aws-sdk-kms 1.102.0 → 1.103.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +5 -0
  3. data/VERSION +1 -1
  4. data/lib/aws-sdk-kms/client.rb +622 -485
  5. data/lib/aws-sdk-kms/client_api.rb +35 -1
  6. data/lib/aws-sdk-kms/types.rb +441 -187
  7. data/lib/aws-sdk-kms.rb +1 -1
  8. data/sig/client.rbs +24 -4
  9. data/sig/types.rbs +30 -1
  10. metadata +1 -1
data/lib/aws-sdk-kms/client.rb CHANGED
@@ -503,7 +503,7 @@ module Aws::KMS
503
503
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
504
504
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
505
505
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
506
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
506
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
507
507
  #
508
508
  # @option params [required, String] :key_id
509
509
  # Identifies the KMS key whose deletion is being canceled.
@@ -575,9 +575,9 @@ module Aws::KMS
575
575
  # custom key store is connected. To get the connection state of the
576
576
  # custom key store, use the DescribeCustomKeyStores operation.
577
577
  #
578
- # This operation is part of the [custom key stores][1] feature in KMS,
579
- # which combines the convenience and extensive integration of KMS with
580
- # the isolation and control of a key store that you own and manage.
578
+ # This operation is part of the custom key stores feature in KMS, which
579
+ # combines the convenience and extensive integration of KMS with the
580
+ # isolation and control of a key store that you own and manage.
581
581
  #
582
582
  # The `ConnectCustomKeyStore` operation might fail for various reasons.
583
583
  # To find the reason, use the DescribeCustomKeyStores operation and see
@@ -651,14 +651,14 @@ module Aws::KMS
651
651
  #
652
652
  #
653
653
  #
654
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
654
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
655
655
  # [2]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html
656
656
  # [3]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html
657
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
657
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
658
658
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
659
659
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
660
660
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
661
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
661
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
662
662
  #
663
663
  # @option params [required, String] :custom_key_store_id
664
664
  # Enter the key store ID of the custom key store that you want to
@@ -720,7 +720,7 @@ module Aws::KMS
720
720
  #
721
721
  # The alias must be unique in the account and Region, but you can have
722
722
  # aliases with the same name in different Regions. For detailed
723
- # information about aliases, see [Using aliases][3] in the *Key
723
+ # information about aliases, see [Aliases in KMS][3] in the *Key
724
724
  # Management Service Developer Guide*.
725
725
  #
726
726
  # This operation does not return a response. To get the alias that you
@@ -756,12 +756,12 @@ module Aws::KMS
756
756
  #
757
757
  #
758
758
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
759
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
759
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
760
760
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
761
761
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
762
762
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
763
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
764
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
763
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html
764
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
765
765
  #
766
766
  # @option params [required, String] :alias_name
767
767
  # Specifies the alias name. This value must begin with `alias/` followed
@@ -788,7 +788,7 @@ module Aws::KMS
788
788
  # A valid key ID is required. If you supply a null or empty string
789
789
  # value, this operation returns an error.
790
790
  #
791
- # For help finding the key ID and ARN, see [Finding the Key ID and
791
+ # For help finding the key ID and ARN, see [Find the key ID and key
792
792
  # ARN][2] in the <i> <i>Key Management Service Developer Guide</i> </i>.
793
793
  #
794
794
  # Specify the key ID or key ARN of the KMS key.
@@ -806,7 +806,7 @@ module Aws::KMS
806
806
  #
807
807
  #
808
808
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
809
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn
809
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html
810
810
  #
811
811
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
812
812
  #
@@ -844,9 +844,9 @@ module Aws::KMS
844
844
  # stores][4] backed by an external key store proxy and external key
845
845
  # manager outside of Amazon Web Services.
846
846
  #
847
- # This operation is part of the [custom key stores][1] feature in KMS,
848
- # which combines the convenience and extensive integration of KMS with
849
- # the isolation and control of a key store that you own and manage.
847
+ # This operation is part of the custom key stores feature in KMS, which
848
+ # combines the convenience and extensive integration of KMS with the
849
+ # isolation and control of a key store that you own and manage.
850
850
  #
851
851
  # Before you create the custom key store, the required elements must be
852
852
  # in place and operational. We recommend that you use the test tools
@@ -899,9 +899,6 @@ module Aws::KMS
899
899
  # immediately, you might want to connect it to verify that all settings
900
900
  # are correct and then disconnect it until you are ready to use it.
901
901
  #
902
- # For help with failures, see [Troubleshooting a custom key store][7] in
903
- # the *Key Management Service Developer Guide*.
904
- #
905
902
  # **Cross-account use**: No. You cannot perform this operation on a
906
903
  # custom key store in a different Amazon Web Services account.
907
904
  #
@@ -924,7 +921,7 @@ module Aws::KMS
924
921
  #
925
922
  #
926
923
  #
927
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
924
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
928
925
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
929
926
  # [3]: https://docs.aws.amazon.com/cloudhsm/latest/userguide/clusters.html
930
927
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
@@ -933,7 +930,7 @@ module Aws::KMS
933
930
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
934
931
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
935
932
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
936
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
933
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
937
934
  #
938
935
  # @option params [required, String] :custom_key_store_name
939
936
  # Specifies a friendly name for the custom key store. The name must be
@@ -987,7 +984,7 @@ module Aws::KMS
987
984
  #
988
985
  #
989
986
  #
990
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
987
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
991
988
  #
992
989
  # @option params [String] :custom_key_store_type
993
990
  # Specifies the type of custom key store. The default value is
@@ -1088,7 +1085,7 @@ module Aws::KMS
1088
1085
  # `RawSecretAccessKey`, a secret key, and `AccessKeyId`, a unique
1089
1086
  # identifier for the `RawSecretAccessKey`. For character requirements,
1090
1087
  # see
1091
- # [XksProxyAuthenticationCredentialType](kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html).
1088
+ # [XksProxyAuthenticationCredentialType](API_XksProxyAuthenticationCredentialType.html).
1092
1089
  #
1093
1090
  # KMS uses this authentication credential to sign requests to the
1094
1091
  # external key store proxy on your behalf. This credential is unrelated
@@ -1128,7 +1125,7 @@ module Aws::KMS
1128
1125
  #
1129
1126
  #
1130
1127
  #
1131
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity
1128
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/choose-xks-connectivity.html
1132
1129
  #
1133
1130
  # @return [Types::CreateCustomKeyStoreResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
1134
1131
  #
@@ -1237,8 +1234,9 @@ module Aws::KMS
1237
1234
  #
1238
1235
  # For detailed information about grants, including grant terminology,
1239
1236
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
1240
- # Guide</i> </i>. For examples of working with grants in several
1241
- # programming languages, see [Programming grants][2].
1237
+ # Guide</i> </i>. For examples of creating grants in several programming
1238
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
1239
+ # CLI][2].
1242
1240
  #
1243
1241
  # The `CreateGrant` operation returns a `GrantToken` and a `GrantId`.
1244
1242
  #
@@ -1284,11 +1282,11 @@ module Aws::KMS
1284
1282
  #
1285
1283
  #
1286
1284
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
1287
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
1288
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1285
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
1286
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1289
1287
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
1290
1288
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1291
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
1289
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
1292
1290
  #
1293
1291
  # @option params [required, String] :key_id
1294
1292
  # Identifies the KMS key for the grant. The grant gives principals
@@ -1341,7 +1339,7 @@ module Aws::KMS
1341
1339
  #
1342
1340
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
1343
1341
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns
1344
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
1342
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
1345
1343
  #
1346
1344
  # @option params [required, Array<String>] :operations
1347
1345
  # A list of operations that the grant permits.
@@ -1410,7 +1408,7 @@ module Aws::KMS
1410
1408
  #
1411
1409
  #
1412
1410
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
1413
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1411
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1414
1412
  #
1415
1413
  # @option params [String] :name
1416
1414
  # A friendly name for the grant. Use this value to prevent the
@@ -1436,12 +1434,12 @@ module Aws::KMS
1436
1434
  # Checks if your request will succeed. `DryRun` is an optional
1437
1435
  # parameter.
1438
1436
  #
1439
- # To learn more about how to use this parameter, see [Testing your KMS
1440
- # API calls][1] in the *Key Management Service Developer Guide*.
1437
+ # To learn more about how to use this parameter, see [Testing your
1438
+ # permissions][1] in the *Key Management Service Developer Guide*.
1441
1439
  #
1442
1440
  #
1443
1441
  #
1444
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
1442
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
1445
1443
  #
1446
1444
  # @return [Types::CreateGrantResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
1447
1445
  #
@@ -1511,8 +1509,7 @@ module Aws::KMS
1511
1509
  # A KMS key is a logical representation of a cryptographic key. In
1512
1510
  # addition to the key material used in cryptographic operations, a KMS
1513
1511
  # key includes metadata, such as the key ID, key policy, creation date,
1514
- # description, and key state. For details, see [Managing keys][2] in the
1515
- # *Key Management Service Developer Guide*
1512
+ # description, and key state.
1516
1513
  #
1517
1514
  # Use the parameters of `CreateKey` to specify the type of KMS key, the
1518
1515
  # source of its key material, its key policy, description, tags, and
@@ -1570,7 +1567,7 @@ module Aws::KMS
1570
1567
  # keys with SM2 key pairs (China Regions only) can be used to either
1571
1568
  # encrypt and decrypt data, sign and verify messages, or derive shared
1572
1569
  # secrets (you must choose one key usage type). For information about
1573
- # asymmetric KMS keys, see [Asymmetric KMS keys][3] in the *Key
1570
+ # asymmetric KMS keys, see [Asymmetric KMS keys][2] in the *Key
1574
1571
  # Management Service Developer Guide*.
1575
1572
  #
1576
1573
  #
@@ -1614,7 +1611,7 @@ module Aws::KMS
1614
1611
  # to encrypt data in one Amazon Web Services Region and decrypt it in
1615
1612
  # a different Amazon Web Services Region without re-encrypting the
1616
1613
  # data or making a cross-Region call. For more information about
1617
- # multi-Region keys, see [Multi-Region keys in KMS][4] in the *Key
1614
+ # multi-Region keys, see [Multi-Region keys in KMS][3] in the *Key
1618
1615
  # Management Service Developer Guide*.
1619
1616
  #
1620
1617
  #
@@ -1626,7 +1623,7 @@ module Aws::KMS
1626
1623
  # token. Use the wrapping public key to encrypt your key material.
1627
1624
  # Then, use ImportKeyMaterial with your import token to import the key
1628
1625
  # material. For step-by-step instructions, see [Importing Key
1629
- # Material][5] in the <i> <i>Key Management Service Developer
1626
+ # Material][4] in the <i> <i>Key Management Service Developer
1630
1627
  # Guide</i> </i>.
1631
1628
  #
1632
1629
  # You can import key material into KMS keys of all supported KMS key
@@ -1639,23 +1636,22 @@ module Aws::KMS
1639
1636
  # the `Origin` parameter of `CreateKey` with a value of `EXTERNAL` and
1640
1637
  # the `MultiRegion` parameter with a value of `True`. To create
1641
1638
  # replicas of the multi-Region primary key, use the ReplicateKey
1642
- # operation. For instructions, see [Importing key material into
1643
- # multi-Region keys][6]. For more information about multi-Region keys,
1644
- # see [Multi-Region keys in KMS][4] in the *Key Management Service
1645
- # Developer Guide*.
1639
+ # operation. For instructions, see [Importing key material step 1][5].
1640
+ # For more information about multi-Region keys, see [Multi-Region keys
1641
+ # in KMS][3] in the *Key Management Service Developer Guide*.
1646
1642
  #
1647
1643
  #
1648
1644
  #
1649
1645
  # Custom key store
1650
1646
  #
1651
- # : A [custom key store][7] lets you protect your Amazon Web Services
1647
+ # : A [custom key store][6] lets you protect your Amazon Web Services
1652
1648
  # resources using keys in a backing key store that you own and manage.
1653
1649
  # When you request a cryptographic operation with a KMS key in a
1654
1650
  # custom key store, the operation is performed in the backing key
1655
1651
  # store using its cryptographic keys.
1656
1652
  #
1657
- # KMS supports [CloudHSM key stores][8] backed by an CloudHSM cluster
1658
- # and [external key stores][9] backed by an external key manager
1653
+ # KMS supports [CloudHSM key stores][7] backed by an CloudHSM cluster
1654
+ # and [external key stores][8] backed by an external key manager
1659
1655
  # outside of Amazon Web Services. When you create a KMS key in an
1660
1656
  # CloudHSM key store, KMS generates an encryption key in the CloudHSM
1661
1657
  # cluster and associates it with the KMS key. When you create a KMS
@@ -1680,13 +1676,13 @@ module Aws::KMS
1680
1676
  # `ENCRYPT_DECRYPT` to create a symmetric encryption key. No other key
1681
1677
  # type is supported in a custom key store.
1682
1678
  #
1683
- # To create a KMS key in an [CloudHSM key store][8], use the `Origin`
1679
+ # To create a KMS key in an [CloudHSM key store][9], use the `Origin`
1684
1680
  # parameter with a value of `AWS_CLOUDHSM`. The CloudHSM cluster that
1685
1681
  # is associated with the custom key store must have at least two
1686
1682
  # active HSMs in different Availability Zones in the Amazon Web
1687
1683
  # Services Region.
1688
1684
  #
1689
- # To create a KMS key in an [external key store][9], use the `Origin`
1685
+ # To create a KMS key in an [external key store][10], use the `Origin`
1690
1686
  # parameter with a value of `EXTERNAL_KEY_STORE` and an `XksKeyId`
1691
1687
  # parameter that identifies an existing external key.
1692
1688
  #
@@ -1699,10 +1695,10 @@ module Aws::KMS
1699
1695
  # **Cross-account use**: No. You cannot use this operation to create a
1700
1696
  # KMS key in a different Amazon Web Services account.
1701
1697
  #
1702
- # **Required permissions**: [kms:CreateKey][10] (IAM policy). To use the
1703
- # `Tags` parameter, [kms:TagResource][10] (IAM policy). For examples and
1698
+ # **Required permissions**: [kms:CreateKey][11] (IAM policy). To use the
1699
+ # `Tags` parameter, [kms:TagResource][11] (IAM policy). For examples and
1704
1700
  # information about related permissions, see [Allow a user to create KMS
1705
- # keys][11] in the *Key Management Service Developer Guide*.
1701
+ # keys][12] in the *Key Management Service Developer Guide*.
1706
1702
  #
1707
1703
  # **Related operations:**
1708
1704
  #
@@ -1713,22 +1709,23 @@ module Aws::KMS
1713
1709
  # * ScheduleKeyDeletion
1714
1710
  #
1715
1711
  # **Eventual consistency**: The KMS API follows an eventual consistency
1716
- # model. For more information, see [KMS eventual consistency][12].
