aws-sdk-kms 1.17.0 → 1.18.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (5) hide show
  1. checksums.yaml +4 -4
  2. data/lib/aws-sdk-kms.rb +1 -1
  3. data/lib/aws-sdk-kms/client.rb +341 -399
  4. data/lib/aws-sdk-kms/types.rb +196 -176
  5. metadata +2 -2
data/lib/aws-sdk-kms/types.rb CHANGED
@@ -11,7 +11,7 @@ module Aws::KMS
11
11
  # Contains information about an alias.
12
12
  #
13
13
  # @!attribute [rw] alias_name
14
- # String that contains the alias.
14
+ # String that contains the alias. This value begins with `alias/`.
15
15
  # @return [String]
16
16
  #
17
17
  # @!attribute [rw] alias_arn
@@ -107,26 +107,22 @@ module Aws::KMS
107
107
  # }
108
108
  #
109
109
  # @!attribute [rw] alias_name
110
- # String that contains the display name. The name must start with the
111
- # word "alias" followed by a forward slash (alias/). Aliases that
112
- # begin with "alias/AWS" are reserved.
110
+ # Specifies the alias name. This value must begin with `alias/`
111
+ # followed by a name, such as `alias/ExampleAlias`. The alias name
112
+ # cannot begin with `alias/aws/`. The `alias/aws/` prefix is reserved
113
+ # for AWS managed CMKs.
113
114
  # @return [String]
114
115
  #
115
116
  # @!attribute [rw] target_key_id
116
- # Identifies the CMK for which you are creating the alias. This value
117
- # cannot be an alias.
118
- #
119
- # Specify the key ID or the Amazon Resource Name (ARN) of the CMK.
120
- #
121
- # For example:
117
+ # Identifies the CMK to which the alias refers. Specify the key ID or
118
+ # the Amazon Resource Name (ARN) of the CMK. You cannot specify
119
+ # another alias. For help finding the key ID and ARN, see [Finding the
120
+ # Key ID and ARN][1] in the *AWS Key Management Service Developer
121
+ # Guide*.
122
122
  #
123
- # * Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
124
123
  #
125
- # * Key ARN:
126
- # `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
127
124
  #
128
- # To get the key ID and key ARN for a CMK, use ListKeys or
129
- # DescribeKey.
125
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn
130
126
  # @return [String]
131
127
  #
132
128
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateAliasRequest AWS API Documentation
@@ -160,7 +156,7 @@ module Aws::KMS
160
156
  #
161
157
  #
162
158
  #
163
- # [1]: http://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html
159
+ # [1]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html
164
160
  # @return [String]
165
161
  #
166
162
  # @!attribute [rw] trust_anchor_certificate
@@ -170,7 +166,7 @@ module Aws::KMS
170
166
  #
171
167
  #
172
168
  #
173
- # [1]: http://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html
169
+ # [1]: https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html
174
170
  # @return [String]
175
171
  #
176
172
  # @!attribute [rw] key_store_password
@@ -183,7 +179,7 @@ module Aws::KMS
183
179
  #
184
180
  #
185
181
  #
186
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
182
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
187
183
  # @return [String]
188
184
  #
189
185
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateCustomKeyStoreRequest AWS API Documentation
@@ -258,8 +254,8 @@ module Aws::KMS
258
254
  #
259
255
  #
260
256
  #
261
- # [1]: http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
262
- # [2]: http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam
257
+ # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
258
+ # [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam
263
259
  # @return [String]
264
260
  #
265
261
  # @!attribute [rw] retiring_principal
@@ -275,8 +271,8 @@ module Aws::KMS
275
271
  #
276
272
  #
277
273
  #
278
- # [1]: http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
279
- # [2]: http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam
274
+ # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
275
+ # [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam
280
276
  # @return [String]
281
277
  #
282
278
  # @!attribute [rw] operations
@@ -284,14 +280,15 @@ module Aws::KMS
284
280
  # @return [Array<String>]
285
281
  #
286
282
  # @!attribute [rw] constraints
287
- # A structure that you can use to allow certain operations in the
288
- # grant only when the desired encryption context is present. For more
289
- # information about encryption context, see [Encryption Context][1] in
290
- # the *AWS Key Management Service Developer Guide*.
283
+ # Allows a cryptographic operation only when the encryption context
284
+ # matches or includes the encryption context specified in this
285
+ # structure. For more information about encryption context, see
286
+ # [Encryption Context][1] in the <i> <i>AWS Key Management Service
287
+ # Developer Guide</i> </i>.
291
288
  #
292
289
  #
293
290
  #
294
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html
291
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
295
292
  # @return [Types::GrantConstraints]
296
293
  #
297
294
  # @!attribute [rw] grant_tokens
@@ -302,12 +299,13 @@ module Aws::KMS
302
299
  #
303
300
  #
304
301
  #
305
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
302
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
306
303
  # @return [Array<String>]
307
304
  #
308
305
  # @!attribute [rw] name
309
306
  # A friendly name for identifying the grant. Use this value to prevent
310
- # unintended creation of duplicate grants when retrying this request.
