must be 64 bytes.
6242
+ #
5899
6243
  # You can submit a message digest and omit the `MessageType` or
5900
6244
  # specify `RAW` so the digest is hashed again while signing. However,
5901
6245
  # this can cause verification failures when verifying with a system
5902
6246
  # that assumes a single hash.
5903
6247
  #
5904
- # The hashing algorithm in that `Sign` uses is based on the
6248
+ # The hashing algorithm that `Sign` uses is based on the
5905
6249
  # `SigningAlgorithm` value.
5906
6250
  #
5907
6251
  # * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
@@ -5913,12 +6257,15 @@ module Aws::KMS
5913
6257
  # * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
5914
6258
  # algorithm.
5915
6259
  #
6260
+ # * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256
6261
+ # hashing algorithm.
6262
+ #
5916
6263
  # * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
5917
6264
  # verification with SM2 key pairs][1].
5918
6265
  #
5919
6266
  #
5920
6267
  #
5921
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
6268
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
5922
6269
  # @return [String]
5923
6270
  #
5924
6271
  # @!attribute [rw] grant_tokens
@@ -5932,7 +6279,7 @@ module Aws::KMS
5932
6279
  #
5933
6280
  #
5934
6281
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5935
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6282
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5936
6283
  # @return [Array<String>]
5937
6284
  #
5938
6285
  # @!attribute [rw] signing_algorithm
@@ -5948,12 +6295,12 @@ module Aws::KMS
5948
6295
  # Checks if your request will succeed. `DryRun` is an optional
5949
6296
  # parameter.
5950
6297
  #
5951
- # To learn more about how to use this parameter, see [Testing your KMS
5952
- # API calls][1] in the *Key Management Service Developer Guide*.
6298
+ # To learn more about how to use this parameter, see [Testing your
6299
+ # permissions][1] in the *Key Management Service Developer Guide*.
5953
6300
  #
5954
6301
  #
5955
6302
  #
5956
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
6303
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5957
6304
  # @return [Boolean]
5958
6305
  #
5959
6306
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/SignRequest AWS API Documentation
@@ -6178,8 +6525,8 @@ module Aws::KMS
6178
6525
  #
6179
6526
  #
6180
6527
  #
6181
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
6182
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
6528
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
6529
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
6183
6530
  # @return [String]
6184
6531
  #
6185
6532
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/UpdateAliasRequest AWS API Documentation
@@ -6293,6 +6640,16 @@ module Aws::KMS
6293
6640
  # To change this value, the external key store must be disconnected.
6294
6641
  # @return [String]
6295
6642
  #
6643
+ # @!attribute [rw] xks_proxy_vpc_endpoint_service_owner
6644
+ # Changes the Amazon Web Services account ID that KMS uses to identify
6645
+ # the Amazon VPC endpoint service for your external key store proxy
6646
+ # (XKS proxy). This parameter is optional. If not specified, the
6647
+ # current Amazon Web Services account ID for the VPC endpoint service
6648
+ # will not be updated.
6649
+ #
6650
+ # To change this value, the external key store must be disconnected.
6651
+ # @return [String]
6652
+ #
6296
6653
  # @!attribute [rw] xks_proxy_authentication_credential
6297
6654
  # Changes the credentials that KMS uses to sign requests to the
6298
6655
  # external key store proxy (XKS proxy). This parameter is valid only
@@ -6340,6 +6697,7 @@ module Aws::KMS
6340
6697
  :xks_proxy_uri_endpoint,
6341
6698
  :xks_proxy_uri_path,
6342
6699
  :xks_proxy_vpc_endpoint_service_name,
6700
+ :xks_proxy_vpc_endpoint_service_owner,
6343
6701
  :xks_proxy_authentication_credential,
6344
6702
  :xks_proxy_connectivity)
6345
6703
  SENSITIVE = [:key_store_password]
@@ -6458,19 +6816,19 @@ module Aws::KMS
6458
6816
  #
6459
6817
  #
6460
6818
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
6461
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6819
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
6462
6820
  # @return [Array<String>]
6463
6821
  #
6464
6822
  # @!attribute [rw] dry_run
6465
6823
  # Checks if your request will succeed. `DryRun` is an optional
6466
6824
  # parameter.
6467
6825
  #
6468
- # To learn more about how to use this parameter, see [Testing your KMS
6469
- # API calls][1] in the *Key Management Service Developer Guide*.
6826
+ # To learn more about how to use this parameter, see [Testing your
6827
+ # permissions][1] in the *Key Management Service Developer Guide*.
6470
6828
  #
6471
6829
  #
6472
6830
  #
6473
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
6831
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
6474
6832
  # @return [Boolean]
6475
6833
  #
6476
6834
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/VerifyMacRequest AWS API Documentation
@@ -6554,28 +6912,42 @@ module Aws::KMS
6554
6912
  # Tells KMS whether the value of the `Message` parameter should be
6555
6913
  # hashed as part of the signing algorithm. Use `RAW` for unhashed
6556
6914
  # messages; use `DIGEST` for message digests, which are already
6557
- # hashed.
