aws-sdk-kms 1.25.0 → 1.26.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: fc40b47d473897a755651115bc45f54ad4665f60
-  data.tar.gz: 15b7304c7bcfb42ed6d837c1de32855847ebe046
+  metadata.gz: d59aaf932f27931fc311148bfc796c86df64701d
+  data.tar.gz: ac1dad7855119f6cddf454fc003e119c2df422dd
 SHA512:
-  metadata.gz: a95c2c152d30f4075256ea7cecef0bd0b20b300055bd19b85864919135c3367cb85946af0ccca4a163a8ecd3aac8fac3c88c854756d6a935db51a77d40523723
-  data.tar.gz: e4a0fe25fdb376afd009ad5e7773503138be0d899f483fafd023217375fd19217b3cd4bd25e1d2a901b2b72a8f3502d5adce7d184b0d4a8204c5186d251a7acc
+  metadata.gz: 39eee3a7813574221e57b7a80147d10ee1fdc3ef79cf1d8969b743167de96c63aa934085091f13e62040ec765cdd217815d4be3dc4f31d8aaccc0f9f8e148434
+  data.tar.gz: 872bbe01e8a2ea47976706e4c8e0177b778ef80b85945aca05fbcdd30bf036c345c129d07fa50a28b7000875f957efc4076c84886275bd1adcc12ed268b841c2

data/lib/aws-sdk-kms.rb

@@ -42,6 +42,6 @@ require_relative 'aws-sdk-kms/customizations'
 # @service
 module Aws::KMS
 
-  GEM_VERSION = '1.25.0'
+  GEM_VERSION = '1.26.0'
 
 end

data/lib/aws-sdk-kms/client.rb

@@ -265,17 +265,17 @@ module Aws::KMS
     # @!group API Operations
 
     # Cancels the deletion of a customer master key (CMK). When this
-    # operation is successful, the CMK is set to the `Disabled` state. To
-    # enable a CMK, use EnableKey. You cannot perform this operation on a
-    # CMK in a different AWS account.
+    # operation succeeds, the key state of the CMK is `Disabled`. To enable
+    # the CMK, use EnableKey. You cannot perform this operation on a CMK in
+    # a different AWS account.
     #
     # For more information about scheduling and canceling deletion of a CMK,
     # see [Deleting Customer Master Keys][1] in the *AWS Key Management
     # Service Developer Guide*.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][2] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
@@ -405,39 +405,78 @@ module Aws::KMS
     end
 
     # Creates a display name for a customer managed customer master key
-    # (CMK). You can use an alias to identify a CMK in selected operations,
-    # such as Encrypt and GenerateDataKey.
-    #
-    # Each CMK can have multiple aliases, but each alias points to only one
-    # CMK. The alias name must be unique in the AWS account and region. To
-    # simplify code that runs in multiple regions, use the same alias name,
-    # but point it to a different CMK in each region.
+    # (CMK). You can use an alias to identify a CMK in cryptographic
+    # operations, such as Encrypt and GenerateDataKey. You can change the
+    # CMK associated with the alias at any time.
+    #
+    # Aliases are easier to remember than key IDs. They can also help to
+    # simplify your applications. For example, if you use an alias in your
+    # code, you can change the CMK your code uses by associating a given
+    # alias with a different CMK.
+    #
+    # To run the same code in multiple AWS regions, use an alias in your
+    # code, such as `alias/ApplicationKey`. Then, in each AWS Region, create
+    # an `alias/ApplicationKey` alias that is associated with a CMK in that
+    # Region. When you run your code, it uses the `alias/ApplicationKey` CMK
+    # for that AWS Region without any Region-specific code.
+    #
+    # This operation does not return a response. To get the alias that you
+    # created, use the ListAliases operation.
+    #
+    # To use aliases successfully, be aware of the following information.
+    #
+    # * Each alias points to only one CMK at a time, although a single CMK
+    #   can have multiple aliases. The alias and its associated CMK must be
+    #   in the same AWS account and Region.
+    #
+    # * You can associate an alias with any customer managed CMK in the same
+    #   AWS account and Region. However, you do not have permission to
+    #   associate an alias with an [AWS managed CMK][1] or an [AWS owned
+    #   CMK][2].
+    #
+    # * To change the CMK associated with an alias, use the UpdateAlias
+    #   operation. The current CMK and the new CMK must be the same type
+    #   (both symmetric or both asymmetric) and they must have the same key
+    #   usage (`ENCRYPT_DECRYPT` or `SIGN_VERIFY`). This restriction
+    #   prevents cryptographic errors in code that uses aliases.
+    #
+    # * The alias name must begin with `alias/` followed by a name, such as
+    #   `alias/ExampleAlias`. It can contain only alphanumeric characters,
+    #   forward slashes (/), underscores (\_), and dashes (-). The alias
+    #   name cannot begin with `alias/aws/`. The `alias/aws/` prefix is
+    #   reserved for [AWS managed CMKs][1].
+    #
+    # * The alias name must be unique within an AWS Region. However, you can
+    #   use the same alias name in multiple Regions of the same AWS account.
+    #   Each instance of the alias is associated with a CMK in its Region.
+    #
+    # * After you create an alias, you cannot change its alias name.
+    #   However, you can use the DeleteAlias operation to delete the alias
+    #   and then create a new alias with the desired name.
+    #
+    # * You can use an alias name or alias ARN to identify a CMK in AWS KMS
+    #   cryptographic operations and in the DescribeKey operation. However,
+    #   you cannot use alias names or alias ARNs in API operations that
+    #   manage CMKs, such as DisableKey or GetKeyPolicy. For information
+    #   about the valid CMK identifiers for each AWS KMS API operation, see
+    #   the descriptions of the `KeyId` parameter in the API operation
+    #   documentation.
     #
     # Because an alias is not a property of a CMK, you can delete and change
     # the aliases of a CMK without affecting the CMK. Also, aliases do not
     # appear in the response from the DescribeKey operation. To get the
-    # aliases of all CMKs, use the ListAliases operation.
-    #
-    # The alias name must begin with `alias/` followed by a name, such as
-    # `alias/ExampleAlias`. It can contain only alphanumeric characters,
-    # forward slashes (/), underscores (\_), and dashes (-). The alias name
-    # cannot begin with `alias/aws/`. The `alias/aws/` prefix is reserved
-    # for [AWS managed CMKs][1].
-    #
-    # The alias and the CMK it is mapped to must be in the same AWS account
-    # and the same region. You cannot perform this operation on an alias in
-    # a different AWS account.
+    # aliases and alias ARNs of CMKs in each AWS account and Region, use the
+    # ListAliases operation.
     #
-    # To map an existing alias to a different CMK, call UpdateAlias.
-    #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][3] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
     # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
-    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
+    # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String] :alias_name
     #   Specifies the alias name. This value must begin with `alias/` followed
@@ -581,23 +620,58 @@ module Aws::KMS
     # key policies.
     #
     # To create a grant that allows a cryptographic operation only when the
-    # encryption context in the operation request matches or includes a
-    # specified encryption context, use the `Constraints` parameter. For
-    # details, see GrantConstraints.
+    # request includes a particular [encryption context][1], use the
+    # `Constraints` parameter. For details, see GrantConstraints.
+    #
+    # You can create grants on symmetric and asymmetric CMKs. However, if
+    # the grant allows an operation that the CMK does not support,
+    # `CreateGrant` fails with a `ValidationException`.
+    #
+    # * Grants for symmetric CMKs cannot allow operations that are not
+    #   supported for symmetric CMKs, including Sign, Verify, and
+    #   GetPublicKey. (There are limited exceptions to this rule for legacy
+    #   operations, but you should not create a grant for an operation that
+    #   AWS KMS does not support.)
+    #
+    # * Grants for asymmetric CMKs cannot allow operations that are not
+    #   supported for asymmetric CMKs, including operations that [generate
+    #   data keys][2] or [data key pairs][3], or operations related to
+    #   [automatic key rotation][4], [imported key material][5], or CMKs in
+    #   [custom key stores][6].
+    #
+    # * Grants for asymmetric CMKs with a `KeyUsage` of `ENCRYPT_DECRYPT`
+    #   cannot allow the Sign or Verify operations. Grants for asymmetric
+    #   CMKs with a `KeyUsage` of `SIGN_VERIFY` cannot allow the Encrypt or
+    #   Decrypt operations.
+    #
+    # * Grants for asymmetric CMKs cannot include an encryption context
+    #   grant constraint. An encryption context is not supported on
+    #   asymmetric CMKs.
+    #
+    # For information about symmetric and asymmetric CMKs, see [Using
+    # Symmetric and Asymmetric CMKs][7] in the *AWS Key Management Service
+    # Developer Guide*.
     #
     # To perform this operation on a CMK in a different AWS account, specify
     # the key ARN in the value of the `KeyId` parameter. For more
-    # information about grants, see [Grants][1] in the <i> <i>AWS Key
+    # information about grants, see [Grants][8] in the <i> <i>AWS Key
     # Management Service Developer Guide</i> </i>.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][9] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
-    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
-    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
+    # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey
+    # [3]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair
+    # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
+    # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
+    # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
+    # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
+    # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
+    # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String] :key_id
     #   The unique identifier for the customer master key (CMK) that the grant
@@ -720,7 +794,7 @@ module Aws::KMS
     #     key_id: "KeyIdType", # required
     #     grantee_principal: "PrincipalIdType", # required
     #     retiring_principal: "PrincipalIdType",
-    #     operations: ["Decrypt"], # required, accepts Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, CreateGrant, RetireGrant, DescribeKey
+    #     operations: ["Decrypt"], # required, accepts Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, Sign, Verify, GetPublicKey, CreateGrant, RetireGrant, DescribeKey, GenerateDataKeyPair, GenerateDataKeyPairWithoutPlaintext
     #     constraints: {
     #       encryption_context_subset: {
     #         "EncryptionContextKey" => "EncryptionContextValue",
@@ -747,31 +821,89 @@ module Aws::KMS
       req.send_request(options)
     end
 
