aws-sdk-kms 1.102.0 → 1.104.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +10 -0
  3. data/VERSION +1 -1
  4. data/lib/aws-sdk-kms/client.rb +620 -485
  5. data/lib/aws-sdk-kms/client_api.rb +34 -1
  6. data/lib/aws-sdk-kms/types.rb +438 -186
  7. data/lib/aws-sdk-kms.rb +1 -1
  8. data/sig/client.rbs +23 -4
  9. data/sig/types.rbs +29 -1
  10. metadata +1 -1
data/lib/aws-sdk-kms/client.rb CHANGED
@@ -503,7 +503,7 @@ module Aws::KMS
503
503
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
504
504
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
505
505
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
506
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
506
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
507
507
  #
508
508
  # @option params [required, String] :key_id
509
509
  # Identifies the KMS key whose deletion is being canceled.
@@ -575,9 +575,9 @@ module Aws::KMS
575
575
  # custom key store is connected. To get the connection state of the
576
576
  # custom key store, use the DescribeCustomKeyStores operation.
577
577
  #
578
- # This operation is part of the [custom key stores][1] feature in KMS,
579
- # which combines the convenience and extensive integration of KMS with
580
- # the isolation and control of a key store that you own and manage.
578
+ # This operation is part of the custom key stores feature in KMS, which
579
+ # combines the convenience and extensive integration of KMS with the
580
+ # isolation and control of a key store that you own and manage.
581
581
  #
582
582
  # The `ConnectCustomKeyStore` operation might fail for various reasons.
583
583
  # To find the reason, use the DescribeCustomKeyStores operation and see
@@ -651,14 +651,14 @@ module Aws::KMS
651
651
  #
652
652
  #
653
653
  #
654
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
654
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
655
655
  # [2]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html
656
656
  # [3]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html
657
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
657
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
658
658
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
659
659
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
660
660
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
661
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
661
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
662
662
  #
663
663
  # @option params [required, String] :custom_key_store_id
664
664
  # Enter the key store ID of the custom key store that you want to
@@ -720,7 +720,7 @@ module Aws::KMS
720
720
  #
721
721
  # The alias must be unique in the account and Region, but you can have
722
722
  # aliases with the same name in different Regions. For detailed
723
- # information about aliases, see [Using aliases][3] in the *Key
723
+ # information about aliases, see [Aliases in KMS][3] in the *Key
724
724
  # Management Service Developer Guide*.
725
725
  #
726
726
  # This operation does not return a response. To get the alias that you
@@ -756,12 +756,12 @@ module Aws::KMS
756
756
  #
757
757
  #
758
758
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
759
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
759
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
760
760
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
761
761
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
762
762
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
763
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
764
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
763
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html
764
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
765
765
  #
766
766
  # @option params [required, String] :alias_name
767
767
  # Specifies the alias name. This value must begin with `alias/` followed
@@ -788,7 +788,7 @@ module Aws::KMS
788
788
  # A valid key ID is required. If you supply a null or empty string
789
789
  # value, this operation returns an error.
790
790
  #
791
- # For help finding the key ID and ARN, see [Finding the Key ID and
791
+ # For help finding the key ID and ARN, see [Find the key ID and key
792
792
  # ARN][2] in the <i> <i>Key Management Service Developer Guide</i> </i>.
793
793
  #
794
794
  # Specify the key ID or key ARN of the KMS key.
@@ -806,7 +806,7 @@ module Aws::KMS
806
806
  #
807
807
  #
808
808
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
809
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn
809
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html
810
810
  #
811
811
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
812
812
  #
@@ -844,9 +844,9 @@ module Aws::KMS
844
844
  # stores][4] backed by an external key store proxy and external key
845
845
  # manager outside of Amazon Web Services.
846
846
  #
847
- # This operation is part of the [custom key stores][1] feature in KMS,
848
- # which combines the convenience and extensive integration of KMS with
849
- # the isolation and control of a key store that you own and manage.
847
+ # This operation is part of the custom key stores feature in KMS, which
848
+ # combines the convenience and extensive integration of KMS with the
849
+ # isolation and control of a key store that you own and manage.
850
850
  #
851
851
  # Before you create the custom key store, the required elements must be
852
852
  # in place and operational. We recommend that you use the test tools
@@ -899,9 +899,6 @@ module Aws::KMS
899
899
  # immediately, you might want to connect it to verify that all settings
900
900
  # are correct and then disconnect it until you are ready to use it.
901
901
  #
902
- # For help with failures, see [Troubleshooting a custom key store][7] in
903
- # the *Key Management Service Developer Guide*.
904
- #
905
902
  # **Cross-account use**: No. You cannot perform this operation on a
906
903
  # custom key store in a different Amazon Web Services account.
907
904
  #
@@ -924,7 +921,7 @@ module Aws::KMS
924
921
  #
925
922
  #
926
923
  #
927
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
924
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
928
925
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
929
926
  # [3]: https://docs.aws.amazon.com/cloudhsm/latest/userguide/clusters.html
930
927
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
@@ -933,7 +930,7 @@ module Aws::KMS
933
930
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
934
931
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
935
932
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
936
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
933
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
937
934
  #
938
935
  # @option params [required, String] :custom_key_store_name
939
936
  # Specifies a friendly name for the custom key store. The name must be
@@ -987,7 +984,7 @@ module Aws::KMS
987
984
  #
988
985
  #
989
986
  #
990
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
987
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
991
988
  #
992
989
  # @option params [String] :custom_key_store_type
993
990
  # Specifies the type of custom key store. The default value is
@@ -1088,7 +1085,7 @@ module Aws::KMS
1088
1085
  # `RawSecretAccessKey`, a secret key, and `AccessKeyId`, a unique
1089
1086
  # identifier for the `RawSecretAccessKey`. For character requirements,
1090
1087
  # see
1091
- # [XksProxyAuthenticationCredentialType](kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html).
1088
+ # [XksProxyAuthenticationCredentialType](API_XksProxyAuthenticationCredentialType.html).
1092
1089
  #
1093
1090
  # KMS uses this authentication credential to sign requests to the
1094
1091
  # external key store proxy on your behalf. This credential is unrelated
@@ -1128,7 +1125,7 @@ module Aws::KMS
1128
1125
  #
1129
1126
  #
1130
1127
  #
1131
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity
1128
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/choose-xks-connectivity.html
1132
1129
  #
1133
1130
  # @return [Types::CreateCustomKeyStoreResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
1134
1131
  #
@@ -1237,8 +1234,9 @@ module Aws::KMS
1237
1234
  #
1238
1235
  # For detailed information about grants, including grant terminology,
1239
1236
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
1240
- # Guide</i> </i>. For examples of working with grants in several
1241
- # programming languages, see [Programming grants][2].
1237
+ # Guide</i> </i>. For examples of creating grants in several programming
1238
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
1239
+ # CLI][2].
1242
1240
  #
1243
1241
  # The `CreateGrant` operation returns a `GrantToken` and a `GrantId`.
1244
1242
  #
@@ -1284,11 +1282,11 @@ module Aws::KMS
1284
1282
  #
1285
1283
  #
1286
1284
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
1287
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
1288
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1285
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
1286
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1289
1287
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
1290
1288
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1291
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
1289
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
1292
1290
  #
1293
1291
  # @option params [required, String] :key_id
1294
1292
  # Identifies the KMS key for the grant. The grant gives principals
@@ -1341,7 +1339,7 @@ module Aws::KMS
1341
1339
  #
1342
1340
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
1343
1341
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns
1344
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
1342
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
1345
1343
  #
1346
1344
  # @option params [required, Array<String>] :operations
1347
1345
  # A list of operations that the grant permits.
@@ -1410,7 +1408,7 @@ module Aws::KMS
1410
1408
  #
1411
1409
  #
1412
1410
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
1413
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1411
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1414
1412
  #
1415
1413
  # @option params [String] :name
1416
1414
  # A friendly name for the grant. Use this value to prevent the
@@ -1436,12 +1434,12 @@ module Aws::KMS
1436
1434
  # Checks if your request will succeed. `DryRun` is an optional
1437
1435
  # parameter.
1438
1436
  #
1439
- # To learn more about how to use this parameter, see [Testing your KMS
1440
- # API calls][1] in the *Key Management Service Developer Guide*.
1437
+ # To learn more about how to use this parameter, see [Testing your
1438
+ # permissions][1] in the *Key Management Service Developer Guide*.
1441
1439
  #
1442
1440
  #
1443
1441
  #
1444
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
1442
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
1445
1443
  #
1446
1444
  # @return [Types::CreateGrantResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
1447
1445
  #
@@ -1511,8 +1509,7 @@ module Aws::KMS
1511
1509
  # A KMS key is a logical representation of a cryptographic key. In
1512
1510
  # addition to the key material used in cryptographic operations, a KMS
1513
1511
  # key includes metadata, such as the key ID, key policy, creation date,
1514
- # description, and key state. For details, see [Managing keys][2] in the
1515
- # *Key Management Service Developer Guide*
1512
+ # description, and key state.
1516
1513
  #
1517
1514
  # Use the parameters of `CreateKey` to specify the type of KMS key, the
1518
1515
  # source of its key material, its key policy, description, tags, and
@@ -1570,7 +1567,7 @@ module Aws::KMS
1570
1567
  # keys with SM2 key pairs (China Regions only) can be used to either
1571
1568
  # encrypt and decrypt data, sign and verify messages, or derive shared
1572
1569
  # secrets (you must choose one key usage type). For information about
1573
- # asymmetric KMS keys, see [Asymmetric KMS keys][3] in the *Key
1570
+ # asymmetric KMS keys, see [Asymmetric KMS keys][2] in the *Key
1574
1571
  # Management Service Developer Guide*.
1575
1572
  #
1576
1573
  #
@@ -1614,7 +1611,7 @@ module Aws::KMS
1614
1611
  # to encrypt data in one Amazon Web Services Region and decrypt it in
1615
1612
  # a different Amazon Web Services Region without re-encrypting the
1616
1613
  # data or making a cross-Region call. For more information about
1617
- # multi-Region keys, see [Multi-Region keys in KMS][4] in the *Key
1614
+ # multi-Region keys, see [Multi-Region keys in KMS][3] in the *Key
1618
1615
  # Management Service Developer Guide*.
1619
1616
  #
1620
1617
  #
@@ -1626,7 +1623,7 @@ module Aws::KMS
1626
1623
  # token. Use the wrapping public key to encrypt your key material.
1627
1624
  # Then, use ImportKeyMaterial with your import token to import the key
1628
1625
  # material. For step-by-step instructions, see [Importing Key
1629
- # Material][5] in the <i> <i>Key Management Service Developer
1626
+ # Material][4] in the <i> <i>Key Management Service Developer
1630
1627
  # Guide</i> </i>.
1631
1628
  #
1632
1629
  # You can import key material into KMS keys of all supported KMS key
@@ -1639,23 +1636,22 @@ module Aws::KMS
1639
1636
  # the `Origin` parameter of `CreateKey` with a value of `EXTERNAL` and
1640
1637
  # the `MultiRegion` parameter with a value of `True`. To create
1641
1638
  # replicas of the multi-Region primary key, use the ReplicateKey
1642
- # operation. For instructions, see [Importing key material into
1643
- # multi-Region keys][6]. For more information about multi-Region keys,
1644
- # see [Multi-Region keys in KMS][4] in the *Key Management Service
1645
- # Developer Guide*.
1639
+ # operation. For instructions, see [Importing key material step 1][5].
1640
+ # For more information about multi-Region keys, see [Multi-Region keys
1641
+ # in KMS][3] in the *Key Management Service Developer Guide*.
1646
1642
  #
1647
1643
  #
1648
1644
  #
1649
1645
  # Custom key store
1650
1646
  #
1651
- # : A [custom key store][7] lets you protect your Amazon Web Services
1647
+ # : A [custom key store][6] lets you protect your Amazon Web Services
1652
1648
  # resources using keys in a backing key store that you own and manage.
1653
1649
  # When you request a cryptographic operation with a KMS key in a
1654
1650
  # custom key store, the operation is performed in the backing key
1655
1651
  # store using its cryptographic keys.
1656
1652
  #
1657
- # KMS supports [CloudHSM key stores][8] backed by an CloudHSM cluster
1658
- # and [external key stores][9] backed by an external key manager
1653
+ # KMS supports [CloudHSM key stores][7] backed by an CloudHSM cluster
1654
+ # and [external key stores][8] backed by an external key manager
1659
1655
  # outside of Amazon Web Services. When you create a KMS key in an
1660
1656
  # CloudHSM key store, KMS generates an encryption key in the CloudHSM
1661
1657
  # cluster and associates it with the KMS key. When you create a KMS
@@ -1680,13 +1676,13 @@ module Aws::KMS
1680
1676
  # `ENCRYPT_DECRYPT` to create a symmetric encryption key. No other key
1681
1677
  # type is supported in a custom key store.
1682
1678
  #
1683
- # To create a KMS key in an [CloudHSM key store][8], use the `Origin`
1679
+ # To create a KMS key in an [CloudHSM key store][9], use the `Origin`
1684
1680
  # parameter with a value of `AWS_CLOUDHSM`. The CloudHSM cluster that
1685
1681
  # is associated with the custom key store must have at least two
1686
1682
  # active HSMs in different Availability Zones in the Amazon Web
1687
1683
  # Services Region.
1688
1684
  #
1689
- # To create a KMS key in an [external key store][9], use the `Origin`
1685
+ # To create a KMS key in an [external key store][10], use the `Origin`
1690
1686
  # parameter with a value of `EXTERNAL_KEY_STORE` and an `XksKeyId`
1691
1687
  # parameter that identifies an existing external key.
1692
1688
  #
@@ -1699,10 +1695,10 @@ module Aws::KMS
1699
1695
  # **Cross-account use**: No. You cannot use this operation to create a
1700
1696
  # KMS key in a different Amazon Web Services account.
1701
1697
  #
1702
- # **Required permissions**: [kms:CreateKey][10] (IAM policy). To use the
1703
- # `Tags` parameter, [kms:TagResource][10] (IAM policy). For examples and
1698
+ # **Required permissions**: [kms:CreateKey][11] (IAM policy). To use the
1699
+ # `Tags` parameter, [kms:TagResource][11] (IAM policy). For examples and
1704
1700
  # information about related permissions, see [Allow a user to create KMS
1705
- # keys][11] in the *Key Management Service Developer Guide*.
1701
+ # keys][12] in the *Key Management Service Developer Guide*.