1712
+ # model. For more information, see [KMS eventual consistency][13].
1717
1713
  #
1718
1714
  #
1719
1715
  #
1720
1716
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys
1721
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html
1722
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
1723
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
1724
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
1725
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html
1726
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1727
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
1728
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1729
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1730
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html#iam-policy-example-create-key
1731
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
1717
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
1718
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
1719
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
1720
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html
1721
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1722
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
1723
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1724
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html
1725
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html
1726
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1727
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/customer-managed-policies.html#iam-policy-example-create-key
1728
+ # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
1732
1729
  #
1733
1730
  # @option params [String] :policy
1734
1731
  # The key policy to attach to the KMS key.
@@ -1750,22 +1747,38 @@ module Aws::KMS
1750
1747
  # not always immediately visible][2] in the *Amazon Web Services
1751
1748
  # Identity and Access Management User Guide*.
1752
1749
  #
1750
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are missing
1751
+ # from a key policy statement, the policy statement has no effect. When
1752
+ # a key policy statement is missing one of these elements, the KMS
1753
+ # console correctly reports an error, but the `CreateKey` and
1754
+ # `PutKeyPolicy` API requests succeed, even though the policy statement
1755
+ # is ineffective.
1756
+ #
1757
+ # For more information on required key policy elements, see [Elements in
1758
+ # a key policy][3] in the *Key Management Service Developer Guide*.
1759
+ #
1760
+ # </note>
1761
+ #
1753
1762
  # If you do not provide a key policy, KMS attaches a default key policy
1754
- # to the KMS key. For more information, see [Default key policy][3] in
1763
+ # to the KMS key. For more information, see [Default key policy][4] in
1755
1764
  # the *Key Management Service Developer Guide*.
1756
1765
  #
1757
- # The key policy size quota is 32 kilobytes (32768 bytes).
1766
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
1767
+ # `LimitExceededException`.
1768
+ #
1769
+ # </note>
1758
1770
  #
1759
1771
  # For help writing and formatting a JSON policy document, see the [IAM
1760
- # JSON Policy Reference][4] in the <i> <i>Identity and Access Management
1772
+ # JSON Policy Reference][5] in the <i> <i>Identity and Access Management
1761
1773
  # User Guide</i> </i>.
1762
1774
  #
1763
1775
  #
1764
1776
  #
1765
1777
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
1766
1778
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
1767
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
1768
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
1779
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
1780
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
1781
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
1769
1782
  #
1770
1783
  # @option params [String] :description
1771
1784
  # A description of the KMS key. Use a description that helps you decide
@@ -1807,7 +1820,7 @@ module Aws::KMS
1807
1820
  #
1808
1821
  #
1809
1822
  #
1810
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
1823
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
1811
1824
  #
1812
1825
  # @option params [String] :customer_master_key_spec
1813
1826
  # Instead, use the `KeySpec` parameter.
@@ -1821,20 +1834,21 @@ module Aws::KMS
1821
1834
  # Specifies the type of KMS key to create. The default value,
1822
1835
  # `SYMMETRIC_DEFAULT`, creates a KMS key with a 256-bit AES-GCM key that
1823
1836
  # is used for encryption and decryption, except in China Regions, where
1824
- # it creates a 128-bit symmetric key that uses SM4 encryption. For help
1825
- # choosing a key spec for your KMS key, see [Choosing a KMS key type][1]
1826
- # in the <i> <i>Key Management Service Developer Guide</i> </i>.
1837
+ # it creates a 128-bit symmetric key that uses SM4 encryption. For a
1838
+ # detailed description of all supported key specs, see [Key spec
1839
+ # reference][1] in the <i> <i>Key Management Service Developer Guide</i>
1840
+ # </i>.
1827
1841
  #
1828
1842
  # The `KeySpec` determines whether the KMS key contains a symmetric key
1829
1843
  # or an asymmetric key pair. It also determines the algorithms that the
1830
1844
  # KMS key supports. You can't change the `KeySpec` after the KMS key is
1831
1845
  # created. To further restrict the algorithms that can be used with the
1832
1846
  # KMS key, use a condition key in its key policy or IAM policy. For more
1833
- # information, see [kms:EncryptionAlgorithm][2], [kms:MacAlgorithm][3]
1834
- # or [kms:Signing Algorithm][4] in the <i> <i>Key Management Service
1835
- # Developer Guide</i> </i>.
1847
+ # information, see [kms:EncryptionAlgorithm][2], [kms:MacAlgorithm][3],
1848
+ # [kms:KeyAgreementAlgorithm][4], or [kms:SigningAlgorithm][5] in the
1849
+ # <i> <i>Key Management Service Developer Guide</i> </i>.
1836
1850
  #
1837
- # [Amazon Web Services services that are integrated with KMS][5] use
1851
+ # [Amazon Web Services services that are integrated with KMS][6] use
1838
1852
  # symmetric encryption KMS keys to protect your data. These services do
1839
1853
  # not support asymmetric KMS keys or HMAC KMS keys.
1840
1854
  #
@@ -1884,11 +1898,12 @@ module Aws::KMS
1884
1898
  #
1885
1899
  #
1886
1900
  #
1887
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose
1888
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm
1889
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm
1890
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm
1891
- # [5]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
1901
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html
1902
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-algorithm
1903
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-mac-algorithm
1904
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-agreement-algorithm
1905
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-signing-algorithm
1906
+ # [6]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
1892
1907
  #
1893
1908
  # @option params [String] :origin
1894
1909
  # The source of the key material for the KMS key. You cannot change the
@@ -1938,7 +1953,7 @@ module Aws::KMS
1938
1953
  #
1939
1954
  #
1940
1955
  #
1941
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1956
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1942
1957
  #
1943
1958
  # @option params [Boolean] :bypass_policy_lockout_safety_check
1944
1959
  # Skips ("bypasses") the key policy lockout safety check. The default
@@ -1986,7 +2001,7 @@ module Aws::KMS
1986
2001
  # When you add tags to an Amazon Web Services resource, Amazon Web
1987
2002
  # Services generates a cost allocation report with usage and costs
1988
2003
  # aggregated by tags. Tags can also be used to control access to a KMS
1989
- # key. For details, see [Tagging Keys][3].
2004
+ # key. For details, see [Tags in KMS][3].
1990
2005
  #
1991
2006
  #
1992
2007
  #
@@ -2057,7 +2072,7 @@ module Aws::KMS
2057
2072
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
2058
2073
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
2059
2074
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy
2060
- # [4]: https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements
2075
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html#xks-key-requirements
2061
2076
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption
2062
2077
  #
2063
2078
  # @return [Types::CreateKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
@@ -2394,6 +2409,7 @@ module Aws::KMS
2394
2409
  # resp.key_metadata.mac_algorithms #=> Array
2395
2410
  # resp.key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
2396
2411
  # resp.key_metadata.xks_key_configuration.id #=> String
2412
+ # resp.key_metadata.current_key_material_id #=> String
2397
2413
  #
2398
2414
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateKey AWS API Documentation
2399
2415
  #
@@ -2444,15 +2460,14 @@ module Aws::KMS
2444
2460
  # key that you intend.
2445
2461
  #
2446
2462
  # Whenever possible, use key policies to give users permission to call
2447
- # the `Decrypt` operation on a particular KMS key, instead of using
2448
- # &amp;IAM; policies. Otherwise, you might create an &amp;IAM; policy
2449
- # that gives the user `Decrypt` permission on all KMS keys. This user
2450
- # could decrypt ciphertext that was encrypted by KMS keys in other
2451
- # accounts if the key policy for the cross-account KMS key permits it.
2452
- # If you must use an IAM policy for `Decrypt` permissions, limit the
2453
- # user to particular KMS keys or particular trusted accounts. For
2454
- # details, see [Best practices for IAM policies][4] in the *Key
2455
- # Management Service Developer Guide*.
2463
+ # the `Decrypt` operation on a particular KMS key, instead of using IAM
2464
+ # policies. Otherwise, you might create an IAM policy that gives the
2465
+ # user `Decrypt` permission on all KMS keys. This user could decrypt
2466
+ # ciphertext that was encrypted by KMS keys in other accounts if the key
2467
+ # policy for the cross-account KMS key permits it. If you must use an
2468
+ # IAM policy for `Decrypt` permissions, limit the user to particular KMS
2469
+ # keys or particular trusted accounts. For details, see [Best practices
2470
+ # for IAM policies][4] in the *Key Management Service Developer Guide*.
2456
2471
  #
2457
2472
  # `Decrypt` also supports [Amazon Web Services Nitro Enclaves][5], which
2458
2473
  # provide an isolated compute environment in Amazon EC2. To call
@@ -2500,7 +2515,7 @@ module Aws::KMS
2500
2515
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2501
2516
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
2502
2517
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2503
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2518
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2504
2519
  #
2505
2520
  # @option params [required, String, StringIO, File] :ciphertext_blob
2506
2521
  # Ciphertext to be decrypted. The blob includes metadata.
@@ -2525,8 +2540,8 @@ module Aws::KMS
2525
2540
  #
2526
2541
  #
2527
2542
  #
2528
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2529
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2543
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2544
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2530
2545
  #
2531
2546
  # @option params [Array<String>] :grant_tokens
2532
2547
  # A list of grant tokens.
@@ -2539,7 +2554,7 @@ module Aws::KMS
2539
2554
  #
2540
2555
  #
2541
2556
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2542
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2557
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2543
2558
  #
2544
2559
  # @option params [String] :key_id
2545
2560
  # Specifies the KMS key that KMS uses to decrypt the ciphertext.
@@ -2615,12 +2630,12 @@ module Aws::KMS
2615
2630
  # Checks if your request will succeed. `DryRun` is an optional
2616
2631
  # parameter.
2617
2632
  #
2618
- # To learn more about how to use this parameter, see [Testing your KMS
2619
- # API calls][1] in the *Key Management Service Developer Guide*.
2633
+ # To learn more about how to use this parameter, see [Testing your
2634
+ # permissions][1] in the *Key Management Service Developer Guide*.
2620
2635
  #
2621
2636
  #
2622
2637
  #
2623
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2638
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2624
2639
  #
2625
2640
  # @return [Types::DecryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
2626
2641
  #
@@ -2628,6 +2643,7 @@ module Aws::KMS
2628
2643
  # * {Types::DecryptResponse#plaintext #plaintext} => String
2629
2644
  # * {Types::DecryptResponse#encryption_algorithm #encryption_algorithm} => String
2630
2645
  # * {Types::DecryptResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
2646
+ # * {Types::DecryptResponse#key_material_id #key_material_id} => String
2631
2647
  #
2632
2648
  #
2633
2649
  # @example Example: To decrypt data with a symmetric encryption KMS key
@@ -2710,6 +2726,7 @@ module Aws::KMS
2710
2726
  # resp.plaintext #=> String
2711
2727
  # resp.encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
2712
2728
  # resp.ciphertext_for_recipient #=> String
2729
+ # resp.key_material_id #=> String
2713
2730
  #
2714
2731
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Decrypt AWS API Documentation
2715
2732
  #
@@ -2766,7 +2783,7 @@ module Aws::KMS
2766
2783
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
2767
2784
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2768
2785
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
2769
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2786
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2770
2787
  #
2771
2788
  # @option params [required, String] :alias_name
2772
2789
  # The alias to be deleted. The alias name must begin with `alias/`
@@ -2805,9 +2822,9 @@ module Aws::KMS
2805
2822
  # does not affect the external key store proxy, external key manager, or
2806
2823
  # any external keys.
2807
2824
  #
2808
- # This operation is part of the [custom key stores][1] feature in KMS,
2809
- # which combines the convenience and extensive integration of KMS with
2810
- # the isolation and control of a key store that you own and manage.
2825
+ # This operation is part of the custom key stores feature in KMS, which
2826
+ # combines the convenience and extensive integration of KMS with the
2827
+ # isolation and control of a key store that you own and manage.
2811
2828
  #
2812
2829
  # The custom key store that you delete cannot contain any [KMS keys][2].
2813
2830
  # Before deleting the key store, verify that you will never need to use
@@ -2858,12 +2875,12 @@ module Aws::KMS
2858
2875
  #
2859
2876
  #
2860
2877
  #
2861
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
2878
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
2862
2879
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys
2863
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2880
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2864
2881
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
2865
2882
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2866
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2883
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2867
2884
  #
2868
2885
  # @option params [required, String] :custom_key_store_id
2869
2886
  # Enter the ID of the custom key store you want to delete. To find the
@@ -2925,6 +2942,8 @@ module Aws::KMS
2925
2942
  #
2926
2943
  # * GetParametersForImport
2927
2944
  #
2945
+ # * ListKeyRotations
2946
+ #
2928
2947
  # * ImportKeyMaterial
2929
2948
  #
2930
2949
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -2935,7 +2954,7 @@ module Aws::KMS
2935
2954
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
2936
2955
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
2937
2956
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2938
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2957
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2939
2958
  #
2940
2959
  # @option params [required, String] :key_id
2941
2960
  # Identifies the KMS key from which you are deleting imported key
@@ -2953,7 +2972,19 @@ module Aws::KMS
2953
2972
  # To get the key ID and key ARN for a KMS key, use ListKeys or
2954
2973
  # DescribeKey.
2955
2974
  #
2956
- # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
2975
+ # @option params [String] :key_material_id
2976
+ # Identifies the imported key material you are deleting.
2977
+ #
2978
+ # If no KeyMaterialId is specified, KMS deletes the current key
2979
+ # material.
2980
+ #
2981
+ # To get the list of key material IDs associated with a KMS key, use
2982
+ # ListKeyRotations.
2983
+ #
2984
+ # @return [Types::DeleteImportedKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
2985
+ #
2986
+ # * {Types::DeleteImportedKeyMaterialResponse#key_id #key_id} => String
2987
+ # * {Types::DeleteImportedKeyMaterialResponse#key_material_id #key_material_id} => String
2957
2988
  #
2958
2989
  #
2959
2990
  # @example Example: To delete imported key material
@@ -2968,8 +2999,14 @@ module Aws::KMS
2968
2999
  #
2969
3000
  # resp = client.delete_imported_key_material({
2970
3001
  # key_id: "KeyIdType", # required
3002
+ # key_material_id: "BackingKeyIdType",
2971
3003
  # })
2972
3004
  #
3005
+ # @example Response structure
3006
+ #
3007
+ # resp.key_id #=> String
3008
+ # resp.key_material_id #=> String
3009
+ #
2973
3010
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterial AWS API Documentation
2974
3011
  #
2975
3012
  # @overload delete_imported_key_material(params = {})
@@ -3072,7 +3109,7 @@ module Aws::KMS
3072
3109
  # [2]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf
3073
3110
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3074
3111
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3075
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3112
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3076
3113
  #
3077
3114
  # @option params [required, String] :key_id
3078
3115
  # Identifies an asymmetric NIST-recommended ECC or SM2 (China Regions
@@ -3140,18 +3177,18 @@ module Aws::KMS
3140
3177
  #
3141
3178
  #
3142
3179
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3143
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3180
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3144
3181
  #
3145
3182
  # @option params [Boolean] :dry_run
3146
3183
  # Checks if your request will succeed. `DryRun` is an optional
3147
3184
  # parameter.
3148
3185
  #
3149
- # To learn more about how to use this parameter, see [Testing your KMS
3150
- # API calls][1] in the *Key Management Service Developer Guide*.