-    # Creates a customer managed [customer master key][1] (CMK) in your AWS
-    # account.
+    # Creates a unique customer managed [customer master key][1] (CMK) in
+    # your AWS account and Region. You cannot use this operation to create a
+    # CMK in a different AWS account.
     #
-    # You can use a CMK to encrypt small amounts of data (up to 4096 bytes)
-    # directly. But CMKs are more commonly used to encrypt the [data
-    # keys][2] that are used to encrypt data.
+    # You can use the `CreateKey` operation to create symmetric or
+    # asymmetric CMKs.
+    #
+    # * **Symmetric CMKs** contain a 256-bit symmetric key that never leaves
+    #   AWS KMS unencrypted. To use the CMK, you must call AWS KMS. You can
+    #   use a symmetric CMK to encrypt and decrypt small amounts of data,
+    #   but they are typically used to generate [data keys][2] or data key
+    #   pairs. For details, see GenerateDataKey and GenerateDataKeyPair.
+    #
+    # * **Asymmetric CMKs** can contain an RSA key pair or an Elliptic Curve
+    #   (ECC) key pair. The private key in an asymmetric CMK never leaves
+    #   AWS KMS unencrypted. However, you can use the GetPublicKey operation
+    #   to download the public key so it can be used outside of AWS KMS.
+    #   CMKs with RSA key pairs can be used to encrypt or decrypt data or
+    #   sign and verify messages (but not both). CMKs with ECC key pairs can
+    #   be used only to sign and verify messages.
+    #
+    # For information about symmetric and asymmetric CMKs, see [Using
+    # Symmetric and Asymmetric CMKs][3] in the *AWS Key Management Service
+    # Developer Guide*.
     #
-    # To create a CMK for imported key material, use the `Origin` parameter
-    # with a value of `EXTERNAL`.
+    # To create different types of CMKs, use the following guidance:
     #
-    # To create a CMK in a [custom key store][3], use the `CustomKeyStoreId`
-    # parameter to specify the custom key store. You must also use the
-    # `Origin` parameter with a value of `AWS_CLOUDHSM`. The AWS CloudHSM
-    # cluster that is associated with the custom key store must have at
-    # least two active HSMs in different Availability Zones in the AWS
-    # Region.
+    # Asymmetric CMKs
     #
-    # You cannot use this operation to create a CMK in a different AWS
-    # account.
+    # : To create an asymmetric CMK, use the `CustomerMasterKeySpec`
+    #   parameter to specify the type of key material in the CMK. Then, use
+    #   the `KeyUsage` parameter to determine whether the CMK will be used
+    #   to encrypt and decrypt or sign and verify. You can't change these
+    #   properties after the CMK is created.
+    #
+    #
+    #
+    # Symmetric CMKs
+    #
+    # : When creating a symmetric CMK, you don't need to specify the
+    #   `CustomerMasterKeySpec` or `KeyUsage` parameters. The default value
+    #   for `CustomerMasterKeySpec`, `SYMMETRIC_DEFAULT`, and the default
+    #   value for `KeyUsage`, `ENCRYPT_DECRYPT`, are the only valid values
+    #   for symmetric CMKs.
+    #
+    #
+    #
+    # Imported Key Material
+    #
+    # : To import your own key material, begin by creating a symmetric CMK
+    #   with no key material. To do this, use the `Origin` parameter of
+    #   `CreateKey` with a value of `EXTERNAL`. Next, use
+    #   GetParametersForImport operation to get a public key and import
+    #   token, and use the public key to encrypt your key material. Then,
+    #   use ImportKeyMaterial with your import token to import the key
+    #   material. For step-by-step instructions, see [Importing Key
+    #   Material][4] in the <i> <i>AWS Key Management Service Developer
+    #   Guide</i> </i>. You cannot import the key material into an
+    #   asymmetric CMK.
+    #
+    #
+    #
+    # Custom Key Stores
+    #
+    # : To create a symmetric CMK in a [custom key store][5], use the
+    #   `CustomKeyStoreId` parameter to specify the custom key store. You
+    #   must also use the `Origin` parameter with a value of `AWS_CLOUDHSM`.
+    #   The AWS CloudHSM cluster that is associated with the custom key
+    #   store must have at least two active HSMs in different Availability
+    #   Zones in the AWS Region.
+    #
+    #   You cannot create an asymmetric CMK in a custom key store. For
+    #   information about custom key stores in AWS KMS see [Using Custom Key
+    #   Stores][5] in the <i> <i>AWS Key Management Service Developer
+    #   Guide</i> </i>.
     #
     #
     #
-    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master-keys
     # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-keys
-    # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
+    # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
+    # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
+    # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
     #
     # @option params [String] :policy
     #   The key policy to attach to the CMK.
@@ -814,27 +946,87 @@ module Aws::KMS
     #   for a task.
     #
     # @option params [String] :key_usage
-    #   The cryptographic operations for which you can use the CMK. The only
-    #   valid value is `ENCRYPT_DECRYPT`, which means you can use the CMK to
-    #   encrypt and decrypt data.
+    #   Determines the cryptographic operations for which you can use the CMK.
+    #   The default value is `ENCRYPT_DECRYPT`. This parameter is required
+    #   only for asymmetric CMKs. You can't change the `KeyUsage` value after
+    #   the CMK is created.
+    #
+    #   Select only one valid value.
+    #
+    #   * For symmetric CMKs, omit the parameter or specify `ENCRYPT_DECRYPT`.
+    #
+    #   * For asymmetric CMKs with RSA key material, specify `ENCRYPT_DECRYPT`
+    #     or `SIGN_VERIFY`.
+    #
+    #   * For asymmetric CMKs with ECC key material, specify `SIGN_VERIFY`.
+    #
+    # @option params [String] :customer_master_key_spec
+    #   Specifies the type of CMK to create. The `CustomerMasterKeySpec`
+    #   determines whether the CMK contains a symmetric key or an asymmetric
+    #   key pair. It also determines the encryption algorithms or signing
+    #   algorithms that the CMK supports. You can't change the
+    #   `CustomerMasterKeySpec` after the CMK is created. To further restrict
+    #   the algorithms that can be used with the CMK, use its key policy or
+    #   IAM policy.
+    #
+    #   For help with choosing a key spec for your CMK, see [Selecting a
+    #   Customer Master Key Spec][1] in the *AWS Key Management Service
+    #   Developer Guide*.
+    #
+    #   The default value, `SYMMETRIC_DEFAULT`, creates a CMK with a 256-bit
+    #   symmetric key.
+    #
+    #   AWS KMS supports the following key specs for CMKs:
+    #
+    #   * Symmetric key (default)
+    #
+    #     * `SYMMETRIC_DEFAULT` (AES-256-GCM)
+    #
+    #     ^
+    #
+    #   * Asymmetric RSA key pairs
+    #
+    #     * `RSA_2048`
+    #
+    #     * `RSA_3072`
+    #
+    #     * `RSA_4096`
+    #
+    #   * Asymmetric NIST-recommended elliptic curve key pairs
+    #
+    #     * `ECC_NIST_P256` (secp256r1)
+    #
+    #     * `ECC_NIST_P384` (secp384r1)
+    #
+    #     * `ECC_NIST_P521` (secp521r1)
+    #
+    #   * Other asymmetric elliptic curve key pairs
+    #
+    #     * `ECC_SECG_P256K1` (secp256k1), commonly used for cryptocurrencies.
+    #
+    #     ^
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#cmk-key-spec
     #
     # @option params [String] :origin
     #   The source of the key material for the CMK. You cannot change the
-    #   origin after you create the CMK.
-    #
-    #   The default is `AWS_KMS`, which means AWS KMS creates the key material
-    #   in its own key store.
+    #   origin after you create the CMK. The default is `AWS_KMS`, which means
+    #   AWS KMS creates the key material.
     #
     #   When the parameter value is `EXTERNAL`, AWS KMS creates a CMK without
     #   key material so that you can import key material from your existing
     #   key management infrastructure. For more information about importing
     #   key material into AWS KMS, see [Importing Key Material][1] in the *AWS
-    #   Key Management Service Developer Guide*.
+    #   Key Management Service Developer Guide*. This value is valid only for
+    #   symmetric CMKs.
     #
     #   When the parameter value is `AWS_CLOUDHSM`, AWS KMS creates the CMK in
     #   an AWS KMS [custom key store][2] and creates its key material in the
     #   associated AWS CloudHSM cluster. You must also use the
-    #   `CustomKeyStoreId` parameter to identify the custom key store.
+    #   `CustomKeyStoreId` parameter to identify the custom key store. This
+    #   value is valid only for symmetric CMKs.
     #
     #
     #
@@ -849,6 +1041,9 @@ module Aws::KMS
     #   with the custom key store must have at least two active HSMs, each in
     #   a different Availability Zone in the Region.
     #
+    #   This parameter is valid only for symmetric CMKs. You cannot create an
+    #   asymmetric CMK in a custom key store.
+    #
     #   To find the ID of a custom key store, use the DescribeCustomKeyStores
     #   operation.
     #
@@ -885,13 +1080,21 @@ module Aws::KMS
     #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam
     #
     # @option params [Array<Types::Tag>] :tags
-    #   One or more tags. Each tag consists of a tag key and a tag value. Tag
-    #   keys and tag values are both required, but tag values can be empty
-    #   (null) strings.
+    #   One or more tags. Each tag consists of a tag key and a tag value. Both
+    #   the tag key and the tag value are required, but the tag value can be
+    #   an empty (null) string.
+    #
+    #   When you add tags to an AWS resource, AWS generates a cost allocation
+    #   report with usage and costs aggregated by tags. For information about
+    #   adding, changing, deleting and listing tags for CMKs, see [Tagging
+    #   Keys][1].
     #
-    #   Use this parameter to tag the CMK when it is created. Alternately, you
-    #   can omit this parameter and instead tag the CMK after it is created
-    #   using TagResource.
+    #   Use this parameter to tag the CMK when it is created. To add tags to
+    #   an existing CMK, use the TagResource operation.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
     #
     # @return [Types::CreateKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -932,7 +1135,8 @@ module Aws::KMS
     #   resp = client.create_key({
     #     policy: "PolicyType",
     #     description: "DescriptionType",
-    #     key_usage: "ENCRYPT_DECRYPT", # accepts ENCRYPT_DECRYPT
+    #     key_usage: "SIGN_VERIFY", # accepts SIGN_VERIFY, ENCRYPT_DECRYPT
+    #     customer_master_key_spec: "RSA_2048", # accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, SYMMETRIC_DEFAULT
     #     origin: "AWS_KMS", # accepts AWS_KMS, EXTERNAL, AWS_CLOUDHSM
     #     custom_key_store_id: "CustomKeyStoreIdType",
     #     bypass_policy_lockout_safety_check: false,
@@ -952,7 +1156,7 @@ module Aws::KMS
     #   resp.key_metadata.creation_date #=> Time
     #   resp.key_metadata.enabled #=> Boolean
     #   resp.key_metadata.description #=> String
-    #   resp.key_metadata.key_usage #=> String, one of "ENCRYPT_DECRYPT"
+    #   resp.key_metadata.key_usage #=> String, one of "SIGN_VERIFY", "ENCRYPT_DECRYPT"
     #   resp.key_metadata.key_state #=> String, one of "Enabled", "Disabled", "PendingDeletion", "PendingImport", "Unavailable"
     #   resp.key_metadata.deletion_date #=> Time
     #   resp.key_metadata.valid_to #=> Time
@@ -961,6 +1165,11 @@ module Aws::KMS
     #   resp.key_metadata.cloud_hsm_cluster_id #=> String
     #   resp.key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
     #   resp.key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
+    #   resp.key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT"
+    #   resp.key_metadata.encryption_algorithms #=> Array
+    #   resp.key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256"
+    #   resp.key_metadata.signing_algorithms #=> Array
+    #   resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512"
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateKey AWS API Documentation
     #
@@ -971,39 +1180,79 @@ module Aws::KMS
       req.send_request(options)
     end
 
