aws-sdk-kms 1.135.0 → 1.136.0

data/lib/aws-sdk-kms/client_api.rb

@@ -61,6 +61,8 @@ module Aws::KMS
     DataKeyPairSpec = Shapes::StringShape.new(name: 'DataKeyPairSpec')
     DataKeySpec = Shapes::StringShape.new(name: 'DataKeySpec')
     DateType = Shapes::TimestampShape.new(name: 'DateType')
+    DecapsulateRequest = Shapes::StructureShape.new(name: 'DecapsulateRequest')
+    DecapsulateResponse = Shapes::StructureShape.new(name: 'DecapsulateResponse')
     DecryptRequest = Shapes::StructureShape.new(name: 'DecryptRequest')
     DecryptResponse = Shapes::StructureShape.new(name: 'DecryptResponse')
     DeleteAliasRequest = Shapes::StructureShape.new(name: 'DeleteAliasRequest')
@@ -86,6 +88,10 @@ module Aws::KMS
     DryRunOperationException = Shapes::StructureShape.new(name: 'DryRunOperationException')
     EnableKeyRequest = Shapes::StructureShape.new(name: 'EnableKeyRequest')
     EnableKeyRotationRequest = Shapes::StructureShape.new(name: 'EnableKeyRotationRequest')
+    EncapsulateRequest = Shapes::StructureShape.new(name: 'EncapsulateRequest')
+    EncapsulateResponse = Shapes::StructureShape.new(name: 'EncapsulateResponse')
+    EncapsulationAlgorithmSpec = Shapes::StringShape.new(name: 'EncapsulationAlgorithmSpec')
+    EncapsulationAlgorithmSpecList = Shapes::ListShape.new(name: 'EncapsulationAlgorithmSpecList')
     EncryptRequest = Shapes::StructureShape.new(name: 'EncryptRequest')
     EncryptResponse = Shapes::StructureShape.new(name: 'EncryptResponse')
     EncryptionAlgorithmSpec = Shapes::StringShape.new(name: 'EncryptionAlgorithmSpec')
@@ -384,6 +390,18 @@ module Aws::KMS
     CustomKeyStoresListEntry.add_member(:xks_proxy_configuration, Shapes::ShapeRef.new(shape: XksProxyConfigurationType, location_name: "XksProxyConfiguration"))
     CustomKeyStoresListEntry.struct_class = Types::CustomKeyStoresListEntry
 
+    DecapsulateRequest.add_member(:key_id, Shapes::ShapeRef.new(shape: KeyIdType, required: true, location_name: "KeyId"))
+    DecapsulateRequest.add_member(:shared_secret_ciphertext_blob, Shapes::ShapeRef.new(shape: CiphertextType, required: true, location_name: "SharedSecretCiphertextBlob"))
+    DecapsulateRequest.add_member(:encapsulation_algorithm, Shapes::ShapeRef.new(shape: EncapsulationAlgorithmSpec, required: true, location_name: "EncapsulationAlgorithm"))
+    DecapsulateRequest.add_member(:grant_tokens, Shapes::ShapeRef.new(shape: GrantTokenList, location_name: "GrantTokens"))
+    DecapsulateRequest.add_member(:dry_run, Shapes::ShapeRef.new(shape: NullableBooleanType, location_name: "DryRun"))
+    DecapsulateRequest.struct_class = Types::DecapsulateRequest
+
+    DecapsulateResponse.add_member(:key_id, Shapes::ShapeRef.new(shape: KeyIdType, location_name: "KeyId"))
+    DecapsulateResponse.add_member(:shared_secret, Shapes::ShapeRef.new(shape: PlaintextType, location_name: "SharedSecret"))
+    DecapsulateResponse.add_member(:encapsulation_algorithm, Shapes::ShapeRef.new(shape: EncapsulationAlgorithmSpec, location_name: "EncapsulationAlgorithm"))
+    DecapsulateResponse.struct_class = Types::DecapsulateResponse
+
     DecryptRequest.add_member(:ciphertext_blob, Shapes::ShapeRef.new(shape: CiphertextType, location_name: "CiphertextBlob"))
     DecryptRequest.add_member(:encryption_context, Shapes::ShapeRef.new(shape: EncryptionContextType, location_name: "EncryptionContext"))
     DecryptRequest.add_member(:grant_tokens, Shapes::ShapeRef.new(shape: GrantTokenList, location_name: "GrantTokens"))
@@ -479,6 +497,20 @@ module Aws::KMS
     EnableKeyRotationRequest.add_member(:rotation_period_in_days, Shapes::ShapeRef.new(shape: RotationPeriodInDaysType, location_name: "RotationPeriodInDays"))
     EnableKeyRotationRequest.struct_class = Types::EnableKeyRotationRequest
 