1706
1702
  #
1707
1703
  # **Related operations:**
1708
1704
  #
@@ -1713,22 +1709,23 @@ module Aws::KMS
1713
1709
  # * ScheduleKeyDeletion
1714
1710
  #
1715
1711
  # **Eventual consistency**: The KMS API follows an eventual consistency
1716
- # model. For more information, see [KMS eventual consistency][12].
1712
+ # model. For more information, see [KMS eventual consistency][13].
1717
1713
  #
1718
1714
  #
1719
1715
  #
1720
1716
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys
1721
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html
1722
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
1723
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
1724
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
1725
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html
1726
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1727
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
1728
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1729
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1730
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html#iam-policy-example-create-key
1731
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
1717
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
1718
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
1719
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
1720
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html
1721
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1722
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
1723
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1724
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html
1725
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html
1726
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1727
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/customer-managed-policies.html#iam-policy-example-create-key
1728
+ # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
1732
1729
  #
1733
1730
  # @option params [String] :policy
1734
1731
  # The key policy to attach to the KMS key.
@@ -1750,22 +1747,38 @@ module Aws::KMS
1750
1747
  # not always immediately visible][2] in the *Amazon Web Services
1751
1748
  # Identity and Access Management User Guide*.
1752
1749
  #
1750
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are missing
1751
+ # from a key policy statement, the policy statement has no effect. When
1752
+ # a key policy statement is missing one of these elements, the KMS
1753
+ # console correctly reports an error, but the `CreateKey` and
1754
+ # `PutKeyPolicy` API requests succeed, even though the policy statement
1755
+ # is ineffective.
1756
+ #
1757
+ # For more information on required key policy elements, see [Elements in
1758
+ # a key policy][3] in the *Key Management Service Developer Guide*.
1759
+ #
1760
+ # </note>
1761
+ #
1753
1762
  # If you do not provide a key policy, KMS attaches a default key policy
1754
- # to the KMS key. For more information, see [Default key policy][3] in
1763
+ # to the KMS key. For more information, see [Default key policy][4] in
1755
1764
  # the *Key Management Service Developer Guide*.
1756
1765
  #
1757
- # The key policy size quota is 32 kilobytes (32768 bytes).
1766
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
1767
+ # `LimitExceededException`.
1768
+ #
1769
+ # </note>
1758
1770
  #
1759
1771
  # For help writing and formatting a JSON policy document, see the [IAM
1760
- # JSON Policy Reference][4] in the <i> <i>Identity and Access Management
1772
+ # JSON Policy Reference][5] in the <i> <i>Identity and Access Management
1761
1773
  # User Guide</i> </i>.
1762
1774
  #
1763
1775
  #
1764
1776
  #
1765
1777
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
1766
1778
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
1767
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
1768
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
1779
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
1780
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
1781
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
1769
1782
  #
1770
1783
  # @option params [String] :description
1771
1784
  # A description of the KMS key. Use a description that helps you decide
@@ -1807,7 +1820,7 @@ module Aws::KMS
1807
1820
  #
1808
1821
  #
1809
1822
  #
1810
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
1823
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
1811
1824
  #
1812
1825
  # @option params [String] :customer_master_key_spec
1813
1826
  # Instead, use the `KeySpec` parameter.
@@ -1821,20 +1834,21 @@ module Aws::KMS
1821
1834
  # Specifies the type of KMS key to create. The default value,
1822
1835
  # `SYMMETRIC_DEFAULT`, creates a KMS key with a 256-bit AES-GCM key that
1823
1836
  # is used for encryption and decryption, except in China Regions, where
1824
- # it creates a 128-bit symmetric key that uses SM4 encryption. For help
1825
- # choosing a key spec for your KMS key, see [Choosing a KMS key type][1]
1826
- # in the <i> <i>Key Management Service Developer Guide</i> </i>.
1837
+ # it creates a 128-bit symmetric key that uses SM4 encryption. For a
1838
+ # detailed description of all supported key specs, see [Key spec
1839
+ # reference][1] in the <i> <i>Key Management Service Developer Guide</i>
1840
+ # </i>.
1827
1841
  #
1828
1842
  # The `KeySpec` determines whether the KMS key contains a symmetric key
1829
1843
  # or an asymmetric key pair. It also determines the algorithms that the
1830
1844
  # KMS key supports. You can't change the `KeySpec` after the KMS key is
1831
1845
  # created. To further restrict the algorithms that can be used with the
1832
1846
  # KMS key, use a condition key in its key policy or IAM policy. For more
1833
- # information, see [kms:EncryptionAlgorithm][2], [kms:MacAlgorithm][3]
1834
- # or [kms:Signing Algorithm][4] in the <i> <i>Key Management Service
1835
- # Developer Guide</i> </i>.
1847
+ # information, see [kms:EncryptionAlgorithm][2], [kms:MacAlgorithm][3],
1848
+ # [kms:KeyAgreementAlgorithm][4], or [kms:SigningAlgorithm][5] in the
1849
+ # <i> <i>Key Management Service Developer Guide</i> </i>.
1836
1850
  #
1837
- # [Amazon Web Services services that are integrated with KMS][5] use
1851
+ # [Amazon Web Services services that are integrated with KMS][6] use
1838
1852
  # symmetric encryption KMS keys to protect your data. These services do
1839
1853
  # not support asymmetric KMS keys or HMAC KMS keys.
1840
1854
  #
@@ -1884,11 +1898,12 @@ module Aws::KMS
1884
1898
  #
1885
1899
  #
1886
1900
  #
1887
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose
1888
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm
1889
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm
1890
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm
1891
- # [5]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
1901
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html
1902
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-algorithm
1903
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-mac-algorithm
1904
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-agreement-algorithm
1905
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-signing-algorithm
1906
+ # [6]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
1892
1907
  #
1893
1908
  # @option params [String] :origin
1894
1909
  # The source of the key material for the KMS key. You cannot change the
@@ -1938,7 +1953,7 @@ module Aws::KMS
1938
1953
  #
1939
1954
  #
1940
1955
  #
1941
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1956
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1942
1957
  #
1943
1958
  # @option params [Boolean] :bypass_policy_lockout_safety_check
1944
1959
  # Skips ("bypasses") the key policy lockout safety check. The default
@@ -1986,7 +2001,7 @@ module Aws::KMS
1986
2001
  # When you add tags to an Amazon Web Services resource, Amazon Web
1987
2002
  # Services generates a cost allocation report with usage and costs
1988
2003
  # aggregated by tags. Tags can also be used to control access to a KMS
1989
- # key. For details, see [Tagging Keys][3].
2004
+ # key. For details, see [Tags in KMS][3].
1990
2005
  #
1991
2006
  #
1992
2007
  #
@@ -2057,7 +2072,7 @@ module Aws::KMS
2057
2072
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
2058
2073
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
2059
2074
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy
2060
- # [4]: https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements
2075
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html#xks-key-requirements
2061
2076
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption
2062
2077
  #
2063
2078
  # @return [Types::CreateKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
@@ -2394,6 +2409,7 @@ module Aws::KMS
2394
2409
  # resp.key_metadata.mac_algorithms #=> Array
2395
2410
  # resp.key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
2396
2411
  # resp.key_metadata.xks_key_configuration.id #=> String
2412
+ # resp.key_metadata.current_key_material_id #=> String
2397
2413
  #
2398
2414
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateKey AWS API Documentation
2399
2415
  #
@@ -2444,15 +2460,14 @@ module Aws::KMS
2444
2460
  # key that you intend.
2445
2461
  #
2446
2462
  # Whenever possible, use key policies to give users permission to call
2447
- # the `Decrypt` operation on a particular KMS key, instead of using
2448
- # &amp;IAM; policies. Otherwise, you might create an &amp;IAM; policy
2449
- # that gives the user `Decrypt` permission on all KMS keys. This user
2450
- # could decrypt ciphertext that was encrypted by KMS keys in other
2451
- # accounts if the key policy for the cross-account KMS key permits it.
2452
- # If you must use an IAM policy for `Decrypt` permissions, limit the
2453
- # user to particular KMS keys or particular trusted accounts. For
2454
- # details, see [Best practices for IAM policies][4] in the *Key
2455
- # Management Service Developer Guide*.
2463
+ # the `Decrypt` operation on a particular KMS key, instead of using IAM
2464
+ # policies. Otherwise, you might create an IAM policy that gives the
2465
+ # user `Decrypt` permission on all KMS keys. This user could decrypt
2466
+ # ciphertext that was encrypted by KMS keys in other accounts if the key
2467
+ # policy for the cross-account KMS key permits it. If you must use an
2468
+ # IAM policy for `Decrypt` permissions, limit the user to particular KMS
2469
+ # keys or particular trusted accounts. For details, see [Best practices
2470
+ # for IAM policies][4] in the *Key Management Service Developer Guide*.
2456
2471
  #
2457
2472
  # `Decrypt` also supports [Amazon Web Services Nitro Enclaves][5], which
2458
2473
  # provide an isolated compute environment in Amazon EC2. To call
@@ -2500,7 +2515,7 @@ module Aws::KMS
2500
2515
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2501
2516
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
2502
2517
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2503
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2518
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2504
2519
  #
2505
2520
  # @option params [required, String, StringIO, File] :ciphertext_blob
2506
2521
  # Ciphertext to be decrypted. The blob includes metadata.
@@ -2525,8 +2540,8 @@ module Aws::KMS
2525
2540
  #
2526
2541
  #
2527
2542
  #
2528
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2529
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2543
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2544
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2530
2545
  #
2531
2546
  # @option params [Array<String>] :grant_tokens
2532
2547
  # A list of grant tokens.
@@ -2539,7 +2554,7 @@ module Aws::KMS
2539
2554
  #
2540
2555
  #
2541
2556
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2542
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2557
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2543
2558
  #
2544
2559
  # @option params [String] :key_id
2545
2560
  # Specifies the KMS key that KMS uses to decrypt the ciphertext.
@@ -2615,12 +2630,12 @@ module Aws::KMS
2615
2630
  # Checks if your request will succeed. `DryRun` is an optional
2616
2631
  # parameter.
2617
2632
  #
2618
- # To learn more about how to use this parameter, see [Testing your KMS
2619
- # API calls][1] in the *Key Management Service Developer Guide*.
2633
+ # To learn more about how to use this parameter, see [Testing your
2634
+ # permissions][1] in the *Key Management Service Developer Guide*.
2620
2635
  #
2621
2636
  #
2622
2637
  #
2623
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2638
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2624
2639
  #
2625
2640
  # @return [Types::DecryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
2626
2641
  #
@@ -2628,6 +2643,7 @@ module Aws::KMS
2628
2643
  # * {Types::DecryptResponse#plaintext #plaintext} => String
2629
2644
  # * {Types::DecryptResponse#encryption_algorithm #encryption_algorithm} => String
2630
2645
  # * {Types::DecryptResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
2646
+ # * {Types::DecryptResponse#key_material_id #key_material_id} => String
2631
2647
  #
2632
2648
  #
2633
2649
  # @example Example: To decrypt data with a symmetric encryption KMS key
@@ -2710,6 +2726,7 @@ module Aws::KMS
2710
2726
  # resp.plaintext #=> String
2711
2727
  # resp.encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
2712
2728
  # resp.ciphertext_for_recipient #=> String
2729
+ # resp.key_material_id #=> String
2713
2730
  #
2714
2731
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Decrypt AWS API Documentation
2715
2732
  #
@@ -2766,7 +2783,7 @@ module Aws::KMS
2766
2783
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
2767
2784
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2768
2785
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
2769
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2786
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2770
2787
  #
2771
2788
  # @option params [required, String] :alias_name
2772
2789
  # The alias to be deleted. The alias name must begin with `alias/`
@@ -2805,9 +2822,9 @@ module Aws::KMS
2805
2822
  # does not affect the external key store proxy, external key manager, or
2806
2823
  # any external keys.
2807
2824
  #
2808
- # This operation is part of the [custom key stores][1] feature in KMS,
2809
- # which combines the convenience and extensive integration of KMS with
2810
- # the isolation and control of a key store that you own and manage.
2825
+ # This operation is part of the custom key stores feature in KMS, which
2826
+ # combines the convenience and extensive integration of KMS with the
2827
+ # isolation and control of a key store that you own and manage.
2811
2828
  #
2812
2829
  # The custom key store that you delete cannot contain any [KMS keys][2].
2813
2830
  # Before deleting the key store, verify that you will never need to use
@@ -2858,12 +2875,12 @@ module Aws::KMS
2858
2875
  #
2859
2876
  #
2860
2877
  #
2861
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
2878
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
2862
2879
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys
2863
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2880
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2864
2881
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
2865
2882
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2866
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2883
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2867
2884
  #
2868
2885
  # @option params [required, String] :custom_key_store_id
2869
2886
  # Enter the ID of the custom key store you want to delete. To find the
@@ -2925,6 +2942,8 @@ module Aws::KMS
2925
2942
  #
2926
2943
  # * GetParametersForImport
2927
2944
  #
2945
+ # * ListKeyRotations
2946
+ #
2928
2947
  # * ImportKeyMaterial
2929
2948
  #
2930
2949
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -2935,7 +2954,7 @@ module Aws::KMS
2935
2954
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
2936
2955
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
2937
2956
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2938
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2957
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2939
2958
  #
2940
2959
  # @option params [required, String] :key_id
2941
2960
  # Identifies the KMS key from which you are deleting imported key
@@ -2953,7 +2972,19 @@ module Aws::KMS
2953
2972
  # To get the key ID and key ARN for a KMS key, use ListKeys or
2954
2973
  # DescribeKey.
2955
2974
  #
2956
- # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
2975
+ # @option params [String] :key_material_id
2976
+ # Identifies the imported key material you are deleting.
2977
+ #
2978
+ # If no KeyMaterialId is specified, KMS deletes the current key
2979
+ # material.
2980
+ #
2981
+ # To get the list of key material IDs associated with a KMS key, use
2982
+ # ListKeyRotations.