-    # Decrypts ciphertext. Ciphertext is plaintext that has been previously
-    # encrypted by using any of the following operations:
+    # Decrypts ciphertext that was encrypted by a AWS KMS customer master
+    # key (CMK) using any of the following operations:
+    #
+    # * Encrypt
     #
     # * GenerateDataKey
     #
+    # * GenerateDataKeyPair
+    #
     # * GenerateDataKeyWithoutPlaintext
     #
-    # * Encrypt
+    # * GenerateDataKeyPairWithoutPlaintext
+    #
+    # You can use this operation to decrypt ciphertext that was encrypted
+    # under a symmetric or asymmetric CMK. When the CMK is asymmetric, you
+    # must specify the CMK and the encryption algorithm that was used to
+    # encrypt the ciphertext. For information about symmetric and asymmetric
+    # CMKs, see [Using Symmetric and Asymmetric CMKs][1] in the *AWS Key
+    # Management Service Developer Guide*.
+    #
+    # The Decrypt operation also decrypts ciphertext that was encrypted
+    # outside of AWS KMS by the public key in an AWS KMS asymmetric CMK.
+    # However, it cannot decrypt ciphertext produced by other libraries,
+    # such as the [AWS Encryption SDK][2] or [Amazon S3 client-side
+    # encryption][3]. These libraries return a ciphertext format that is
+    # incompatible with AWS KMS.
+    #
+    # If the ciphertext was encrypted under a symmetric CMK, you do not need
+    # to specify the CMK or the encryption algorithm. AWS KMS can get this
+    # information from metadata that it adds to the symmetric ciphertext
+    # blob. However, if you prefer, you can specify the `KeyId` to ensure
+    # that a particular CMK is used to decrypt the ciphertext. If you
+    # specify a different CMK than the one used to encrypt the ciphertext,
+    # the `Decrypt` operation fails.
     #
     # Whenever possible, use key policies to give users permission to call
-    # the Decrypt operation on the CMK, instead of IAM policies. Otherwise,
-    # you might create an IAM user policy that gives the user Decrypt
-    # permission on all CMKs. This user could decrypt ciphertext that was
-    # encrypted by CMKs in other accounts if the key policy for the
-    # cross-account CMK permits it. If you must use an IAM policy for
-    # `Decrypt` permissions, limit the user to particular CMKs or particular
-    # trusted accounts.
-    #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][1]
-    # in the *AWS Key Management Service Developer Guide*.
+    # the Decrypt operation on a particular CMK, instead of using IAM
+    # policies. Otherwise, you might create an IAM user policy that gives
+    # the user Decrypt permission on all CMKs. This user could decrypt
+    # ciphertext that was encrypted by CMKs in other accounts if the key
+    # policy for the cross-account CMK permits it. If you must use an IAM
+    # policy for `Decrypt` permissions, limit the user to particular CMKs or
+    # particular trusted accounts.
     #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][4] in the *AWS Key Management Service Developer Guide*.
     #
     #
-    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    #
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
+    # [2]: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/
+    # [3]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
+    # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String, IO] :ciphertext_blob
     #   Ciphertext to be decrypted. The blob includes metadata.
     #
     # @option params [Hash<String,String>] :encryption_context
-    #   The encryption context. If this was specified in the Encrypt function,
-    #   it must be specified here or the decryption operation will fail. For
-    #   more information, see [Encryption Context][1].
+    #   Specifies the encryption context to use when decrypting the data. An
+    #   encryption context is valid only for cryptographic operations with a
+    #   symmetric CMK. The standard asymmetric encryption algorithms that AWS
+    #   KMS uses do not support an encryption context.
+    #
+    #   An *encryption context* is a collection of non-secret key-value pairs
+    #   that represents additional authenticated data. When you use an
+    #   encryption context to encrypt data, you must specify the same (an
+    #   exact case-sensitive match) encryption context to decrypt the data. An
+    #   encryption context is optional when encrypting with a symmetric CMK,
+    #   but it is highly recommended.
+    #
+    #   For more information, see [Encryption Context][1] in the *AWS Key
+    #   Management Service Developer Guide*.
     #
     #
     #
@@ -1019,10 +1268,54 @@ module Aws::KMS
     #
     #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
     #
+    # @option params [String] :key_id
+    #   Specifies the customer master key (CMK) that AWS KMS will use to
+    #   decrypt the ciphertext. Enter a key ID of the CMK that was used to
+    #   encrypt the ciphertext.
+    #
+    #   If you specify a `KeyId` value, the `Decrypt` operation succeeds only
+    #   if the specified CMK was used to encrypt the ciphertext.
+    #
+    #   This parameter is required only when the ciphertext was encrypted
+    #   under an asymmetric CMK. Otherwise, AWS KMS uses the metadata that it
+    #   adds to the ciphertext blob to determine which CMK was used to encrypt
+    #   the ciphertext. However, you can use this parameter to ensure that a
+    #   particular CMK (of any kind) is used to decrypt the ciphertext.
+    #
+    #   To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
+    #   name, or alias ARN. When using an alias name, prefix it with
+    #   `"alias/"`.
+    #
+    #   For example:
+    #
+    #   * Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Key ARN:
+    #     `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Alias name: `alias/ExampleAlias`
+    #
+    #   * Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
+    #
+    #   To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.
+    #   To get the alias name and alias ARN, use ListAliases.
+    #
+    # @option params [String] :encryption_algorithm
+    #   Specifies the encryption algorithm that will be used to decrypt the
+    #   ciphertext. Specify the same algorithm that was used to encrypt the
+    #   data. If you specify a different algorithm, the `Decrypt` operation
+    #   fails.
+    #
+    #   This parameter is required only when the ciphertext was encrypted
+    #   under an asymmetric CMK. The default value, `SYMMETRIC_DEFAULT`,
+    #   represents the only supported algorithm that is valid for symmetric
+    #   CMKs.
+    #
     # @return [Types::DecryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::DecryptResponse#key_id #key_id} => String
     #   * {Types::DecryptResponse#plaintext #plaintext} => String
+    #   * {Types::DecryptResponse#encryption_algorithm #encryption_algorithm} => String
     #
     #
     # @example Example: To decrypt data
@@ -1047,12 +1340,15 @@ module Aws::KMS
     #       "EncryptionContextKey" => "EncryptionContextValue",
     #     },
     #     grant_tokens: ["GrantTokenType"],
+    #     key_id: "KeyIdType",
+    #     encryption_algorithm: "SYMMETRIC_DEFAULT", # accepts SYMMETRIC_DEFAULT, RSAES_OAEP_SHA_1, RSAES_OAEP_SHA_256
     #   })
     #
     # @example Response structure
     #
     #   resp.key_id #=> String
     #   resp.plaintext #=> String
+    #   resp.encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256"
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Decrypt AWS API Documentation
     #
@@ -1178,9 +1474,9 @@ module Aws::KMS
     # After you delete key material, you can use ImportKeyMaterial to
     # reimport the same key material into the CMK.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][2] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
@@ -1328,20 +1624,50 @@ module Aws::KMS
       req.send_request(options)
     end
 