6915
+ # hashed; use `EXTERNAL_MU` for 64-byte representative μ used in
6916
+ # ML-DSA signing as defined in NIST FIPS 204 Section 6.2.
6558
6917
  #
6559
6918
  # When the value of `MessageType` is `RAW`, KMS uses the standard
6560
6919
  # signing algorithm, which begins with a hash function. When the value
6561
6920
  # is `DIGEST`, KMS skips the hashing step in the signing algorithm.
6921
+ # When the value is `EXTERNAL_MU` KMS skips the concatenated hashing
6922
+ # of the public key hash and the message done in the ML-DSA signing
6923
+ # algorithm.
6924
+ #
6925
+ # Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
6926
+ # `Message` parameter is a message digest. If you use the `DIGEST`
6927
+ # value with an unhashed message, the security of the signing
6928
+ # operation can be compromised.
6929
+ #
6930
+ # When using ECC\_NIST\_EDWARDS25519 KMS keys:
6562
6931
  #
6563
- # Use the `DIGEST` value only when the value of the `Message`
6564
- # parameter is a message digest. If you use the `DIGEST` value with an
6565
- # unhashed message, the security of the verification operation can be
6566
- # compromised.
6932
+ # * ED25519\_SHA\_512 signing algorithm requires KMS `MessageType:RAW`
6567
6933
  #
6568
- # When the value of `MessageType`is `DIGEST`, the length of the
6934
+ # * ED25519\_PH\_SHA\_512 signing algorithm requires KMS
6935
+ # `MessageType:DIGEST`
6936
+ #
6937
+ # When the value of `MessageType` is `DIGEST`, the length of the
6569
6938
  # `Message` value must match the length of hashed messages for the
6570
6939
  # specified signing algorithm.
6571
6940
  #
6941
+ # When the value of `MessageType` is `EXTERNAL_MU` the length of the
6942
+ # `Message` value must be 64 bytes.
6943
+ #
6572
6944
  # You can submit a message digest and omit the `MessageType` or
6573
6945
  # specify `RAW` so the digest is hashed again while signing. However,
6574
6946
  # if the signed message is hashed once while signing, but twice while
6575
6947
  # verifying, verification fails, even when the message hasn't
6576
6948
  # changed.
6577
6949
  #
6578
- # The hashing algorithm in that `Verify` uses is based on the
6950
+ # The hashing algorithm that `Verify` uses is based on the
6579
6951
  # `SigningAlgorithm` value.
6580
6952
  #
6581
6953
  # * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
@@ -6587,12 +6959,15 @@ module Aws::KMS
6587
6959
  # * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
6588
6960
  # algorithm.
6589
6961
  #
6962
+ # * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256
6963
+ # hashing algorithm.
6964
+ #
6590
6965
  # * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
6591
6966
  # verification with SM2 key pairs][1].
6592
6967
  #
6593
6968
  #
6594
6969
  #
6595
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
6970
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
6596
6971
  # @return [String]
6597
6972
  #
6598
6973
  # @!attribute [rw] signature
@@ -6615,19 +6990,19 @@ module Aws::KMS
6615
6990
  #
6616
6991
  #
6617
6992
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
6618
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6993
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
6619
6994
  # @return [Array<String>]
6620
6995
  #
6621
6996
  # @!attribute [rw] dry_run
6622
6997
  # Checks if your request will succeed. `DryRun` is an optional
6623
6998
  # parameter.
6624
6999
  #
6625
- # To learn more about how to use this parameter, see [Testing your KMS
6626
- # API calls][1] in the *Key Management Service Developer Guide*.
7000
+ # To learn more about how to use this parameter, see [Testing your
7001
+ # permissions][1] in the *Key Management Service Developer Guide*.
6627
7002
  #
6628
7003
  #
6629
7004
  #
6630
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
7005
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
6631
7006
  # @return [Boolean]
6632
7007
  #
6633
7008
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/VerifyRequest AWS API Documentation
@@ -6828,6 +7203,13 @@ module Aws::KMS
6828
7203
  # with KMS.
6829
7204
  # @return [String]
6830
7205
  #
7206
+ # @!attribute [rw] vpc_endpoint_service_owner
7207
+ # The Amazon Web Services account ID that owns the Amazon VPC endpoint
7208
+ # service used to communicate with the external key store proxy (XKS).
7209
+ # This field appears only when the XKS uses an VPC endpoint service to
7210
+ # communicate with KMS.
7211
+ # @return [String]
7212
+ #
6831
7213
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/XksProxyConfigurationType AWS API Documentation
6832
7214
  #
6833
7215
  class XksProxyConfigurationType < Struct.new(
@@ -6835,7 +7217,8 @@ module Aws::KMS
6835
7217
  :access_key_id,
6836
7218
  :uri_endpoint,
6837
7219
  :uri_path,
6838
- :vpc_endpoint_service_name)
7220
+ :vpc_endpoint_service_name,
7221
+ :vpc_endpoint_service_owner)
6839
7222
  SENSITIVE = [:access_key_id]
6840
7223
  include Aws::Structure
6841
7224
  end