3186
+ # To learn more about how to use this parameter, see [Testing your
3187
+ # permissions][1] in the *Key Management Service Developer Guide*.
3151
3188
  #
3152
3189
  #
3153
3190
  #
3154
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3191
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
3155
3192
  #
3156
3193
  # @option params [Types::RecipientInfo] :recipient
3157
3194
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -3246,9 +3283,9 @@ module Aws::KMS
3246
3283
  # Gets information about [custom key stores][1] in the account and
3247
3284
  # Region.
3248
3285
  #
3249
- # This operation is part of the [custom key stores][1] feature in KMS,
3250
- # which combines the convenience and extensive integration of KMS with
3251
- # the isolation and control of a key store that you own and manage.
3286
+ # This operation is part of the custom key stores feature in KMS, which
3287
+ # combines the convenience and extensive integration of KMS with the
3288
+ # isolation and control of a key store that you own and manage.
3252
3289
  #
3253
3290
  # By default, this operation returns information about all custom key
3254
3291
  # stores in the account and Region. To get only information about a
@@ -3301,11 +3338,11 @@ module Aws::KMS
3301
3338
  #
3302
3339
  #
3303
3340
  #
3304
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
3341
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
3305
3342
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
3306
3343
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
3307
3344
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3308
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3345
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3309
3346
  #
3310
3347
  # @option params [String] :custom_key_store_id
3311
3348
  # Gets only information about the specified custom key store. Enter the
@@ -3503,8 +3540,8 @@ module Aws::KMS
3503
3540
  # * Whether automatic key rotation is enabled on the KMS key. To get
3504
3541
  # this information, use GetKeyRotationStatus. Also, some key states
3505
3542
  # prevent a KMS key from being automatically rotated. For details, see
3506
- # [How Automatic Key Rotation Works][6] in the *Key Management Service
3507
- # Developer Guide*.
3543
+ # [How key rotation works][6] in the *Key Management Service Developer
3544
+ # Guide*.
3508
3545
  #
3509
3546
  # * Tags on the KMS key. To get this information, use ListResourceTags.
3510
3547
  #
@@ -3550,7 +3587,7 @@ module Aws::KMS
3550
3587
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
3551
3588
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-how-it-works
3552
3589
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3553
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3590
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3554
3591
  #
3555
3592
  # @option params [required, String] :key_id
3556
3593
  # Describes the specified KMS key.
@@ -3594,7 +3631,7 @@ module Aws::KMS
3594
3631
  #
3595
3632
  #
3596
3633
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3597
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3634
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3598
3635
  #
3599
3636
  # @return [Types::DescribeKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
3600
3637
  #
@@ -3855,6 +3892,7 @@ module Aws::KMS
3855
3892
  # resp.key_metadata.mac_algorithms #=> Array
3856
3893
  # resp.key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
3857
3894
  # resp.key_metadata.xks_key_configuration.id #=> String
3895
+ # resp.key_metadata.current_key_material_id #=> String
3858
3896
  #
3859
3897
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeKey AWS API Documentation
3860
3898
  #
@@ -3868,13 +3906,10 @@ module Aws::KMS
3868
3906
  # Sets the state of a KMS key to disabled. This change temporarily
3869
3907
  # prevents use of the KMS key for [cryptographic operations][1].
3870
3908
  #
3871
- # For more information about how key state affects the use of a KMS key,
3872
- # see [Key states of KMS keys][2] in the <i> <i>Key Management Service
3873
- # Developer Guide</i> </i>.
3874
- #
3875
3909
  # The KMS key that you use for this operation must be in a compatible
3876
- # key state. For details, see [Key states of KMS keys][2] in the *Key
3877
- # Management Service Developer Guide*.
3910
+ # key state. For more information about how key state affects the use of
3911
+ # a KMS key, see [Key states of KMS keys][2] in the <i> <i>Key
3912
+ # Management Service Developer Guide</i> </i>.
3878
3913
  #
3879
3914
  # **Cross-account use**: No. You cannot perform this operation on a KMS
3880
3915
  # key in a different Amazon Web Services account.
@@ -3888,10 +3923,10 @@ module Aws::KMS
3888
3923
  #
3889
3924
  #
3890
3925
  #
3891
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3926
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3892
3927
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3893
3928
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3894
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3929
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3895
3930
  #
3896
3931
  # @option params [required, String] :key_id
3897
3932
  # Identifies the KMS key to disable.
@@ -3980,18 +4015,18 @@ module Aws::KMS
3980
4015
  #
3981
4016
  #
3982
4017
  #
3983
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
4018
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
3984
4019
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
3985
4020
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
3986
4021
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
3987
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
3988
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4022
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4023
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
3989
4024
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
3990
4025
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
3991
4026
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
3992
4027
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3993
4028
  # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3994
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4029
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3995
4030
  #
3996
4031
  # @option params [required, String] :key_id
3997
4032
  # Identifies a symmetric encryption KMS key. You cannot enable or
@@ -4016,7 +4051,7 @@ module Aws::KMS
4016
4051
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks
4017
4052
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4018
4053
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4019
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4054
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4020
4055
  #
4021
4056
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
4022
4057
  #
@@ -4050,9 +4085,9 @@ module Aws::KMS
4050
4085
  # external key store proxy that communicates with your external key
4051
4086
  # manager.
4052
4087
  #
4053
- # This operation is part of the [custom key stores][1] feature in KMS,
4054
- # which combines the convenience and extensive integration of KMS with
4055
- # the isolation and control of a key store that you own and manage.
4088
+ # This operation is part of the custom key stores feature in KMS, which
4089
+ # combines the convenience and extensive integration of KMS with the
4090
+ # isolation and control of a key store that you own and manage.
4056
4091
  #
4057
4092
  # While a custom key store is disconnected, you can manage the custom
4058
4093
  # key store and its KMS keys, but you cannot create or use its KMS keys.
@@ -4096,10 +4131,10 @@ module Aws::KMS
4096
4131
  #
4097
4132
  #
4098
4133
  #
4099
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4100
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4134
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4135
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4101
4136
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4102
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4137
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4103
4138
  #
4104
4139
  # @option params [required, String] :custom_key_store_id
4105
4140
  # Enter the ID of the custom key store you want to disconnect. To find
@@ -4158,10 +4193,10 @@ module Aws::KMS
4158
4193
  #
4159
4194
  #
4160
4195
  #
4161
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4196
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4162
4197
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4163
4198
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4164
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4199
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4165
4200
  #
4166
4201
  # @option params [required, String] :key_id
4167
4202
  # Identifies the KMS key to enable.
@@ -4222,17 +4257,17 @@ module Aws::KMS
4222
4257
  # any in progress rotations. You can use the ListKeyRotations operation
4223
4258
  # to view the details of completed rotations.
4224
4259
  #
4225
- # Automatic key rotation is supported only on [symmetric encryption KMS
4226
- # keys][3]. You cannot enable automatic rotation of [asymmetric KMS
4227
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
4228
- # material][6], or KMS keys in a [custom key store][7]. To enable or
4229
- # disable automatic rotation of a set of related [multi-Region keys][8],
4260
+ # Automatic key rotation is supported only on symmetric encryption KMS
4261
+ # keys. You cannot enable automatic rotation of [asymmetric KMS
4262
+ # keys][3], [HMAC KMS keys][4], KMS keys with [imported key
4263
+ # material][5], or KMS keys in a [custom key store][6]. To enable or
4264
+ # disable automatic rotation of a set of related [multi-Region keys][7],
4230
4265
  # set the property on the primary key.
4231
4266
  #
4232
4267
  # You cannot enable or disable automatic rotation of [Amazon Web
4233
- # Services managed KMS keys][9]. KMS always rotates the key material of
4268
+ # Services managed KMS keys][8]. KMS always rotates the key material of
4234
4269
  # Amazon Web Services managed keys every year. Rotation of [Amazon Web
4235
- # Services owned KMS keys][10] is managed by the Amazon Web Services
4270
+ # Services owned KMS keys][9] is managed by the Amazon Web Services
4236
4271
  # service that owns the key.
4237
4272
  #
4238
4273
  # <note markdown="1"> In May 2022, KMS changed the rotation schedule for Amazon Web Services
@@ -4248,13 +4283,13 @@ module Aws::KMS
4248
4283
  # </note>
4249
4284
  #
4250
4285
  # The KMS key that you use for this operation must be in a compatible
4251
- # key state. For details, see [Key states of KMS keys][11] in the *Key
4286
+ # key state. For details, see [Key states of KMS keys][10] in the *Key
4252
4287
  # Management Service Developer Guide*.
4253
4288
  #
4254
4289
  # **Cross-account use**: No. You cannot perform this operation on a KMS
4255
4290
  # key in a different Amazon Web Services account.
4256
4291
  #
4257
- # **Required permissions**: [kms:EnableKeyRotation][12] (key policy)
4292
+ # **Required permissions**: [kms:EnableKeyRotation][11] (key policy)
4258
4293
  #
4259
4294
  # **Related operations:**
4260
4295
  #
@@ -4273,23 +4308,22 @@ module Aws::KMS
4273
4308
  # </note>
4274
4309
  #
4275
4310
  # **Eventual consistency**: The KMS API follows an eventual consistency
4276
- # model. For more information, see [KMS eventual consistency][13].
4311
+ # model. For more information, see [KMS eventual consistency][12].
4277
4312
  #
4278
4313
  #
4279
4314
  #
4280
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
4315
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
4281
4316
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
4282
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
4283
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4284
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4285
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4286
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4287
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4288
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
4289
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
4290
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4291
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4292
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4317
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4318
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4319
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4320
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4321
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4322
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
4323
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
4324
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4325
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4326
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4293
4327
  #
4294
4328
  # @option params [required, String] :key_id
4295
4329
  # Identifies a symmetric encryption KMS key. You cannot enable automatic
@@ -4315,8 +4349,8 @@ module Aws::KMS
4315
4349
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4316
4350
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4317
4351
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4318
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4319
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4352
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4353
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4320
4354
  #
4321
4355
  # @option params [Integer] :rotation_period_in_days
4322
4356
  # Use this parameter to specify a custom period of time between each
@@ -4448,10 +4482,10 @@ module Aws::KMS
4448
4482
  #
4449
4483
  #
4450
4484
  #
4451
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4485
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4452
4486
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4453
4487
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4454
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4488
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4455
4489
  #
4456
4490
  # @option params [required, String] :key_id
4457
4491
  # Identifies the KMS key to use in the encryption operation. The KMS key
@@ -4504,8 +4538,8 @@ module Aws::KMS
4504
4538
  #
4505
4539
  #
4506
4540
  #
4507
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4508
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4541
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4542
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4509
4543
  #
4510
4544
  # @option params [Array<String>] :grant_tokens
4511
4545
  # A list of grant tokens.
@@ -4518,7 +4552,7 @@ module Aws::KMS
4518
4552
  #
4519
4553
  #
4520
4554
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
4521
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
4555
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
4522
4556
  #
4523
4557
  # @option params [String] :encryption_algorithm
4524
4558
  # Specifies the encryption algorithm that KMS will use to encrypt the
@@ -4536,18 +4570,19 @@ module Aws::KMS
4536
4570
  # Checks if your request will succeed. `DryRun` is an optional
4537
4571
  # parameter.
4538
4572
  #
4539
- # To learn more about how to use this parameter, see [Testing your KMS
4540
- # API calls][1] in the *Key Management Service Developer Guide*.
4573
+ # To learn more about how to use this parameter, see [Testing your
4574
+ # permissions][1] in the *Key Management Service Developer Guide*.
4541
4575
  #
4542
4576
  #
4543
4577
  #
4544
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
4578
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
4545
4579
  #
4546
4580
  # @return [Types::EncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
4547
4581
  #
4548
4582
  # * {Types::EncryptResponse#ciphertext_blob #ciphertext_blob} => String
4549
4583
  # * {Types::EncryptResponse#key_id #key_id} => String
4550
4584
  # * {Types::EncryptResponse#encryption_algorithm #encryption_algorithm} => String
4585
+ # * {Types::EncryptResponse#key_material_id #key_material_id} => String
4551
4586
  #
4552
4587
  #
4553
4588
  # @example Example: To encrypt data with a symmetric encryption KMS key
@@ -4602,6 +4637,7 @@ module Aws::KMS
4602
4637
  # resp.ciphertext_blob #=> String
4603
4638
  # resp.key_id #=> String
4604
4639
  # resp.encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
4640
+ # resp.key_material_id #=> String
4605
4641
  #
4606
4642
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Encrypt AWS API Documentation
4607
4643
  #
@@ -4716,7 +4752,7 @@ module Aws::KMS
4716
4752
  #
4717
4753
  #
4718
4754
  #
4719
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4755
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4720
4756
  # [2]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
4721
4757
  # [3]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
4722
4758
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
@@ -4725,7 +4761,7 @@ module Aws::KMS
4725
4761
  # [7]: https://docs.aws.amazon.com/dynamodb-encryption-client/latest/devguide/
4726
4762
  # [8]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
4727
4763
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4728
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4764
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4729
4765
  #
4730
4766
  # @option params [required, String] :key_id
4731
4767
  # Specifies the symmetric encryption KMS key that encrypts the data key.
@@ -4773,7 +4809,7 @@ module Aws::KMS
4773
4809
  #
4774
4810
  #
4775
4811
  #
4776
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4812
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4777
4813
  #
4778
4814
  # @option params [Integer] :number_of_bytes
4779
4815
  # Specifies the length of the data key in bytes. For example, use the
@@ -4803,7 +4839,7 @@ module Aws::KMS
4803
4839
  #
4804
4840
  #
4805
4841
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
4806
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
4842
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
4807
4843
  #
4808
4844
  # @option params [Types::RecipientInfo] :recipient
4809
4845
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -4837,12 +4873,12 @@ module Aws::KMS
4837
4873
  # Checks if your request will succeed. `DryRun` is an optional
4838
4874
  # parameter.
4839
4875
  #
4840
- # To learn more about how to use this parameter, see [Testing your KMS
4841
- # API calls][1] in the *Key Management Service Developer Guide*.