-    # Provides detailed information about the specified customer master key
-    # (CMK).
+    # Provides detailed information about a customer master key (CMK). You
+    # can run `DescribeKey` on a [customer managed CMK][1] or an [AWS
+    # managed CMK][2].
+    #
+    # This detailed information includes the key ARN, creation date (and
+    # deletion date, if applicable), the key state, and the origin and
+    # expiration date (if any) of the key material. For CMKs in custom key
+    # stores, it includes information about the custom key store, such as
+    # the key store ID and the AWS CloudHSM cluster ID. It includes fields,
+    # like `KeySpec`, that help you distinguish symmetric from asymmetric
+    # CMKs. It also provides information that is particularly important to
+    # asymmetric CMKs, such as the key usage (encryption or signing) and the
+    # encryption algorithms or signing algorithms that the CMK supports.
+    #
+    # `DescribeKey` does not return the following information:
+    #
+    # * Aliases associated with the CMK. To get this information, use
+    #   ListAliases.
+    #
+    # * Whether automatic key rotation is enabled on the CMK. To get this
+    #   information, use GetKeyRotationStatus. Also, some key states prevent
+    #   a CMK from being automatically rotated. For details, see [How
+    #   Automatic Key Rotation Works][3] in *AWS Key Management Service
+    #   Developer Guide*.
+    #
+    # * Tags on the CMK. To get this information, use ListResourceTags.
     #
-    # You can use `DescribeKey` on a predefined AWS alias, that is, an AWS
-    # alias with no key ID. When you do, AWS KMS associates the alias with
-    # an [AWS managed CMK][1] and returns its `KeyId` and `Arn` in the
-    # response.
+    # * Key policies and grants on the CMK. To get this information, use
+    #   GetKeyPolicy and ListGrants.
+    #
+    # If you call the `DescribeKey` operation on a *predefined AWS alias*,
+    # that is, an AWS alias with no key ID, AWS KMS creates an [AWS managed
+    # CMK][4]. Then, it associates the alias with the new CMK, and returns
+    # the `KeyId` and `Arn` of the new CMK in the response.
     #
     # To perform this operation on a CMK in a different AWS account, specify
     # the key ARN or alias ARN in the value of the KeyId parameter.
     #
     #
     #
-    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
+    # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-how-it-works
+    # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys
     #
     # @option params [required, String] :key_id
     #   Describes the specified customer master key (CMK).
@@ -1427,7 +1753,7 @@ module Aws::KMS
     #   resp.key_metadata.creation_date #=> Time
     #   resp.key_metadata.enabled #=> Boolean
     #   resp.key_metadata.description #=> String
-    #   resp.key_metadata.key_usage #=> String, one of "ENCRYPT_DECRYPT"
+    #   resp.key_metadata.key_usage #=> String, one of "SIGN_VERIFY", "ENCRYPT_DECRYPT"
     #   resp.key_metadata.key_state #=> String, one of "Enabled", "Disabled", "PendingDeletion", "PendingImport", "Unavailable"
     #   resp.key_metadata.deletion_date #=> Time
     #   resp.key_metadata.valid_to #=> Time
@@ -1436,6 +1762,11 @@ module Aws::KMS
     #   resp.key_metadata.cloud_hsm_cluster_id #=> String
     #   resp.key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
     #   resp.key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
+    #   resp.key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT"
+    #   resp.key_metadata.encryption_algorithms #=> Array
+    #   resp.key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256"
+    #   resp.key_metadata.signing_algorithms #=> Array
+    #   resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512"
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeKey AWS API Documentation
     #
@@ -1454,9 +1785,9 @@ module Aws::KMS
     # [How Key State Affects the Use of a Customer Master Key][1] in the <i>
     # <i>AWS Key Management Service Developer Guide</i> </i>.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][1]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][1] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
@@ -1503,20 +1834,26 @@ module Aws::KMS
     end
 