+    EncapsulateRequest.add_member(:key_id, Shapes::ShapeRef.new(shape: KeyIdType, required: true, location_name: "KeyId"))
+    EncapsulateRequest.add_member(:encapsulation_algorithm, Shapes::ShapeRef.new(shape: EncapsulationAlgorithmSpec, required: true, location_name: "EncapsulationAlgorithm"))
+    EncapsulateRequest.add_member(:grant_tokens, Shapes::ShapeRef.new(shape: GrantTokenList, location_name: "GrantTokens"))
+    EncapsulateRequest.add_member(:dry_run, Shapes::ShapeRef.new(shape: NullableBooleanType, location_name: "DryRun"))
+    EncapsulateRequest.struct_class = Types::EncapsulateRequest
+
+    EncapsulateResponse.add_member(:key_id, Shapes::ShapeRef.new(shape: KeyIdType, location_name: "KeyId"))
+    EncapsulateResponse.add_member(:shared_secret, Shapes::ShapeRef.new(shape: PlaintextType, location_name: "SharedSecret"))
+    EncapsulateResponse.add_member(:shared_secret_ciphertext_blob, Shapes::ShapeRef.new(shape: CiphertextType, location_name: "SharedSecretCiphertextBlob"))
+    EncapsulateResponse.add_member(:encapsulation_algorithm, Shapes::ShapeRef.new(shape: EncapsulationAlgorithmSpec, location_name: "EncapsulationAlgorithm"))
+    EncapsulateResponse.struct_class = Types::EncapsulateResponse
+
+    EncapsulationAlgorithmSpecList.member = Shapes::ShapeRef.new(shape: EncapsulationAlgorithmSpec)
+
     EncryptRequest.add_member(:key_id, Shapes::ShapeRef.new(shape: KeyIdType, required: true, location_name: "KeyId"))
     EncryptRequest.add_member(:plaintext, Shapes::ShapeRef.new(shape: PlaintextType, required: true, location_name: "Plaintext"))
     EncryptRequest.add_member(:encryption_context, Shapes::ShapeRef.new(shape: EncryptionContextType, location_name: "EncryptionContext"))
@@ -631,6 +663,7 @@ module Aws::KMS
     GetPublicKeyResponse.add_member(:encryption_algorithms, Shapes::ShapeRef.new(shape: EncryptionAlgorithmSpecList, location_name: "EncryptionAlgorithms"))
     GetPublicKeyResponse.add_member(:signing_algorithms, Shapes::ShapeRef.new(shape: SigningAlgorithmSpecList, location_name: "SigningAlgorithms"))
     GetPublicKeyResponse.add_member(:key_agreement_algorithms, Shapes::ShapeRef.new(shape: KeyAgreementAlgorithmSpecList, location_name: "KeyAgreementAlgorithms"))
+    GetPublicKeyResponse.add_member(:encapsulation_algorithms, Shapes::ShapeRef.new(shape: EncapsulationAlgorithmSpecList, location_name: "EncapsulationAlgorithms"))
     GetPublicKeyResponse.struct_class = Types::GetPublicKeyResponse
 
     GrantConstraints.add_member(:encryption_context_subset, Shapes::ShapeRef.new(shape: EncryptionContextType, location_name: "EncryptionContextSubset"))
@@ -750,6 +783,7 @@ module Aws::KMS
     KeyMetadata.add_member(:encryption_algorithms, Shapes::ShapeRef.new(shape: EncryptionAlgorithmSpecList, location_name: "EncryptionAlgorithms"))
     KeyMetadata.add_member(:signing_algorithms, Shapes::ShapeRef.new(shape: SigningAlgorithmSpecList, location_name: "SigningAlgorithms"))
     KeyMetadata.add_member(:key_agreement_algorithms, Shapes::ShapeRef.new(shape: KeyAgreementAlgorithmSpecList, location_name: "KeyAgreementAlgorithms"))
+    KeyMetadata.add_member(:encapsulation_algorithms, Shapes::ShapeRef.new(shape: EncapsulationAlgorithmSpecList, location_name: "EncapsulationAlgorithms"))
     KeyMetadata.add_member(:multi_region, Shapes::ShapeRef.new(shape: NullableBooleanType, location_name: "MultiRegion"))
     KeyMetadata.add_member(:multi_region_configuration, Shapes::ShapeRef.new(shape: MultiRegionConfiguration, location_name: "MultiRegionConfiguration"))
     KeyMetadata.add_member(:pending_deletion_window_in_days, Shapes::ShapeRef.new(shape: PendingWindowInDaysType, location_name: "PendingDeletionWindowInDays"))
@@ -1204,6 +1238,24 @@ module Aws::KMS
         o.errors << Shapes::ShapeRef.new(shape: XksKeyNotFoundException)
       end)
 