4876
+ # To learn more about how to use this parameter, see [Testing your
4877
+ # permissions][1] in the *Key Management Service Developer Guide*.
4842
4878
  #
4843
4879
  #
4844
4880
  #
4845
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
4881
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
4846
4882
  #
4847
4883
  # @return [Types::GenerateDataKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
4848
4884
  #
@@ -4850,6 +4886,7 @@ module Aws::KMS
4850
4886
  # * {Types::GenerateDataKeyResponse#plaintext #plaintext} => String
4851
4887
  # * {Types::GenerateDataKeyResponse#key_id #key_id} => String
4852
4888
  # * {Types::GenerateDataKeyResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
4889
+ # * {Types::GenerateDataKeyResponse#key_material_id #key_material_id} => String
4853
4890
  #
4854
4891
  #
4855
4892
  # @example Example: To generate a data key
@@ -4917,6 +4954,7 @@ module Aws::KMS
4917
4954
  # resp.plaintext #=> String
4918
4955
  # resp.key_id #=> String
4919
4956
  # resp.ciphertext_for_recipient #=> String
4957
+ # resp.key_material_id #=> String
4920
4958
  #
4921
4959
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKey AWS API Documentation
4922
4960
  #
@@ -5025,10 +5063,10 @@ module Aws::KMS
5025
5063
  # [3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
5026
5064
  # [4]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
5027
5065
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5028
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5066
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5029
5067
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5030
5068
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5031
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5069
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5032
5070
  #
5033
5071
  # @option params [Hash<String,String>] :encryption_context
5034
5072
  # Specifies the encryption context that will be used when encrypting the
@@ -5051,7 +5089,7 @@ module Aws::KMS
5051
5089
  #
5052
5090
  #
5053
5091
  #
5054
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5092
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5055
5093
  #
5056
5094
  # @option params [required, String] :key_id
5057
5095
  # Specifies the symmetric encryption KMS key that encrypts the private
@@ -5098,7 +5136,7 @@ module Aws::KMS
5098
5136
  #
5099
5137
  #
5100
5138
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5101
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5139
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5102
5140
  #
5103
5141
  # @option params [Types::RecipientInfo] :recipient
5104
5142
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -5136,12 +5174,12 @@ module Aws::KMS
5136
5174
  # Checks if your request will succeed. `DryRun` is an optional
5137
5175
  # parameter.
5138
5176
  #
5139
- # To learn more about how to use this parameter, see [Testing your KMS
5140
- # API calls][1] in the *Key Management Service Developer Guide*.
5177
+ # To learn more about how to use this parameter, see [Testing your
5178
+ # permissions][1] in the *Key Management Service Developer Guide*.
5141
5179
  #
5142
5180
  #
5143
5181
  #
5144
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5182
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5145
5183
  #
5146
5184
  # @return [Types::GenerateDataKeyPairResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5147
5185
  #
@@ -5151,6 +5189,7 @@ module Aws::KMS
5151
5189
  # * {Types::GenerateDataKeyPairResponse#key_id #key_id} => String
5152
5190
  # * {Types::GenerateDataKeyPairResponse#key_pair_spec #key_pair_spec} => String
5153
5191
  # * {Types::GenerateDataKeyPairResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
5192
+ # * {Types::GenerateDataKeyPairResponse#key_material_id #key_material_id} => String
5154
5193
  #
5155
5194
  #
5156
5195
  # @example Example: To generate an RSA key pair for encryption and decryption
@@ -5223,6 +5262,7 @@ module Aws::KMS
5223
5262
  # resp.key_id #=> String
5224
5263
  # resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SM2"
5225
5264
  # resp.ciphertext_for_recipient #=> String
5265
+ # resp.key_material_id #=> String
5226
5266
  #
5227
5267
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPair AWS API Documentation
5228
5268
  #
@@ -5301,10 +5341,10 @@ module Aws::KMS
5301
5341
  #
5302
5342
  #
5303
5343
  # [1]: https://tools.ietf.org/html/rfc5280
5304
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5344
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5305
5345
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5306
5346
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5307
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5347
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5308
5348
  #
5309
5349
  # @option params [Hash<String,String>] :encryption_context
5310
5350
  # Specifies the encryption context that will be used when encrypting the
@@ -5327,7 +5367,7 @@ module Aws::KMS
5327
5367
  #
5328
5368
  #
5329
5369
  #
5330
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5370
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5331
5371
  #
5332
5372
  # @option params [required, String] :key_id
5333
5373
  # Specifies the symmetric encryption KMS key that encrypts the private
@@ -5374,18 +5414,18 @@ module Aws::KMS
5374
5414
  #
5375
5415
  #
5376
5416
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5377
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5417
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5378
5418
  #
5379
5419
  # @option params [Boolean] :dry_run
5380
5420
  # Checks if your request will succeed. `DryRun` is an optional
5381
5421
  # parameter.
5382
5422
  #
5383
- # To learn more about how to use this parameter, see [Testing your KMS
5384
- # API calls][1] in the *Key Management Service Developer Guide*.
5423
+ # To learn more about how to use this parameter, see [Testing your
5424
+ # permissions][1] in the *Key Management Service Developer Guide*.
5385
5425
  #
5386
5426
  #
5387
5427
  #
5388
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5428
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5389
5429
  #
5390
5430
  # @return [Types::GenerateDataKeyPairWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5391
5431
  #
@@ -5393,6 +5433,7 @@ module Aws::KMS
5393
5433
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#public_key #public_key} => String
5394
5434
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_id #key_id} => String
5395
5435
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_pair_spec #key_pair_spec} => String
5436
+ # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_material_id #key_material_id} => String
5396
5437
  #
5397
5438
  #
5398
5439
  # @example Example: To generate an asymmetric data key pair without a plaintext key
@@ -5431,6 +5472,7 @@ module Aws::KMS
5431
5472
  # resp.public_key #=> String
5432
5473
  # resp.key_id #=> String
5433
5474
  # resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SM2"
5475
+ # resp.key_material_id #=> String
5434
5476
  #
5435
5477
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintext AWS API Documentation
5436
5478
  #
@@ -5520,10 +5562,10 @@ module Aws::KMS
5520
5562
  #
5521
5563
  #
5522
5564
  #
5523
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5565
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5524
5566
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5525
5567
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5526
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5568
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5527
5569
  #
5528
5570
  # @option params [required, String] :key_id
5529
5571
  # Specifies the symmetric encryption KMS key that encrypts the data key.
@@ -5571,7 +5613,7 @@ module Aws::KMS
5571
5613
  #
5572
5614
  #
5573
5615
  #
5574
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5616
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5575
5617
  #
5576
5618
  # @option params [String] :key_spec
5577
5619
  # The length of the data key. Use `AES_128` to generate a 128-bit
@@ -5594,23 +5636,24 @@ module Aws::KMS
5594
5636
  #
5595
5637
  #
5596
5638
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5597
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5639
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5598
5640
  #
5599
5641
  # @option params [Boolean] :dry_run
5600
5642
  # Checks if your request will succeed. `DryRun` is an optional
5601
5643
  # parameter.
5602
5644
  #
5603
- # To learn more about how to use this parameter, see [Testing your KMS
5604
- # API calls][1] in the *Key Management Service Developer Guide*.
5645
+ # To learn more about how to use this parameter, see [Testing your
5646
+ # permissions][1] in the *Key Management Service Developer Guide*.
5605
5647
  #
5606
5648
  #
5607
5649
  #
5608
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5650
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5609
5651
  #
5610
5652
  # @return [Types::GenerateDataKeyWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5611
5653
  #
5612
5654
  # * {Types::GenerateDataKeyWithoutPlaintextResponse#ciphertext_blob #ciphertext_blob} => String
5613
5655
  # * {Types::GenerateDataKeyWithoutPlaintextResponse#key_id #key_id} => String
5656
+ # * {Types::GenerateDataKeyWithoutPlaintextResponse#key_material_id #key_material_id} => String
5614
5657
  #
5615
5658
  #
5616
5659
  # @example Example: To generate an encrypted data key
@@ -5646,6 +5689,7 @@ module Aws::KMS
5646
5689
  #
5647
5690
  # resp.ciphertext_blob #=> String
5648
5691
  # resp.key_id #=> String
5692
+ # resp.key_material_id #=> String
5649
5693
  #
5650
5694
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintext AWS API Documentation
5651
5695
  #
@@ -5700,7 +5744,7 @@ module Aws::KMS
5700
5744
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
5701
5745
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5702
5746
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5703
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5747
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5704
5748
  #
5705
5749
  # @option params [required, String, StringIO, File] :message
5706
5750
  # The message to be hashed. Specify a message of up to 4,096 bytes.
@@ -5739,18 +5783,18 @@ module Aws::KMS
5739
5783
  #
5740
5784
  #
5741
5785
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5742
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5786
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5743
5787
  #
5744
5788
  # @option params [Boolean] :dry_run
5745
5789
  # Checks if your request will succeed. `DryRun` is an optional
5746
5790
  # parameter.
5747
5791
  #
5748
- # To learn more about how to use this parameter, see [Testing your KMS
5749
- # API calls][1] in the *Key Management Service Developer Guide*.
5792
+ # To learn more about how to use this parameter, see [Testing your
5793
+ # permissions][1] in the *Key Management Service Developer Guide*.
5750
5794
  #
5751
5795
  #
5752
5796
  #
5753
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5797
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5754
5798
  #
5755
5799
  # @return [Types::GenerateMacResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5756
5800
  #
@@ -5824,7 +5868,8 @@ module Aws::KMS
5824
5868
  # Management Service Developer Guide*.
5825
5869
  #
5826
5870
  # For more information about entropy and random number generation, see
5827
- # [Key Management Service Cryptographic Details][4].
5871
+ # [Entropy and random number generation][4] in the *Key Management
5872
+ # Service Developer Guide*.
5828
5873
  #
5829
5874
  # **Cross-account use**: Not applicable. `GenerateRandom` does not use
5830
5875
  # any account-specific resources, such as KMS keys.
@@ -5839,9 +5884,9 @@ module Aws::KMS
5839
5884
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
5840
5885
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
5841
5886
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5842
- # [4]: https://docs.aws.amazon.com/kms/latest/cryptographic-details/
5887
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#entropy-and-random-numbers
5843
5888
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5844
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5889
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5845
5890
  #
5846
5891
  # @option params [Integer] :number_of_bytes
5847
5892
  # The length of the random byte string. This parameter is required.
@@ -5961,7 +6006,7 @@ module Aws::KMS
5961
6006
  #
5962
6007
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5963
6008
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
5964
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6009
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5965
6010
  #
5966
6011
  # @option params [required, String] :key_id
5967
6012
  # Gets the key policy for the specified KMS key.
@@ -6029,16 +6074,16 @@ module Aws::KMS
6029
6074
  # enabled for the specified KMS key, the [rotation period][2], and the
6030
6075
  # next scheduled rotation date.
6031
6076
  #
6032
- # Automatic key rotation is supported only on [symmetric encryption KMS
6033
- # keys][3]. You cannot enable automatic rotation of [asymmetric KMS
6034
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
6035
- # material][6], or KMS keys in a [custom key store][7]. To enable or
6036
- # disable automatic rotation of a set of related [multi-Region keys][8],
6037
- # set the property on the primary key..
6077
+ # Automatic key rotation is supported only on symmetric encryption KMS
6078
+ # keys. You cannot enable automatic rotation of [asymmetric KMS
6079
+ # keys][3], [HMAC KMS keys][4], KMS keys with [imported key
6080
+ # material][5], or KMS keys in a [custom key store][6]. To enable or
6081
+ # disable automatic rotation of a set of related [multi-Region keys][7],
6082
+ # set the property on the primary key.
6038
6083
  #
6039
6084
  # You can enable (EnableKeyRotation) and disable automatic rotation
6040
6085
  # (DisableKeyRotation) of the key material in customer managed KMS keys.
6041
- # Key material rotation of [Amazon Web Services managed KMS keys][9] is
6086
+ # Key material rotation of [Amazon Web Services managed KMS keys][8] is
6042
6087
  # not configurable. KMS always rotates the key material in Amazon Web
6043
6088
  # Services managed KMS keys every year. The key rotation status for
6044
6089
  # Amazon Web Services managed KMS keys is always `true`.
@@ -6057,7 +6102,7 @@ module Aws::KMS
6057
6102
  # </note>
6058
6103
  #
6059
6104
  # The KMS key that you use for this operation must be in a compatible
6060
- # key state. For details, see [Key states of KMS keys][10] in the *Key
6105
+ # key state. For details, see [Key states of KMS keys][9] in the *Key
6061
6106
  # Management Service Developer Guide*.
6062
6107
  #
6063
6108
  # * Disabled: The key rotation status does not change when you disable a
@@ -6078,7 +6123,7 @@ module Aws::KMS
6078
6123
  # a different Amazon Web Services account, specify the key ARN in the
6079
6124
  # value of the `KeyId` parameter.
6080
6125
  #
6081
- # **Required permissions**: [kms:GetKeyRotationStatus][11] (key policy)
6126
+ # **Required permissions**: [kms:GetKeyRotationStatus][10] (key policy)
6082
6127
  #
6083
6128
  # **Related operations:**
6084
6129
  #
@@ -6091,22 +6136,21 @@ module Aws::KMS
6091
6136
  # * RotateKeyOnDemand
6092
6137
  #
6093
6138
  # **Eventual consistency**: The KMS API follows an eventual consistency
6094
- # model. For more information, see [KMS eventual consistency][12].
6139
+ # model. For more information, see [KMS eventual consistency][11].
6095
6140
  #
6096
6141
  #
6097
6142
  #
6098
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
6143
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
6099
6144
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotation-period
6100
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
6101
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
6102
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
6103
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6104
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
6105
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
6106
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
6107
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6108
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6109
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6145
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
6146
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
6147
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6148
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6149
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
6150
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
6151
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6152
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6153
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6110
6154
  #
6111
6155
  # @option params [required, String] :key_id
6112
6156
  # Gets the rotation status for the specified KMS key.
@@ -6180,9 +6224,7 @@ module Aws::KMS
6180
6224
  # By default, KMS keys are created with key material that KMS generates.
6181
6225
  # This operation supports [Importing key material][1], an advanced
6182
6226
  # feature that lets you generate and import the cryptographic key
6183
- # material for a KMS key. For more information about importing key
6184
- # material into KMS, see [Importing key material][1] in the *Key
6185
- # Management Service Developer Guide*.
6227
+ # material for a KMS key.