     # Disables [automatic rotation of the key material][1] for the specified
-    # customer master key (CMK). You cannot perform this operation on a CMK
-    # in a different AWS account.
+    # symmetric customer master key (CMK).
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
+    # You cannot enable automatic rotation of asymmetric CMKs, CMKs with
+    # imported key material, or CMKs in a [custom key store][2]. You cannot
+    # perform this operation on a CMK in a different AWS account.
+    #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][3] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
     # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
-    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
+    # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String] :key_id
-    #   A unique identifier for the customer master key (CMK).
+    #   Identifies a symmetric customer master key (CMK). You cannot enable
+    #   automatic rotation of [asymmetric CMKs][1], CMKs with [imported key
+    #   material][2], or CMKs in a [custom key store][3].
     #
     #   Specify the key ID or the Amazon Resource Name (ARN) of the CMK.
     #
@@ -1529,6 +1866,12 @@ module Aws::KMS
     #
     #   To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.
     #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks
+    #   [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
+    #   [3]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
+    #
     # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
     #
     #
@@ -1611,9 +1954,9 @@ module Aws::KMS
     # allows you to use the CMK for cryptographic operations. You cannot
     # perform this operation on a CMK in a different AWS account.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][1]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][1] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
@@ -1660,15 +2003,15 @@ module Aws::KMS
     end
 
     # Enables [automatic rotation of the key material][1] for the specified
-    # customer master key (CMK). You cannot perform this operation on a CMK
-    # in a different AWS account.
+    # symmetric customer master key (CMK). You cannot perform this operation
+    # on a CMK in a different AWS account.
     #
-    # You cannot enable automatic rotation of CMKs with imported key
-    # material or CMKs in a [custom key store][2].
+    # You cannot enable automatic rotation of asymmetric CMKs, CMKs with
+    # imported key material, or CMKs in a [custom key store][2].
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][3]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][3] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
@@ -1677,7 +2020,9 @@ module Aws::KMS
     # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String] :key_id
-    #   A unique identifier for the customer master key (CMK).
+    #   Identifies a symmetric customer master key (CMK). You cannot enable
+    #   automatic rotation of asymmetric CMKs, CMKs with imported key
+    #   material, or CMKs in a [custom key store][1].
     #
     #   Specify the key ID or the Amazon Resource Name (ARN) of the CMK.
     #
@@ -1690,6 +2035,10 @@ module Aws::KMS
     #
     #   To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.
     #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
+    #
     # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
     #
     #
@@ -1719,9 +2068,8 @@ module Aws::KMS
     # Encrypts plaintext into ciphertext by using a customer master key
     # (CMK). The `Encrypt` operation has two primary use cases:
     #
-    # * You can encrypt up to 4 kilobytes (4096 bytes) of arbitrary data
-    #   such as an RSA key, a database password, or other sensitive
-    #   information.
+    # * You can encrypt small amounts of arbitrary data, such as a personal
+    #   identifier or database password, or other sensitive information.
     #
     # * You can use the `Encrypt` operation to move encrypted data from one
     #   AWS region to another. In the first region, generate a data key and
@@ -1730,24 +2078,76 @@ module Aws::KMS
     #   safely move the encrypted data and encrypted data key to the new
     #   region, and decrypt in the new region when necessary.
     #
-    # You don't need use this operation to encrypt a data key within a
-    # region. The GenerateDataKey and GenerateDataKeyWithoutPlaintext
-    # operations return an encrypted data key.
+    # You don't need to use the `Encrypt` operation to encrypt a data key.
+    # The GenerateDataKey and GenerateDataKeyPair operations return a
+    # plaintext data key and an encrypted copy of that data key.
     #
-    # Also, you don't need to use this operation to encrypt data in your
-    # application. You can use the plaintext and encrypted data keys that
-    # the `GenerateDataKey` operation returns.
+    # When you encrypt data, you must specify a symmetric or asymmetric CMK
+    # to use in the encryption operation. The CMK must have a `KeyUsage`
+    # value of `ENCRYPT_DECRYPT.` To find the `KeyUsage` of a CMK, use the
+    # DescribeKey operation.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][1]
-    # in the *AWS Key Management Service Developer Guide*.
+    # If you use a symmetric CMK, you can use an encryption context to add
+    # additional security to your encryption operation. If you specify an
+    # `EncryptionContext` when encrypting data, you must specify the same
+    # encryption context (a case-sensitive exact match) when decrypting the
+    # data. Otherwise, the request to decrypt fails with an
+    # `InvalidCiphertextException`. For more information, see [Encryption
+    # Context][1] in the *AWS Key Management Service Developer Guide*.
+    #
+    # If you specify an asymmetric CMK, you must also specify the encryption
+    # algorithm. The algorithm must be compatible with the CMK type.
+    #
+    # When you use an asymmetric CMK to encrypt or reencrypt data, be sure
+    # to record the CMK and encryption algorithm that you choose. You will
+    # be required to provide the same CMK and encryption algorithm when you
+    # decrypt the data. If the CMK and algorithm do not match the values
+    # used to encrypt the data, the decrypt operation fails.
+    #
+    #  You are not required to supply the CMK ID and encryption algorithm
+    # when you decrypt with symmetric CMKs because AWS KMS stores this
+    # information in the ciphertext blob. AWS KMS cannot store metadata in
+    # ciphertext generated with asymmetric keys. The standard format for
+    # asymmetric key ciphertext does not include configurable fields.
+    #
+    # The maximum size of the data that you can encrypt varies with the type
+    # of CMK and the encryption algorithm that you choose.
+    #
+    # * Symmetric CMKs
+    #
+    #   * `SYMMETRIC_DEFAULT`\: 4096 bytes
+    #
+    #   ^
+    #
+    # * `RSA_2048`
+    #
+    #   * `RSAES_OAEP_SHA_1`\: 214 bytes
+    #
+    #   * `RSAES_OAEP_SHA_256`\: 190 bytes
+    #
+    # * `RSA_3072`
+    #
+    #   * `RSAES_OAEP_SHA_1`\: 342 bytes
+    #
+    #   * `RSAES_OAEP_SHA_256`\: 318 bytes
+    #
+    # * `RSA_4096`
+    #
+    #   * `RSAES_OAEP_SHA_1`\: 470 bytes
+    #
+    #   * `RSAES_OAEP_SHA_256`\: 446 bytes
+    #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][2] in the *AWS Key Management Service Developer Guide*.
     #
     # To perform this operation on a CMK in a different AWS account, specify
     # the key ARN or alias ARN in the value of the KeyId parameter.
     #
     #
     #
-    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String] :key_id
     #   A unique identifier for the customer master key (CMK).
@@ -1775,10 +2175,20 @@ module Aws::KMS
     #   Data to be encrypted.
     #
     # @option params [Hash<String,String>] :encryption_context
-    #   Name-value pair that specifies the encryption context to be used for
-    #   authenticated encryption. If used here, the same value must be
-    #   supplied to the `Decrypt` API or decryption will fail. For more
-    #   information, see [Encryption Context][1].
+    #   Specifies the encryption context that will be used to encrypt the
+    #   data. An encryption context is valid only for cryptographic operations
+    #   with a symmetric CMK. The standard asymmetric encryption algorithms
+    #   that AWS KMS uses do not support an encryption context.
+    #
+    #   An *encryption context* is a collection of non-secret key-value pairs
+    #   that represents additional authenticated data. When you use an
+    #   encryption context to encrypt data, you must specify the same (an
+    #   exact case-sensitive match) encryption context to decrypt the data. An
+    #   encryption context is optional when encrypting with a symmetric CMK,
+    #   but it is highly recommended.
+    #
+    #   For more information, see [Encryption Context][1] in the *AWS Key
+    #   Management Service Developer Guide*.
     #
     #
     #
@@ -1794,10 +2204,21 @@ module Aws::KMS
     #
     #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
     #
+    # @option params [String] :encryption_algorithm
+    #   Specifies the encryption algorithm that AWS KMS will use to encrypt
+    #   the plaintext message. The algorithm must be compatible with the CMK
+    #   that you specify.
+    #
+    #   This parameter is required only for asymmetric CMKs. The default
+    #   value, `SYMMETRIC_DEFAULT`, is the algorithm used for symmetric CMKs.
+    #   If you are using an asymmetric CMK, we recommend
+    #   RSAES\_OAEP\_SHA\_256.
+    #
     # @return [Types::EncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::EncryptResponse#ciphertext_blob #ciphertext_blob} => String
     #   * {Types::EncryptResponse#key_id #key_id} => String
+    #   * {Types::EncryptResponse#encryption_algorithm #encryption_algorithm} => String
     #
     #
     # @example Example: To encrypt data
@@ -1824,12 +2245,14 @@ module Aws::KMS
     #       "EncryptionContextKey" => "EncryptionContextValue",
     #     },
     #     grant_tokens: ["GrantTokenType"],
+    #     encryption_algorithm: "SYMMETRIC_DEFAULT", # accepts SYMMETRIC_DEFAULT, RSAES_OAEP_SHA_1, RSAES_OAEP_SHA_256
     #   })
     #
     # @example Response structure
     #
     #   resp.ciphertext_blob #=> String
     #   resp.key_id #=> String
+    #   resp.encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256"
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Encrypt AWS API Documentation
     #
@@ -1840,27 +2263,45 @@ module Aws::KMS
       req.send_request(options)
     end
 