2983
+ #
2984
+ # @return [Types::DeleteImportedKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
2985
+ #
2986
+ # * {Types::DeleteImportedKeyMaterialResponse#key_id #key_id} => String
2987
+ # * {Types::DeleteImportedKeyMaterialResponse#key_material_id #key_material_id} => String
2957
2988
  #
2958
2989
  #
2959
2990
  # @example Example: To delete imported key material
@@ -2968,8 +2999,14 @@ module Aws::KMS
2968
2999
  #
2969
3000
  # resp = client.delete_imported_key_material({
2970
3001
  # key_id: "KeyIdType", # required
3002
+ # key_material_id: "BackingKeyIdType",
2971
3003
  # })
2972
3004
  #
3005
+ # @example Response structure
3006
+ #
3007
+ # resp.key_id #=> String
3008
+ # resp.key_material_id #=> String
3009
+ #
2973
3010
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterial AWS API Documentation
2974
3011
  #
2975
3012
  # @overload delete_imported_key_material(params = {})
@@ -3072,7 +3109,7 @@ module Aws::KMS
3072
3109
  # [2]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf
3073
3110
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3074
3111
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3075
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3112
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3076
3113
  #
3077
3114
  # @option params [required, String] :key_id
3078
3115
  # Identifies an asymmetric NIST-recommended ECC or SM2 (China Regions
@@ -3140,18 +3177,18 @@ module Aws::KMS
3140
3177
  #
3141
3178
  #
3142
3179
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3143
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3180
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3144
3181
  #
3145
3182
  # @option params [Boolean] :dry_run
3146
3183
  # Checks if your request will succeed. `DryRun` is an optional
3147
3184
  # parameter.
3148
3185
  #
3149
- # To learn more about how to use this parameter, see [Testing your KMS
3150
- # API calls][1] in the *Key Management Service Developer Guide*.
3186
+ # To learn more about how to use this parameter, see [Testing your
3187
+ # permissions][1] in the *Key Management Service Developer Guide*.
3151
3188
  #
3152
3189
  #
3153
3190
  #
3154
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3191
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
3155
3192
  #
3156
3193
  # @option params [Types::RecipientInfo] :recipient
3157
3194
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -3246,9 +3283,9 @@ module Aws::KMS
3246
3283
  # Gets information about [custom key stores][1] in the account and
3247
3284
  # Region.
3248
3285
  #
3249
- # This operation is part of the [custom key stores][1] feature in KMS,
3250
- # which combines the convenience and extensive integration of KMS with
3251
- # the isolation and control of a key store that you own and manage.
3286
+ # This operation is part of the custom key stores feature in KMS, which
3287
+ # combines the convenience and extensive integration of KMS with the
3288
+ # isolation and control of a key store that you own and manage.
3252
3289
  #
3253
3290
  # By default, this operation returns information about all custom key
3254
3291
  # stores in the account and Region. To get only information about a
@@ -3301,11 +3338,11 @@ module Aws::KMS
3301
3338
  #
3302
3339
  #
3303
3340
  #
3304
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
3341
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
3305
3342
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
3306
3343
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
3307
3344
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3308
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3345
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3309
3346
  #
3310
3347
  # @option params [String] :custom_key_store_id
3311
3348
  # Gets only information about the specified custom key store. Enter the
@@ -3503,8 +3540,8 @@ module Aws::KMS
3503
3540
  # * Whether automatic key rotation is enabled on the KMS key. To get
3504
3541
  # this information, use GetKeyRotationStatus. Also, some key states
3505
3542
  # prevent a KMS key from being automatically rotated. For details, see
3506
- # [How Automatic Key Rotation Works][6] in the *Key Management Service
3507
- # Developer Guide*.
3543
+ # [How key rotation works][6] in the *Key Management Service Developer
3544
+ # Guide*.
3508
3545
  #
3509
3546
  # * Tags on the KMS key. To get this information, use ListResourceTags.
3510
3547
  #
@@ -3550,7 +3587,7 @@ module Aws::KMS
3550
3587
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
3551
3588
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-how-it-works
3552
3589
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3553
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3590
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3554
3591
  #
3555
3592
  # @option params [required, String] :key_id
3556
3593
  # Describes the specified KMS key.
@@ -3594,7 +3631,7 @@ module Aws::KMS
3594
3631
  #
3595
3632
  #
3596
3633
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3597
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3634
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3598
3635
  #
3599
3636
  # @return [Types::DescribeKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
3600
3637
  #
@@ -3855,6 +3892,7 @@ module Aws::KMS
3855
3892
  # resp.key_metadata.mac_algorithms #=> Array
3856
3893
  # resp.key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
3857
3894
  # resp.key_metadata.xks_key_configuration.id #=> String
3895
+ # resp.key_metadata.current_key_material_id #=> String
3858
3896
  #
3859
3897
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeKey AWS API Documentation
3860
3898
  #
@@ -3868,13 +3906,10 @@ module Aws::KMS
3868
3906
  # Sets the state of a KMS key to disabled. This change temporarily
3869
3907
  # prevents use of the KMS key for [cryptographic operations][1].
3870
3908
  #
3871
- # For more information about how key state affects the use of a KMS key,
3872
- # see [Key states of KMS keys][2] in the <i> <i>Key Management Service
3873
- # Developer Guide</i> </i>.
3874
- #
3875
3909
  # The KMS key that you use for this operation must be in a compatible
3876
- # key state. For details, see [Key states of KMS keys][2] in the *Key
3877
- # Management Service Developer Guide*.
3910
+ # key state. For more information about how key state affects the use of
3911
+ # a KMS key, see [Key states of KMS keys][2] in the <i> <i>Key
3912
+ # Management Service Developer Guide</i> </i>.
3878
3913
  #
3879
3914
  # **Cross-account use**: No. You cannot perform this operation on a KMS
3880
3915
  # key in a different Amazon Web Services account.
@@ -3888,10 +3923,10 @@ module Aws::KMS
3888
3923
  #
3889
3924
  #
3890
3925
  #
3891
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3926
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3892
3927
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3893
3928
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3894
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3929
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3895
3930
  #
3896
3931
  # @option params [required, String] :key_id
3897
3932
  # Identifies the KMS key to disable.
@@ -3980,18 +4015,18 @@ module Aws::KMS
3980
4015
  #
3981
4016
  #
3982
4017
  #
3983
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
4018
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
3984
4019
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
3985
4020
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
3986
4021
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
3987
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
3988
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4022
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4023
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
3989
4024
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
3990
4025
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
3991
4026
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
3992
4027
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3993
4028
  # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3994
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4029
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3995
4030
  #
3996
4031
  # @option params [required, String] :key_id
3997
4032
  # Identifies a symmetric encryption KMS key. You cannot enable or
@@ -4016,7 +4051,7 @@ module Aws::KMS
4016
4051
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks
4017
4052
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4018
4053
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4019
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4054
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4020
4055
  #
4021
4056
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
4022
4057
  #
@@ -4050,9 +4085,9 @@ module Aws::KMS
4050
4085
  # external key store proxy that communicates with your external key
4051
4086
  # manager.
4052
4087
  #
4053
- # This operation is part of the [custom key stores][1] feature in KMS,
4054
- # which combines the convenience and extensive integration of KMS with
4055
- # the isolation and control of a key store that you own and manage.
4088
+ # This operation is part of the custom key stores feature in KMS, which
4089
+ # combines the convenience and extensive integration of KMS with the
4090
+ # isolation and control of a key store that you own and manage.
4056
4091
  #
4057
4092
  # While a custom key store is disconnected, you can manage the custom
4058
4093
  # key store and its KMS keys, but you cannot create or use its KMS keys.
@@ -4096,10 +4131,10 @@ module Aws::KMS
4096
4131
  #
4097
4132
  #
4098
4133
  #
4099
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4100
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4134
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4135
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4101
4136
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4102
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4137
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4103
4138
  #
4104
4139
  # @option params [required, String] :custom_key_store_id
4105
4140
  # Enter the ID of the custom key store you want to disconnect. To find
@@ -4158,10 +4193,10 @@ module Aws::KMS
4158
4193
  #
4159
4194
  #
4160
4195
  #
4161
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4196
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4162
4197
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4163
4198
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4164
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4199
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4165
4200
  #
4166
4201
  # @option params [required, String] :key_id
4167
4202
  # Identifies the KMS key to enable.
@@ -4222,17 +4257,17 @@ module Aws::KMS
4222
4257
  # any in progress rotations. You can use the ListKeyRotations operation
4223
4258
  # to view the details of completed rotations.
4224
4259
  #
4225
- # Automatic key rotation is supported only on [symmetric encryption KMS
4226
- # keys][3]. You cannot enable automatic rotation of [asymmetric KMS
4227
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
4228
- # material][6], or KMS keys in a [custom key store][7]. To enable or
4229
- # disable automatic rotation of a set of related [multi-Region keys][8],
4260
+ # Automatic key rotation is supported only on symmetric encryption KMS
4261
+ # keys. You cannot enable automatic rotation of [asymmetric KMS
4262
+ # keys][3], [HMAC KMS keys][4], KMS keys with [imported key
4263
+ # material][5], or KMS keys in a [custom key store][6]. To enable or
4264
+ # disable automatic rotation of a set of related [multi-Region keys][7],
4230
4265
  # set the property on the primary key.
4231
4266
  #
4232
4267
  # You cannot enable or disable automatic rotation of [Amazon Web
4233
- # Services managed KMS keys][9]. KMS always rotates the key material of
4268
+ # Services managed KMS keys][8]. KMS always rotates the key material of
4234
4269
  # Amazon Web Services managed keys every year. Rotation of [Amazon Web
4235
- # Services owned KMS keys][10] is managed by the Amazon Web Services
4270
+ # Services owned KMS keys][9] is managed by the Amazon Web Services
4236
4271
  # service that owns the key.
4237
4272
  #
4238
4273
  # <note markdown="1"> In May 2022, KMS changed the rotation schedule for Amazon Web Services
@@ -4248,13 +4283,13 @@ module Aws::KMS
4248
4283
  # </note>
4249
4284
  #
4250
4285
  # The KMS key that you use for this operation must be in a compatible
4251
- # key state. For details, see [Key states of KMS keys][11] in the *Key
4286
+ # key state. For details, see [Key states of KMS keys][10] in the *Key
4252
4287
  # Management Service Developer Guide*.
4253
4288
  #
4254
4289
  # **Cross-account use**: No. You cannot perform this operation on a KMS
4255
4290
  # key in a different Amazon Web Services account.
4256
4291
  #
4257
- # **Required permissions**: [kms:EnableKeyRotation][12] (key policy)
4292
+ # **Required permissions**: [kms:EnableKeyRotation][11] (key policy)
4258
4293
  #
4259
4294
  # **Related operations:**
4260
4295
  #
@@ -4273,23 +4308,22 @@ module Aws::KMS
4273
4308
  # </note>
4274
4309
  #
4275
4310
  # **Eventual consistency**: The KMS API follows an eventual consistency
4276
- # model. For more information, see [KMS eventual consistency][13].
4311
+ # model. For more information, see [KMS eventual consistency][12].
4277
4312
  #
4278
4313
  #
4279
4314
  #
4280
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
4315
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
4281
4316
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
4282
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
4283
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4284
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4285
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4286
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4287
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4288
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
4289
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
4290
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4291
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4292
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4317
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4318
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4319
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4320
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4321
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4322
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
4323
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
4324
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4325
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4326
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4293
4327
  #
4294
4328
  # @option params [required, String] :key_id
4295
4329
  # Identifies a symmetric encryption KMS key. You cannot enable automatic
@@ -4315,8 +4349,8 @@ module Aws::KMS
4315
4349
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4316
4350
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4317
4351
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4318
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4319
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4352
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4353
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4320
4354
  #
4321
4355
  # @option params [Integer] :rotation_period_in_days
4322
4356
  # Use this parameter to specify a custom period of time between each
@@ -4448,10 +4482,10 @@ module Aws::KMS
4448
4482
  #
4449
4483
  #
4450
4484
  #
4451
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4485
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4452
4486
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4453
4487
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4454
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4488
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4455
4489
  #
4456
4490
  # @option params [required, String] :key_id
4457
4491
  # Identifies the KMS key to use in the encryption operation. The KMS key
@@ -4504,8 +4538,8 @@ module Aws::KMS
4504
4538
  #
4505
4539
  #
4506
4540
  #
4507
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4508
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4541
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4542
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4509
4543
  #
4510
4544
  # @option params [Array<String>] :grant_tokens
4511
4545
  # A list of grant tokens.
@@ -4518,7 +4552,7 @@ module Aws::KMS
4518
4552
  #
4519
4553
  #
4520
4554
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
4521
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
4555
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
4522
4556
  #
4523
4557
  # @option params [String] :encryption_algorithm
4524
4558
  # Specifies the encryption algorithm that KMS will use to encrypt the
@@ -4536,12 +4570,12 @@ module Aws::KMS
4536
4570
  # Checks if your request will succeed. `DryRun` is an optional
4537
4571
  # parameter.
4538
4572
  #
4539
- # To learn more about how to use this parameter, see [Testing your KMS
4540
- # API calls][1] in the *Key Management Service Developer Guide*.
4573
+ # To learn more about how to use this parameter, see [Testing your
4574
+ # permissions][1] in the *Key Management Service Developer Guide*.
4541
4575
  #
4542
4576
  #
4543
4577
  #
4544
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
4578
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
4545
4579
  #
4546
4580
  # @return [Types::EncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
4547
4581
  #
@@ -4716,7 +4750,7 @@ module Aws::KMS
4716
4750
  #
4717
4751
  #
4718
4752
  #
4719
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4753
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4720
4754
  # [2]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
4721
4755
  # [3]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
4722
4756
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
@@ -4725,7 +4759,7 @@ module Aws::KMS
4725
4759
  # [7]: https://docs.aws.amazon.com/dynamodb-encryption-client/latest/devguide/
4726
4760
  # [8]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
4727
4761
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4728
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4762
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4729
4763
  #
4730
4764
  # @option params [required, String] :key_id
4731
4765
  # Specifies the symmetric encryption KMS key that encrypts the data key.
@@ -4773,7 +4807,7 @@ module Aws::KMS
4773
4807
  #
4774
4808
  #
4775
4809
  #
4776
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4810
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4777
4811
  #
4778
4812
  # @option params [Integer] :number_of_bytes
4779
4813
  # Specifies the length of the data key in bytes. For example, use the
@@ -4803,7 +4837,7 @@ module Aws::KMS
4803
4837
  #
4804
4838
  #
4805
4839
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
4806
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
4840
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
4807
4841
  #
4808
4842
  # @option params [Types::RecipientInfo] :recipient
4809
4843
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -4837,12 +4871,12 @@ module Aws::KMS
4837
4871
  # Checks if your request will succeed. `DryRun` is an optional
4838
4872
  # parameter.
4839
4873
  #
4840
- # To learn more about how to use this parameter, see [Testing your KMS
4841
- # API calls][1] in the *Key Management Service Developer Guide*.
4874
+ # To learn more about how to use this parameter, see [Testing your
4875
+ # permissions][1] in the *Key Management Service Developer Guide*.