6186
6228
  #
6187
6229
  # Before calling `GetParametersForImport`, use the CreateKey operation
6188
6230
  # with an `Origin` value of `EXTERNAL` to create a KMS key with no key
@@ -6251,11 +6293,11 @@ module Aws::KMS
6251
6293
  #
6252
6294
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6253
6295
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6254
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
6255
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
6296
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6297
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#reimport-key-material
6256
6298
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6257
6299
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6258
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6300
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6259
6301
  #
6260
6302
  # @option params [required, String] :key_id
6261
6303
  # The identifier of the KMS key that will be associated with the
@@ -6279,9 +6321,8 @@ module Aws::KMS
6279
6321
  # @option params [required, String] :wrapping_algorithm
6280
6322
  # The algorithm you will use with the RSA public key (`PublicKey`) in
6281
6323
  # the response to protect your key material during import. For more
6282
- # information, see [Select a wrapping
6283
- # algorithm](kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm)
6284
- # in the *Key Management Service Developer Guide*.
6324
+ # information, see [Select a wrapping algorithm][1] in the *Key
6325
+ # Management Service Developer Guide*.
6285
6326
  #
6286
6327
  # For RSA\_AES wrapping algorithms, you encrypt your key material with
6287
6328
  # an AES key that you generate, then encrypt your AES key with the RSA
@@ -6313,6 +6354,10 @@ module Aws::KMS
6313
6354
  # * **RSAES\_PKCS1\_V1\_5** (Deprecated) — As of October 10, 2023, KMS
6314
6355
  # does not support the RSAES\_PKCS1\_V1\_5 wrapping algorithm.
6315
6356
  #
6357
+ #
6358
+ #
6359
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm
6360
+ #
6316
6361
  # @option params [required, String] :wrapping_key_spec
6317
6362
  # The type of RSA public key to return in the response. You will use
6318
6363
  # this wrapping key with the specified wrapping algorithm to protect
@@ -6460,8 +6505,9 @@ module Aws::KMS
6460
6505
  # * [KeyUsage][3]: Whether the key is used for encryption, signing, or
6461
6506
  # deriving a shared secret.
6462
6507
  #
6463
- # * [EncryptionAlgorithms][4] or [SigningAlgorithms][5]: A list of the
6464
- # encryption algorithms or the signing algorithms for the key.
6508
+ # * [EncryptionAlgorithms][4], [KeyAgreementAlgorithms][5], or
6509
+ # [SigningAlgorithms][6]: A list of the encryption algorithms, key
6510
+ # agreement algorithms, or signing algorithms for the key.
6465
6511
  #
6466
6512
  # Although KMS cannot enforce these restrictions on external operations,
6467
6513
  # it is crucial that you use this information to prevent the public key
@@ -6474,22 +6520,22 @@ module Aws::KMS
6474
6520
  # To verify a signature outside of KMS with an SM2 public key (China
6475
6521
  # Regions only), you must specify the distinguishing ID. By default, KMS
6476
6522
  # uses `1234567812345678` as the distinguishing ID. For more
6477
- # information, see [Offline verification with SM2 key pairs][6].
6523
+ # information, see [Offline verification with SM2 key pairs][7].
6478
6524
  #
6479
6525
  # The KMS key that you use for this operation must be in a compatible
6480
- # key state. For details, see [Key states of KMS keys][7] in the *Key
6526
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
6481
6527
  # Management Service Developer Guide*.
6482
6528
  #
6483
6529
  # **Cross-account use**: Yes. To perform this operation with a KMS key
6484
6530
  # in a different Amazon Web Services account, specify the key ARN or
6485
6531
  # alias ARN in the value of the `KeyId` parameter.
6486
6532
  #
6487
- # **Required permissions**: [kms:GetPublicKey][8] (key policy)
6533
+ # **Required permissions**: [kms:GetPublicKey][9] (key policy)
6488
6534
  #
6489
6535
  # **Related operations**: CreateKey
6490
6536
  #
6491
6537
  # **Eventual consistency**: The KMS API follows an eventual consistency
6492
- # model. For more information, see [KMS eventual consistency][9].
6538
+ # model. For more information, see [KMS eventual consistency][10].
6493
6539
  #
6494
6540
  #
6495
6541
  #
@@ -6497,11 +6543,12 @@ module Aws::KMS
6497
6543
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeySpec
6498
6544
  # [3]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyUsage
6499
6545
  # [4]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-EncryptionAlgorithms
6500
- # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
6501
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
6502
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6503
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6504
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6546
+ # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyAgreementAlgorithms
6547
+ # [6]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
6548
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
6549
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6550
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6551
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6505
6552
  #
6506
6553
  # @option params [required, String] :key_id
6507
6554
  # Identifies the asymmetric KMS key that includes the public key.
@@ -6536,7 +6583,7 @@ module Aws::KMS
6536
6583
  #
6537
6584
  #
6538
6585
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
6539
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6586
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
6540
6587
  #
6541
6588
  # @return [Types::GetPublicKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
6542
6589
  #
@@ -6603,53 +6650,47 @@ module Aws::KMS
6603
6650
  end
6604
6651
 
6605
6652
  # Imports or reimports key material into an existing KMS key that was
6606
- # created without key material. `ImportKeyMaterial` also sets the
6607
- # expiration model and expiration date of the imported key material.
6608
- #
6609
- # By default, KMS keys are created with key material that KMS generates.
6610
- # This operation supports [Importing key material][1], an advanced
6611
- # feature that lets you generate and import the cryptographic key
6612
- # material for a KMS key. For more information about importing key
6613
- # material into KMS, see [Importing key material][1] in the *Key
6614
- # Management Service Developer Guide*.
6653
+ # created without key material. You can also use this operation to set
6654
+ # or update the expiration model and expiration date of the imported key
6655
+ # material.
6615
6656
  #
6616
- # After you successfully import key material into a KMS key, you can
6617
- # [reimport the same key material][2] into that KMS key, but you cannot
6618
- # import different key material. You might reimport key material to
6619
- # replace key material that expired or key material that you deleted.
6620
- # You might also reimport key material to change the expiration model or
6621
- # expiration date of the key material.
6657
+ # By default, KMS creates KMS keys with key material that it generates.
6658
+ # You can also generate and import your own key material. For more
6659
+ # information about importing key material, see [Importing key
6660
+ # material][1].
6661
+ #
6662
+ # For asymmetric, HMAC and multi-Region keys, you cannot change the key
6663
+ # material after the initial import. You can import multiple key
6664
+ # materials into single-Region, symmetric encryption keys and rotate the
6665
+ # key material on demand using `RotateKeyOnDemand`.
6666
+ #
6667
+ # After you import key material, you can [reimport the same key
6668
+ # material][2] into that KMS key or, if the key supports on-demand
6669
+ # rotation, import new key material. You can use the `ImportType`
6670
+ # parameter to indicate whether you are importing new key material or
6671
+ # re-importing previously imported key material. You might reimport key
6672
+ # material to replace key material that expired or key material that you
6673
+ # deleted. You might also reimport key material to change the expiration
6674
+ # model or expiration date of the key material.
6622
6675
  #
6623
6676
  # Each time you import key material into KMS, you can determine whether
6624
6677
  # (`ExpirationModel`) and when (`ValidTo`) the key material expires. To
6625
6678
  # change the expiration of your key material, you must import it again,
6626
6679
  # either by calling `ImportKeyMaterial` or using the [import
6627
- # features](kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console)
6628
- # of the KMS console.
6680
+ # features][3] of the KMS console.
6629
6681
  #
6630
- # Before calling `ImportKeyMaterial`:
6682
+ # Before you call `ImportKeyMaterial`, complete these steps:
6631
6683
  #
6632
- # * Create or identify a KMS key with no key material. The KMS key must
6633
- # have an `Origin` value of `EXTERNAL`, which indicates that the KMS
6634
- # key is designed for imported key material.
6684
+ # * Create or identify a KMS key with `EXTERNAL` origin, which indicates
6685
+ # that the KMS key is designed for imported key material.
6635
6686
  #
6636
- # To create an new KMS key for imported key material, call the
6687
+ # To create a new KMS key for imported key material, call the
6637
6688
  # CreateKey operation with an `Origin` value of `EXTERNAL`. You can
6638
6689
  # create a symmetric encryption KMS key, HMAC KMS key, asymmetric
6639
- # encryption KMS key, or asymmetric signing KMS key. You can also
6640
- # import key material into a [multi-Region
6641
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of
6642
- # any supported type. However, you can't import key material into a
6643
- # KMS key in a [custom key
6644
- # store](kms/latest/developerguide/custom-key-store-overview.html).
6645
- #
6646
- # * Use the DescribeKey operation to verify that the `KeyState` of the
6647
- # KMS key is `PendingImport`, which indicates that the KMS key has no
6648
- # key material.
6649
- #
6650
- # If you are reimporting the same key material into an existing KMS
6651
- # key, you might need to call the DeleteImportedKeyMaterial to delete
6652
- # its existing key material.
6690
+ # encryption KMS key, asymmetric key agreement key, or asymmetric
6691
+ # signing KMS key. You can also import key material into a
6692
+ # [multi-Region key][4] of any supported type. However, you can't
6693
+ # import key material into a KMS key in a [custom key store][5].
6653
6694
  #
6654
6695
  # * Call the GetParametersForImport operation to get a public key and
6655
6696
  # import token set for importing key material.
@@ -6664,10 +6705,9 @@ module Aws::KMS
6664
6705
  # * The key ID or key ARN of the KMS key to associate with the imported
6665
6706
  # key material. Its `Origin` must be `EXTERNAL` and its `KeyState`
6666
6707
  # must be `PendingImport`. You cannot perform this operation on a KMS
6667
- # key in a [custom key
6668
- # store](kms/latest/developerguide/custom-key-store-overview.html), or
6669
- # on a KMS key in a different Amazon Web Services account. To get the
6670
- # `Origin` and `KeyState` of a KMS key, call DescribeKey.
6708
+ # key in a [custom key store][5], or on a KMS key in a different
6709
+ # Amazon Web Services account. To get the `Origin` and `KeyState` of a
6710
+ # KMS key, call DescribeKey.
6671
6711
  #
6672
6712
  # * The encrypted key material.
6673
6713
  #
@@ -6677,7 +6717,7 @@ module Aws::KMS
6677
6717
  #
6678
6718
  # * Whether the key material expires (`ExpirationModel`) and, if so,
6679
6719
  # when (`ValidTo`). For help with this choice, see [Setting an
6680
- # expiration time][3] in the *Key Management Service Developer Guide*.
6720
+ # expiration time][6] in the *Key Management Service Developer Guide*.
6681
6721
  #
6682
6722
  # If you set an expiration date, KMS deletes the key material from the
6683
6723
  # KMS key on the specified date, making the KMS key unusable. To use
@@ -6689,23 +6729,27 @@ module Aws::KMS
6689
6729
  #
6690
6730
  # When this operation is successful, the key state of the KMS key
6691
6731
  # changes from `PendingImport` to `Enabled`, and you can use the KMS key
6692
- # in cryptographic operations.
6732
+ # in cryptographic operations. For single-Region, symmetric encryption
6733
+ # keys, you will need to import all of the key materials associated with
6734
+ # the KMS key to change its state to `Enabled`. Use the
6735
+ # `ListKeyRotations` operation to list the ID and import state of each
6736
+ # key material associated with a KMS key.
6693
6737
  #
6694
6738
  # If this operation fails, use the exception to help determine the
6695
6739
  # problem. If the error is related to the key material, the import
6696
6740
  # token, or wrapping key, use GetParametersForImport to get a new public
6697
6741
  # key and import token for the KMS key and repeat the import procedure.
6698
- # For help, see [How To Import Key Material][4] in the *Key Management
6699
- # Service Developer Guide*.
6742
+ # For help, see [Create a KMS key with imported key material][7] in the
6743
+ # *Key Management Service Developer Guide*.
6700
6744
  #
6701
6745
  # The KMS key that you use for this operation must be in a compatible
6702
- # key state. For details, see [Key states of KMS keys][5] in the *Key
6746
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
6703
6747
  # Management Service Developer Guide*.
6704
6748
  #
6705
6749
  # **Cross-account use**: No. You cannot perform this operation on a KMS
6706
6750
  # key in a different Amazon Web Services account.
6707
6751
  #
6708
- # **Required permissions**: [kms:ImportKeyMaterial][6] (key policy)
6752
+ # **Required permissions**: [kms:ImportKeyMaterial][9] (key policy)
6709
6753
  #
6710
6754
  # **Related operations:**
6711
6755
  #
@@ -6713,18 +6757,25 @@ module Aws::KMS
6713
6757
  #
6714
6758
  # * GetParametersForImport
6715
6759
  #
6760
+ # * ListKeyRotations
6761
+ #
6762
+ # * RotateKeyOnDemand
6763
+ #
6716
6764
  # **Eventual consistency**: The KMS API follows an eventual consistency
6717
- # model. For more information, see [KMS eventual consistency][7].
6765
+ # model. For more information, see [KMS eventual consistency][10].
6718
6766
  #
6719
6767
  #
6720
6768
  #
6721
6769
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6722
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
6723
- # [3]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
6724
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#importing-keys-overview
6725
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6726
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6727
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6770
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#reimport-key-material
6771
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console
6772
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6773
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6774
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
6775
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-conceptual.html
6776
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6777
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6778
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6728
6779
  #
6729
6780
  # @option params [required, String] :key_id
6730
6781
  # The identifier of the KMS key that will be associated with the
@@ -6735,11 +6786,9 @@ module Aws::KMS
6735
6786
  #
6736
6787
  # The KMS key can be a symmetric encryption KMS key, HMAC KMS key,
6737
6788
  # asymmetric encryption KMS key, or asymmetric signing KMS key,
6738
- # including a [multi-Region
6739
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of any
6740
- # supported type. You cannot perform this operation on a KMS key in a
6741
- # custom key store, or on a KMS key in a different Amazon Web Services
6742
- # account.
6789
+ # including a [multi-Region key][1] of any supported type. You cannot
6790
+ # perform this operation on a KMS key in a custom key store, or on a KMS
6791
+ # key in a different Amazon Web Services account.
6743
6792
  #
6744
6793
  # Specify the key ID or key ARN of the KMS key.
6745
6794
  #
@@ -6753,6 +6802,10 @@ module Aws::KMS
6753
6802
  # To get the key ID and key ARN for a KMS key, use ListKeys or
6754
6803
  # DescribeKey.
6755
6804
  #
6805
+ #
6806
+ #
6807
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6808
+ #
6756
6809
  # @option params [required, String, StringIO, File] :import_token
6757
6810
  # The import token that you received in the response to a previous
6758
6811
  # GetParametersForImport request. It must be from the same response that
@@ -6797,9 +6850,47 @@ module Aws::KMS
6797
6850
  #
6798
6851
  #
6799
6852
  #
6800
- # [1]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
6853
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
6801
6854
  #
6802
- # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
6855
+ # @option params [String] :import_type
6856
+ # Indicates whether the key material being imported is previously
6857
+ # associated with this KMS key or not. This parameter is optional and
6858
+ # only usable with symmetric encryption keys. The default is
6859
+ # `EXISTING_KEY_MATERIAL`. If no key material has ever been imported
6860
+ # into the KMS key, and this parameter is omitted, the parameter
6861
+ # defaults to `NEW_KEY_MATERIAL`.