-    # Generates a unique data key. This operation returns a plaintext copy
-    # of the data key and a copy that is encrypted under a customer master
-    # key (CMK) that you specify. You can use the plaintext key to encrypt
-    # your data outside of KMS and store the encrypted data key with the
-    # encrypted data.
+    # Generates a unique symmetric data key. This operation returns a
+    # plaintext copy of the data key and a copy that is encrypted under a
+    # customer master key (CMK) that you specify. You can use the plaintext
+    # key to encrypt your data outside of AWS KMS and store the encrypted
+    # data key with the encrypted data.
     #
     # `GenerateDataKey` returns a unique data key for each request. The
     # bytes in the key are not related to the caller or CMK that is used to
     # encrypt the data key.
     #
-    # To generate a data key, you need to specify the customer master key
-    # (CMK) that will be used to encrypt the data key. You must also specify
-    # the length of the data key using either the `KeySpec` or
-    # `NumberOfBytes` field (but not both). For common key lengths (128-bit
-    # and 256-bit symmetric keys), we recommend that you use `KeySpec`. To
-    # perform this operation on a CMK in a different AWS account, specify
-    # the key ARN or alias ARN in the value of the KeyId parameter.
+    # To generate a data key, specify the symmetric CMK that will be used to
+    # encrypt the data key. You cannot use an asymmetric CMK to generate
+    # data keys.
+    #
+    # You must also specify the length of the data key. Use either the
+    # `KeySpec` or `NumberOfBytes` parameters (but not both). For 128-bit
+    # and 256-bit data keys, use the `KeySpec` parameter.
+    #
+    # If the operation succeeds, the plaintext copy of the data key is in
+    # the `Plaintext` field of the response, and the encrypted copy of the
+    # data key in the `CiphertextBlob` field.
+    #
+    # To get only an encrypted copy of the data key, use
+    # GenerateDataKeyWithoutPlaintext. To generate an asymmetric data key
+    # pair, use the GenerateDataKeyPair or
+    # GenerateDataKeyPairWithoutPlaintext operation. To get a
+    # cryptographically secure random byte string, use GenerateRandom.
+    #
+    # You can use the optional encryption context to add additional security
+    # to the encryption operation. If you specify an `EncryptionContext`,
+    # you must specify the same encryption context (a case-sensitive exact
+    # match) when decrypting the encrypted data key. Otherwise, the request
+    # to decrypt fails with an InvalidCiphertextException. For more
+    # information, see [Encryption Context][1] in the *AWS Key Management
+    # Service Developer Guide*.
     #
-    # You will find the plaintext copy of the data key in the `Plaintext`
-    # field of the response, and the encrypted copy of the data key in the
-    # `CiphertextBlob` field.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][2] in the *AWS Key Management Service Developer Guide*.
     #
     # We recommend that you use the following pattern to encrypt data
     # locally in your application:
@@ -1882,30 +2323,13 @@ module Aws::KMS
     # 2.  Use the plaintext data key to decrypt data locally, then erase the
     #     plaintext data key from memory.
     #
-    # To get only an encrypted copy of the data key, use
-    # GenerateDataKeyWithoutPlaintext. To get a cryptographically secure
-    # random byte string, use GenerateRandom.
-    #
-    # You can use the optional encryption context to add additional security
-    # to your encryption operation. When you specify an `EncryptionContext`
-    # in the `GenerateDataKey` operation, you must specify the same
-    # encryption context (a case-sensitive exact match) in your request to
-    # Decrypt the data key. Otherwise, the request to decrypt fails with an
-    # `InvalidCiphertextException`. For more information, see [Encryption
-    # Context][1] in the <i> <i>AWS Key Management Service Developer
-    # Guide</i> </i>.
-    #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
-    #
     #
     #
     # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
     # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String] :key_id
-    #   An identifier for the CMK that encrypts the data key.
+    #   Identifies the symmetric CMK that encrypts the data key.
     #
     #   To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
     #   name, or alias ARN. When using an alias name, prefix it with
@@ -1927,8 +2351,15 @@ module Aws::KMS
     #   To get the alias name and alias ARN, use ListAliases.
     #
     # @option params [Hash<String,String>] :encryption_context
-    #   A set of key-value pairs that represents additional authenticated
-    #   data.
+    #   Specifies the encryption context that will be used when encrypting the
+    #   data key.
+    #
+    #   An *encryption context* is a collection of non-secret key-value pairs
+    #   that represents additional authenticated data. When you use an
+    #   encryption context to encrypt data, you must specify the same (an
+    #   exact case-sensitive match) encryption context to decrypt the data. An
+    #   encryption context is optional when encrypting with a symmetric CMK,
+    #   but it is highly recommended.
     #
     #   For more information, see [Encryption Context][1] in the *AWS Key
     #   Management Service Developer Guide*.
@@ -1938,14 +2369,21 @@ module Aws::KMS
     #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
     #
     # @option params [Integer] :number_of_bytes
-    #   The length of the data key in bytes. For example, use the value 64 to
-    #   generate a 512-bit data key (64 bytes is 512 bits). For common key
-    #   lengths (128-bit and 256-bit symmetric keys), we recommend that you
-    #   use the `KeySpec` field instead of this one.
+    #   Specifies the length of the data key in bytes. For example, use the
+    #   value 64 to generate a 512-bit data key (64 bytes is 512 bits). For
+    #   128-bit (16-byte) and 256-bit (32-byte) data keys, use the `KeySpec`
+    #   parameter.
+    #
+    #   You must specify either the `KeySpec` or the `NumberOfBytes` parameter
+    #   (but not both) in every `GenerateDataKey` request.
     #
     # @option params [String] :key_spec
-    #   The length of the data key. Use `AES_128` to generate a 128-bit
-    #   symmetric key, or `AES_256` to generate a 256-bit symmetric key.
+    #   Specifies the length of the data key. Use `AES_128` to generate a
+    #   128-bit symmetric key, or `AES_256` to generate a 256-bit symmetric
+    #   key.
+    #
+    #   You must specify either the `KeySpec` or the `NumberOfBytes` parameter
+    #   (but not both) in every `GenerateDataKey` request.
     #
     # @option params [Array<String>] :grant_tokens
     #   A list of grant tokens.
@@ -2008,40 +2446,74 @@ module Aws::KMS
       req.send_request(options)
     end
 