+      api.add_operation(:decapsulate, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "Decapsulate"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: DecapsulateRequest)
+        o.output = Shapes::ShapeRef.new(shape: DecapsulateResponse)
+        o.errors << Shapes::ShapeRef.new(shape: NotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: DisabledException)
+        o.errors << Shapes::ShapeRef.new(shape: KeyUnavailableException)
+        o.errors << Shapes::ShapeRef.new(shape: DependencyTimeoutException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidGrantTokenException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidKeyUsageException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidCiphertextException)
+        o.errors << Shapes::ShapeRef.new(shape: KMSInternalException)
+        o.errors << Shapes::ShapeRef.new(shape: KMSInvalidStateException)
+        o.errors << Shapes::ShapeRef.new(shape: DryRunOperationException)
+      end)
+
       api.add_operation(:decrypt, Seahorse::Model::Operation.new.tap do |o|
         o.name = "Decrypt"
         o.http_method = "POST"
@@ -1376,6 +1428,23 @@ module Aws::KMS
         o.errors << Shapes::ShapeRef.new(shape: UnsupportedOperationException)
       end)
 
+      api.add_operation(:encapsulate, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "Encapsulate"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: EncapsulateRequest)
+        o.output = Shapes::ShapeRef.new(shape: EncapsulateResponse)
+        o.errors << Shapes::ShapeRef.new(shape: NotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: DisabledException)
+        o.errors << Shapes::ShapeRef.new(shape: KeyUnavailableException)
+        o.errors << Shapes::ShapeRef.new(shape: DependencyTimeoutException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidGrantTokenException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidKeyUsageException)
+        o.errors << Shapes::ShapeRef.new(shape: KMSInternalException)
+        o.errors << Shapes::ShapeRef.new(shape: KMSInvalidStateException)
+        o.errors << Shapes::ShapeRef.new(shape: DryRunOperationException)
+      end)
+
       api.add_operation(:encrypt, Seahorse::Model::Operation.new.tap do |o|
         o.name = "Encrypt"
         o.http_method = "POST"

data/lib/aws-sdk-kms/types.rb

@@ -932,6 +932,9 @@ module Aws::KMS
     #   * For asymmetric KMS keys with ML-DSA key pairs, specify
     #     `SIGN_VERIFY`.
     #
+    #   * For asymmetric KMS keys with ML-KEM key pairs, specify
+    #     `ENCAPSULATE_DECAPSULATE`.
+    #
     #   * For asymmetric KMS keys with SM2 key pairs (China Regions only),
     #     specify `ENCRYPT_DECRYPT`, `SIGN_VERIFY`, or `KEY_AGREEMENT`.
     #
@@ -1033,6 +1036,15 @@ module Aws::KMS
     #     * `ML_DSA_65`
     #
     #     * `ML_DSA_87`
+    #   * Asymmetric ML-KEM key pairs (establishing shared secrets)
+    #
+    #     * `ML_KEM_512`
+    #
+    #     * `ML_KEM_768`
+    #
+    #     * `ML_KEM_1024`
+    #     The ML-KEM key specs are not available in China Regions.
+    #
     #   * SM2 key pairs (encryption and decryption -or- signing and
     #     verification -or- deriving shared secrets)
     #
@@ -1609,6 +1621,109 @@ module Aws::KMS
       include Aws::Structure
     end
 