4842
4876
  #
4843
4877
  #
4844
4878
  #
4845
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
4879
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
4846
4880
  #
4847
4881
  # @return [Types::GenerateDataKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
4848
4882
  #
@@ -4850,6 +4884,7 @@ module Aws::KMS
4850
4884
  # * {Types::GenerateDataKeyResponse#plaintext #plaintext} => String
4851
4885
  # * {Types::GenerateDataKeyResponse#key_id #key_id} => String
4852
4886
  # * {Types::GenerateDataKeyResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
4887
+ # * {Types::GenerateDataKeyResponse#key_material_id #key_material_id} => String
4853
4888
  #
4854
4889
  #
4855
4890
  # @example Example: To generate a data key
@@ -4917,6 +4952,7 @@ module Aws::KMS
4917
4952
  # resp.plaintext #=> String
4918
4953
  # resp.key_id #=> String
4919
4954
  # resp.ciphertext_for_recipient #=> String
4955
+ # resp.key_material_id #=> String
4920
4956
  #
4921
4957
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKey AWS API Documentation
4922
4958
  #
@@ -5025,10 +5061,10 @@ module Aws::KMS
5025
5061
  # [3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
5026
5062
  # [4]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
5027
5063
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5028
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5064
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5029
5065
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5030
5066
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5031
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5067
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5032
5068
  #
5033
5069
  # @option params [Hash<String,String>] :encryption_context
5034
5070
  # Specifies the encryption context that will be used when encrypting the
@@ -5051,7 +5087,7 @@ module Aws::KMS
5051
5087
  #
5052
5088
  #
5053
5089
  #
5054
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5090
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5055
5091
  #
5056
5092
  # @option params [required, String] :key_id
5057
5093
  # Specifies the symmetric encryption KMS key that encrypts the private
@@ -5098,7 +5134,7 @@ module Aws::KMS
5098
5134
  #
5099
5135
  #
5100
5136
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5101
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5137
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5102
5138
  #
5103
5139
  # @option params [Types::RecipientInfo] :recipient
5104
5140
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -5136,12 +5172,12 @@ module Aws::KMS
5136
5172
  # Checks if your request will succeed. `DryRun` is an optional
5137
5173
  # parameter.
5138
5174
  #
5139
- # To learn more about how to use this parameter, see [Testing your KMS
5140
- # API calls][1] in the *Key Management Service Developer Guide*.
5175
+ # To learn more about how to use this parameter, see [Testing your
5176
+ # permissions][1] in the *Key Management Service Developer Guide*.
5141
5177
  #
5142
5178
  #
5143
5179
  #
5144
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5180
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5145
5181
  #
5146
5182
  # @return [Types::GenerateDataKeyPairResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5147
5183
  #
@@ -5151,6 +5187,7 @@ module Aws::KMS
5151
5187
  # * {Types::GenerateDataKeyPairResponse#key_id #key_id} => String
5152
5188
  # * {Types::GenerateDataKeyPairResponse#key_pair_spec #key_pair_spec} => String
5153
5189
  # * {Types::GenerateDataKeyPairResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
5190
+ # * {Types::GenerateDataKeyPairResponse#key_material_id #key_material_id} => String
5154
5191
  #
5155
5192
  #
5156
5193
  # @example Example: To generate an RSA key pair for encryption and decryption
@@ -5223,6 +5260,7 @@ module Aws::KMS
5223
5260
  # resp.key_id #=> String
5224
5261
  # resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SM2"
5225
5262
  # resp.ciphertext_for_recipient #=> String
5263
+ # resp.key_material_id #=> String
5226
5264
  #
5227
5265
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPair AWS API Documentation
5228
5266
  #
@@ -5301,10 +5339,10 @@ module Aws::KMS
5301
5339
  #
5302
5340
  #
5303
5341
  # [1]: https://tools.ietf.org/html/rfc5280
5304
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5342
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5305
5343
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5306
5344
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5307
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5345
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5308
5346
  #
5309
5347
  # @option params [Hash<String,String>] :encryption_context
5310
5348
  # Specifies the encryption context that will be used when encrypting the
@@ -5327,7 +5365,7 @@ module Aws::KMS
5327
5365
  #
5328
5366
  #
5329
5367
  #
5330
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5368
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5331
5369
  #
5332
5370
  # @option params [required, String] :key_id
5333
5371
  # Specifies the symmetric encryption KMS key that encrypts the private
@@ -5374,18 +5412,18 @@ module Aws::KMS
5374
5412
  #
5375
5413
  #
5376
5414
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5377
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5415
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5378
5416
  #
5379
5417
  # @option params [Boolean] :dry_run
5380
5418
  # Checks if your request will succeed. `DryRun` is an optional
5381
5419
  # parameter.
5382
5420
  #
5383
- # To learn more about how to use this parameter, see [Testing your KMS
5384
- # API calls][1] in the *Key Management Service Developer Guide*.
5421
+ # To learn more about how to use this parameter, see [Testing your
5422
+ # permissions][1] in the *Key Management Service Developer Guide*.
5385
5423
  #
5386
5424
  #
5387
5425
  #
5388
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5426
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5389
5427
  #
5390
5428
  # @return [Types::GenerateDataKeyPairWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5391
5429
  #
@@ -5393,6 +5431,7 @@ module Aws::KMS
5393
5431
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#public_key #public_key} => String
5394
5432
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_id #key_id} => String
5395
5433
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_pair_spec #key_pair_spec} => String
5434
+ # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_material_id #key_material_id} => String
5396
5435
  #
5397
5436
  #
5398
5437
  # @example Example: To generate an asymmetric data key pair without a plaintext key
@@ -5431,6 +5470,7 @@ module Aws::KMS
5431
5470
  # resp.public_key #=> String
5432
5471
  # resp.key_id #=> String
5433
5472
  # resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SM2"
5473
+ # resp.key_material_id #=> String
5434
5474
  #
5435
5475
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintext AWS API Documentation
5436
5476
  #
@@ -5520,10 +5560,10 @@ module Aws::KMS
5520
5560
  #
5521
5561
  #
5522
5562
  #
5523
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5563
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5524
5564
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5525
5565
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5526
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5566
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5527
5567
  #
5528
5568
  # @option params [required, String] :key_id
5529
5569
  # Specifies the symmetric encryption KMS key that encrypts the data key.
@@ -5571,7 +5611,7 @@ module Aws::KMS
5571
5611
  #
5572
5612
  #
5573
5613
  #
5574
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5614
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5575
5615
  #
5576
5616
  # @option params [String] :key_spec
5577
5617
  # The length of the data key. Use `AES_128` to generate a 128-bit
@@ -5594,23 +5634,24 @@ module Aws::KMS
5594
5634
  #
5595
5635
  #
5596
5636
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5597
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5637
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5598
5638
  #
5599
5639
  # @option params [Boolean] :dry_run
5600
5640
  # Checks if your request will succeed. `DryRun` is an optional
5601
5641
  # parameter.
5602
5642
  #
5603
- # To learn more about how to use this parameter, see [Testing your KMS
5604
- # API calls][1] in the *Key Management Service Developer Guide*.
5643
+ # To learn more about how to use this parameter, see [Testing your
5644
+ # permissions][1] in the *Key Management Service Developer Guide*.
5605
5645
  #
5606
5646
  #
5607
5647
  #
5608
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5648
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5609
5649
  #
5610
5650
  # @return [Types::GenerateDataKeyWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5611
5651
  #
5612
5652
  # * {Types::GenerateDataKeyWithoutPlaintextResponse#ciphertext_blob #ciphertext_blob} => String
5613
5653
  # * {Types::GenerateDataKeyWithoutPlaintextResponse#key_id #key_id} => String
5654
+ # * {Types::GenerateDataKeyWithoutPlaintextResponse#key_material_id #key_material_id} => String
5614
5655
  #
5615
5656
  #
5616
5657
  # @example Example: To generate an encrypted data key
@@ -5646,6 +5687,7 @@ module Aws::KMS
5646
5687
  #
5647
5688
  # resp.ciphertext_blob #=> String
5648
5689
  # resp.key_id #=> String
5690
+ # resp.key_material_id #=> String
5649
5691
  #
5650
5692
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintext AWS API Documentation
5651
5693
  #
@@ -5700,7 +5742,7 @@ module Aws::KMS
5700
5742
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
5701
5743
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5702
5744
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5703
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5745
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5704
5746
  #
5705
5747
  # @option params [required, String, StringIO, File] :message
5706
5748
  # The message to be hashed. Specify a message of up to 4,096 bytes.
@@ -5739,18 +5781,18 @@ module Aws::KMS
5739
5781
  #
5740
5782
  #
5741
5783
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5742
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5784
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5743
5785
  #
5744
5786
  # @option params [Boolean] :dry_run
5745
5787
  # Checks if your request will succeed. `DryRun` is an optional
5746
5788
  # parameter.
5747
5789
  #
5748
- # To learn more about how to use this parameter, see [Testing your KMS
5749
- # API calls][1] in the *Key Management Service Developer Guide*.
5790
+ # To learn more about how to use this parameter, see [Testing your
5791
+ # permissions][1] in the *Key Management Service Developer Guide*.
5750
5792
  #
5751
5793
  #
5752
5794
  #
5753
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5795
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5754
5796
  #
5755
5797
  # @return [Types::GenerateMacResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5756
5798
  #
@@ -5824,7 +5866,8 @@ module Aws::KMS
5824
5866
  # Management Service Developer Guide*.
5825
5867
  #
5826
5868
  # For more information about entropy and random number generation, see
5827
- # [Key Management Service Cryptographic Details][4].
5869
+ # [Entropy and random number generation][4] in the *Key Management
5870
+ # Service Developer Guide*.
5828
5871
  #
5829
5872
  # **Cross-account use**: Not applicable. `GenerateRandom` does not use
5830
5873
  # any account-specific resources, such as KMS keys.
@@ -5839,9 +5882,9 @@ module Aws::KMS
5839
5882
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
5840
5883
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
5841
5884
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5842
- # [4]: https://docs.aws.amazon.com/kms/latest/cryptographic-details/
5885
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#entropy-and-random-numbers
5843
5886
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5844
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5887
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5845
5888
  #
5846
5889
  # @option params [Integer] :number_of_bytes
5847
5890
  # The length of the random byte string. This parameter is required.
@@ -5961,7 +6004,7 @@ module Aws::KMS
5961
6004
  #
5962
6005
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5963
6006
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
5964
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6007
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5965
6008
  #
5966
6009
  # @option params [required, String] :key_id
5967
6010
  # Gets the key policy for the specified KMS key.
@@ -6029,16 +6072,16 @@ module Aws::KMS
6029
6072
  # enabled for the specified KMS key, the [rotation period][2], and the
6030
6073
  # next scheduled rotation date.
6031
6074
  #
6032
- # Automatic key rotation is supported only on [symmetric encryption KMS
6033
- # keys][3]. You cannot enable automatic rotation of [asymmetric KMS
6034
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
6035
- # material][6], or KMS keys in a [custom key store][7]. To enable or
6036
- # disable automatic rotation of a set of related [multi-Region keys][8],
6037
- # set the property on the primary key..
6075
+ # Automatic key rotation is supported only on symmetric encryption KMS
6076
+ # keys. You cannot enable automatic rotation of [asymmetric KMS
6077
+ # keys][3], [HMAC KMS keys][4], KMS keys with [imported key
6078
+ # material][5], or KMS keys in a [custom key store][6]. To enable or
6079
+ # disable automatic rotation of a set of related [multi-Region keys][7],
6080
+ # set the property on the primary key.
6038
6081
  #
6039
6082
  # You can enable (EnableKeyRotation) and disable automatic rotation
6040
6083
  # (DisableKeyRotation) of the key material in customer managed KMS keys.
6041
- # Key material rotation of [Amazon Web Services managed KMS keys][9] is
6084
+ # Key material rotation of [Amazon Web Services managed KMS keys][8] is
6042
6085
  # not configurable. KMS always rotates the key material in Amazon Web
6043
6086
  # Services managed KMS keys every year. The key rotation status for
6044
6087
  # Amazon Web Services managed KMS keys is always `true`.
@@ -6057,7 +6100,7 @@ module Aws::KMS
6057
6100
  # </note>
6058
6101
  #
6059
6102
  # The KMS key that you use for this operation must be in a compatible
6060
- # key state. For details, see [Key states of KMS keys][10] in the *Key
6103
+ # key state. For details, see [Key states of KMS keys][9] in the *Key
6061
6104
  # Management Service Developer Guide*.
6062
6105
  #
6063
6106
  # * Disabled: The key rotation status does not change when you disable a
@@ -6078,7 +6121,7 @@ module Aws::KMS
6078
6121
  # a different Amazon Web Services account, specify the key ARN in the
6079
6122
  # value of the `KeyId` parameter.
6080
6123
  #
6081
- # **Required permissions**: [kms:GetKeyRotationStatus][11] (key policy)
6124
+ # **Required permissions**: [kms:GetKeyRotationStatus][10] (key policy)
6082
6125
  #
6083
6126
  # **Related operations:**
6084
6127
  #
@@ -6091,22 +6134,21 @@ module Aws::KMS
6091
6134
  # * RotateKeyOnDemand
6092
6135
  #
6093
6136
  # **Eventual consistency**: The KMS API follows an eventual consistency
6094
- # model. For more information, see [KMS eventual consistency][12].
6137
+ # model. For more information, see [KMS eventual consistency][11].
6095
6138
  #
6096
6139
  #
6097
6140
  #
6098
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
6141
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
6099
6142
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotation-period
6100
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
6101
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
6102
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
6103
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6104
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
6105
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
6106
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
6107
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6108
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6109
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6143
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
6144
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
6145
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6146
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6147
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
6148
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
6149
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6150
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6151
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6110
6152
  #
6111
6153
  # @option params [required, String] :key_id
6112
6154
  # Gets the rotation status for the specified KMS key.
@@ -6180,9 +6222,7 @@ module Aws::KMS
6180
6222
  # By default, KMS keys are created with key material that KMS generates.
6181
6223
  # This operation supports [Importing key material][1], an advanced
6182
6224
  # feature that lets you generate and import the cryptographic key
6183
- # material for a KMS key. For more information about importing key
6184
- # material into KMS, see [Importing key material][1] in the *Key
6185
- # Management Service Developer Guide*.
6225
+ # material for a KMS key.
6186
6226
  #
6187
6227
  # Before calling `GetParametersForImport`, use the CreateKey operation
6188
6228
  # with an `Origin` value of `EXTERNAL` to create a KMS key with no key
@@ -6251,11 +6291,11 @@ module Aws::KMS
6251
6291
  #
6252
6292
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6253
6293
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6254
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
6255
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
6294
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6295
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#reimport-key-material
6256
6296
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6257
6297
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6258
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6298
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6259
6299
  #
6260
6300
  # @option params [required, String] :key_id
6261
6301
  # The identifier of the KMS key that will be associated with the
@@ -6279,9 +6319,8 @@ module Aws::KMS
6279
6319
  # @option params [required, String] :wrapping_algorithm
6280
6320
  # The algorithm you will use with the RSA public key (`PublicKey`) in
6281
6321
  # the response to protect your key material during import. For more
6282
- # information, see [Select a wrapping
6283
- # algorithm](kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm)
6284
- # in the *Key Management Service Developer Guide*.