307
+ # the unintended creation of duplicate grants when retrying this
308
+ # request.
311
309
  #
312
310
  # When this value is absent, all `CreateGrant` requests result in a
313
311
  # new grant with a unique `GrantId` even if all the supplied
@@ -343,7 +341,7 @@ module Aws::KMS
343
341
  #
344
342
  #
345
343
  #
346
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
344
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
347
345
  # @return [String]
348
346
  #
349
347
  # @!attribute [rw] grant_id
@@ -389,7 +387,8 @@ module Aws::KMS
389
387
  # request to make a subsequent PutKeyPolicy request on the CMK. This
390
388
  # reduces the risk that the CMK becomes unmanageable. For more
391
389
  # information, refer to the scenario in the [Default Key Policy][1]
392
- # section of the *AWS Key Management Service Developer Guide*.
390
+ # section of the <i> <i>AWS Key Management Service Developer
391
+ # Guide</i> </i>.
393
392
  #
394
393
  # * Each statement in the key policy must contain one or more
395
394
  # principals. The principals in the key policy must exist and be
@@ -409,9 +408,9 @@ module Aws::KMS
409
408
  #
410
409
  #
411
410
  #
412
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam
413
- # [2]: http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
414
- # [3]: http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
411
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam
412
+ # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
413
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
415
414
  # @return [String]
416
415
  #
417
416
  # @!attribute [rw] description
@@ -422,14 +421,14 @@ module Aws::KMS
422
421
  # @return [String]
423
422
  #
424
423
  # @!attribute [rw] key_usage
425
- # The intended use of the CMK.
426
- #
427
- # You can use CMKs only for symmetric encryption and decryption.
424
+ # The cryptographic operations for which you can use the CMK. The only
425
+ # valid value is `ENCRYPT_DECRYPT`, which means you can use the CMK to
426
+ # encrypt and decrypt data.
428
427
  # @return [String]
429
428
  #
430
429
  # @!attribute [rw] origin
431
- # The source of the CMK's key material. You cannot change the origin
432
- # after you create the CMK.
430
+ # The source of the key material for the CMK. You cannot change the
431
+ # origin after you create the CMK.
433
432
  #
434
433
  # The default is `AWS_KMS`, which means AWS KMS creates the key
435
434
  # material in its own key store.
@@ -441,14 +440,14 @@ module Aws::KMS
441
440
  # in the *AWS Key Management Service Developer Guide*.
442
441
  #
443
442
  # When the parameter value is `AWS_CLOUDHSM`, AWS KMS creates the CMK
444
- # in a AWS KMS [custom key store][2] and creates its key material in
443
+ # in an AWS KMS [custom key store][2] and creates its key material in
445
444
  # the associated AWS CloudHSM cluster. You must also use the
446
445
  # `CustomKeyStoreId` parameter to identify the custom key store.
447
446
  #
448
447
  #
449
448
  #
450
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
451
- # [2]: http://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
449
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
450
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
452
451
  # @return [String]
453
452
  #
454
453
  # @!attribute [rw] custom_key_store_id
@@ -465,15 +464,14 @@ module Aws::KMS
465
464
  # The response includes the custom key store ID and the ID of the AWS
466
465
  # CloudHSM cluster.
467
466
  #
468
- # This operation is part of the [Custom Key Store feature][2] feature
467
+ # This operation is part of the [Custom Key Store feature][1] feature
469
468
  # in AWS KMS, which combines the convenience and extensive integration
470
469
  # of AWS KMS with the isolation and control of a single-tenant key
471
470
  # store.
472
471
  #
473
472
  #
474
473
  #
475
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
476
- # [2]: http://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
474
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
477
475
  # @return [String]
478
476
  #
479
477
  # @!attribute [rw] bypass_policy_lockout_safety_check
@@ -484,8 +482,8 @@ module Aws::KMS
484
482
  # unmanageable. Do not set this value to true indiscriminately.
485
483
  #
486
484
  # For more information, refer to the scenario in the [Default Key
487
- # Policy][1] section in the *AWS Key Management Service Developer
488
- # Guide*.
485
+ # Policy][1] section in the <i> <i>AWS Key Management Service
486
+ # Developer Guide</i> </i>.
489
487
  #
490
488
  # Use this parameter only when you include a policy in the request and
491
489
  # you intend to prevent the principal that is making the request from
@@ -495,7 +493,7 @@ module Aws::KMS
495
493
  #
496
494
  #
497
495
  #
498
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam
496
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam
499
497
  # @return [Boolean]
500
498
  #
501
499
  # @!attribute [rw] tags
@@ -555,7 +553,7 @@ module Aws::KMS
555
553
  #
556
554
  #
557
555
  #
558
- # [1]: http://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr
556
+ # [1]: https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr
559
557
  # @return [String]
560
558
  #
561
559
  # @!attribute [rw] connection_state
@@ -578,7 +576,7 @@ module Aws::KMS
578
576
  #
579
577
  #
580
578
  #
581
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
579
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
582
580
  # @return [String]
583
581
  #
584
582
  # @!attribute [rw] connection_error_code
@@ -592,6 +590,11 @@ module Aws::KMS
592
590
  # its AWS CloudHSM cluster, the cluster must contain at least one
593
591
  # active HSM.
594
592
  #
593
+ # * `INTERNAL_ERROR` - AWS KMS could not complete the request due to
594
+ # an internal error. Retry the request. For `ConnectCustomKeyStore`
595
+ # requests, disconnect the custom key store before trying to connect
596
+ # again.