+    # @!attribute [rw] key_id
+    #   Identifies the asymmetric ML-KEM KMS key whose public key was used
+    #   to produce the encapsulated shared secret. KMS uses the private key
+    #   in the specified key pair to decapsulate the shared secret.
+    #
+    #   To specify a KMS key, use its key ID, key ARN, alias name, or alias
+    #   ARN. When using an alias name, prefix it with `"alias/"`. To specify
+    #   a KMS key in a different Amazon Web Services account, you must use
+    #   the key ARN or alias ARN.
+    #
+    #   For example:
+    #
+    #   * Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Key ARN:
+    #     `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Alias name: `alias/ExampleAlias`
+    #
+    #   * Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
+    #
+    #   To get the key ID and key ARN for a KMS key, use ListKeys or
+    #   DescribeKey. To get the alias name and alias ARN, use ListAliases.
+    #   @return [String]
+    #
+    # @!attribute [rw] shared_secret_ciphertext_blob
+    #   The encapsulated (ciphertext) form of the shared secret to recover.
+    #   This is the `SharedSecretCiphertextBlob` value that the Encapsulate
+    #   operation returns. When you use the HTTP API or the Amazon Web
+    #   Services CLI, the value is Base64-encoded. Otherwise, it is not
+    #   Base64-encoded.
+    #   @return [String]
+    #
+    # @!attribute [rw] encapsulation_algorithm
+    #   Specifies the key encapsulation algorithm used to recover the shared
+    #   secret. The only valid value is `ML_KEM`.
+    #   @return [String]
+    #
+    # @!attribute [rw] grant_tokens
+    #   A list of grant tokens.
+    #
+    #   Use a grant token when your permission to call this operation comes
+    #   from a new grant that has not yet achieved *eventual consistency*.
+    #   For more information, see [Grant token][1] and [Using a grant
+    #   token][2] in the *Key Management Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
+    #   [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
+    #   @return [Array<String>]
+    #
+    # @!attribute [rw] dry_run
+    #   Checks if your request will succeed. `DryRun` is an optional
+    #   parameter.
+    #
+    #   To learn more about how to use this parameter, see [Testing your
+    #   permissions][1] in the *Key Management Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
+    #   @return [Boolean]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DecapsulateRequest AWS API Documentation
+    #
+    class DecapsulateRequest < Struct.new(
+      :key_id,
+      :shared_secret_ciphertext_blob,
+      :encapsulation_algorithm,
+      :grant_tokens,
+      :dry_run)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] key_id
+    #   The identifier of the ML-KEM KMS key used to decapsulate the shared
+    #   secret.
+    #   @return [String]
+    #
+    # @!attribute [rw] shared_secret
+    #   The plaintext shared secret recovered from the encapsulated form. It
+    #   is a 32-byte value that matches the shared secret held by the
+    #   encapsulating party. When you use the HTTP API or the Amazon Web
+    #   Services CLI, the value is Base64-encoded. Otherwise, it is not
+    #   Base64-encoded.
+    #   @return [String]
+    #
+    # @!attribute [rw] encapsulation_algorithm
+    #   The key encapsulation algorithm used to recover the shared secret.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DecapsulateResponse AWS API Documentation
+    #
+    class DecapsulateResponse < Struct.new(
+      :key_id,
+      :shared_secret,
+      :encapsulation_algorithm)
+      SENSITIVE = [:shared_secret]
+      include Aws::Structure
+    end
+
     # @!attribute [rw] ciphertext_blob
     #   Ciphertext to be decrypted. The blob includes metadata.
     #
@@ -2451,6 +2566,116 @@ module Aws::KMS
       include Aws::Structure
     end
 