-    # Generates a unique data key. This operation returns a data key that is
-    # encrypted under a customer master key (CMK) that you specify.
-    # `GenerateDataKeyWithoutPlaintext` is identical to GenerateDataKey
-    # except that returns only the encrypted copy of the data key.
+    # Generates a unique asymmetric data key pair. The `GenerateDataKeyPair`
+    # operation returns a plaintext public key, a plaintext private key, and
+    # a copy of the private key that is encrypted under the symmetric CMK
+    # you specify. You can use the data key pair to perform asymmetric
+    # cryptography outside of AWS KMS.
+    #
+    # `GenerateDataKeyPair` returns a unique data key pair for each request.
+    # The bytes in the keys are not related to the caller or the CMK that is
+    # used to encrypt the private key.
+    #
+    # You can use the public key that `GenerateDataKeyPair` returns to
+    # encrypt data or verify a signature outside of AWS KMS. Then, store the
+    # encrypted private key with the data. When you are ready to decrypt
+    # data or sign a message, you can use the Decrypt operation to decrypt
+    # the encrypted private key.
+    #
+    # To generate a data key pair, you must specify a symmetric customer
+    # master key (CMK) to encrypt the private key in a data key pair. You
+    # cannot use an asymmetric CMK. To get the type of your CMK, use the
+    # DescribeKey operation.
+    #
+    # If you are using the data key pair to encrypt data, or for any
+    # operation where you don't immediately need a private key, consider
+    # using the GenerateDataKeyPairWithoutPlaintext operation.
+    # `GenerateDataKeyPairWithoutPlaintext` returns a plaintext public key
+    # and an encrypted private key, but omits the plaintext private key that
+    # you need only to decrypt ciphertext or sign a message. Later, when you
+    # need to decrypt the data or sign a message, use the Decrypt operation
+    # to decrypt the encrypted private key in the data key pair.
     #
-    # Like `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext` returns a
-    # unique data key for each request. The bytes in the key are not related
-    # to the caller or CMK that is used to encrypt the data key.
+    # You can use the optional encryption context to add additional security
+    # to the encryption operation. If you specify an `EncryptionContext`,
+    # you must specify the same encryption context (a case-sensitive exact
+    # match) when decrypting the encrypted data key. Otherwise, the request
+    # to decrypt fails with an InvalidCiphertextException. For more
+    # information, see [Encryption Context][1] in the *AWS Key Management
+    # Service Developer Guide*.
     #
-    # This operation is useful for systems that need to encrypt data at some
-    # point, but not immediately. When you need to encrypt the data, you
-    # call the Decrypt operation on the encrypted copy of the key.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][2] in the *AWS Key Management Service Developer Guide*.
     #
-    # It's also useful in distributed systems with different levels of
-    # trust. For example, you might store encrypted data in containers. One
-    # component of your system creates new containers and stores an
-    # encrypted data key with each container. Then, a different component
-    # puts the data into the containers. That component first decrypts the
-    # data key, uses the plaintext data key to encrypt data, puts the
-    # encrypted data into the container, and then destroys the plaintext
-    # data key. In this system, the component that creates the containers
-    # never sees the plaintext data key.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][1]
-    # in the *AWS Key Management Service Developer Guide*.
     #
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    #
+    # @option params [Hash<String,String>] :encryption_context
+    #   Specifies the encryption context that will be used when encrypting the
+    #   private key in the data key pair.
+    #
+    #   An *encryption context* is a collection of non-secret key-value pairs
+    #   that represents additional authenticated data. When you use an
+    #   encryption context to encrypt data, you must specify the same (an
+    #   exact case-sensitive match) encryption context to decrypt the data. An
+    #   encryption context is optional when encrypting with a symmetric CMK,
+    #   but it is highly recommended.
+    #
+    #   For more information, see [Encryption Context][1] in the *AWS Key
+    #   Management Service Developer Guide*.
     #
     #
-    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
     #
     # @option params [required, String] :key_id
-    #   The identifier of the customer master key (CMK) that encrypts the data
-    #   key.
+    #   Specifies the symmetric CMK that encrypts the private key in the data
+    #   key pair. You cannot specify an asymmetric CMKs.
     #
     #   To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
     #   name, or alias ARN. When using an alias name, prefix it with
@@ -2062,26 +2534,13 @@ module Aws::KMS
     #   To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.
     #   To get the alias name and alias ARN, use ListAliases.
     #
-    # @option params [Hash<String,String>] :encryption_context
-    #   A set of key-value pairs that represents additional authenticated
-    #   data.
-    #
-    #   For more information, see [Encryption Context][1] in the *AWS Key
-    #   Management Service Developer Guide*.
-    #
-    #
-    #
-    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
-    #
-    # @option params [String] :key_spec
-    #   The length of the data key. Use `AES_128` to generate a 128-bit
-    #   symmetric key, or `AES_256` to generate a 256-bit symmetric key.
+    # @option params [required, String] :key_pair_spec
+    #   Determines the type of data key pair that is generated.
     #
-    # @option params [Integer] :number_of_bytes
-    #   The length of the data key in bytes. For example, use the value 64 to
-    #   generate a 512-bit data key (64 bytes is 512 bits). For common key
-    #   lengths (128-bit and 256-bit symmetric keys), we recommend that you
-    #   use the `KeySpec` field instead of this one.
+    #   The AWS KMS rule that restricts the use of asymmetric RSA CMKs to
+    #   encrypt and decrypt or to sign and verify (but not both), and the rule
+    #   that permits you to use ECC CMKs only to sign and verify, are not
+    #   effective outside of AWS KMS.
     #
     # @option params [Array<String>] :grant_tokens
     #   A list of grant tokens.
@@ -2093,36 +2552,317 @@ module Aws::KMS
     #
     #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
     #
-    # @return [Types::GenerateDataKeyWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
-    #
-    #   * {Types::GenerateDataKeyWithoutPlaintextResponse#ciphertext_blob #ciphertext_blob} => String
-    #   * {Types::GenerateDataKeyWithoutPlaintextResponse#key_id #key_id} => String
-    #
-    #
-    # @example Example: To generate an encrypted data key
-    #
-    #   # The following example generates an encrypted copy of a 256-bit symmetric data encryption key (data key). The data key is
-    #   # encrypted with the specified customer master key (CMK).
-    #
-    #   resp = client.generate_data_key_without_plaintext({
-    #     key_id: "alias/ExampleAlias", # The identifier of the CMK to use to encrypt the data key. You can use the key ID or Amazon Resource Name (ARN) of the CMK, or the name or ARN of an alias that refers to the CMK.
-    #     key_spec: "AES_256", # Specifies the type of data key to return.
-    #   })
+    # @return [Types::GenerateDataKeyPairResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
-    #   resp.to_h outputs the following:
-    #   {
-    #     ciphertext_blob: "<binary data>", # The encrypted data key.
-    #     key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the CMK that was used to encrypt the data key.
-    #   }
+    #   * {Types::GenerateDataKeyPairResponse#private_key_ciphertext_blob #private_key_ciphertext_blob} => String
+    #   * {Types::GenerateDataKeyPairResponse#private_key_plaintext #private_key_plaintext} => String
+    #   * {Types::GenerateDataKeyPairResponse#public_key #public_key} => String
+    #   * {Types::GenerateDataKeyPairResponse#key_id #key_id} => String
+    #   * {Types::GenerateDataKeyPairResponse#key_pair_spec #key_pair_spec} => String
     #
     # @example Request syntax with placeholder values
     #
-    #   resp = client.generate_data_key_without_plaintext({
-    #     key_id: "KeyIdType", # required
+    #   resp = client.generate_data_key_pair({
     #     encryption_context: {
     #       "EncryptionContextKey" => "EncryptionContextValue",
     #     },
-    #     key_spec: "AES_256", # accepts AES_256, AES_128
+    #     key_id: "KeyIdType", # required
+    #     key_pair_spec: "RSA_2048", # required, accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1
+    #     grant_tokens: ["GrantTokenType"],
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.private_key_ciphertext_blob #=> String
+    #   resp.private_key_plaintext #=> String
+    #   resp.public_key #=> String
+    #   resp.key_id #=> String
+    #   resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPair AWS API Documentation
+    #
+    # @overload generate_data_key_pair(params = {})
+    # @param [Hash] params ({})
+    def generate_data_key_pair(params = {}, options = {})
+      req = build_request(:generate_data_key_pair, params)
+      req.send_request(options)
+    end
+
+    # Generates a unique asymmetric data key pair. The
+    # `GenerateDataKeyPairWithoutPlaintext` operation returns a plaintext
+    # public key and a copy of the private key that is encrypted under the
+    # symmetric CMK you specify. Unlike GenerateDataKeyPair, this operation
+    # does not return a plaintext private key.
+    #
+    # To generate a data key pair, you must specify a symmetric customer
+    # master key (CMK) to encrypt the private key in the data key pair. You
+    # cannot use an asymmetric CMK. To get the type of your CMK, use the
+    # `KeySpec` field in the DescribeKey response.
+    #
+    # You can use the public key that `GenerateDataKeyPairWithoutPlaintext`
+    # returns to encrypt data or verify a signature outside of AWS KMS.
+    # Then, store the encrypted private key with the data. When you are
+    # ready to decrypt data or sign a message, you can use the Decrypt
+    # operation to decrypt the encrypted private key.
+    #
+    # `GenerateDataKeyPairWithoutPlaintext` returns a unique data key pair
+    # for each request. The bytes in the key are not related to the caller
+    # or CMK that is used to encrypt the private key.