6322
+ # information, see [Select a wrapping algorithm][1] in the *Key
6323
+ # Management Service Developer Guide*.
6285
6324
  #
6286
6325
  # For RSA\_AES wrapping algorithms, you encrypt your key material with
6287
6326
  # an AES key that you generate, then encrypt your AES key with the RSA
@@ -6313,6 +6352,10 @@ module Aws::KMS
6313
6352
  # * **RSAES\_PKCS1\_V1\_5** (Deprecated) — As of October 10, 2023, KMS
6314
6353
  # does not support the RSAES\_PKCS1\_V1\_5 wrapping algorithm.
6315
6354
  #
6355
+ #
6356
+ #
6357
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm
6358
+ #
6316
6359
  # @option params [required, String] :wrapping_key_spec
6317
6360
  # The type of RSA public key to return in the response. You will use
6318
6361
  # this wrapping key with the specified wrapping algorithm to protect
@@ -6460,8 +6503,9 @@ module Aws::KMS
6460
6503
  # * [KeyUsage][3]: Whether the key is used for encryption, signing, or
6461
6504
  # deriving a shared secret.
6462
6505
  #
6463
- # * [EncryptionAlgorithms][4] or [SigningAlgorithms][5]: A list of the
6464
- # encryption algorithms or the signing algorithms for the key.
6506
+ # * [EncryptionAlgorithms][4], [KeyAgreementAlgorithms][5], or
6507
+ # [SigningAlgorithms][6]: A list of the encryption algorithms, key
6508
+ # agreement algorithms, or signing algorithms for the key.
6465
6509
  #
6466
6510
  # Although KMS cannot enforce these restrictions on external operations,
6467
6511
  # it is crucial that you use this information to prevent the public key
@@ -6474,22 +6518,22 @@ module Aws::KMS
6474
6518
  # To verify a signature outside of KMS with an SM2 public key (China
6475
6519
  # Regions only), you must specify the distinguishing ID. By default, KMS
6476
6520
  # uses `1234567812345678` as the distinguishing ID. For more
6477
- # information, see [Offline verification with SM2 key pairs][6].
6521
+ # information, see [Offline verification with SM2 key pairs][7].
6478
6522
  #
6479
6523
  # The KMS key that you use for this operation must be in a compatible
6480
- # key state. For details, see [Key states of KMS keys][7] in the *Key
6524
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
6481
6525
  # Management Service Developer Guide*.
6482
6526
  #
6483
6527
  # **Cross-account use**: Yes. To perform this operation with a KMS key
6484
6528
  # in a different Amazon Web Services account, specify the key ARN or
6485
6529
  # alias ARN in the value of the `KeyId` parameter.
6486
6530
  #
6487
- # **Required permissions**: [kms:GetPublicKey][8] (key policy)
6531
+ # **Required permissions**: [kms:GetPublicKey][9] (key policy)
6488
6532
  #
6489
6533
  # **Related operations**: CreateKey
6490
6534
  #
6491
6535
  # **Eventual consistency**: The KMS API follows an eventual consistency
6492
- # model. For more information, see [KMS eventual consistency][9].
6536
+ # model. For more information, see [KMS eventual consistency][10].
6493
6537
  #
6494
6538
  #
6495
6539
  #
@@ -6497,11 +6541,12 @@ module Aws::KMS
6497
6541
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeySpec
6498
6542
  # [3]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyUsage
6499
6543
  # [4]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-EncryptionAlgorithms
6500
- # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
6501
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
6502
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6503
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6504
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6544
+ # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyAgreementAlgorithms
6545
+ # [6]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
6546
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
6547
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6548
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6549
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6505
6550
  #
6506
6551
  # @option params [required, String] :key_id
6507
6552
  # Identifies the asymmetric KMS key that includes the public key.
@@ -6536,7 +6581,7 @@ module Aws::KMS
6536
6581
  #
6537
6582
  #
6538
6583
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
6539
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6584
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
6540
6585
  #
6541
6586
  # @return [Types::GetPublicKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
6542
6587
  #
@@ -6603,53 +6648,47 @@ module Aws::KMS
6603
6648
  end
6604
6649
 
6605
6650
  # Imports or reimports key material into an existing KMS key that was
6606
- # created without key material. `ImportKeyMaterial` also sets the
6607
- # expiration model and expiration date of the imported key material.
6608
- #
6609
- # By default, KMS keys are created with key material that KMS generates.
6610
- # This operation supports [Importing key material][1], an advanced
6611
- # feature that lets you generate and import the cryptographic key
6612
- # material for a KMS key. For more information about importing key
6613
- # material into KMS, see [Importing key material][1] in the *Key
6614
- # Management Service Developer Guide*.
6651
+ # created without key material. You can also use this operation to set
6652
+ # or update the expiration model and expiration date of the imported key
6653
+ # material.
6615
6654
  #
6616
- # After you successfully import key material into a KMS key, you can
6617
- # [reimport the same key material][2] into that KMS key, but you cannot
6618
- # import different key material. You might reimport key material to
6619
- # replace key material that expired or key material that you deleted.
6620
- # You might also reimport key material to change the expiration model or
6621
- # expiration date of the key material.
6655
+ # By default, KMS creates KMS keys with key material that it generates.
6656
+ # You can also generate and import your own key material. For more
6657
+ # information about importing key material, see [Importing key
6658
+ # material][1].
6659
+ #
6660
+ # For asymmetric, HMAC and multi-Region keys, you cannot change the key
6661
+ # material after the initial import. You can import multiple key
6662
+ # materials into single-Region, symmetric encryption keys and rotate the
6663
+ # key material on demand using `RotateKeyOnDemand`.
6664
+ #
6665
+ # After you import key material, you can [reimport the same key
6666
+ # material][2] into that KMS key or, if the key supports on-demand
6667
+ # rotation, import new key material. You can use the `ImportType`
6668
+ # parameter to indicate whether you are importing new key material or
6669
+ # re-importing previously imported key material. You might reimport key
6670
+ # material to replace key material that expired or key material that you
6671
+ # deleted. You might also reimport key material to change the expiration
6672
+ # model or expiration date of the key material.
6622
6673
  #
6623
6674
  # Each time you import key material into KMS, you can determine whether
6624
6675
  # (`ExpirationModel`) and when (`ValidTo`) the key material expires. To
6625
6676
  # change the expiration of your key material, you must import it again,
6626
6677
  # either by calling `ImportKeyMaterial` or using the [import
6627
- # features](kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console)
6628
- # of the KMS console.
6678
+ # features][3] of the KMS console.
6629
6679
  #
6630
- # Before calling `ImportKeyMaterial`:
6680
+ # Before you call `ImportKeyMaterial`, complete these steps:
6631
6681
  #
6632
- # * Create or identify a KMS key with no key material. The KMS key must
6633
- # have an `Origin` value of `EXTERNAL`, which indicates that the KMS
6634
- # key is designed for imported key material.
6682
+ # * Create or identify a KMS key with `EXTERNAL` origin, which indicates
6683
+ # that the KMS key is designed for imported key material.
6635
6684
  #
6636
- # To create an new KMS key for imported key material, call the
6685
+ # To create a new KMS key for imported key material, call the
6637
6686
  # CreateKey operation with an `Origin` value of `EXTERNAL`. You can
6638
6687
  # create a symmetric encryption KMS key, HMAC KMS key, asymmetric
6639
- # encryption KMS key, or asymmetric signing KMS key. You can also
6640
- # import key material into a [multi-Region
6641
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of
6642
- # any supported type. However, you can't import key material into a
6643
- # KMS key in a [custom key
6644
- # store](kms/latest/developerguide/custom-key-store-overview.html).
6645
- #
6646
- # * Use the DescribeKey operation to verify that the `KeyState` of the
6647
- # KMS key is `PendingImport`, which indicates that the KMS key has no
6648
- # key material.
6649
- #
6650
- # If you are reimporting the same key material into an existing KMS
6651
- # key, you might need to call the DeleteImportedKeyMaterial to delete
6652
- # its existing key material.
6688
+ # encryption KMS key, asymmetric key agreement key, or asymmetric
6689
+ # signing KMS key. You can also import key material into a
6690
+ # [multi-Region key][4] of any supported type. However, you can't
6691
+ # import key material into a KMS key in a [custom key store][5].
6653
6692
  #
6654
6693
  # * Call the GetParametersForImport operation to get a public key and
6655
6694
  # import token set for importing key material.
@@ -6664,10 +6703,9 @@ module Aws::KMS
6664
6703
  # * The key ID or key ARN of the KMS key to associate with the imported
6665
6704
  # key material. Its `Origin` must be `EXTERNAL` and its `KeyState`
6666
6705
  # must be `PendingImport`. You cannot perform this operation on a KMS
6667
- # key in a [custom key
6668
- # store](kms/latest/developerguide/custom-key-store-overview.html), or
6669
- # on a KMS key in a different Amazon Web Services account. To get the
6670
- # `Origin` and `KeyState` of a KMS key, call DescribeKey.
6706
+ # key in a [custom key store][5], or on a KMS key in a different
6707
+ # Amazon Web Services account. To get the `Origin` and `KeyState` of a
6708
+ # KMS key, call DescribeKey.
6671
6709
  #
6672
6710
  # * The encrypted key material.
6673
6711
  #
@@ -6677,7 +6715,7 @@ module Aws::KMS
6677
6715
  #
6678
6716
  # * Whether the key material expires (`ExpirationModel`) and, if so,
6679
6717
  # when (`ValidTo`). For help with this choice, see [Setting an
6680
- # expiration time][3] in the *Key Management Service Developer Guide*.
6718
+ # expiration time][6] in the *Key Management Service Developer Guide*.
6681
6719
  #
6682
6720
  # If you set an expiration date, KMS deletes the key material from the
6683
6721
  # KMS key on the specified date, making the KMS key unusable. To use
@@ -6689,23 +6727,27 @@ module Aws::KMS
6689
6727
  #
6690
6728
  # When this operation is successful, the key state of the KMS key
6691
6729
  # changes from `PendingImport` to `Enabled`, and you can use the KMS key
6692
- # in cryptographic operations.
6730
+ # in cryptographic operations. For single-Region, symmetric encryption
6731
+ # keys, you will need to import all of the key materials associated with
6732
+ # the KMS key to change its state to `Enabled`. Use the
6733
+ # `ListKeyRotations` operation to list the ID and import state of each
6734
+ # key material associated with a KMS key.
6693
6735
  #
6694
6736
  # If this operation fails, use the exception to help determine the
6695
6737
  # problem. If the error is related to the key material, the import
6696
6738
  # token, or wrapping key, use GetParametersForImport to get a new public
6697
6739
  # key and import token for the KMS key and repeat the import procedure.
6698
- # For help, see [How To Import Key Material][4] in the *Key Management
6699
- # Service Developer Guide*.
6740
+ # For help, see [Create a KMS key with imported key material][7] in the
6741
+ # *Key Management Service Developer Guide*.
6700
6742
  #
6701
6743
  # The KMS key that you use for this operation must be in a compatible
6702
- # key state. For details, see [Key states of KMS keys][5] in the *Key
6744
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
6703
6745
  # Management Service Developer Guide*.
6704
6746
  #
6705
6747
  # **Cross-account use**: No. You cannot perform this operation on a KMS
6706
6748
  # key in a different Amazon Web Services account.
6707
6749
  #
6708
- # **Required permissions**: [kms:ImportKeyMaterial][6] (key policy)
6750
+ # **Required permissions**: [kms:ImportKeyMaterial][9] (key policy)
6709
6751
  #
6710
6752
  # **Related operations:**
6711
6753
  #
@@ -6713,18 +6755,25 @@ module Aws::KMS
6713
6755
  #
6714
6756
  # * GetParametersForImport
6715
6757
  #
6758
+ # * ListKeyRotations
6759
+ #
6760
+ # * RotateKeyOnDemand
6761
+ #
6716
6762
  # **Eventual consistency**: The KMS API follows an eventual consistency
6717
- # model. For more information, see [KMS eventual consistency][7].
6763
+ # model. For more information, see [KMS eventual consistency][10].
6718
6764
  #
6719
6765
  #
6720
6766
  #
6721
6767
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6722
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
6723
- # [3]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
6724
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#importing-keys-overview
6725
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6726
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6727
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6768
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#reimport-key-material
6769
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console
6770
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6771
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6772
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
6773
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-conceptual.html
6774
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6775
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6776
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6728
6777
  #
6729
6778
  # @option params [required, String] :key_id
6730
6779
  # The identifier of the KMS key that will be associated with the
@@ -6735,11 +6784,9 @@ module Aws::KMS
6735
6784
  #
6736
6785
  # The KMS key can be a symmetric encryption KMS key, HMAC KMS key,
6737
6786
  # asymmetric encryption KMS key, or asymmetric signing KMS key,
6738
- # including a [multi-Region
6739
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of any
6740
- # supported type. You cannot perform this operation on a KMS key in a
6741
- # custom key store, or on a KMS key in a different Amazon Web Services
6742
- # account.
6787
+ # including a [multi-Region key][1] of any supported type. You cannot
6788
+ # perform this operation on a KMS key in a custom key store, or on a KMS
6789
+ # key in a different Amazon Web Services account.
6743
6790
  #
6744
6791
  # Specify the key ID or key ARN of the KMS key.
6745
6792
  #
@@ -6753,6 +6800,10 @@ module Aws::KMS
6753
6800
  # To get the key ID and key ARN for a KMS key, use ListKeys or
6754
6801
  # DescribeKey.
6755
6802
  #
6803
+ #
6804
+ #
6805
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6806
+ #
6756
6807
  # @option params [required, String, StringIO, File] :import_token
6757
6808
  # The import token that you received in the response to a previous
6758
6809
  # GetParametersForImport request. It must be from the same response that
@@ -6797,9 +6848,47 @@ module Aws::KMS
6797
6848
  #
6798
6849
  #
6799
6850
  #
6800
- # [1]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
6851
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
6801
6852
  #
6802
- # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
6853
+ # @option params [String] :import_type
6854
+ # Indicates whether the key material being imported is previously
6855
+ # associated with this KMS key or not. This parameter is optional and
6856
+ # only usable with symmetric encryption keys. The default is
6857
+ # `EXISTING_KEY_MATERIAL`. If no key material has ever been imported
6858
+ # into the KMS key, and this parameter is omitted, the parameter
6859
+ # defaults to `NEW_KEY_MATERIAL`.