+    # @!attribute [rw] key_id
+    #   Identifies an asymmetric ML-KEM KMS key. KMS uses the public key in
+    #   the specified key pair to encapsulate the shared secret. ML-KEM KMS
+    #   keys have a `KeySpec` value of `ML_KEM_512`, `ML_KEM_768`, or
+    #   `ML_KEM_1024` and a `KeyUsage` value of `ENCAPSULATE_DECAPSULATE`.
+    #   To find the `KeySpec` and `KeyUsage` of a KMS key, use the
+    #   DescribeKey operation.
+    #
+    #   To specify a KMS key, use its key ID, key ARN, alias name, or alias
+    #   ARN. When using an alias name, prefix it with `"alias/"`. To specify
+    #   a KMS key in a different Amazon Web Services account, you must use
+    #   the key ARN or alias ARN.
+    #
+    #   For example:
+    #
+    #   * Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Key ARN:
+    #     `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Alias name: `alias/ExampleAlias`
+    #
+    #   * Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
+    #
+    #   To get the key ID and key ARN for a KMS key, use ListKeys or
+    #   DescribeKey. To get the alias name and alias ARN, use ListAliases.
+    #   @return [String]
+    #
+    # @!attribute [rw] encapsulation_algorithm
+    #   Specifies the key encapsulation algorithm used to generate the
+    #   shared secret and its encapsulated form. The only valid value is
+    #   `ML_KEM`.
+    #   @return [String]
+    #
+    # @!attribute [rw] grant_tokens
+    #   A list of grant tokens.
+    #
+    #   Use a grant token when your permission to call this operation comes
+    #   from a new grant that has not yet achieved *eventual consistency*.
+    #   For more information, see [Grant token][1] and [Using a grant
+    #   token][2] in the *Key Management Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
+    #   [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
+    #   @return [Array<String>]
+    #
+    # @!attribute [rw] dry_run
+    #   Checks if your request will succeed. `DryRun` is an optional
+    #   parameter.
+    #
+    #   To learn more about how to use this parameter, see [Testing your
+    #   permissions][1] in the *Key Management Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
+    #   @return [Boolean]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/EncapsulateRequest AWS API Documentation
+    #
+    class EncapsulateRequest < Struct.new(
+      :key_id,
+      :encapsulation_algorithm,
+      :grant_tokens,
+      :dry_run)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] key_id
+    #   The identifier of the ML-KEM KMS key used to encapsulate the shared
+    #   secret.
+    #   @return [String]
+    #
+    # @!attribute [rw] shared_secret
+    #   The plaintext shared secret. It is a 32-byte cryptographically
+    #   random value that both parties can use directly as key material or
+    #   pass through a key derivation function to generate multiple keys and
+    #   nonces. When you use the HTTP API or the Amazon Web Services CLI,
+    #   the value is Base64-encoded. Otherwise, it is not Base64-encoded.
+    #   @return [String]
+    #
+    # @!attribute [rw] shared_secret_ciphertext_blob
+    #   The encapsulated form of the shared secret. Pass this value to the
+    #   Decapsulate operation to recover the shared secret. When you use the
+    #   HTTP API or the Amazon Web Services CLI, the value is
+    #   Base64-encoded. Otherwise, it is not Base64-encoded. The length of
+    #   `SharedSecretCiphertextBlob` depends on the ML-KEM key spec. Before
+    #   Base64 encoding, the encapsulated shared secret is 768 bytes for
+    #   `ML_KEM_512`, 1088 bytes for `ML_KEM_768`, and 1568 bytes for
+    #   `ML_KEM_1024`.
+    #   @return [String]
+    #
+    # @!attribute [rw] encapsulation_algorithm
+    #   The key encapsulation algorithm used to generate the shared secret.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/EncapsulateResponse AWS API Documentation
+    #
+    class EncapsulateResponse < Struct.new(
+      :key_id,
+      :shared_secret,
+      :shared_secret_ciphertext_blob,
+      :encapsulation_algorithm)
+      SENSITIVE = [:shared_secret]
+      include Aws::Structure
+    end
+
     # @!attribute [rw] key_id
     #   Identifies the KMS key to use in the encryption operation. The KMS