6862
+ #
6863
+ # @option params [String] :key_material_description
6864
+ # Description for the key material being imported. This parameter is
6865
+ # optional and only usable with symmetric encryption keys. If you do not
6866
+ # specify a key material description, KMS retains the value you
6867
+ # specified when you last imported the same key material into this KMS
6868
+ # key.
6869
+ #
6870
+ # @option params [String] :key_material_id
6871
+ # Identifies the key material being imported. This parameter is optional
6872
+ # and only usable with symmetric encryption keys. You cannot specify a
6873
+ # key material ID with `ImportType` set to `NEW_KEY_MATERIAL`. Whenever
6874
+ # you import key material into a symmetric encryption key, KMS assigns a
6875
+ # unique identifier to the key material based on the KMS key ID and the
6876
+ # imported key material. When you re-import key material with a
6877
+ # specified key material ID, KMS:
6878
+ #
6879
+ # * Computes the identifier for the key material
6880
+ #
6881
+ # * Matches the computed identifier against the specified key material
6882
+ # ID
6883
+ #
6884
+ # * Verifies that the key material ID is already associated with the KMS
6885
+ # key
6886
+ #
6887
+ # To get the list of key material IDs associated with a KMS key, use
6888
+ # ListKeyRotations.
6889
+ #
6890
+ # @return [Types::ImportKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
6891
+ #
6892
+ # * {Types::ImportKeyMaterialResponse#key_id #key_id} => String
6893
+ # * {Types::ImportKeyMaterialResponse#key_material_id #key_material_id} => String
6803
6894
  #
6804
6895
  #
6805
6896
  # @example Example: To import key material into a KMS key
@@ -6834,8 +6925,16 @@ module Aws::KMS
6834
6925
  # encrypted_key_material: "data", # required
6835
6926
  # valid_to: Time.now,
6836
6927
  # expiration_model: "KEY_MATERIAL_EXPIRES", # accepts KEY_MATERIAL_EXPIRES, KEY_MATERIAL_DOES_NOT_EXPIRE
6928
+ # import_type: "NEW_KEY_MATERIAL", # accepts NEW_KEY_MATERIAL, EXISTING_KEY_MATERIAL
6929
+ # key_material_description: "KeyMaterialDescriptionType",
6930
+ # key_material_id: "BackingKeyIdType",
6837
6931
  # })
6838
6932
  #
6933
+ # @example Response structure
6934
+ #
6935
+ # resp.key_id #=> String
6936
+ # resp.key_material_id #=> String
6937
+ #
6839
6938
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterial AWS API Documentation
6840
6939
  #
6841
6940
  # @overload import_key_material(params = {})
@@ -6886,10 +6985,10 @@ module Aws::KMS
6886
6985
  #
6887
6986
  #
6888
6987
  #
6889
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/limits.html#aliases-limit
6988
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/resource-limits.html#aliases-per-key
6890
6989
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6891
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
6892
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6990
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html
6991
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6893
6992
  #
6894
6993
  # @option params [String] :key_id
6895
6994
  # Lists only aliases that are associated with the specified KMS key.
@@ -7021,8 +7120,9 @@ module Aws::KMS
7021
7120
  #
7022
7121
  # For detailed information about grants, including grant terminology,
7023
7122
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
7024
- # Guide</i> </i>. For examples of working with grants in several
7025
- # programming languages, see [Programming grants][2].
7123
+ # Guide</i> </i>. For examples of creating grants in several programming
7124
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
7125
+ # CLI][2].
7026
7126
  #
7027
7127
  # <note markdown="1"> The `GranteePrincipal` field in the `ListGrants` response usually
7028
7128
  # contains the user or role designated as the grantee principal in the
@@ -7055,10 +7155,10 @@ module Aws::KMS
7055
7155
  #
7056
7156
  #
7057
7157
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
7058
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
7158
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
7059
7159
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services
7060
7160
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7061
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7161
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7062
7162
  #
7063
7163
  # @option params [Integer] :limit
7064
7164
  # Use this parameter to specify the maximum number of items to return.
@@ -7234,7 +7334,7 @@ module Aws::KMS
7234
7334
  #
7235
7335
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7236
7336
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
7237
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7337
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7238
7338
  #
7239
7339
  # @option params [required, String] :key_id
7240
7340
  # Gets the names of key policies for the specified KMS key.
@@ -7316,14 +7416,15 @@ module Aws::KMS
7316
7416
  req.send_request(options)
7317
7417
  end
7318
7418
 
7319
- # Returns information about all completed key material rotations for the
7320
- # specified KMS key.
7419
+ # Returns information about the key materials associated with the
7420
+ # specified KMS key. You can use the optional `IncludeKeyMaterial`
7421
+ # parameter to control which key materials are included in the response.
7321
7422
  #
7322
7423
  # You must specify the KMS key in all requests. You can refine the key
7323
7424
  # rotations list by limiting the number of rotations returned.
7324
7425
  #
7325
7426
  # For detailed information about automatic and on-demand key rotations,
7326
- # see [Rotating KMS keys][1] in the *Key Management Service Developer
7427
+ # see [Rotate KMS keys][1] in the *Key Management Service Developer
7327
7428
  # Guide*.
7328
7429
  #
7329
7430
  # **Cross-account use**: No. You cannot perform this operation on a KMS
@@ -7335,10 +7436,14 @@ module Aws::KMS
7335
7436
  #
7336
7437
  # * EnableKeyRotation
7337
7438
  #
7439
+ # * DeleteImportedKeyMaterial
7440
+ #
7338
7441
  # * DisableKeyRotation
7339
7442
  #
7340
7443
  # * GetKeyRotationStatus
7341
7444
  #
7445
+ # * ImportKeyMaterial
7446
+ #
7342
7447
  # * RotateKeyOnDemand
7343
7448
  #
7344
7449
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -7348,7 +7453,7 @@ module Aws::KMS
7348
7453
  #
7349
7454
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
7350
7455
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7351
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7456
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7352
7457
  #
7353
7458
  # @option params [required, String] :key_id
7354
7459
  # Gets the key rotations for the specified KMS key.
@@ -7365,6 +7470,16 @@ module Aws::KMS
7365
7470
  # To get the key ID and key ARN for a KMS key, use ListKeys or
7366
7471
  # DescribeKey.
7367
7472
  #
7473
+ # @option params [String] :include_key_material
7474
+ # Use this optional parameter to control which key materials associated
7475
+ # with this key are listed in the response. The default value of this
7476
+ # parameter is `ROTATIONS_ONLY`. If you omit this parameter, KMS returns
7477
+ # information on the key materials created by automatic or on-demand key
7478
+ # rotation. When you specify a value of `ALL_KEY_MATERIAL`, KMS adds the
7479
+ # first key material and any imported key material pending rotation to
7480
+ # the response. This parameter can only be used with KMS keys that
7481
+ # support automatic or on-demand key rotation.
7482
+ #
7368
7483
  # @option params [Integer] :limit
7369
7484
  # Use this parameter to specify the maximum number of items to return.
7370
7485
  # When this value is present, KMS does not return more than the
@@ -7417,6 +7532,7 @@ module Aws::KMS
7417
7532
  #
7418
7533
  # resp = client.list_key_rotations({
7419
7534
  # key_id: "KeyIdType", # required
7535
+ # include_key_material: "ALL_KEY_MATERIAL", # accepts ALL_KEY_MATERIAL, ROTATIONS_ONLY
7420
7536
  # limit: 1,
7421
7537
  # marker: "MarkerType",
7422
7538
  # })
@@ -7425,6 +7541,12 @@ module Aws::KMS
7425
7541
  #
7426
7542
  # resp.rotations #=> Array
7427
7543
  # resp.rotations[0].key_id #=> String
7544
+ # resp.rotations[0].key_material_id #=> String
7545
+ # resp.rotations[0].key_material_description #=> String
7546
+ # resp.rotations[0].import_state #=> String, one of "IMPORTED", "PENDING_IMPORT"
7547
+ # resp.rotations[0].key_material_state #=> String, one of "NON_CURRENT", "CURRENT", "PENDING_ROTATION"
7548
+ # resp.rotations[0].expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
7549
+ # resp.rotations[0].valid_to #=> Time
7428
7550
  # resp.rotations[0].rotation_date #=> Time
7429
7551
  # resp.rotations[0].rotation_type #=> String, one of "AUTOMATIC", "ON_DEMAND"
7430
7552
  # resp.next_marker #=> String
@@ -7463,7 +7585,7 @@ module Aws::KMS
7463
7585
  #
7464
7586
  #
7465
7587
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7466
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7588
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7467
7589
  #
7468
7590
  # @option params [Integer] :limit
7469
7591
  # Use this parameter to specify the maximum number of items to return.
@@ -7559,7 +7681,7 @@ module Aws::KMS
7559
7681
  # For general information about tags, including the format and syntax,
7560
7682
  # see [Tagging Amazon Web Services resources][1] in the *Amazon Web
7561
7683
  # Services General Reference*. For information about using tags in KMS,
7562
- # see [Tagging keys][2].
7684
+ # see [Tags in KMS][2].
7563
7685
  #
7564
7686
  # **Cross-account use**: No. You cannot perform this operation on a KMS
7565
7687
  # key in a different Amazon Web Services account.
@@ -7584,7 +7706,7 @@ module Aws::KMS
7584
7706
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
7585
7707
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
7586
7708
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7587
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7709
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7588
7710
  #
7589
7711
  # @option params [required, String] :key_id
7590
7712
  # Gets tags on the specified KMS key.
@@ -7689,8 +7811,9 @@ module Aws::KMS
7689
7811
  #
7690
7812
  # For detailed information about grants, including grant terminology,
7691
7813
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
7692
- # Guide</i> </i>. For examples of working with grants in several
7693
- # programming languages, see [Programming grants][2].
7814
+ # Guide</i> </i>. For examples of creating grants in several programming
7815
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
7816
+ # CLI][2].
7694
7817
  #
7695
7818
  # **Cross-account use**: You must specify a principal in your Amazon Web
7696
7819
  # Services account. This operation returns a list of grants where the
@@ -7728,9 +7851,9 @@ module Aws::KMS
7728
7851
  #
7729
7852
  #
7730
7853
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
7731
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
7854
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
7732
7855
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7733
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7856
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7734
7857
  #
7735
7858
  # @option params [Integer] :limit
7736
7859
  # Use this parameter to specify the maximum number of items to return.
@@ -7840,8 +7963,9 @@ module Aws::KMS
7840
7963
  # formatting a JSON policy document, see the [IAM JSON Policy
7841
7964
  # Reference][2] in the <i> <i>Identity and Access Management User
7842
7965
  # Guide</i> </i>. For examples of adding a key policy in multiple
7843
- # programming languages, see [Setting a key policy][3] in the *Key
7844
- # Management Service Developer Guide*.
7966
+ # programming languages, see [Use PutKeyPolicy with an Amazon Web
7967
+ # Services SDK or CLI][3] in the *Key Management Service Developer
7968
+ # Guide*.
7845
7969
  #
7846
7970
  # **Cross-account use**: No. You cannot perform this operation on a KMS
7847
7971
  # key in a different Amazon Web Services account.
@@ -7857,9 +7981,9 @@ module Aws::KMS
7857
7981
  #
7858
7982
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
7859
7983
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
7860
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-key-policies.html#put-policy
7984
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_PutKeyPolicy_section.html
7861
7985
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7862
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7986
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7863
7987
  #
7864
7988
  # @option params [required, String] :key_id
7865
7989
  # Sets the key policy on the specified KMS key.
@@ -7900,6 +8024,17 @@ module Aws::KMS
7900
8024
  # not always immediately visible][2] in the *Amazon Web Services
7901
8025
  # Identity and Access Management User Guide*.
7902
8026
  #
8027
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are missing
8028
+ # from a key policy statement, the policy statement has no effect. When
8029
+ # a key policy statement is missing one of these elements, the KMS
8030
+ # console correctly reports an error, but the `PutKeyPolicy` API request
8031
+ # succeeds, even though the policy statement is ineffective.
8032
+ #
8033
+ # For more information on required key policy elements, see [Elements in
8034
+ # a key policy][3] in the *Key Management Service Developer Guide*.
8035
+ #
8036
+ # </note>
8037
+ #
7903
8038
  # A key policy document can include only the following characters:
7904
8039
  #
7905
8040
  # * Printable ASCII characters from the space character (`\u0020`)
@@ -7911,18 +8046,24 @@ module Aws::KMS
7911
8046
  # * The tab (`\u0009`), line feed (`\u000A`), and carriage return
7912
8047
  # (`\u000D`) special characters
7913
8048
  #
7914
- # For information about key policies, see [Key policies in KMS][3] in
8049
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
8050
+ # `LimitExceededException`.
8051
+ #
8052
+ # </note>
8053
+ #
8054
+ # For information about key policies, see [Key policies in KMS][4] in
7915
8055
  # the *Key Management Service Developer Guide*.For help writing and
7916
8056
  # formatting a JSON policy document, see the [IAM JSON Policy
7917
- # Reference][4] in the <i> <i>Identity and Access Management User
8057
+ # Reference][5] in the <i> <i>Identity and Access Management User
7918
8058
  # Guide</i> </i>.
7919
8059
  #
7920
8060
  #
7921
8061
  #
7922
8062
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
7923
8063
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
7924
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
7925
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
8064
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
8065
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8066
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
7926
8067
  #
7927
8068
  # @option params [Boolean] :bypass_policy_lockout_safety_check
7928
8069
  # Skips ("bypasses") the key policy lockout safety check. The default
@@ -8071,15 +8212,15 @@ module Aws::KMS
8071
8212
  #
8072
8213
  #
8073
8214
  #
8074
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-manually
8075
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8076
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#asymmetric-cmks
8215
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys-manually.html
8216
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8217
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
8077
8218
  # [4]: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/
8078
8219
  # [5]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
8079
8220
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8080
8221
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8081
8222
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8082
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8223
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8083
8224
  #
8084
8225
  # @option params [required, String, StringIO, File] :ciphertext_blob
8085
8226
  # Ciphertext of the data to reencrypt.
@@ -8102,7 +8243,7 @@ module Aws::KMS
8102
8243
  #
8103
8244
  #
8104
8245
  #
8105
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8246
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8106
8247
  #
8107
8248
  # @option params [String] :source_key_id
8108
8249
  # Specifies the KMS key that KMS will use to decrypt the ciphertext
@@ -8188,7 +8329,7 @@ module Aws::KMS
8188
8329
  #
8189
8330
  #
8190
8331
  #
8191
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8332
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8192
8333
  #
8193
8334
  # @option params [String] :source_encryption_algorithm
8194
8335
  # Specifies the encryption algorithm that KMS will use to decrypt the
@@ -8222,18 +8363,18 @@ module Aws::KMS
8222
8363
  #
8223
8364
  #
8224
8365
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
8225
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
8366
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
8226
8367
  #
8227
8368
  # @option params [Boolean] :dry_run
8228
8369
  # Checks if your request will succeed. `DryRun` is an optional
8229
8370
  # parameter.
8230
8371
  #
8231
- # To learn more about how to use this parameter, see [Testing your KMS
8232
- # API calls][1] in the *Key Management Service Developer Guide*.