597
+ #
595
598
  # * `INVALID_CREDENTIALS` - AWS KMS does not have the correct password
596
599
  # for the `kmsuser` crypto user in the AWS CloudHSM cluster.
597
600
  #
@@ -609,7 +612,7 @@ module Aws::KMS
609
612
  #
610
613
  #
611
614
  #
612
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
615
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
613
616
  # @return [String]
614
617
  #
615
618
  # @!attribute [rw] creation_date
@@ -651,7 +654,7 @@ module Aws::KMS
651
654
  #
652
655
  #
653
656
  #
654
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html
657
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
655
658
  # @return [Hash<String,String>]
656
659
  #
657
660
  # @!attribute [rw] grant_tokens
@@ -662,7 +665,7 @@ module Aws::KMS
662
665
  #
663
666
  #
664
667
  #
665
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
668
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
666
669
  # @return [Array<String>]
667
670
  #
668
671
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DecryptRequest AWS API Documentation
@@ -681,7 +684,7 @@ module Aws::KMS
681
684
  #
682
685
  # @!attribute [rw] plaintext
683
686
  # Decrypted plaintext data. When you use the HTTP API or the AWS CLI,
684
- # the value is Base64-encdoded. Otherwise, it is not encoded.
687
+ # the value is Base64-encoded. Otherwise, it is not encoded.
685
688
  # @return [String]
686
689
  #
687
690
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DecryptResponse AWS API Documentation
@@ -700,9 +703,8 @@ module Aws::KMS
700
703
  # }
701
704
  #
702
705
  # @!attribute [rw] alias_name
703
- # The alias to be deleted. The name must start with the word "alias"
704
- # followed by a forward slash (alias/). Aliases that begin with
705
- # "alias/aws" are reserved.
706
+ # The alias to be deleted. The alias name must begin with `alias/`
707
+ # followed by the alias name, such as `alias/ExampleAlias`.
706
708
  # @return [String]
707
709
  #
708
710
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteAliasRequest AWS API Documentation
@@ -743,8 +745,8 @@ module Aws::KMS
743
745
  # }
744
746
  #
745
747
  # @!attribute [rw] key_id
746
- # The identifier of the CMK whose key material to delete. The CMK's
747
- # `Origin` must be `EXTERNAL`.
748
+ # Identifies the CMK from which you are deleting imported key
749
+ # material. The `Origin` of the CMK must be `EXTERNAL`.
748
750
  #
749
751
  # Specify the key ID or the Amazon Resource Name (ARN) of the CMK.
750
752
  #
@@ -830,8 +832,8 @@ module Aws::KMS
830
832
  # @!attribute [rw] truncated
831
833
  # A flag that indicates whether there are more items in the list. When
832
834
  # this value is true, the list in this response is truncated. To get
833
- # more items, pass the value of the `NextMarker` element in this
834
- # response to the `Marker` parameter in a subsequent request.
835
+ # more items, pass the value of the `NextMarker` element in
836
+ # thisresponse to the `Marker` parameter in a subsequent request.
835
837
  # @return [Boolean]
836
838
  #
837
839
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeCustomKeyStoresResponse AWS API Documentation
@@ -860,7 +862,7 @@ module Aws::KMS
860
862
  #
861
863
  # To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
862
864
  # name, or alias ARN. When using an alias name, prefix it with
863
- # "alias/". To specify a CMK in a different AWS account, you must
865
+ # `"alias/"`. To specify a CMK in a different AWS account, you must
864
866
  # use the key ARN or alias ARN.
865
867
  #
866
868
  # For example:
@@ -879,7 +881,7 @@ module Aws::KMS
879
881
  #
880
882
  #
881
883
  #
882
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys
884
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys
883
885
  # @return [String]
884
886
  #
885
887
  # @!attribute [rw] grant_tokens
@@ -890,7 +892,7 @@ module Aws::KMS
890
892
  #
891
893
  #
892
894
  #
893
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
895
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
894
896
  # @return [Array<String>]
895
897
  #
896
898
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeKeyRequest AWS API Documentation
@@ -1073,7 +1075,7 @@ module Aws::KMS
1073
1075
  #
1074
1076
  # To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
1075
1077
  # name, or alias ARN. When using an alias name, prefix it with
1076
- # "alias/". To specify a CMK in a different AWS account, you must
1078
+ # `"alias/"`. To specify a CMK in a different AWS account, you must
1077
1079
  # use the key ARN or alias ARN.
1078
1080
  #
1079
1081
  # For example:
@@ -1103,7 +1105,7 @@ module Aws::KMS
1103
1105
  #
1104
1106
  #
1105
1107
  #
1106
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html
1108
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
1107
1109
  # @return [Hash<String,String>]
1108
1110
  #
1109
1111
  # @!attribute [rw] grant_tokens
@@ -1114,7 +1116,7 @@ module Aws::KMS
1114
1116
  #
1115
1117
  #
1116
1118
  #
1117
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
1119
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
1118
1120
  # @return [Array<String>]
1119
1121
  #
1120
1122
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/EncryptRequest AWS API Documentation
@@ -1129,7 +1131,7 @@ module Aws::KMS
1129
1131
 
1130
1132
  # @!attribute [rw] ciphertext_blob
1131
1133
  # The encrypted plaintext. When you use the HTTP API or the AWS CLI,
1132
- # the value is Base64-encdoded. Otherwise, it is not encoded.