     #   key must have a `KeyUsage` of `ENCRYPT_DECRYPT`. To find the
@@ -2666,7 +2891,7 @@ module Aws::KMS
     #   verify, and the rule that permits you to use ML-DSA key pairs to
     #   sign and verify only are not effective on data key pairs, which are
     #   used outside of KMS. The SM2 key spec is only available in China
-    #   Regions.
+    #   Regions. The ML-KEM key specs are not available in China Regions.
     #   @return [String]
     #
     # @!attribute [rw] grant_tokens
@@ -2876,7 +3101,7 @@ module Aws::KMS
     #   verify, and the rule that permits you to use ML-DSA key pairs to
     #   sign and verify only are not effective on data key pairs, which are
     #   used outside of KMS. The SM2 key spec is only available in China
-    #   Regions.
+    #   Regions. The ML-KEM key specs are not available in China Regions.
     #   @return [String]
     #
     # @!attribute [rw] grant_tokens
@@ -3510,7 +3735,7 @@ module Aws::KMS
     # @!attribute [rw] key_last_usage
     #   Contains usage information about the last time the KMS key was used
     #   for a successful cryptographic operation. If the key has not been
-    #   used since tracking began, this response element is empty.
+    #   used since tracking began, this response element is an empty object.
     #   @return [Types::KeyLastUsageData]
     #
     # @!attribute [rw] tracking_start_date
@@ -3886,6 +4111,12 @@ module Aws::KMS
     #   `KEY_AGREEMENT`.
     #   @return [Array<String>]
     #
+    # @!attribute [rw] encapsulation_algorithms
+    #   The key encapsulation algorithm used to establish a shared secret.
+    #   This field is present only when the KMS key has a `KeyUsage` value
+    #   of `ENCAPSULATE_DECAPSULATE`.
+    #   @return [Array<String>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GetPublicKeyResponse AWS API Documentation
     #
     class GetPublicKeyResponse < Struct.new(
@@ -3896,7 +4127,8 @@ module Aws::KMS
       :key_usage,
       :encryption_algorithms,
       :signing_algorithms,
-      :key_agreement_algorithms)
+      :key_agreement_algorithms,
+      :encapsulation_algorithms)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -4338,6 +4570,10 @@ module Aws::KMS
     # From the ImportKeyMaterial operation, the request was rejected because
     # KMS could not decrypt the encrypted (wrapped) key material.
     #
+    # From the Decapsulate operation, the request was rejected because the
+    # length of the `SharedSecretCiphertextBlob` is inconsistent with the
+    # specified ML-KEM key spec.
+    #
     # @!attribute [rw] message
     #   @return [String]
     #
@@ -4404,8 +4640,10 @@ module Aws::KMS
     # messages, the `KeyUsage` must be `SIGN_VERIFY`. For generating and
     # verifying message authentication codes (MACs), the `KeyUsage` must be
     # `GENERATE_VERIFY_MAC`. For deriving key agreement secrets, the
-    # `KeyUsage` must be `KEY_AGREEMENT`. To find the `KeyUsage` of a KMS
-    # key, use the DescribeKey operation.
+    # `KeyUsage` must be `KEY_AGREEMENT`. For encapsulating and
+    # decapsulating shared secrets, the `KeyUsage` must be
+    # `ENCAPSULATE_DECAPSULATE`. To find the `KeyUsage` of a KMS key, use
+    # the DescribeKey operation.
     #
     # To find the encryption or signing algorithms supported for a
     # particular KMS key, use the DescribeKey operation.
@@ -4726,6 +4964,12 @@ module Aws::KMS
     #   The key agreement algorithm used to derive a shared secret.
     #   @return [Array<String>]
     #
+    # @!attribute [rw] encapsulation_algorithms
+    #   The key encapsulation algorithm that the KMS key supports. This
+    #   field appears only for KMS keys with a `KeyUsage` value of
+    #   `ENCAPSULATE_DECAPSULATE`.
+    #   @return [Array<String>]
+    #
     # @!attribute [rw] multi_region
     #   Indicates whether the KMS key is a multi-Region (`True`) or regional
     #   (`False`) key. This value is `True` for multi-Region primary and
@@ -4829,6 +5073,7 @@ module Aws::KMS
       :encryption_algorithms,
       :signing_algorithms,
       :key_agreement_algorithms,
+      :encapsulation_algorithms,
       :multi_region,
       :multi_region_configuration,
       :pending_deletion_window_in_days,