8372
+ # To learn more about how to use this parameter, see [Testing your
8373
+ # permissions][1] in the *Key Management Service Developer Guide*.
8233
8374
  #
8234
8375
  #
8235
8376
  #
8236
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
8377
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8237
8378
  #
8238
8379
  # @return [Types::ReEncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
8239
8380
  #
@@ -8242,6 +8383,8 @@ module Aws::KMS
8242
8383
  # * {Types::ReEncryptResponse#key_id #key_id} => String
8243
8384
  # * {Types::ReEncryptResponse#source_encryption_algorithm #source_encryption_algorithm} => String
8244
8385
  # * {Types::ReEncryptResponse#destination_encryption_algorithm #destination_encryption_algorithm} => String
8386
+ # * {Types::ReEncryptResponse#source_key_material_id #source_key_material_id} => String
8387
+ # * {Types::ReEncryptResponse#destination_key_material_id #destination_key_material_id} => String
8245
8388
  #
8246
8389
  #
8247
8390
  # @example Example: To reencrypt data
@@ -8285,6 +8428,8 @@ module Aws::KMS
8285
8428
  # resp.key_id #=> String
8286
8429
  # resp.source_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8287
8430
  # resp.destination_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8431
+ # resp.source_key_material_id #=> String
8432
+ # resp.destination_key_material_id #=> String
8288
8433
  #
8289
8434
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncrypt AWS API Documentation
8290
8435
  #
@@ -8316,12 +8461,12 @@ module Aws::KMS
8316
8461
  # independently of its primary and peer replica keys. A primary key and
8317
8462
  # its replica keys share properties that make them interoperable. They
8318
8463
  # have the same [key ID][2] and key material. They also have the same
8319
- # [key spec][3], [key usage][4], [key material origin][5], and
8320
- # [automatic key rotation status][6]. KMS automatically synchronizes
8321
- # these shared properties among related multi-Region keys. All other
8322
- # properties of a replica key can differ, including its [key policy][7],
8323
- # [tags][8], [aliases][9], and [Key states of KMS keys][10]. KMS pricing
8324
- # and quotas for KMS keys apply to each primary key and replica key.
8464
+ # key spec, key usage, key material origin, and automatic key rotation
8465
+ # status. KMS automatically synchronizes these shared properties among
8466
+ # related multi-Region keys. All other properties of a replica key can
8467
+ # differ, including its [key policy][3], [tags][4], [aliases][5], and
8468
+ # [key state][6]. KMS pricing and quotas for KMS keys apply to each
8469
+ # primary key and replica key.
8325
8470
  #
8326
8471
  # When this operation completes, the new replica key has a transient key
8327
8472
  # state of `Creating`. This key state changes to `Enabled` (or
@@ -8331,7 +8476,7 @@ module Aws::KMS
8331
8476
  # If you are creating and using the replica key programmatically, retry
8332
8477
  # on `KMSInvalidStateException` or call `DescribeKey` to check its
8333
8478
  # `KeyState` value before using it. For details about the `Creating` key
8334
- # state, see [Key states of KMS keys][10] in the *Key Management Service
8479
+ # state, see [Key states of KMS keys][6] in the *Key Management Service
8335
8480
  # Developer Guide*.
8336
8481
  #
8337
8482
  # You cannot create more than one replica of a primary key in any
@@ -8340,7 +8485,7 @@ module Aws::KMS
8340
8485
  # `AlreadyExistsException` error. If the key state of the existing
8341
8486
  # replica is `PendingDeletion`, you can cancel the scheduled key
8342
8487
  # deletion (CancelKeyDeletion) or wait for the key to be deleted. The
8343
- # new replica key you create will have the same [shared properties][11]
8488
+ # new replica key you create will have the same [shared properties][7]
8344
8489
  # as the original replica key.
8345
8490
  #
8346
8491
  # The CloudTrail log of a `ReplicateKey` operation records a
@@ -8350,8 +8495,6 @@ module Aws::KMS
8350
8495
  # If you replicate a multi-Region primary key with imported key
8351
8496
  # material, the replica key is created with no key material. You must
8352
8497
  # import the same key material that you imported into the primary key.
8353
- # For details, see [Importing key material into multi-Region keys][12]
8354
- # in the *Key Management Service Developer Guide*.
8355
8498
  #
8356
8499
  # To convert a replica key to a primary key, use the UpdatePrimaryRegion
8357
8500
  # operation.
@@ -8382,23 +8525,18 @@ module Aws::KMS
8382
8525
  # * UpdatePrimaryRegion
8383
8526
  #
8384
8527
  # **Eventual consistency**: The KMS API follows an eventual consistency
8385
- # model. For more information, see [KMS eventual consistency][13].
8528
+ # model. For more information, see [KMS eventual consistency][8].
8386
8529
  #
8387
8530
  #
8388
8531
  #
8389
8532
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
8390
8533
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id
8391
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec
8392
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-usage
8393
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-origin
8394
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
8395
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8396
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
8397
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
8398
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8399
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties
8400
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html
8401
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8534
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8535
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
8536
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
8537
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8538
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties
8539
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8402
8540
  #
8403
8541
  # @option params [required, String] :key_id
8404
8542
  # Identifies the multi-Region primary key that is being replicated. To
@@ -8426,33 +8564,23 @@ module Aws::KMS
8426
8564
  # [KMS service endpoints][1] in the *Amazon Web Services General
8427
8565
  # Reference*.
8428
8566
  #
8429
- # <note markdown="1"> HMAC KMS keys are not supported in all Amazon Web Services Regions. If
8430
- # you try to replicate an HMAC KMS key in an Amazon Web Services Region
8431
- # in which HMAC keys are not supported, the `ReplicateKey` operation
8432
- # returns an `UnsupportedOperationException`. For a list of Regions in
8433
- # which HMAC KMS keys are supported, see [HMAC keys in KMS][2] in the
8434
- # *Key Management Service Developer Guide*.
8435
- #
8436
- # </note>
8437
- #
8438
8567
  # The replica must be in a different Amazon Web Services Region than its
8439
8568
  # primary key and other replicas of that primary key, but in the same
8440
8569
  # Amazon Web Services partition. KMS must be available in the replica
8441
8570
  # Region. If the Region is not enabled by default, the Amazon Web
8442
8571
  # Services account must be enabled in the Region. For information about
8443
- # Amazon Web Services partitions, see [Amazon Resource Names (ARNs)][3]
8572
+ # Amazon Web Services partitions, see [Amazon Resource Names (ARNs)][2]
8444
8573
  # in the *Amazon Web Services General Reference*. For information about
8445
- # enabling and disabling Regions, see [Enabling a Region][4] and
8446
- # [Disabling a Region][5] in the *Amazon Web Services General
8574
+ # enabling and disabling Regions, see [Enabling a Region][3] and
8575
+ # [Disabling a Region][4] in the *Amazon Web Services General
8447
8576
  # Reference*.
8448
8577
  #
8449
8578
  #
8450
8579
  #
8451
8580
  # [1]: https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region
8452
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
8453
- # [3]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
8454
- # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
8455
- # [5]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
8581
+ # [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
8582
+ # [3]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
8583
+ # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
8456
8584
  #
8457
8585
  # @option params [String] :policy
8458
8586
  # The key policy to attach to the KMS key. This parameter is optional.
@@ -8500,7 +8628,7 @@ module Aws::KMS
8500
8628
  #
8501
8629
  #
8502
8630
  #
8503
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
8631
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
8504
8632
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
8505
8633
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
8506
8634
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
@@ -8569,7 +8697,7 @@ module Aws::KMS
8569
8697
  # When you add tags to an Amazon Web Services resource, Amazon Web
8570
8698
  # Services generates a cost allocation report with usage and costs
8571
8699
  # aggregated by tags. Tags can also be used to control access to a KMS
8572
- # key. For details, see [Tagging Keys][3].
8700
+ # key. For details, see [Tags in KMS][3].
8573
8701
  #
8574
8702
  #
8575
8703
  #
@@ -8682,6 +8810,7 @@ module Aws::KMS
8682
8810
  # resp.replica_key_metadata.mac_algorithms #=> Array
8683
8811
  # resp.replica_key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
8684
8812
  # resp.replica_key_metadata.xks_key_configuration.id #=> String
8813
+ # resp.replica_key_metadata.current_key_material_id #=> String
8685
8814
  # resp.replica_policy #=> String
8686
8815
  # resp.replica_tags #=> Array
8687
8816
  # resp.replica_tags[0].tag_key #=> String
@@ -8705,20 +8834,20 @@ module Aws::KMS
8705
8834
  # by the *grantee principal* if the grant allows the `RetireGrant`
8706
8835
  # operation, and by the Amazon Web Services account in which the grant
8707
8836
  # is created. It can also be called by principals to whom permission for
8708
- # retiring a grant is delegated. For details, see [Retiring and revoking
8709
- # grants][2] in the *Key Management Service Developer Guide*.
8837
+ # retiring a grant is delegated.
8710
8838
  #
8711
8839
  # For detailed information about grants, including grant terminology,
8712
- # see [Grants in KMS][3] in the <i> <i>Key Management Service Developer
8713
- # Guide</i> </i>. For examples of working with grants in several
8714
- # programming languages, see [Programming grants][4].
8840
+ # see [Grants in KMS][2] in the <i> <i>Key Management Service Developer
8841
+ # Guide</i> </i>. For examples of creating grants in several programming
8842
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
8843
+ # CLI][3].
8715
8844
  #
8716
8845
  # **Cross-account use**: Yes. You can retire a grant on a KMS key in a
8717
8846
  # different Amazon Web Services account.
8718
8847
  #
8719
8848
  # **Required permissions**: Permission to retire a grant is determined
8720
8849
  # primarily by the grant. For details, see [Retiring and revoking
8721
- # grants][2] in the *Key Management Service Developer Guide*.
8850
+ # grants][4] in the *Key Management Service Developer Guide*.
8722
8851
  #
8723
8852
  # **Related operations:**
8724
8853
  #
@@ -8736,10 +8865,10 @@ module Aws::KMS
8736
8865
  #
8737
8866
  #
8738
8867
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
8739
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
8740
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8741
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
8742
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8868
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8869
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
8870
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
8871
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8743
8872
  #
8744
8873
  # @option params [String] :grant_token
8745
8874
  # Identifies the grant to be retired. You can use a grant token to
@@ -8774,12 +8903,12 @@ module Aws::KMS
8774
8903
  # Checks if your request will succeed. `DryRun` is an optional
8775
8904
  # parameter.
8776
8905
  #
8777
- # To learn more about how to use this parameter, see [Testing your KMS
8778
- # API calls][1] in the *Key Management Service Developer Guide*.
8906
+ # To learn more about how to use this parameter, see [Testing your
8907
+ # permissions][1] in the *Key Management Service Developer Guide*.
8779
8908
  #
8780
8909
  #
8781
8910
  #
8782
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
8911
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8783
8912
  #
8784
8913
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
8785
8914
  #
@@ -8824,8 +8953,9 @@ module Aws::KMS
8824
8953
  #
8825
8954
  # For detailed information about grants, including grant terminology,
8826
8955
  # see [Grants in KMS][3] in the <i> <i>Key Management Service Developer
8827
- # Guide</i> </i>. For examples of working with grants in several
8828
- # programming languages, see [Programming grants][4].
8956
+ # Guide</i> </i>. For examples of creating grants in several programming
8957
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
8958
+ # CLI][4].
8829
8959
  #
8830
8960
  # **Cross-account use**: Yes. To perform this operation on a KMS key in
8831
8961
  # a different Amazon Web Services account, specify the key ARN in the
@@ -8848,12 +8978,12 @@ module Aws::KMS
8848
8978
  #
8849
8979
  #
8850
8980
  #
8851
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
8981
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
8852
8982
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-eventual-consistency
8853
8983
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8854
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
8984
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
8855
8985
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8856
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8986
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8857
8987
  #
8858
8988
  # @option params [required, String] :key_id
8859
8989
  # A unique identifier for the KMS key associated with the grant. To get
@@ -8880,12 +9010,12 @@ module Aws::KMS
8880
9010
  # Checks if your request will succeed. `DryRun` is an optional
8881
9011
  # parameter.
8882
9012
  #
8883
- # To learn more about how to use this parameter, see [Testing your KMS
8884
- # API calls][1] in the *Key Management Service Developer Guide*.
9013
+ # To learn more about how to use this parameter, see [Testing your
9014
+ # permissions][1] in the *Key Management Service Developer Guide*.