1134
+ # the value is Base64-encoded. Otherwise, it is not encoded.
1133
1135
  # @return [String]
1134
1136
  #
1135
1137
  # @!attribute [rw] key_id
@@ -1158,12 +1160,11 @@ module Aws::KMS
1158
1160
  # }
1159
1161
  #
1160
1162
  # @!attribute [rw] key_id
1161
- # The identifier of the CMK under which to generate and encrypt the
1162
- # data encryption key.
1163
+ # An identifier for the CMK that encrypts the data key.
1163
1164
  #
1164
1165
  # To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
1165
1166
  # name, or alias ARN. When using an alias name, prefix it with
1166
- # "alias/". To specify a CMK in a different AWS account, you must
1167
+ # `"alias/"`. To specify a CMK in a different AWS account, you must
1167
1168
  # use the key ARN or alias ARN.
1168
1169
  #
1169
1170
  # For example:
@@ -1190,20 +1191,19 @@ module Aws::KMS
1190
1191
  #
1191
1192
  #
1192
1193
  #
1193
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html
1194
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
1194
1195
  # @return [Hash<String,String>]
1195
1196
  #
1196
1197
  # @!attribute [rw] number_of_bytes
1197
- # The length of the data encryption key in bytes. For example, use the
1198
- # value 64 to generate a 512-bit data key (64 bytes is 512 bits). For
1199
- # common key lengths (128-bit and 256-bit symmetric keys), we
1200
- # recommend that you use the `KeySpec` field instead of this one.
1198
+ # The length of the data key in bytes. For example, use the value 64
1199
+ # to generate a 512-bit data key (64 bytes is 512 bits). For common
1200
+ # key lengths (128-bit and 256-bit symmetric keys), we recommend that
1201
+ # you use the `KeySpec` field instead of this one.
1201
1202
  # @return [Integer]
1202
1203
  #
1203
1204
  # @!attribute [rw] key_spec
1204
- # The length of the data encryption key. Use `AES_128` to generate a
1205
- # 128-bit symmetric key, or `AES_256` to generate a 256-bit symmetric
1206
- # key.
1205
+ # The length of the data key. Use `AES_128` to generate a 128-bit
1206
+ # symmetric key, or `AES_256` to generate a 256-bit symmetric key.
1207
1207
  # @return [String]
1208
1208
  #
1209
1209
  # @!attribute [rw] grant_tokens
@@ -1214,7 +1214,7 @@ module Aws::KMS
1214
1214
  #
1215
1215
  #
1216
1216
  #
1217
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
1217
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
1218
1218
  # @return [Array<String>]
1219
1219
  #
1220
1220
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyRequest AWS API Documentation
@@ -1229,20 +1229,19 @@ module Aws::KMS
1229
1229
  end
1230
1230
 
1231
1231
  # @!attribute [rw] ciphertext_blob
1232
- # The encrypted data encryption key. When you use the HTTP API or the
1233
- # AWS CLI, the value is Base64-encdoded. Otherwise, it is not encoded.
1232
+ # The encrypted copy of the data key. When you use the HTTP API or the
1233
+ # AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.
1234
1234
  # @return [String]
1235
1235
  #
1236
1236
  # @!attribute [rw] plaintext
1237
- # The data encryption key. When you use the HTTP API or the AWS CLI,
1238
- # the value is Base64-encdoded. Otherwise, it is not encoded. Use this
1239
- # data key for local encryption and decryption, then remove it from
1237
+ # The plaintext data key. When you use the HTTP API or the AWS CLI,
1238
+ # the value is Base64-encoded. Otherwise, it is not encoded. Use this
1239
+ # data key to encrypt your data outside of KMS. Then, remove it from
1240
1240
  # memory as soon as possible.
1241
1241
  # @return [String]
1242
1242
  #
1243
1243
  # @!attribute [rw] key_id
1244
- # The identifier of the CMK under which the data encryption key was
1245
- # generated and encrypted.
1244
+ # The identifier of the CMK that encrypted the data key.
1246
1245
  # @return [String]
1247
1246
  #
1248
1247
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyResponse AWS API Documentation
@@ -1268,12 +1267,12 @@ module Aws::KMS
1268
1267
  # }
1269
1268
  #
1270
1269
  # @!attribute [rw] key_id
1271
- # The identifier of the customer master key (CMK) under which to
1272
- # generate and encrypt the data encryption key.
1270
+ # The identifier of the customer master key (CMK) that encrypts the
1271
+ # data key.