data/lib/aws-sdk-kms.rb

@@ -54,7 +54,7 @@ module Aws::KMS
   autoload :EndpointProvider, 'aws-sdk-kms/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-kms/endpoints'
 
-  GEM_VERSION = '1.135.0'
+  GEM_VERSION = '1.136.0'
 
 end
 

data/sig/client.rbs

@@ -139,7 +139,7 @@ module Aws
                           key_id: ::String,
                           ?grantee_principal: ::String,
                           ?retiring_principal: ::String,
-                          operations: Array[("Decrypt" | "Encrypt" | "GenerateDataKey" | "GenerateDataKeyWithoutPlaintext" | "ReEncryptFrom" | "ReEncryptTo" | "Sign" | "Verify" | "GetPublicKey" | "CreateGrant" | "RetireGrant" | "DescribeKey" | "GenerateDataKeyPair" | "GenerateDataKeyPairWithoutPlaintext" | "GenerateMac" | "VerifyMac" | "DeriveSharedSecret")],
+                          operations: Array[("Decrypt" | "Encrypt" | "GenerateDataKey" | "GenerateDataKeyWithoutPlaintext" | "ReEncryptFrom" | "ReEncryptTo" | "Sign" | "Verify" | "GetPublicKey" | "CreateGrant" | "RetireGrant" | "DescribeKey" | "GenerateDataKeyPair" | "GenerateDataKeyPairWithoutPlaintext" | "GenerateMac" | "VerifyMac" | "DeriveSharedSecret" | "Encapsulate" | "Decapsulate")],
                           ?constraints: {
                             encryption_context_subset: Hash[::String, ::String]?,
                             encryption_context_equals: Hash[::String, ::String]?,
@@ -161,9 +161,9 @@ module Aws
       def create_key: (
                         ?policy: ::String,
                         ?description: ::String,
-                        ?key_usage: ("SIGN_VERIFY" | "ENCRYPT_DECRYPT" | "GENERATE_VERIFY_MAC" | "KEY_AGREEMENT"),
+                        ?key_usage: ("SIGN_VERIFY" | "ENCRYPT_DECRYPT" | "GENERATE_VERIFY_MAC" | "KEY_AGREEMENT" | "ENCAPSULATE_DECAPSULATE"),
                         ?customer_master_key_spec: ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SYMMETRIC_DEFAULT" | "HMAC_224" | "HMAC_256" | "HMAC_384" | "HMAC_512" | "SM2"),
-                        ?key_spec: ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SYMMETRIC_DEFAULT" | "HMAC_224" | "HMAC_256" | "HMAC_384" | "HMAC_512" | "SM2" | "ML_DSA_44" | "ML_DSA_65" | "ML_DSA_87" | "ECC_NIST_EDWARDS25519"),
+                        ?key_spec: ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SYMMETRIC_DEFAULT" | "HMAC_224" | "HMAC_256" | "HMAC_384" | "HMAC_512" | "SM2" | "ML_DSA_44" | "ML_DSA_65" | "ML_DSA_87" | "ECC_NIST_EDWARDS25519" | "ML_KEM_512" | "ML_KEM_768" | "ML_KEM_1024"),
                         ?origin: ("AWS_KMS" | "EXTERNAL" | "AWS_CLOUDHSM" | "EXTERNAL_KEY_STORE"),
                         ?custom_key_store_id: ::String,
                         ?bypass_policy_lockout_safety_check: bool,
@@ -178,6 +178,22 @@ module Aws
                       ) -> _CreateKeyResponseSuccess
                     | (?Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _CreateKeyResponseSuccess
 
+      interface _DecapsulateResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::DecapsulateResponse]
+        def key_id: () -> ::String
+        def shared_secret: () -> ::String
+        def encapsulation_algorithm: () -> ("ML_KEM")
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/KMS/Client.html#decapsulate-instance_method
+      def decapsulate: (
+                         key_id: ::String,
+                         shared_secret_ciphertext_blob: ::String,
+                         encapsulation_algorithm: ("ML_KEM"),
+                         ?grant_tokens: Array[::String],
+                         ?dry_run: bool
+                       ) -> _DecapsulateResponseSuccess
+                     | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DecapsulateResponseSuccess
+
       interface _DecryptResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::DecryptResponse]
         def key_id: () -> ::String
@@ -311,6 +327,22 @@ module Aws
                                ) -> ::Seahorse::Client::_ResponseSuccess[::Aws::EmptyStructure]
                              | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> ::Seahorse::Client::_ResponseSuccess[::Aws::EmptyStructure]
 