6860
+ #
6861
+ # @option params [String] :key_material_description
6862
+ # Description for the key material being imported. This parameter is
6863
+ # optional and only usable with symmetric encryption keys. If you do not
6864
+ # specify a key material description, KMS retains the value you
6865
+ # specified when you last imported the same key material into this KMS
6866
+ # key.
6867
+ #
6868
+ # @option params [String] :key_material_id
6869
+ # Identifies the key material being imported. This parameter is optional
6870
+ # and only usable with symmetric encryption keys. You cannot specify a
6871
+ # key material ID with `ImportType` set to `NEW_KEY_MATERIAL`. Whenever
6872
+ # you import key material into a symmetric encryption key, KMS assigns a
6873
+ # unique identifier to the key material based on the KMS key ID and the
6874
+ # imported key material. When you re-import key material with a
6875
+ # specified key material ID, KMS:
6876
+ #
6877
+ # * Computes the identifier for the key material
6878
+ #
6879
+ # * Matches the computed identifier against the specified key material
6880
+ # ID
6881
+ #
6882
+ # * Verifies that the key material ID is already associated with the KMS
6883
+ # key
6884
+ #
6885
+ # To get the list of key material IDs associated with a KMS key, use
6886
+ # ListKeyRotations.
6887
+ #
6888
+ # @return [Types::ImportKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
6889
+ #
6890
+ # * {Types::ImportKeyMaterialResponse#key_id #key_id} => String
6891
+ # * {Types::ImportKeyMaterialResponse#key_material_id #key_material_id} => String
6803
6892
  #
6804
6893
  #
6805
6894
  # @example Example: To import key material into a KMS key
@@ -6834,8 +6923,16 @@ module Aws::KMS
6834
6923
  # encrypted_key_material: "data", # required
6835
6924
  # valid_to: Time.now,
6836
6925
  # expiration_model: "KEY_MATERIAL_EXPIRES", # accepts KEY_MATERIAL_EXPIRES, KEY_MATERIAL_DOES_NOT_EXPIRE
6926
+ # import_type: "NEW_KEY_MATERIAL", # accepts NEW_KEY_MATERIAL, EXISTING_KEY_MATERIAL
6927
+ # key_material_description: "KeyMaterialDescriptionType",
6928
+ # key_material_id: "BackingKeyIdType",
6837
6929
  # })
6838
6930
  #
6931
+ # @example Response structure
6932
+ #
6933
+ # resp.key_id #=> String
6934
+ # resp.key_material_id #=> String
6935
+ #
6839
6936
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterial AWS API Documentation
6840
6937
  #
6841
6938
  # @overload import_key_material(params = {})
@@ -6886,10 +6983,10 @@ module Aws::KMS
6886
6983
  #
6887
6984
  #
6888
6985
  #
6889
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/limits.html#aliases-limit
6986
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/resource-limits.html#aliases-per-key
6890
6987
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6891
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
6892
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6988
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html
6989
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6893
6990
  #
6894
6991
  # @option params [String] :key_id
6895
6992
  # Lists only aliases that are associated with the specified KMS key.
@@ -7021,8 +7118,9 @@ module Aws::KMS
7021
7118
  #
7022
7119
  # For detailed information about grants, including grant terminology,
7023
7120
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
7024
- # Guide</i> </i>. For examples of working with grants in several
7025
- # programming languages, see [Programming grants][2].
7121
+ # Guide</i> </i>. For examples of creating grants in several programming
7122
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
7123
+ # CLI][2].
7026
7124
  #
7027
7125
  # <note markdown="1"> The `GranteePrincipal` field in the `ListGrants` response usually
7028
7126
  # contains the user or role designated as the grantee principal in the
@@ -7055,10 +7153,10 @@ module Aws::KMS
7055
7153
  #
7056
7154
  #
7057
7155
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
7058
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
7156
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
7059
7157
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services
7060
7158
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7061
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7159
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7062
7160
  #
7063
7161
  # @option params [Integer] :limit
7064
7162
  # Use this parameter to specify the maximum number of items to return.
@@ -7234,7 +7332,7 @@ module Aws::KMS
7234
7332
  #
7235
7333
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7236
7334
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
7237
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7335
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7238
7336
  #
7239
7337
  # @option params [required, String] :key_id
7240
7338
  # Gets the names of key policies for the specified KMS key.
@@ -7316,14 +7414,15 @@ module Aws::KMS
7316
7414
  req.send_request(options)
7317
7415
  end
7318
7416
 
7319
- # Returns information about all completed key material rotations for the
7320
- # specified KMS key.
7417
+ # Returns information about the key materials associated with the
7418
+ # specified KMS key. You can use the optional `IncludeKeyMaterial`
7419
+ # parameter to control which key materials are included in the response.
7321
7420
  #
7322
7421
  # You must specify the KMS key in all requests. You can refine the key
7323
7422
  # rotations list by limiting the number of rotations returned.
7324
7423
  #
7325
7424
  # For detailed information about automatic and on-demand key rotations,
7326
- # see [Rotating KMS keys][1] in the *Key Management Service Developer
7425
+ # see [Rotate KMS keys][1] in the *Key Management Service Developer
7327
7426
  # Guide*.
7328
7427
  #
7329
7428
  # **Cross-account use**: No. You cannot perform this operation on a KMS
@@ -7335,10 +7434,14 @@ module Aws::KMS
7335
7434
  #
7336
7435
  # * EnableKeyRotation
7337
7436
  #
7437
+ # * DeleteImportedKeyMaterial
7438
+ #
7338
7439
  # * DisableKeyRotation
7339
7440
  #
7340
7441
  # * GetKeyRotationStatus
7341
7442
  #
7443
+ # * ImportKeyMaterial
7444
+ #
7342
7445
  # * RotateKeyOnDemand
7343
7446
  #
7344
7447
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -7348,7 +7451,7 @@ module Aws::KMS
7348
7451
  #
7349
7452
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
7350
7453
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7351
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7454
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7352
7455
  #
7353
7456
  # @option params [required, String] :key_id
7354
7457
  # Gets the key rotations for the specified KMS key.
@@ -7365,6 +7468,16 @@ module Aws::KMS
7365
7468
  # To get the key ID and key ARN for a KMS key, use ListKeys or
7366
7469
  # DescribeKey.
7367
7470
  #
7471
+ # @option params [String] :include_key_material
7472
+ # Use this optional parameter to control which key materials associated
7473
+ # with this key are listed in the response. The default value of this
7474
+ # parameter is `ROTATIONS_ONLY`. If you omit this parameter, KMS returns
7475
+ # information on the key materials created by automatic or on-demand key
7476
+ # rotation. When you specify a value of `ALL_KEY_MATERIAL`, KMS adds the
7477
+ # first key material and any imported key material pending rotation to
7478
+ # the response. This parameter can only be used with KMS keys that
7479
+ # support automatic or on-demand key rotation.
7480
+ #
7368
7481
  # @option params [Integer] :limit
7369
7482
  # Use this parameter to specify the maximum number of items to return.
7370
7483
  # When this value is present, KMS does not return more than the
@@ -7417,6 +7530,7 @@ module Aws::KMS
7417
7530
  #
7418
7531
  # resp = client.list_key_rotations({
7419
7532
  # key_id: "KeyIdType", # required
7533
+ # include_key_material: "ALL_KEY_MATERIAL", # accepts ALL_KEY_MATERIAL, ROTATIONS_ONLY
7420
7534
  # limit: 1,
7421
7535
  # marker: "MarkerType",
7422
7536
  # })
@@ -7425,6 +7539,12 @@ module Aws::KMS
7425
7539
  #
7426
7540
  # resp.rotations #=> Array
7427
7541
  # resp.rotations[0].key_id #=> String
7542
+ # resp.rotations[0].key_material_id #=> String
7543
+ # resp.rotations[0].key_material_description #=> String
7544
+ # resp.rotations[0].import_state #=> String, one of "IMPORTED", "PENDING_IMPORT"
7545
+ # resp.rotations[0].key_material_state #=> String, one of "NON_CURRENT", "CURRENT", "PENDING_ROTATION"
7546
+ # resp.rotations[0].expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
7547
+ # resp.rotations[0].valid_to #=> Time
7428
7548
  # resp.rotations[0].rotation_date #=> Time
7429
7549
  # resp.rotations[0].rotation_type #=> String, one of "AUTOMATIC", "ON_DEMAND"
7430
7550
  # resp.next_marker #=> String
@@ -7463,7 +7583,7 @@ module Aws::KMS
7463
7583
  #
7464
7584
  #
7465
7585
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7466
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7586
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7467
7587
  #
7468
7588
  # @option params [Integer] :limit
7469
7589
  # Use this parameter to specify the maximum number of items to return.
@@ -7559,7 +7679,7 @@ module Aws::KMS
7559
7679
  # For general information about tags, including the format and syntax,
7560
7680
  # see [Tagging Amazon Web Services resources][1] in the *Amazon Web
7561
7681
  # Services General Reference*. For information about using tags in KMS,
7562
- # see [Tagging keys][2].
7682
+ # see [Tags in KMS][2].
7563
7683
  #
7564
7684
  # **Cross-account use**: No. You cannot perform this operation on a KMS
7565
7685
  # key in a different Amazon Web Services account.
@@ -7584,7 +7704,7 @@ module Aws::KMS
7584
7704
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
7585
7705
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
7586
7706
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7587
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7707
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7588
7708
  #
7589
7709
  # @option params [required, String] :key_id
7590
7710
  # Gets tags on the specified KMS key.
@@ -7689,8 +7809,9 @@ module Aws::KMS
7689
7809
  #
7690
7810
  # For detailed information about grants, including grant terminology,
7691
7811
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
7692
- # Guide</i> </i>. For examples of working with grants in several
7693
- # programming languages, see [Programming grants][2].
7812
+ # Guide</i> </i>. For examples of creating grants in several programming
7813
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
7814
+ # CLI][2].
7694
7815
  #
7695
7816
  # **Cross-account use**: You must specify a principal in your Amazon Web
7696
7817
  # Services account. This operation returns a list of grants where the
@@ -7728,9 +7849,9 @@ module Aws::KMS
7728
7849
  #
7729
7850
  #
7730
7851
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
7731
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
7852
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
7732
7853
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7733
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7854
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7734
7855
  #
7735
7856
  # @option params [Integer] :limit
7736
7857
  # Use this parameter to specify the maximum number of items to return.
@@ -7840,8 +7961,9 @@ module Aws::KMS
7840
7961
  # formatting a JSON policy document, see the [IAM JSON Policy
7841
7962
  # Reference][2] in the <i> <i>Identity and Access Management User
7842
7963
  # Guide</i> </i>. For examples of adding a key policy in multiple
7843
- # programming languages, see [Setting a key policy][3] in the *Key
7844
- # Management Service Developer Guide*.
7964
+ # programming languages, see [Use PutKeyPolicy with an Amazon Web
7965
+ # Services SDK or CLI][3] in the *Key Management Service Developer
7966
+ # Guide*.
7845
7967
  #
7846
7968
  # **Cross-account use**: No. You cannot perform this operation on a KMS
7847
7969
  # key in a different Amazon Web Services account.
@@ -7857,9 +7979,9 @@ module Aws::KMS
7857
7979
  #
7858
7980
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
7859
7981
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
7860
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-key-policies.html#put-policy
7982
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_PutKeyPolicy_section.html
7861
7983
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7862
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7984
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7863
7985
  #
7864
7986
  # @option params [required, String] :key_id
7865
7987
  # Sets the key policy on the specified KMS key.
@@ -7900,6 +8022,17 @@ module Aws::KMS
7900
8022
  # not always immediately visible][2] in the *Amazon Web Services
7901
8023
  # Identity and Access Management User Guide*.
7902
8024
  #
8025
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are missing
8026
+ # from a key policy statement, the policy statement has no effect. When
8027
+ # a key policy statement is missing one of these elements, the KMS
8028
+ # console correctly reports an error, but the `PutKeyPolicy` API request
8029
+ # succeeds, even though the policy statement is ineffective.
8030
+ #
8031
+ # For more information on required key policy elements, see [Elements in
8032
+ # a key policy][3] in the *Key Management Service Developer Guide*.
8033
+ #
8034
+ # </note>
8035
+ #
7903
8036
  # A key policy document can include only the following characters:
7904
8037
  #
7905
8038
  # * Printable ASCII characters from the space character (`\u0020`)
@@ -7911,18 +8044,24 @@ module Aws::KMS
7911
8044
  # * The tab (`\u0009`), line feed (`\u000A`), and carriage return
7912
8045
  # (`\u000D`) special characters
7913
8046
  #
7914
- # For information about key policies, see [Key policies in KMS][3] in
8047
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
8048
+ # `LimitExceededException`.
8049
+ #
8050
+ # </note>
8051
+ #
8052
+ # For information about key policies, see [Key policies in KMS][4] in
7915
8053
  # the *Key Management Service Developer Guide*.For help writing and
7916
8054
  # formatting a JSON policy document, see the [IAM JSON Policy
7917
- # Reference][4] in the <i> <i>Identity and Access Management User
8055
+ # Reference][5] in the <i> <i>Identity and Access Management User
7918
8056
  # Guide</i> </i>.
7919
8057
  #
7920
8058
  #
7921
8059
  #
7922
8060
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
7923
8061
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
7924
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
7925
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
8062
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
8063
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8064
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
7926
8065
  #
7927
8066
  # @option params [Boolean] :bypass_policy_lockout_safety_check
7928
8067
  # Skips ("bypasses") the key policy lockout safety check. The default
@@ -8071,15 +8210,15 @@ module Aws::KMS
8071
8210
  #
8072
8211
  #
8073
8212
  #
8074
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-manually
8075
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8076
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#asymmetric-cmks
8213
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys-manually.html
8214
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8215
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
8077
8216
  # [4]: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/
8078
8217
  # [5]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
8079
8218
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8080
8219
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8081
8220
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8082
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8221
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8083
8222
  #
8084
8223
  # @option params [required, String, StringIO, File] :ciphertext_blob
8085
8224
  # Ciphertext of the data to reencrypt.
@@ -8102,7 +8241,7 @@ module Aws::KMS
8102
8241
  #
8103
8242
  #
8104
8243
  #
8105
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8244
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8106
8245
  #
8107
8246
  # @option params [String] :source_key_id
8108
8247
  # Specifies the KMS key that KMS will use to decrypt the ciphertext
@@ -8188,7 +8327,7 @@ module Aws::KMS
8188
8327
  #
8189
8328
  #
8190
8329
  #
8191
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8330
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8192
8331
  #
8193
8332
  # @option params [String] :source_encryption_algorithm
8194
8333
  # Specifies the encryption algorithm that KMS will use to decrypt the
@@ -8222,18 +8361,18 @@ module Aws::KMS
8222
8361
  #
8223
8362
  #
8224
8363
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
8225
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
8364
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
8226
8365
  #
8227
8366
  # @option params [Boolean] :dry_run
8228
8367
  # Checks if your request will succeed. `DryRun` is an optional
8229
8368
  # parameter.
8230
8369
  #
8231
- # To learn more about how to use this parameter, see [Testing your KMS
8232
- # API calls][1] in the *Key Management Service Developer Guide*.