1273
1272
  #
1274
1273
  # To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
1275
1274
  # name, or alias ARN. When using an alias name, prefix it with
1276
- # "alias/". To specify a CMK in a different AWS account, you must
1275
+ # `"alias/"`. To specify a CMK in a different AWS account, you must
1277
1276
  # use the key ARN or alias ARN.
1278
1277
  #
1279
1278
  # For example:
@@ -1300,20 +1299,19 @@ module Aws::KMS
1300
1299
  #
1301
1300
  #
1302
1301
  #
1303
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html
1302
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
1304
1303
  # @return [Hash<String,String>]
1305
1304
  #
1306
1305
  # @!attribute [rw] key_spec
1307
- # The length of the data encryption key. Use `AES_128` to generate a
1308
- # 128-bit symmetric key, or `AES_256` to generate a 256-bit symmetric
1309
- # key.
1306
+ # The length of the data key. Use `AES_128` to generate a 128-bit
1307
+ # symmetric key, or `AES_256` to generate a 256-bit symmetric key.
1310
1308
  # @return [String]
1311
1309
  #
1312
1310
  # @!attribute [rw] number_of_bytes
1313
- # The length of the data encryption key in bytes. For example, use the
1314
- # value 64 to generate a 512-bit data key (64 bytes is 512 bits). For
1315
- # common key lengths (128-bit and 256-bit symmetric keys), we
1316
- # recommend that you use the `KeySpec` field instead of this one.
1311
+ # The length of the data key in bytes. For example, use the value 64
1312
+ # to generate a 512-bit data key (64 bytes is 512 bits). For common
1313
+ # key lengths (128-bit and 256-bit symmetric keys), we recommend that
1314
+ # you use the `KeySpec` field instead of this one.
1317
1315
  # @return [Integer]
1318
1316
  #
1319
1317
  # @!attribute [rw] grant_tokens
@@ -1324,7 +1322,7 @@ module Aws::KMS
1324
1322
  #
1325
1323
  #
1326
1324
  #
1327
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
1325
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
1328
1326
  # @return [Array<String>]
1329
1327
  #
1330
1328
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintextRequest AWS API Documentation
@@ -1339,13 +1337,12 @@ module Aws::KMS
1339
1337
  end
1340
1338
 
1341
1339
  # @!attribute [rw] ciphertext_blob
1342
- # The encrypted data encryption key. When you use the HTTP API or the
1343
- # AWS CLI, the value is Base64-encdoded. Otherwise, it is not encoded.
1340
+ # The encrypted data key. When you use the HTTP API or the AWS CLI,
1341
+ # the value is Base64-encoded. Otherwise, it is not encoded.
1344
1342
  # @return [String]
1345
1343
  #
1346
1344
  # @!attribute [rw] key_id
1347
- # The identifier of the CMK under which the data encryption key was
1348
- # generated and encrypted.
1345
+ # The identifier of the CMK that encrypted the data key.
1349
1346
  # @return [String]
1350
1347
  #
1351
1348
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintextResponse AWS API Documentation
@@ -1375,7 +1372,7 @@ module Aws::KMS
1375
1372
  #
1376
1373
  #
1377
1374
  #
1378
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1375
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1379
1376
  # @return [String]
1380
1377
  #
1381
1378
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateRandomRequest AWS API Documentation
@@ -1388,7 +1385,7 @@ module Aws::KMS
1388
1385
 
1389
1386
  # @!attribute [rw] plaintext
1390
1387
  # The random byte string. When you use the HTTP API or the AWS CLI,
1391
- # the value is Base64-encdoded. Otherwise, it is not encoded.
1388
+ # the value is Base64-encoded. Otherwise, it is not encoded.
1392
1389
  # @return [String]
1393
1390
  #
1394
1391
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateRandomResponse AWS API Documentation
@@ -1522,7 +1519,7 @@ module Aws::KMS
1522
1519
  #
1523
1520
  #
1524
1521
  #
1525
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-encrypt-key-material.html
1522
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-encrypt-key-material.html
1526
1523
  # @return [String]
1527
1524
  #
1528
1525
  # @!attribute [rw] wrapping_key_spec
@@ -1571,23 +1568,46 @@ module Aws::KMS
1571
1568
  include Aws::Structure
1572
1569
  end
1573
1570
 
1574
- # A structure that you can use to allow certain operations in the grant
1575
- # only when the desired encryption context is present. For more
1576
- # information about encryption context, see [Encryption Context][1] in
1577
- # the *AWS Key Management Service Developer Guide*.
1571
+ # Use this structure to allow cryptographic operations in the grant only
1572
+ # when the operation request includes the specified [encryption
1573
+ # context][1].
1574
+ #
1575
+ # AWS KMS applies the grant constraints only when the grant allows a
1576
+ # cryptographic operation that accepts an encryption context as input,
1577
+ # such as the following.