8885
9015
  #
8886
9016
  #
8887
9017
  #
8888
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
9018
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8889
9019
  #
8890
9020
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
8891
9021
  #
@@ -8941,10 +9071,15 @@ module Aws::KMS
8941
9071
  # of the key material for your KMS keys in CloudTrail and Amazon
8942
9072
  # CloudWatch.
8943
9073
  #
8944
- # On-demand key rotation is supported only on [symmetric encryption KMS
8945
- # keys][3]. You cannot perform on-demand rotation of [asymmetric KMS
8946
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
8947
- # material][6], or KMS keys in a [custom key store][7]. To perform
9074
+ # On-demand key rotation is supported only on symmetric encryption KMS
9075
+ # keys. You cannot perform on-demand rotation of [asymmetric KMS
9076
+ # keys][3], [HMAC KMS keys][4], multi-Region KMS keys with [imported key
9077
+ # material][5], or KMS keys in a [custom key store][6]. When you
9078
+ # initiate on-demand key rotation on a symmetric encryption KMS key with
9079
+ # imported key material, you must have already imported [new key
9080
+ # material][7] and that key material's state should be
9081
+ # `PENDING_ROTATION`. Use the `ListKeyRotations` operation to check the
9082
+ # state of all key materials associated with a KMS key. To perform
8948
9083
  # on-demand rotation of a set of related [multi-Region keys][8], invoke
8949
9084
  # the on-demand rotation on the primary key.
8950
9085
  #
@@ -8971,6 +9106,8 @@ module Aws::KMS
8971
9106
  #
8972
9107
  # * GetKeyRotationStatus
8973
9108
  #
9109
+ # * ImportKeyMaterial
9110
+ #
8974
9111
  # * ListKeyRotations
8975
9112
  #
8976
9113
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -8978,27 +9115,27 @@ module Aws::KMS
8978
9115
  #
8979
9116
  #
8980
9117
  #
8981
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-on-demand
8982
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
8983
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
8984
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
8985
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
8986
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
8987
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
8988
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
9118
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html
9119
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
9120
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9121
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
9122
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
9123
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9124
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html
9125
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
8989
9126
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
8990
9127
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
8991
9128
  # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8992
9129
  # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8993
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9130
+ # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8994
9131
  #
8995
9132
  # @option params [required, String] :key_id
8996
9133
  # Identifies a symmetric encryption KMS key. You cannot perform
8997
9134
  # on-demand rotation of [asymmetric KMS keys][1], [HMAC KMS keys][2],
8998
- # KMS keys with [imported key material][3], or KMS keys in a [custom key
8999
- # store][4]. To perform on-demand rotation of a set of related
9000
- # [multi-Region keys][5], invoke the on-demand rotation on the primary
9001
- # key.
9135
+ # multi-Region KMS keys with [imported key material][3], or KMS keys in
9136
+ # a [custom key store][4]. To perform on-demand rotation of a set of
9137
+ # related [multi-Region keys][5], invoke the on-demand rotation on the
9138
+ # primary key.
9002
9139
  #
9003
9140
  # Specify the key ID or key ARN of the KMS key.
9004
9141
  #
@@ -9017,8 +9154,8 @@ module Aws::KMS
9017
9154
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9018
9155
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
9019
9156
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
9020
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
9021
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
9157
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9158
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
9022
9159
  #
9023
9160
  # @return [Types::RotateKeyOnDemandResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
9024
9161
  #
@@ -9072,9 +9209,8 @@ module Aws::KMS
9072
9209
  # operation. When a KMS key is deleted, all data that was encrypted
9073
9210
  # under the KMS key is unrecoverable. (The only exception is a
9074
9211
  # [multi-Region replica key][1], or an [asymmetric or HMAC KMS key with
9075
- # imported key
9076
- # material](kms/latest/developerguide/importing-keys-managing.html#import-delete-key).)
9077
- # To prevent the use of a KMS key without deleting it, use DisableKey.
9212
+ # imported key material][2].) To prevent the use of a KMS key without
9213
+ # deleting it, use DisableKey.
9078
9214
  #
9079
9215
  # You can schedule the deletion of a multi-Region primary key and its
9080
9216
  # replica keys at any time. However, KMS will not delete a multi-Region
@@ -9085,13 +9221,13 @@ module Aws::KMS
9085
9221
  # the last of its replicas keys is deleted (not just scheduled), the key
9086
9222
  # state of the primary key changes to `PendingDeletion` and its waiting
9087
9223
  # period (`PendingWindowInDays`) begins. For details, see [Deleting
9088
- # multi-Region keys][1] in the *Key Management Service Developer Guide*.
9224
+ # multi-Region keys][3] in the *Key Management Service Developer Guide*.
9089
9225
  #
9090
- # When KMS [deletes a KMS key from an CloudHSM key store][2], it makes a
9226
+ # When KMS [deletes a KMS key from an CloudHSM key store][4], it makes a
9091
9227
  # best effort to delete the associated key material from the associated
9092
9228
  # CloudHSM cluster. However, you might need to manually [delete the
9093
- # orphaned key material][3] from the cluster and its backups. [Deleting
9094
- # a KMS key from an external key store][4] has no effect on the
9229
+ # orphaned key material][5] from the cluster and its backups. [Deleting
9230
+ # a KMS key from an external key store][6] has no effect on the
9095
9231
  # associated external key. However, for both types of custom key stores,
9096
9232
  # deleting a KMS key is destructive and irreversible. You cannot decrypt
9097
9233
  # ciphertext encrypted under the KMS key by using only its associated
@@ -9100,11 +9236,11 @@ module Aws::KMS
9100
9236
  # material.
9101
9237
  #
9102
9238
  # For more information about scheduling a KMS key for deletion, see
9103
- # [Deleting KMS keys][5] in the *Key Management Service Developer
9239
+ # [Deleting KMS keys][7] in the *Key Management Service Developer
9104
9240
  # Guide*.
9105
9241
  #
9106
9242
  # The KMS key that you use for this operation must be in a compatible
9107
- # key state. For details, see [Key states of KMS keys][6] in the *Key
9243
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
9108
9244
  # Management Service Developer Guide*.
9109
9245
  #
9110
9246
  # **Cross-account use**: No. You cannot perform this operation on a KMS
@@ -9119,17 +9255,19 @@ module Aws::KMS
9119
9255
  # * DisableKey
9120
9256
  #
9121
9257
  # **Eventual consistency**: The KMS API follows an eventual consistency
9122
- # model. For more information, see [KMS eventual consistency][7].
9258
+ # model. For more information, see [KMS eventual consistency][9].
9123
9259
  #
9124
9260
  #
9125
9261
  #
9126
9262
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-delete.html
9127
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/delete-cmk-keystore.html
9128
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
9129
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/delete-xks-key.html
9130
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
9131
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9132
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9263
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#import-delete-key
9264
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#deleting-mrks
9265
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#delete-cmk-keystore
9266
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
9267
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#delete-xks-key
9268
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
9269
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9270
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9133
9271
  #
9134
9272
  # @option params [required, String] :key_id
9135
9273
  # The unique identifier of the KMS key to delete.
@@ -9278,7 +9416,7 @@ module Aws::KMS
9278
9416
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9279
9417
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9280
9418
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9281
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9419
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9282
9420
  #
9283
9421
  # @option params [required, String] :key_id
9284
9422
  # Identifies an asymmetric KMS key. KMS uses the private key in the
@@ -9352,7 +9490,7 @@ module Aws::KMS
9352
9490
  #
9353
9491
  #
9354
9492
  #
9355
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
9493
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
9356
9494
  #
9357
9495
  # @option params [Array<String>] :grant_tokens
9358
9496
  # A list of grant tokens.
@@ -9365,7 +9503,7 @@ module Aws::KMS
9365
9503
  #
9366
9504
  #
9367
9505
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
9368
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
9506
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
9369
9507
  #
9370
9508
  # @option params [required, String] :signing_algorithm
9371
9509
  # Specifies the signing algorithm to use when signing the message.
@@ -9379,12 +9517,12 @@ module Aws::KMS
9379
9517
  # Checks if your request will succeed. `DryRun` is an optional
9380
9518
  # parameter.
9381
9519
  #
9382
- # To learn more about how to use this parameter, see [Testing your KMS
9383
- # API calls][1] in the *Key Management Service Developer Guide*.
9520
+ # To learn more about how to use this parameter, see [Testing your
9521
+ # permissions][1] in the *Key Management Service Developer Guide*.
9384
9522
  #
9385
9523
  #
9386
9524
  #
9387
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
9525
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
9388
9526
  #
9389
9527
  # @return [Types::SignResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
9390
9528
  #
@@ -9511,13 +9649,13 @@ module Aws::KMS
9511
9649
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
9512
9650
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
9513
9651
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
9514
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#keystore-concept
9515
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#alias-concept
9652
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9653
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
9516
9654
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
9517
9655
  # [8]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
9518
9656
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9519
9657
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9520
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9658
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9521
9659
  #
9522
9660
  # @option params [required, String] :key_id
9523
9661
  # Identifies a customer managed key in the account and Region.
@@ -9633,7 +9771,7 @@ module Aws::KMS
9633
9771
  # [4]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
9634
9772
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9635
9773
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9636
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9774
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9637
9775
  #
9638
9776
  # @option params [required, String] :key_id
9639
9777
  # Identifies the KMS key from which you are removing tags.
@@ -9746,7 +9884,7 @@ module Aws::KMS
9746
9884
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9747
9885
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9748
9886
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
9749
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9887
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9750
9888
  #
9751
9889
  # @option params [required, String] :alias_name
9752
9890
  # Identifies the alias that is changing its KMS key. This value must
@@ -9826,9 +9964,9 @@ module Aws::KMS
9826
9964
  # verify the updated property values, use the DescribeCustomKeyStores
9827
9965
  # operation.
9828
9966
  #
9829
- # This operation is part of the [custom key stores][1] feature in KMS,
9830
- # which combines the convenience and extensive integration of KMS with
9831
- # the isolation and control of a key store that you own and manage.
9967
+ # This operation is part of the custom key stores feature in KMS, which
9968
+ # combines the convenience and extensive integration of KMS with the
9969
+ # isolation and control of a key store that you own and manage.
9832
9970
  #
9833
9971
  # When updating the properties of an external key store, verify that the
9834
9972
  # updated settings connect your key store, via the external key store
@@ -9898,7 +10036,7 @@ module Aws::KMS
9898
10036
  # **Cross-account use**: No. You cannot perform this operation on a
9899
10037
  # custom key store in a different Amazon Web Services account.
9900
10038
  #
9901
- # **Required permissions**: [kms:UpdateCustomKeyStore][2] (IAM policy)
10039
+ # **Required permissions**: [kms:UpdateCustomKeyStore][1] (IAM policy)
9902
10040
  #
9903
10041
  # **Related operations:**
9904
10042
  #
@@ -9913,13 +10051,12 @@ module Aws::KMS
9913
10051
  # * DisconnectCustomKeyStore
9914
10052
  #
9915
10053
  # **Eventual consistency**: The KMS API follows an eventual consistency
9916
- # model. For more information, see [KMS eventual consistency][3].
10054
+ # model. For more information, see [KMS eventual consistency][2].
9917
10055
  #
9918
10056
  #
9919
10057
  #
9920
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
9921
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9922
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10058
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10059
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9923
10060
  #
9924
10061
  # @option params [required, String] :custom_key_store_id
9925
10062
  # Identifies the custom key store that you want to update. Enter the ID
@@ -10197,7 +10334,7 @@ module Aws::KMS
10197
10334
  #
10198
10335
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10199
10336
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10200
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10337
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10201
10338
  #
10202
10339
  # @option params [required, String] :key_id
10203
10340
  # Updates the description of the specified KMS key.
@@ -10257,8 +10394,8 @@ module Aws::KMS
10257
10394
  # key in `eu-west-2`. If you run `UpdatePrimaryRegion` with a
10258
10395
  # `PrimaryRegion` value of `eu-west-2`, the primary key is now the key
10259
10396
  # in `eu-west-2`, and the key in `us-east-1` becomes a replica key. For
10260
- # details, see [Updating the primary Region][1] in the *Key Management
10261
- # Service Developer Guide*.
10397
+ # details, see [Change the primary key in a set of multi-Region keys][1]
10398
+ # in the *Key Management Service Developer Guide*.
10262
10399
  #
10263
10400
  # This operation supports *multi-Region keys*, an KMS feature that lets
10264
10401
  # you create multiple interoperable KMS keys in different Amazon Web
@@ -10326,7 +10463,7 @@ module Aws::KMS
10326
10463
  #
10327
10464
  #
10328
10465
  #
10329
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-update
10466
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-update.html
10330
10467
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
10331
10468
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id
10332
10469
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec
@@ -10335,7 +10472,7 @@ module Aws::KMS
10335
10472
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
10336
10473
  # [8]: https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html
10337
10474
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10338
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10475
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10339
10476
  #
10340
10477
  # @option params [required, String] :key_id
10341
10478
  # Identifies the current primary key. When the operation completes, this
@@ -10450,10 +10587,10 @@ module Aws::KMS
10450
10587
  #
10451
10588
  #
10452
10589
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
10453
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
10590
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
10454
10591
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10455
10592
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10456
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10593
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10457
10594
  #
10458
10595
  # @option params [required, String] :key_id
10459
10596
  # Identifies the asymmetric KMS key that will be used to verify the
@@ -10529,7 +10666,7 @@ module Aws::KMS
10529
10666
  #
10530
10667
  #
10531
10668
  #
10532
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
10669
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
10533
10670
  #
10534
10671
  # @option params [required, String, StringIO, File] :signature
10535
10672
  # The signature that the `Sign` operation generated.
@@ -10549,18 +10686,18 @@ module Aws::KMS
10549
10686
  #
10550
10687
  #
10551
10688
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
10552
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
10689
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
10553
10690
  #
10554
10691
  # @option params [Boolean] :dry_run
10555
10692
  # Checks if your request will succeed. `DryRun` is an optional
10556
10693
  # parameter.
10557
10694
  #
10558
- # To learn more about how to use this parameter, see [Testing your KMS
10559
- # API calls][1] in the *Key Management Service Developer Guide*.
10695
+ # To learn more about how to use this parameter, see [Testing your
10696
+ # permissions][1] in the *Key Management Service Developer Guide*.
10560
10697
  #
10561
10698
  #
10562
10699
  #
10563
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
10700
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
10564
10701
  #
10565
10702
  # @return [Types::VerifyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
10566
10703
  #
@@ -10674,7 +10811,7 @@ module Aws::KMS
10674
10811
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
10675
10812
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10676
10813
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10677
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10814
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10678
10815
  #
10679
10816
  # @option params [required, String, StringIO, File] :message
10680
10817
  # The message that will be used in the verification. Enter the same
@@ -10712,18 +10849,18 @@ module Aws::KMS
10712
10849
  #
10713
10850
  #
10714
10851
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
10715
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
10852
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
10716
10853
  #
10717
10854
  # @option params [Boolean] :dry_run
10718
10855
  # Checks if your request will succeed. `DryRun` is an optional
10719
10856
  # parameter.
10720
10857
  #
10721
- # To learn more about how to use this parameter, see [Testing your KMS
10722
- # API calls][1] in the *Key Management Service Developer Guide*.
10858
+ # To learn more about how to use this parameter, see [Testing your
10859
+ # permissions][1] in the *Key Management Service Developer Guide*.
10723
10860
  #
10724
10861
  #
10725
10862
  #
10726
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
10863
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
10727
10864
  #
10728
10865
  # @return [Types::VerifyMacResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
10729
10866
  #
@@ -10795,7 +10932,7 @@ module Aws::KMS
10795
10932
  tracer: tracer
10796
10933
  )
10797
10934
  context[:gem_name] = 'aws-sdk-kms'
10798
- context[:gem_version] = '1.102.0'
10935
+ context[:gem_version] = '1.103.0'
10799
10936
  Seahorse::Client::Request.new(handlers, context)
10800
10937
  end
10801
10938