8370
+ # To learn more about how to use this parameter, see [Testing your
8371
+ # permissions][1] in the *Key Management Service Developer Guide*.
8233
8372
  #
8234
8373
  #
8235
8374
  #
8236
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
8375
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8237
8376
  #
8238
8377
  # @return [Types::ReEncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
8239
8378
  #
@@ -8242,6 +8381,8 @@ module Aws::KMS
8242
8381
  # * {Types::ReEncryptResponse#key_id #key_id} => String
8243
8382
  # * {Types::ReEncryptResponse#source_encryption_algorithm #source_encryption_algorithm} => String
8244
8383
  # * {Types::ReEncryptResponse#destination_encryption_algorithm #destination_encryption_algorithm} => String
8384
+ # * {Types::ReEncryptResponse#source_key_material_id #source_key_material_id} => String
8385
+ # * {Types::ReEncryptResponse#destination_key_material_id #destination_key_material_id} => String
8245
8386
  #
8246
8387
  #
8247
8388
  # @example Example: To reencrypt data
@@ -8285,6 +8426,8 @@ module Aws::KMS
8285
8426
  # resp.key_id #=> String
8286
8427
  # resp.source_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8287
8428
  # resp.destination_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8429
+ # resp.source_key_material_id #=> String
8430
+ # resp.destination_key_material_id #=> String
8288
8431
  #
8289
8432
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncrypt AWS API Documentation
8290
8433
  #
@@ -8316,12 +8459,12 @@ module Aws::KMS
8316
8459
  # independently of its primary and peer replica keys. A primary key and
8317
8460
  # its replica keys share properties that make them interoperable. They
8318
8461
  # have the same [key ID][2] and key material. They also have the same
8319
- # [key spec][3], [key usage][4], [key material origin][5], and
8320
- # [automatic key rotation status][6]. KMS automatically synchronizes
8321
- # these shared properties among related multi-Region keys. All other
8322
- # properties of a replica key can differ, including its [key policy][7],
8323
- # [tags][8], [aliases][9], and [Key states of KMS keys][10]. KMS pricing
8324
- # and quotas for KMS keys apply to each primary key and replica key.
8462
+ # key spec, key usage, key material origin, and automatic key rotation
8463
+ # status. KMS automatically synchronizes these shared properties among
8464
+ # related multi-Region keys. All other properties of a replica key can
8465
+ # differ, including its [key policy][3], [tags][4], [aliases][5], and
8466
+ # [key state][6]. KMS pricing and quotas for KMS keys apply to each
8467
+ # primary key and replica key.
8325
8468
  #
8326
8469
  # When this operation completes, the new replica key has a transient key
8327
8470
  # state of `Creating`. This key state changes to `Enabled` (or
@@ -8331,7 +8474,7 @@ module Aws::KMS
8331
8474
  # If you are creating and using the replica key programmatically, retry
8332
8475
  # on `KMSInvalidStateException` or call `DescribeKey` to check its
8333
8476
  # `KeyState` value before using it. For details about the `Creating` key
8334
- # state, see [Key states of KMS keys][10] in the *Key Management Service
8477
+ # state, see [Key states of KMS keys][6] in the *Key Management Service
8335
8478
  # Developer Guide*.
8336
8479
  #
8337
8480
  # You cannot create more than one replica of a primary key in any
@@ -8340,7 +8483,7 @@ module Aws::KMS
8340
8483
  # `AlreadyExistsException` error. If the key state of the existing
8341
8484
  # replica is `PendingDeletion`, you can cancel the scheduled key
8342
8485
  # deletion (CancelKeyDeletion) or wait for the key to be deleted. The
8343
- # new replica key you create will have the same [shared properties][11]
8486
+ # new replica key you create will have the same [shared properties][7]
8344
8487
  # as the original replica key.
8345
8488
  #
8346
8489
  # The CloudTrail log of a `ReplicateKey` operation records a
@@ -8350,8 +8493,6 @@ module Aws::KMS
8350
8493
  # If you replicate a multi-Region primary key with imported key
8351
8494
  # material, the replica key is created with no key material. You must
8352
8495
  # import the same key material that you imported into the primary key.
8353
- # For details, see [Importing key material into multi-Region keys][12]
8354
- # in the *Key Management Service Developer Guide*.
8355
8496
  #
8356
8497
  # To convert a replica key to a primary key, use the UpdatePrimaryRegion
8357
8498
  # operation.
@@ -8382,23 +8523,18 @@ module Aws::KMS
8382
8523
  # * UpdatePrimaryRegion
8383
8524
  #
8384
8525
  # **Eventual consistency**: The KMS API follows an eventual consistency
8385
- # model. For more information, see [KMS eventual consistency][13].
8526
+ # model. For more information, see [KMS eventual consistency][8].
8386
8527
  #
8387
8528
  #
8388
8529
  #
8389
8530
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
8390
8531
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id
8391
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec
8392
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-usage
8393
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-origin
8394
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
8395
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8396
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
8397
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
8398
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8399
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties
8400
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html
8401
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8532
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8533
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
8534
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
8535
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8536
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties
8537
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8402
8538
  #
8403
8539
  # @option params [required, String] :key_id
8404
8540
  # Identifies the multi-Region primary key that is being replicated. To
@@ -8426,33 +8562,23 @@ module Aws::KMS
8426
8562
  # [KMS service endpoints][1] in the *Amazon Web Services General
8427
8563
  # Reference*.
8428
8564
  #
8429
- # <note markdown="1"> HMAC KMS keys are not supported in all Amazon Web Services Regions. If
8430
- # you try to replicate an HMAC KMS key in an Amazon Web Services Region
8431
- # in which HMAC keys are not supported, the `ReplicateKey` operation
8432
- # returns an `UnsupportedOperationException`. For a list of Regions in
8433
- # which HMAC KMS keys are supported, see [HMAC keys in KMS][2] in the
8434
- # *Key Management Service Developer Guide*.
8435
- #
8436
- # </note>
8437
- #
8438
8565
  # The replica must be in a different Amazon Web Services Region than its
8439
8566
  # primary key and other replicas of that primary key, but in the same
8440
8567
  # Amazon Web Services partition. KMS must be available in the replica
8441
8568
  # Region. If the Region is not enabled by default, the Amazon Web
8442
8569
  # Services account must be enabled in the Region. For information about
8443
- # Amazon Web Services partitions, see [Amazon Resource Names (ARNs)][3]
8570
+ # Amazon Web Services partitions, see [Amazon Resource Names (ARNs)][2]
8444
8571
  # in the *Amazon Web Services General Reference*. For information about
8445
- # enabling and disabling Regions, see [Enabling a Region][4] and
8446
- # [Disabling a Region][5] in the *Amazon Web Services General
8572
+ # enabling and disabling Regions, see [Enabling a Region][3] and
8573
+ # [Disabling a Region][4] in the *Amazon Web Services General
8447
8574
  # Reference*.
8448
8575
  #
8449
8576
  #
8450
8577
  #
8451
8578
  # [1]: https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region
8452
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
8453
- # [3]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
8454
- # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
8455
- # [5]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
8579
+ # [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
8580
+ # [3]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
8581
+ # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
8456
8582
  #
8457
8583
  # @option params [String] :policy
8458
8584
  # The key policy to attach to the KMS key. This parameter is optional.
@@ -8500,7 +8626,7 @@ module Aws::KMS
8500
8626
  #
8501
8627
  #
8502
8628
  #
8503
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
8629
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
8504
8630
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
8505
8631
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
8506
8632
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
@@ -8569,7 +8695,7 @@ module Aws::KMS
8569
8695
  # When you add tags to an Amazon Web Services resource, Amazon Web
8570
8696
  # Services generates a cost allocation report with usage and costs
8571
8697
  # aggregated by tags. Tags can also be used to control access to a KMS
8572
- # key. For details, see [Tagging Keys][3].
8698
+ # key. For details, see [Tags in KMS][3].
8573
8699
  #
8574
8700
  #
8575
8701
  #
@@ -8682,6 +8808,7 @@ module Aws::KMS
8682
8808
  # resp.replica_key_metadata.mac_algorithms #=> Array
8683
8809
  # resp.replica_key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
8684
8810
  # resp.replica_key_metadata.xks_key_configuration.id #=> String
8811
+ # resp.replica_key_metadata.current_key_material_id #=> String
8685
8812
  # resp.replica_policy #=> String
8686
8813
  # resp.replica_tags #=> Array
8687
8814
  # resp.replica_tags[0].tag_key #=> String
@@ -8705,20 +8832,20 @@ module Aws::KMS
8705
8832
  # by the *grantee principal* if the grant allows the `RetireGrant`
8706
8833
  # operation, and by the Amazon Web Services account in which the grant
8707
8834
  # is created. It can also be called by principals to whom permission for
8708
- # retiring a grant is delegated. For details, see [Retiring and revoking
8709
- # grants][2] in the *Key Management Service Developer Guide*.
8835
+ # retiring a grant is delegated.
8710
8836
  #
8711
8837
  # For detailed information about grants, including grant terminology,
8712
- # see [Grants in KMS][3] in the <i> <i>Key Management Service Developer
8713
- # Guide</i> </i>. For examples of working with grants in several
8714
- # programming languages, see [Programming grants][4].
8838
+ # see [Grants in KMS][2] in the <i> <i>Key Management Service Developer
8839
+ # Guide</i> </i>. For examples of creating grants in several programming
8840
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
8841
+ # CLI][3].
8715
8842
  #
8716
8843
  # **Cross-account use**: Yes. You can retire a grant on a KMS key in a
8717
8844
  # different Amazon Web Services account.
8718
8845
  #
8719
8846
  # **Required permissions**: Permission to retire a grant is determined
8720
8847
  # primarily by the grant. For details, see [Retiring and revoking
8721
- # grants][2] in the *Key Management Service Developer Guide*.
8848
+ # grants][4] in the *Key Management Service Developer Guide*.
8722
8849
  #
8723
8850
  # **Related operations:**
8724
8851
  #
@@ -8736,10 +8863,10 @@ module Aws::KMS
8736
8863
  #
8737
8864
  #
8738
8865
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
8739
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
8740
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8741
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
8742
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8866
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8867
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
8868
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
8869
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8743
8870
  #
8744
8871
  # @option params [String] :grant_token
8745
8872
  # Identifies the grant to be retired. You can use a grant token to
@@ -8774,12 +8901,12 @@ module Aws::KMS
8774
8901
  # Checks if your request will succeed. `DryRun` is an optional
8775
8902
  # parameter.
8776
8903
  #
8777
- # To learn more about how to use this parameter, see [Testing your KMS
8778
- # API calls][1] in the *Key Management Service Developer Guide*.
8904
+ # To learn more about how to use this parameter, see [Testing your
8905
+ # permissions][1] in the *Key Management Service Developer Guide*.
8779
8906
  #
8780
8907
  #
8781
8908
  #
8782
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
8909
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8783
8910
  #
8784
8911
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
8785
8912
  #
@@ -8824,8 +8951,9 @@ module Aws::KMS
8824
8951
  #
8825
8952
  # For detailed information about grants, including grant terminology,
8826
8953
  # see [Grants in KMS][3] in the <i> <i>Key Management Service Developer
8827
- # Guide</i> </i>. For examples of working with grants in several
8828
- # programming languages, see [Programming grants][4].
8954
+ # Guide</i> </i>. For examples of creating grants in several programming
8955
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
8956
+ # CLI][4].
8829
8957
  #
8830
8958
  # **Cross-account use**: Yes. To perform this operation on a KMS key in
8831
8959
  # a different Amazon Web Services account, specify the key ARN in the
@@ -8848,12 +8976,12 @@ module Aws::KMS
8848
8976
  #
8849
8977
  #
8850
8978
  #
8851
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
8979
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
8852
8980
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-eventual-consistency
8853
8981
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8854
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
8982
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
8855
8983
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8856
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8984
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8857
8985
  #
8858
8986
  # @option params [required, String] :key_id
8859
8987
  # A unique identifier for the KMS key associated with the grant. To get
@@ -8880,12 +9008,12 @@ module Aws::KMS
8880
9008
  # Checks if your request will succeed. `DryRun` is an optional
8881
9009
  # parameter.
8882
9010
  #
8883
- # To learn more about how to use this parameter, see [Testing your KMS
8884
- # API calls][1] in the *Key Management Service Developer Guide*.
9011
+ # To learn more about how to use this parameter, see [Testing your
9012
+ # permissions][1] in the *Key Management Service Developer Guide*.
8885
9013
  #
8886
9014
  #
8887
9015
  #
8888
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
9016
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8889
9017
  #
8890
9018
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
8891
9019
  #
@@ -8941,10 +9069,15 @@ module Aws::KMS
8941
9069
  # of the key material for your KMS keys in CloudTrail and Amazon
8942
9070
  # CloudWatch.
8943
9071
  #
8944
- # On-demand key rotation is supported only on [symmetric encryption KMS
8945
- # keys][3]. You cannot perform on-demand rotation of [asymmetric KMS
8946
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
8947
- # material][6], or KMS keys in a [custom key store][7]. To perform
9072
+ # On-demand key rotation is supported only on symmetric encryption KMS
9073
+ # keys. You cannot perform on-demand rotation of [asymmetric KMS
9074
+ # keys][3], [HMAC KMS keys][4], multi-Region KMS keys with [imported key
9075
+ # material][5], or KMS keys in a [custom key store][6]. When you
9076
+ # initiate on-demand key rotation on a symmetric encryption KMS key with
9077
+ # imported key material, you must have already imported [new key
9078
+ # material][7] and that key material's state should be
9079
+ # `PENDING_ROTATION`. Use the `ListKeyRotations` operation to check the
9080
+ # state of all key materials associated with a KMS key. To perform
8948
9081
  # on-demand rotation of a set of related [multi-Region keys][8], invoke
8949
9082
  # the on-demand rotation on the primary key.
8950
9083
  #
@@ -8971,6 +9104,8 @@ module Aws::KMS
8971
9104
  #
8972
9105
  # * GetKeyRotationStatus
8973
9106
  #
9107
+ # * ImportKeyMaterial
9108
+ #
8974
9109
  # * ListKeyRotations
8975
9110
  #
8976
9111
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -8978,27 +9113,27 @@ module Aws::KMS
8978
9113
  #
8979
9114
  #
8980
9115
  #
8981
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-on-demand
8982
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
8983
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
8984
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
8985
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
8986
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
8987
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
8988
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
9116
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html
9117
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
9118
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9119
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
9120
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
9121
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9122
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html
9123
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
8989
9124
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
8990
9125
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
8991
9126
  # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8992
9127
  # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8993
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9128
+ # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8994
9129
  #
8995
9130
  # @option params [required, String] :key_id
8996
9131
  # Identifies a symmetric encryption KMS key. You cannot perform
8997
9132
  # on-demand rotation of [asymmetric KMS keys][1], [HMAC KMS keys][2],
8998
- # KMS keys with [imported key material][3], or KMS keys in a [custom key
8999
- # store][4]. To perform on-demand rotation of a set of related
9000
- # [multi-Region keys][5], invoke the on-demand rotation on the primary
9001
- # key.