1578
+ #
1579
+ # * Encrypt
1580
+ #
1581
+ # * Decrypt
1582
+ #
1583
+ # * GenerateDataKey
1584
+ #
1585
+ # * GenerateDataKeyWithoutPlaintext
1586
+ #
1587
+ # * ReEncrypt
1578
1588
  #
1579
- # Grant constraints apply only to operations that accept encryption
1580
- # context as input. For example, the ` DescribeKey ` operation does not
1581
- # accept encryption context as input. A grant that allows the
1582
- # `DescribeKey` operation does so regardless of the grant constraints.
1583
- # In constrast, the ` Encrypt ` operation accepts encryption context as
1584
- # input. A grant that allows the `Encrypt` operation does so only when
1585
- # the encryption context of the `Encrypt` operation satisfies the grant
1586
- # constraints.
1589
+ # AWS KMS does not apply the grant constraints to other operations, such
1590
+ # as DescribeKey or ScheduleKeyDeletion.
1587
1591
  #
1592
+ # In a cryptographic operation, the encryption context in the decryption
1593
+ # operation must be an exact, case-sensitive match for the keys and
1594
+ # values in the encryption context of the encryption operation. Only the
1595
+ # order of the pairs can vary.
1588
1596
  #
1597
+ # However, in a grant constraint, the key in each key-value pair is not
1598
+ # case sensitive, but the value is case sensitive.
1589
1599
  #
1590
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html
1600
+ # To avoid confusion, do not use multiple encryption context pairs that
1601
+ # differ only by case. To require a fully case-sensitive encryption
1602
+ # context, use the `kms:EncryptionContext:` and
1603
+ # `kms:EncryptionContextKeys` conditions in an IAM or key policy. For
1604
+ # details, see [kms:EncryptionContext:][2] in the <i> <i>AWS Key
1605
+ # Management Service Developer Guide</i> </i>.
1606
+ #
1607
+ #
1608
+ #
1609
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
1610
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-context
1591
1611
  #
1592
1612
  # @note When making an API call, you may pass GrantConstraints
1593
1613
  # data as a hash:
@@ -1602,20 +1622,18 @@ module Aws::KMS
1602
1622
  # }
1603
1623
  #
1604
1624
  # @!attribute [rw] encryption_context_subset
1605
- # A list of key-value pairs, all of which must be present in the
1606
- # encryption context of certain subsequent operations that the grant
1607
- # allows. When certain subsequent operations allowed by the grant
1608
- # include encryption context that matches this list or is a superset
1609
- # of this list, the grant allows the operation. Otherwise, the grant
1610
- # does not allow the operation.
1625
+ # A list of key-value pairs that must be included in the encryption
1626
+ # context of the cryptographic operation request. The grant allows the
1627
+ # cryptographic operation only when the encryption context in the
1628
+ # request includes the key-value pairs specified in this constraint,
1629
+ # although it can include additional key-value pairs.
1611
1630
  # @return [Hash<String,String>]
1612
1631
  #
1613
1632
  # @!attribute [rw] encryption_context_equals
1614
- # A list of key-value pairs that must be present in the encryption
1615
- # context of certain subsequent operations that the grant allows. When
1616
- # certain subsequent operations allowed by the grant include
1617
- # encryption context that matches this list, the grant allows the
1618
- # operation. Otherwise, the grant does not allow the operation.
1633
+ # A list of key-value pairs that must match the encryption context in
1634
+ # the cryptographic operation request. The grant allows the operation
1635
+ # only when the encryption context in the request is the same as the
1636
+ # encryption context specified in this constraint.
1619
1637
  # @return [Hash<String,String>]
1620
1638
  #
1621
1639
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GrantConstraints AWS API Documentation
@@ -1794,7 +1812,7 @@ module Aws::KMS
1794
1812
  #
1795
1813
  #
1796
1814
  #
1797
- # [1]: http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-kms
1815
+ # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-kms
1798
1816
  # @return [String]
1799
1817
  #
1800
1818
  # @!attribute [rw] creation_date
@@ -1811,9 +1829,9 @@ module Aws::KMS
1811
1829
  # @return [String]
1812
1830
  #
1813
1831
  # @!attribute [rw] key_usage
1814
- # The cryptographic operations for which you can use the CMK.
1815
- # Currently the only allowed value is `ENCRYPT_DECRYPT`, which means
1816
- # you can use the CMK for the Encrypt and Decrypt operations.
1832
+ # The cryptographic operations for which you can use the CMK. The only
1833
+ # valid value is `ENCRYPT_DECRYPT`, which means you can use the CMK to
1834
+ # encrypt and decrypt data.
1817
1835
  # @return [String]
1818
1836
  #
1819
1837
  # @!attribute [rw] key_state
@@ -1825,7 +1843,7 @@ module Aws::KMS
1825
1843
  #
1826
1844
  #
1827
1845
  #
1828
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
1846
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
1829
1847
  # @return [String]
1830
1848
  #
1831
1849
  # @!attribute [rw] deletion_date
@@ -1857,7 +1875,7 @@ module Aws::KMS
1857
1875
  #
1858
1876
  #
1859
1877
  #
1860
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1878
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1861
1879
  # @return [String]
1862
1880
  #
1863
1881
  # @!attribute [rw] cloud_hsm_cluster_id
@@ -1869,7 +1887,7 @@ module Aws::KMS
1869
1887
  #
1870
1888
  #
1871
1889
  #
1872
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1890
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1873
1891
  # @return [String]
1874
1892
  #
1875
1893
  # @!attribute [rw] expiration_model
@@ -1879,13 +1897,14 @@ module Aws::KMS
1879
1897
  # @return [String]
1880
1898
  #
1881
1899
  # @!attribute [rw] key_manager
1882
- # The CMK's manager. CMKs are either customer-managed or AWS-managed.