+      interface _EncapsulateResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::EncapsulateResponse]
+        def key_id: () -> ::String
+        def shared_secret: () -> ::String
+        def shared_secret_ciphertext_blob: () -> ::String
+        def encapsulation_algorithm: () -> ("ML_KEM")
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/KMS/Client.html#encapsulate-instance_method
+      def encapsulate: (
+                         key_id: ::String,
+                         encapsulation_algorithm: ("ML_KEM"),
+                         ?grant_tokens: Array[::String],
+                         ?dry_run: bool
+                       ) -> _EncapsulateResponseSuccess
+                     | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _EncapsulateResponseSuccess
+
       interface _EncryptResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::EncryptResponse]
         def ciphertext_blob: () -> ::String
@@ -357,7 +389,7 @@ module Aws
         def private_key_plaintext: () -> ::String
         def public_key: () -> ::String
         def key_id: () -> ::String
-        def key_pair_spec: () -> ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SM2" | "ECC_NIST_EDWARDS25519")
+        def key_pair_spec: () -> ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SM2" | "ECC_NIST_EDWARDS25519" | "ML_KEM_512" | "ML_KEM_768" | "ML_KEM_1024")
         def ciphertext_for_recipient: () -> ::String
         def key_material_id: () -> ::String
       end
@@ -365,7 +397,7 @@ module Aws
       def generate_data_key_pair: (
                                     ?encryption_context: Hash[::String, ::String],
                                     key_id: ::String,
-                                    key_pair_spec: ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SM2" | "ECC_NIST_EDWARDS25519"),
+                                    key_pair_spec: ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SM2" | "ECC_NIST_EDWARDS25519" | "ML_KEM_512" | "ML_KEM_768" | "ML_KEM_1024"),
                                     ?grant_tokens: Array[::String],
                                     ?recipient: {
                                       key_encryption_algorithm: ("RSAES_OAEP_SHA_256")?,
@@ -380,14 +412,14 @@ module Aws
         def private_key_ciphertext_blob: () -> ::String
         def public_key: () -> ::String
         def key_id: () -> ::String
-        def key_pair_spec: () -> ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SM2" | "ECC_NIST_EDWARDS25519")
+        def key_pair_spec: () -> ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SM2" | "ECC_NIST_EDWARDS25519" | "ML_KEM_512" | "ML_KEM_768" | "ML_KEM_1024")
         def key_material_id: () -> ::String
       end
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/KMS/Client.html#generate_data_key_pair_without_plaintext-instance_method
       def generate_data_key_pair_without_plaintext: (
                                                       ?encryption_context: Hash[::String, ::String],
                                                       key_id: ::String,
-                                                      key_pair_spec: ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SM2" | "ECC_NIST_EDWARDS25519"),
+                                                      key_pair_spec: ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SM2" | "ECC_NIST_EDWARDS25519" | "ML_KEM_512" | "ML_KEM_768" | "ML_KEM_1024"),
                                                       ?grant_tokens: Array[::String],
                                                       ?dry_run: bool
                                                     ) -> _GenerateDataKeyPairWithoutPlaintextResponseSuccess
@@ -501,11 +533,12 @@ module Aws
         def key_id: () -> ::String
         def public_key: () -> ::String
         def customer_master_key_spec: () -> ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SYMMETRIC_DEFAULT" | "HMAC_224" | "HMAC_256" | "HMAC_384" | "HMAC_512" | "SM2")
-        def key_spec: () -> ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SYMMETRIC_DEFAULT" | "HMAC_224" | "HMAC_256" | "HMAC_384" | "HMAC_512" | "SM2" | "ML_DSA_44" | "ML_DSA_65" | "ML_DSA_87" | "ECC_NIST_EDWARDS25519")
-        def key_usage: () -> ("SIGN_VERIFY" | "ENCRYPT_DECRYPT" | "GENERATE_VERIFY_MAC" | "KEY_AGREEMENT")
+        def key_spec: () -> ("RSA_2048" | "RSA_3072" | "RSA_4096" | "ECC_NIST_P256" | "ECC_NIST_P384" | "ECC_NIST_P521" | "ECC_SECG_P256K1" | "SYMMETRIC_DEFAULT" | "HMAC_224" | "HMAC_256" | "HMAC_384" | "HMAC_512" | "SM2" | "ML_DSA_44" | "ML_DSA_65" | "ML_DSA_87" | "ECC_NIST_EDWARDS25519" | "ML_KEM_512" | "ML_KEM_768" | "ML_KEM_1024")
+        def key_usage: () -> ("SIGN_VERIFY" | "ENCRYPT_DECRYPT" | "GENERATE_VERIFY_MAC" | "KEY_AGREEMENT" | "ENCAPSULATE_DECAPSULATE")
         def encryption_algorithms: () -> ::Array[("SYMMETRIC_DEFAULT" | "RSAES_OAEP_SHA_1" | "RSAES_OAEP_SHA_256" | "SM2PKE")]
         def signing_algorithms: () -> ::Array[("RSASSA_PSS_SHA_256" | "RSASSA_PSS_SHA_384" | "RSASSA_PSS_SHA_512" | "RSASSA_PKCS1_V1_5_SHA_256" | "RSASSA_PKCS1_V1_5_SHA_384" | "RSASSA_PKCS1_V1_5_SHA_512" | "ECDSA_SHA_256" | "ECDSA_SHA_384" | "ECDSA_SHA_512" | "SM2DSA" | "ML_DSA_SHAKE_256" | "ED25519_SHA_512" | "ED25519_PH_SHA_512")]
         def key_agreement_algorithms: () -> ::Array[("ECDH")]
+        def encapsulation_algorithms: () -> ::Array[("ML_KEM")]
       end
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/KMS/Client.html#get_public_key-instance_method
       def get_public_key: (