9133
+ # multi-Region KMS keys with [imported key material][3], or KMS keys in
9134
+ # a [custom key store][4]. To perform on-demand rotation of a set of
9135
+ # related [multi-Region keys][5], invoke the on-demand rotation on the
9136
+ # primary key.
9002
9137
  #
9003
9138
  # Specify the key ID or key ARN of the KMS key.
9004
9139
  #
@@ -9017,8 +9152,8 @@ module Aws::KMS
9017
9152
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9018
9153
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
9019
9154
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
9020
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
9021
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
9155
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9156
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
9022
9157
  #
9023
9158
  # @return [Types::RotateKeyOnDemandResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
9024
9159
  #
@@ -9072,9 +9207,8 @@ module Aws::KMS
9072
9207
  # operation. When a KMS key is deleted, all data that was encrypted
9073
9208
  # under the KMS key is unrecoverable. (The only exception is a
9074
9209
  # [multi-Region replica key][1], or an [asymmetric or HMAC KMS key with
9075
- # imported key
9076
- # material](kms/latest/developerguide/importing-keys-managing.html#import-delete-key).)
9077
- # To prevent the use of a KMS key without deleting it, use DisableKey.
9210
+ # imported key material][2].) To prevent the use of a KMS key without
9211
+ # deleting it, use DisableKey.
9078
9212
  #
9079
9213
  # You can schedule the deletion of a multi-Region primary key and its
9080
9214
  # replica keys at any time. However, KMS will not delete a multi-Region
@@ -9085,13 +9219,13 @@ module Aws::KMS
9085
9219
  # the last of its replicas keys is deleted (not just scheduled), the key
9086
9220
  # state of the primary key changes to `PendingDeletion` and its waiting
9087
9221
  # period (`PendingWindowInDays`) begins. For details, see [Deleting
9088
- # multi-Region keys][1] in the *Key Management Service Developer Guide*.
9222
+ # multi-Region keys][3] in the *Key Management Service Developer Guide*.
9089
9223
  #
9090
- # When KMS [deletes a KMS key from an CloudHSM key store][2], it makes a
9224
+ # When KMS [deletes a KMS key from an CloudHSM key store][4], it makes a
9091
9225
  # best effort to delete the associated key material from the associated
9092
9226
  # CloudHSM cluster. However, you might need to manually [delete the
9093
- # orphaned key material][3] from the cluster and its backups. [Deleting
9094
- # a KMS key from an external key store][4] has no effect on the
9227
+ # orphaned key material][5] from the cluster and its backups. [Deleting
9228
+ # a KMS key from an external key store][6] has no effect on the
9095
9229
  # associated external key. However, for both types of custom key stores,
9096
9230
  # deleting a KMS key is destructive and irreversible. You cannot decrypt
9097
9231
  # ciphertext encrypted under the KMS key by using only its associated
@@ -9100,11 +9234,11 @@ module Aws::KMS
9100
9234
  # material.
9101
9235
  #
9102
9236
  # For more information about scheduling a KMS key for deletion, see
9103
- # [Deleting KMS keys][5] in the *Key Management Service Developer
9237
+ # [Deleting KMS keys][7] in the *Key Management Service Developer
9104
9238
  # Guide*.
9105
9239
  #
9106
9240
  # The KMS key that you use for this operation must be in a compatible
9107
- # key state. For details, see [Key states of KMS keys][6] in the *Key
9241
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
9108
9242
  # Management Service Developer Guide*.
9109
9243
  #
9110
9244
  # **Cross-account use**: No. You cannot perform this operation on a KMS
@@ -9119,17 +9253,19 @@ module Aws::KMS
9119
9253
  # * DisableKey
9120
9254
  #
9121
9255
  # **Eventual consistency**: The KMS API follows an eventual consistency
9122
- # model. For more information, see [KMS eventual consistency][7].
9256
+ # model. For more information, see [KMS eventual consistency][9].
9123
9257
  #
9124
9258
  #
9125
9259
  #
9126
9260
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-delete.html
9127
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/delete-cmk-keystore.html
9128
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
9129
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/delete-xks-key.html
9130
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
9131
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9132
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9261
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#import-delete-key
9262
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#deleting-mrks
9263
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#delete-cmk-keystore
9264
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
9265
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#delete-xks-key
9266
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
9267
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9268
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9133
9269
  #
9134
9270
  # @option params [required, String] :key_id
9135
9271
  # The unique identifier of the KMS key to delete.
@@ -9278,7 +9414,7 @@ module Aws::KMS
9278
9414
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9279
9415
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9280
9416
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9281
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9417
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9282
9418
  #
9283
9419
  # @option params [required, String] :key_id
9284
9420
  # Identifies an asymmetric KMS key. KMS uses the private key in the
@@ -9352,7 +9488,7 @@ module Aws::KMS
9352
9488
  #
9353
9489
  #
9354
9490
  #
9355
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
9491
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
9356
9492
  #
9357
9493
  # @option params [Array<String>] :grant_tokens
9358
9494
  # A list of grant tokens.
@@ -9365,7 +9501,7 @@ module Aws::KMS
9365
9501
  #
9366
9502
  #
9367
9503
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
9368
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
9504
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
9369
9505
  #
9370
9506
  # @option params [required, String] :signing_algorithm
9371
9507
  # Specifies the signing algorithm to use when signing the message.
@@ -9379,12 +9515,12 @@ module Aws::KMS
9379
9515
  # Checks if your request will succeed. `DryRun` is an optional
9380
9516
  # parameter.
9381
9517
  #
9382
- # To learn more about how to use this parameter, see [Testing your KMS
9383
- # API calls][1] in the *Key Management Service Developer Guide*.
9518
+ # To learn more about how to use this parameter, see [Testing your
9519
+ # permissions][1] in the *Key Management Service Developer Guide*.
9384
9520
  #
9385
9521
  #
9386
9522
  #
9387
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
9523
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
9388
9524
  #
9389
9525
  # @return [Types::SignResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
9390
9526
  #
@@ -9511,13 +9647,13 @@ module Aws::KMS
9511
9647
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
9512
9648
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
9513
9649
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
9514
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#keystore-concept
9515
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#alias-concept
9650
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9651
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
9516
9652
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
9517
9653
  # [8]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
9518
9654
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9519
9655
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9520
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9656
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9521
9657
  #
9522
9658
  # @option params [required, String] :key_id
9523
9659
  # Identifies a customer managed key in the account and Region.
@@ -9633,7 +9769,7 @@ module Aws::KMS
9633
9769
  # [4]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
9634
9770
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9635
9771
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9636
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9772
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9637
9773
  #
9638
9774
  # @option params [required, String] :key_id
9639
9775
  # Identifies the KMS key from which you are removing tags.
@@ -9746,7 +9882,7 @@ module Aws::KMS
9746
9882
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9747
9883
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9748
9884
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
9749
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9885
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9750
9886
  #
9751
9887
  # @option params [required, String] :alias_name
9752
9888
  # Identifies the alias that is changing its KMS key. This value must
@@ -9826,9 +9962,9 @@ module Aws::KMS
9826
9962
  # verify the updated property values, use the DescribeCustomKeyStores
9827
9963
  # operation.
9828
9964
  #
9829
- # This operation is part of the [custom key stores][1] feature in KMS,
9830
- # which combines the convenience and extensive integration of KMS with
9831
- # the isolation and control of a key store that you own and manage.
9965
+ # This operation is part of the custom key stores feature in KMS, which
9966
+ # combines the convenience and extensive integration of KMS with the
9967
+ # isolation and control of a key store that you own and manage.
9832
9968
  #
9833
9969
  # When updating the properties of an external key store, verify that the
9834
9970
  # updated settings connect your key store, via the external key store
@@ -9898,7 +10034,7 @@ module Aws::KMS
9898
10034
  # **Cross-account use**: No. You cannot perform this operation on a
9899
10035
  # custom key store in a different Amazon Web Services account.
9900
10036
  #
9901
- # **Required permissions**: [kms:UpdateCustomKeyStore][2] (IAM policy)
10037
+ # **Required permissions**: [kms:UpdateCustomKeyStore][1] (IAM policy)
9902
10038
  #
9903
10039
  # **Related operations:**
9904
10040
  #
@@ -9913,13 +10049,12 @@ module Aws::KMS
9913
10049
  # * DisconnectCustomKeyStore
9914
10050
  #
9915
10051
  # **Eventual consistency**: The KMS API follows an eventual consistency
9916
- # model. For more information, see [KMS eventual consistency][3].
10052
+ # model. For more information, see [KMS eventual consistency][2].
9917
10053
  #
9918
10054
  #
9919
10055
  #
9920
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
9921
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9922
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10056
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10057
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9923
10058
  #
9924
10059
  # @option params [required, String] :custom_key_store_id
9925
10060
  # Identifies the custom key store that you want to update. Enter the ID
@@ -10197,7 +10332,7 @@ module Aws::KMS
10197
10332
  #
10198
10333
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10199
10334
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10200
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10335
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10201
10336
  #
10202
10337
  # @option params [required, String] :key_id
10203
10338
  # Updates the description of the specified KMS key.
@@ -10257,8 +10392,8 @@ module Aws::KMS
10257
10392
  # key in `eu-west-2`. If you run `UpdatePrimaryRegion` with a
10258
10393
  # `PrimaryRegion` value of `eu-west-2`, the primary key is now the key
10259
10394
  # in `eu-west-2`, and the key in `us-east-1` becomes a replica key. For
10260
- # details, see [Updating the primary Region][1] in the *Key Management
10261
- # Service Developer Guide*.
10395
+ # details, see [Change the primary key in a set of multi-Region keys][1]
10396
+ # in the *Key Management Service Developer Guide*.
10262
10397
  #
10263
10398
  # This operation supports *multi-Region keys*, an KMS feature that lets
10264
10399
  # you create multiple interoperable KMS keys in different Amazon Web
@@ -10326,7 +10461,7 @@ module Aws::KMS
10326
10461
  #
10327
10462
  #
10328
10463
  #
10329
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-update
10464
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-update.html
10330
10465
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
10331
10466
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id
10332
10467
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec
@@ -10335,7 +10470,7 @@ module Aws::KMS
10335
10470
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
10336
10471
  # [8]: https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html
10337
10472
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10338
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10473
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10339
10474
  #
10340
10475
  # @option params [required, String] :key_id
10341
10476
  # Identifies the current primary key. When the operation completes, this
@@ -10450,10 +10585,10 @@ module Aws::KMS
10450
10585
  #
10451
10586
  #
10452
10587
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
10453
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
10588
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
10454
10589
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10455
10590
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10456
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10591
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10457
10592
  #
10458
10593
  # @option params [required, String] :key_id
10459
10594
  # Identifies the asymmetric KMS key that will be used to verify the
@@ -10529,7 +10664,7 @@ module Aws::KMS
10529
10664
  #
10530
10665
  #
10531
10666
  #
10532
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
10667
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
10533
10668
  #
10534
10669
  # @option params [required, String, StringIO, File] :signature
10535
10670
  # The signature that the `Sign` operation generated.
@@ -10549,18 +10684,18 @@ module Aws::KMS
10549
10684
  #
10550
10685
  #
10551
10686
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
10552
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
10687
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
10553
10688
  #
10554
10689
  # @option params [Boolean] :dry_run
10555
10690
  # Checks if your request will succeed. `DryRun` is an optional
10556
10691
  # parameter.
10557
10692
  #
10558
- # To learn more about how to use this parameter, see [Testing your KMS
10559
- # API calls][1] in the *Key Management Service Developer Guide*.
10693
+ # To learn more about how to use this parameter, see [Testing your
10694
+ # permissions][1] in the *Key Management Service Developer Guide*.
10560
10695
  #
10561
10696
  #
10562
10697
  #
10563
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
10698
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
10564
10699
  #
10565
10700
  # @return [Types::VerifyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
10566
10701
  #
@@ -10674,7 +10809,7 @@ module Aws::KMS
10674
10809
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
10675
10810
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10676
10811
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10677
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10812
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10678
10813
  #
10679
10814
  # @option params [required, String, StringIO, File] :message
10680
10815
  # The message that will be used in the verification. Enter the same
@@ -10712,18 +10847,18 @@ module Aws::KMS
10712
10847
  #
10713
10848
  #
10714
10849
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
10715
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
10850
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
10716
10851
  #
10717
10852
  # @option params [Boolean] :dry_run
10718
10853
  # Checks if your request will succeed. `DryRun` is an optional
10719
10854
  # parameter.
10720
10855
  #
10721
- # To learn more about how to use this parameter, see [Testing your KMS
10722
- # API calls][1] in the *Key Management Service Developer Guide*.
10856
+ # To learn more about how to use this parameter, see [Testing your
10857
+ # permissions][1] in the *Key Management Service Developer Guide*.
10723
10858
  #
10724
10859
  #
10725
10860
  #
10726
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
10861
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
10727
10862
  #
10728
10863
  # @return [Types::VerifyMacResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
10729
10864
  #
@@ -10795,7 +10930,7 @@ module Aws::KMS
10795
10930
  tracer: tracer
10796
10931
  )
10797
10932
  context[:gem_name] = 'aws-sdk-kms'
10798
- context[:gem_version] = '1.102.0'
10933
+ context[:gem_version] = '1.104.0'
10799
10934
  Seahorse::Client::Request.new(handlers, context)
10800
10935
  end
10801
10936