1883
- # For more information about the difference, see [Customer Master
1884
- # Keys][1] in the *AWS Key Management Service Developer Guide*.
1900
+ # The manager of the CMK. CMKs in your AWS account are either customer
1901
+ # managed or AWS managed. For more information about the difference,
1902
+ # see [Customer Master Keys][1] in the *AWS Key Management Service
1903
+ # Developer Guide*.
1885
1904
  #
1886
1905
  #
1887
1906
  #
1888
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys
1907
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys
1889
1908
  # @return [String]
1890
1909
  #
1891
1910
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/KeyMetadata AWS API Documentation
@@ -1965,8 +1984,8 @@ module Aws::KMS
1965
1984
  # @!attribute [rw] truncated
1966
1985
  # A flag that indicates whether there are more items in the list. When
1967
1986
  # this value is true, the list in this response is truncated. To get
1968
- # more items, pass the value of the `NextMarker` element in this
1969
- # response to the `Marker` parameter in a subsequent request.
1987
+ # more items, pass the value of the `NextMarker` element in
1988
+ # thisresponse to the `Marker` parameter in a subsequent request.
1970
1989
  # @return [Boolean]
1971
1990
  #
1972
1991
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ListAliasesResponse AWS API Documentation
@@ -2041,8 +2060,8 @@ module Aws::KMS
2041
2060
  # @!attribute [rw] truncated
2042
2061
  # A flag that indicates whether there are more items in the list. When
2043
2062
  # this value is true, the list in this response is truncated. To get
2044
- # more items, pass the value of the `NextMarker` element in this
2045
- # response to the `Marker` parameter in a subsequent request.
2063
+ # more items, pass the value of the `NextMarker` element in
2064
+ # thisresponse to the `Marker` parameter in a subsequent request.
2046
2065
  # @return [Boolean]
2047
2066
  #
2048
2067
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ListGrantsResponse AWS API Documentation
@@ -2088,7 +2107,7 @@ module Aws::KMS
2088
2107
  # and 1000, inclusive. If you do not include a value, it defaults to
2089
2108
  # 100.
2090
2109
  #
2091
- # Currently only 1 policy can be attached to a key.
2110
+ # Only one policy can be attached to a key.
2092
2111
  # @return [Integer]
2093
2112
  #
2094
2113
  # @!attribute [rw] marker
@@ -2107,8 +2126,7 @@ module Aws::KMS
2107
2126
  end
2108
2127
 
2109
2128
  # @!attribute [rw] policy_names
2110
- # A list of key policy names. Currently, there is only one key policy
2111
- # per CMK and it is always named `default`.
2129
+ # A list of key policy names. The only valid value is `default`.
2112
2130
  # @return [Array<String>]
2113
2131
  #
2114
2132
  # @!attribute [rw] next_marker
@@ -2119,8 +2137,8 @@ module Aws::KMS
2119
2137
  # @!attribute [rw] truncated
2120
2138
  # A flag that indicates whether there are more items in the list. When
2121
2139
  # this value is true, the list in this response is truncated. To get
2122
- # more items, pass the value of the `NextMarker` element in this
2123
- # response to the `Marker` parameter in a subsequent request.
2140
+ # more items, pass the value of the `NextMarker` element in
2141
+ # thisresponse to the `Marker` parameter in a subsequent request.
2124
2142
  # @return [Boolean]
2125
2143
  #
2126
2144
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ListKeyPoliciesResponse AWS API Documentation
@@ -2176,8 +2194,8 @@ module Aws::KMS
2176
2194
  # @!attribute [rw] truncated
2177
2195
  # A flag that indicates whether there are more items in the list. When
2178
2196
  # this value is true, the list in this response is truncated. To get
2179
- # more items, pass the value of the `NextMarker` element in this
2180
- # response to the `Marker` parameter in a subsequent request.
2197
+ # more items, pass the value of the `NextMarker` element in
2198
+ # thisresponse to the `Marker` parameter in a subsequent request.
2181
2199
  # @return [Boolean]
2182
2200
  #
2183
2201
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ListKeysResponse AWS API Documentation
@@ -2255,8 +2273,8 @@ module Aws::KMS
2255
2273
  # @!attribute [rw] truncated
2256
2274
  # A flag that indicates whether there are more items in the list. When
2257
2275
  # this value is true, the list in this response is truncated. To get
2258
- # more items, pass the value of the `NextMarker` element in this
2259
- # response to the `Marker` parameter in a subsequent request.
2276
+ # more items, pass the value of the `NextMarker` element in
2277
+ # thisresponse to the `Marker` parameter in a subsequent request.
2260
2278
  # @return [Boolean]
2261
2279
  #
2262
2280
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ListResourceTagsResponse AWS API Documentation
@@ -2305,8 +2323,8 @@ module Aws::KMS
2305
2323
  #
2306
2324
  #
2307
2325
  #
2308
- # [1]: http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
2309
- # [2]: http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam
2326
+ # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
2327
+ # [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam
2310
2328
  # @return [String]
2311
2329
  #
2312
2330
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ListRetirableGrantsRequest AWS API Documentation
@@ -2375,8 +2393,8 @@ module Aws::KMS
2375
2393
  #
2376
2394
  #
2377
2395
  #
2378
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam
2379
- # [2]: http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
2396
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam
2397
+ # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
2380
2398
  # @return [String]
2381
2399
  #
2382
2400
  # @!attribute [rw] bypass_policy_lockout_safety_check
@@ -2398,7 +2416,7 @@ module Aws::KMS
2398
2416
  #
2399
2417
  #
2400
2418
  #
2401
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam
2419
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam
2402
2420
  # @return [Boolean]
2403
2421
  #
2404
2422
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/PutKeyPolicyRequest AWS API Documentation
@@ -2440,7 +2458,7 @@ module Aws::KMS
2440
2458
  #
2441
2459
  # To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
2442
2460
  # name, or alias ARN. When using an alias name, prefix it with
2443
- # "alias/". To specify a CMK in a different AWS account, you must
2461
+ # `"alias/"`. To specify a CMK in a different AWS account, you must
2444
2462
  # use the key ARN or alias ARN.
2445
2463
  #
2446
2464
  # For example:
@@ -2470,7 +2488,7 @@ module Aws::KMS
2470
2488
  #
2471
2489
  #
2472
2490
  #
2473
- # [1]: http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
2491
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
2474
2492
  # @return [Array<String>]
2475
2493
  #
2476
2494
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncryptRequest AWS API Documentation
@@ -2486,7 +2504,7 @@ module Aws::KMS
2486
2504
 
2487
2505
  # @!attribute [rw] ciphertext_blob
2488
2506
  # The reencrypted data. When you use the HTTP API or the AWS CLI, the
2489
- # value is Base64-encdoded. Otherwise, it is not encoded.
2507
+ # value is Base64-encoded. Otherwise, it is not encoded.
2490
2508
  # @return [String]
2491
2509
  #
2492
2510
  # @!attribute [rw] source_key_id
@@ -2651,7 +2669,7 @@ module Aws::KMS
2651
2669
  #
2652
2670
  #
2653
2671
  #
2654
- # [1]: http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation-tag-restrictions.html
2672
+ # [1]: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation-tag-restrictions.html
2655
2673
  #
2656
2674
  # @note When making an API call, you may pass Tag
2657
2675
  # data as a hash:
@@ -2763,14 +2781,15 @@ module Aws::KMS
2763
2781
  # }
2764
2782
  #
2765
2783
  # @!attribute [rw] alias_name
2766
- # String that contains the name of the alias to be modified. The name
2767
- # must start with the word "alias" followed by a forward slash
2768
- # (alias/). Aliases that begin with "alias/aws" are reserved.
2784
+ # Specifies the name of the alias to change. This value must begin
2785
+ # with `alias/` followed by the alias name, such as
2786
+ # `alias/ExampleAlias`.
2769
2787
  # @return [String]
2770
2788
  #
2771
2789
  # @!attribute [rw] target_key_id
2772
- # Unique identifier of the customer master key to be mapped to the
2773
- # alias.
2790
+ # Unique identifier of the customer master key (CMK) to be mapped to
2791
+ # the alias. When the update operation completes, the alias will point
2792
+ # to this CMK.
2774
2793
  #
2775
2794
  # Specify the key ID or the Amazon Resource Name (ARN) of the CMK.
2776
2795
  #
@@ -2831,17 +2850,18 @@ module Aws::KMS
2831
2850
  # Associates the custom key store with a related AWS CloudHSM cluster.
2832
2851
  #
2833
2852
  # Enter the cluster ID of the cluster that you used to create the
2834
- # custom key store or a cluster that shares a backup history with the
2835
- # original cluster. You cannot use this parameter to associate a
2836
- # custom key store with a different cluster.
2837
- #
2838
- # Clusters that share a backup history have the same cluster
2839
- # certificate. To view the cluster certificate of a cluster, use the
2840
- # [DescribeClusters][1] operation.
2853
+ # custom key store or a cluster that shares a backup history and has
2854
+ # the same cluster certificate as the original cluster. You cannot use
2855
+ # this parameter to associate a custom key store with an unrelated
2856
+ # cluster. In addition, the replacement cluster must [fulfill the
2857
+ # requirements][1] for a cluster associated with a custom key store.
2858
+ # To view the cluster certificate of a cluster, use the
2859
+ # [DescribeClusters][2] operation.
2841
2860
  #
2842
2861
  #
2843
2862
  #
2844
- # [1]: http://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html
2863
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore
2864
+ # [2]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html
2845
2865
  # @return [String]
2846
2866
  #
2847
2867
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/UpdateCustomKeyStoreRequest AWS API Documentation