+    #
+    # You can use the optional encryption context to add additional security
+    # to the encryption operation. If you specify an `EncryptionContext`,
+    # you must specify the same encryption context (a case-sensitive exact
+    # match) when decrypting the encrypted data key. Otherwise, the request
+    # to decrypt fails with an InvalidCiphertextException. For more
+    # information, see [Encryption Context][1] in the *AWS Key Management
+    # Service Developer Guide*.
+    #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][2] in the *AWS Key Management Service Developer Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    #
+    # @option params [Hash<String,String>] :encryption_context
+    #   Specifies the encryption context that will be used when encrypting the
+    #   private key in the data key pair.
+    #
+    #   An *encryption context* is a collection of non-secret key-value pairs
+    #   that represents additional authenticated data. When you use an
+    #   encryption context to encrypt data, you must specify the same (an
+    #   exact case-sensitive match) encryption context to decrypt the data. An
+    #   encryption context is optional when encrypting with a symmetric CMK,
+    #   but it is highly recommended.
+    #
+    #   For more information, see [Encryption Context][1] in the *AWS Key
+    #   Management Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
+    #
+    # @option params [required, String] :key_id
+    #   Specifies the CMK that encrypts the private key in the data key pair.
+    #   You must specify a symmetric CMK. You cannot use an asymmetric CMK.
+    #
+    #   To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
+    #   name, or alias ARN. When using an alias name, prefix it with
+    #   `"alias/"`.
+    #
+    #   For example:
+    #
+    #   * Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Key ARN:
+    #     `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Alias name: `alias/ExampleAlias`
+    #
+    #   * Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
+    #
+    #   To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.
+    #   To get the alias name and alias ARN, use ListAliases.
+    #
+    # @option params [required, String] :key_pair_spec
+    #   Determines the type of data key pair that is generated.
+    #
+    #   The AWS KMS rule that restricts the use of asymmetric RSA CMKs to
+    #   encrypt and decrypt or to sign and verify (but not both), and the rule
+    #   that permits you to use ECC CMKs only to sign and verify, are not
+    #   effective outside of AWS KMS.
+    #
+    # @option params [Array<String>] :grant_tokens
+    #   A list of grant tokens.
+    #
+    #   For more information, see [Grant Tokens][1] in the *AWS Key Management
+    #   Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
+    #
+    # @return [Types::GenerateDataKeyPairWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GenerateDataKeyPairWithoutPlaintextResponse#private_key_ciphertext_blob #private_key_ciphertext_blob} => String
+    #   * {Types::GenerateDataKeyPairWithoutPlaintextResponse#public_key #public_key} => String
+    #   * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_id #key_id} => String
+    #   * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_pair_spec #key_pair_spec} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.generate_data_key_pair_without_plaintext({
+    #     encryption_context: {
+    #       "EncryptionContextKey" => "EncryptionContextValue",
+    #     },
+    #     key_id: "KeyIdType", # required
+    #     key_pair_spec: "RSA_2048", # required, accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1
+    #     grant_tokens: ["GrantTokenType"],
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.private_key_ciphertext_blob #=> String
+    #   resp.public_key #=> String
+    #   resp.key_id #=> String
+    #   resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintext AWS API Documentation
+    #
+    # @overload generate_data_key_pair_without_plaintext(params = {})
+    # @param [Hash] params ({})
+    def generate_data_key_pair_without_plaintext(params = {}, options = {})
+      req = build_request(:generate_data_key_pair_without_plaintext, params)
+      req.send_request(options)
+    end
+
+    # Generates a unique symmetric data key. This operation returns a data
+    # key that is encrypted under a customer master key (CMK) that you
+    # specify. To request an asymmetric data key pair, use the
+    # GenerateDataKeyPair or GenerateDataKeyPairWithoutPlaintext operations.
+    #
+    # `GenerateDataKeyWithoutPlaintext` is identical to the GenerateDataKey
+    # operation except that returns only the encrypted copy of the data key.
+    # This operation is useful for systems that need to encrypt data at some
+    # point, but not immediately. When you need to encrypt the data, you
+    # call the Decrypt operation on the encrypted copy of the key.
+    #
+    # It's also useful in distributed systems with different levels of
+    # trust. For example, you might store encrypted data in containers. One
+    # component of your system creates new containers and stores an
+    # encrypted data key with each container. Then, a different component
+    # puts the data into the containers. That component first decrypts the
+    # data key, uses the plaintext data key to encrypt data, puts the
+    # encrypted data into the container, and then destroys the plaintext
+    # data key. In this system, the component that creates the containers
+    # never sees the plaintext data key.
+    #
+    # `GenerateDataKeyWithoutPlaintext` returns a unique data key for each
+    # request. The bytes in the keys are not related to the caller or CMK
+    # that is used to encrypt the private key.
+    #
+    # To generate a data key, you must specify the symmetric customer master
+    # key (CMK) that is used to encrypt the data key. You cannot use an
+    # asymmetric CMK to generate a data key. To get the type of your CMK,
+    # use the `KeySpec` field in the DescribeKey response. You must also
+    # specify the length of the data key using either the `KeySpec` or
+    # `NumberOfBytes` field (but not both). For common key lengths (128-bit
+    # and 256-bit symmetric keys), use the `KeySpec` parameter.
+    #
+    # If the operation succeeds, you will find the plaintext copy of the
+    # data key in the `Plaintext` field of the response, and the encrypted
+    # copy of the data key in the `CiphertextBlob` field.
+    #
+    # You can use the optional encryption context to add additional security
+    # to the encryption operation. If you specify an `EncryptionContext`,
+    # you must specify the same encryption context (a case-sensitive exact
+    # match) when decrypting the encrypted data key. Otherwise, the request
+    # to decrypt fails with an InvalidCiphertextException. For more
+    # information, see [Encryption Context][1] in the *AWS Key Management
+    # Service Developer Guide*.
+    #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][2] in the *AWS Key Management Service Developer Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    #
+    # @option params [required, String] :key_id
+    #   The identifier of the symmetric customer master key (CMK) that
+    #   encrypts the data key.
+    #
+    #   To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
+    #   name, or alias ARN. When using an alias name, prefix it with
+    #   `"alias/"`. To specify a CMK in a different AWS account, you must use
+    #   the key ARN or alias ARN.
+    #
+    #   For example:
+    #
+    #   * Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Key ARN:
+    #     `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Alias name: `alias/ExampleAlias`
+    #
+    #   * Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
+    #
+    #   To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.
+    #   To get the alias name and alias ARN, use ListAliases.
+    #
+    # @option params [Hash<String,String>] :encryption_context
+    #   Specifies the encryption context that will be used when encrypting the
+    #   data key.
+    #
+    #   An *encryption context* is a collection of non-secret key-value pairs
+    #   that represents additional authenticated data. When you use an
+    #   encryption context to encrypt data, you must specify the same (an
+    #   exact case-sensitive match) encryption context to decrypt the data. An
+    #   encryption context is optional when encrypting with a symmetric CMK,
+    #   but it is highly recommended.
+    #
+    #   For more information, see [Encryption Context][1] in the *AWS Key
+    #   Management Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
+    #
+    # @option params [String] :key_spec
+    #   The length of the data key. Use `AES_128` to generate a 128-bit
+    #   symmetric key, or `AES_256` to generate a 256-bit symmetric key.
+    #
+    # @option params [Integer] :number_of_bytes
+    #   The length of the data key in bytes. For example, use the value 64 to
+    #   generate a 512-bit data key (64 bytes is 512 bits). For common key
+    #   lengths (128-bit and 256-bit symmetric keys), we recommend that you
+    #   use the `KeySpec` field instead of this one.
+    #
+    # @option params [Array<String>] :grant_tokens
+    #   A list of grant tokens.
+    #
+    #   For more information, see [Grant Tokens][1] in the *AWS Key Management
+    #   Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
+    #
+    # @return [Types::GenerateDataKeyWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GenerateDataKeyWithoutPlaintextResponse#ciphertext_blob #ciphertext_blob} => String
+    #   * {Types::GenerateDataKeyWithoutPlaintextResponse#key_id #key_id} => String
+    #
+    #
+    # @example Example: To generate an encrypted data key
+    #
+    #   # The following example generates an encrypted copy of a 256-bit symmetric data encryption key (data key). The data key is
+    #   # encrypted with the specified customer master key (CMK).
+    #
+    #   resp = client.generate_data_key_without_plaintext({
+    #     key_id: "alias/ExampleAlias", # The identifier of the CMK to use to encrypt the data key. You can use the key ID or Amazon Resource Name (ARN) of the CMK, or the name or ARN of an alias that refers to the CMK.
+    #     key_spec: "AES_256", # Specifies the type of data key to return.
+    #   })
+    #
+    #   resp.to_h outputs the following:
+    #   {
+    #     ciphertext_blob: "<binary data>", # The encrypted data key.
+    #     key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the CMK that was used to encrypt the data key.
+    #   }
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.generate_data_key_without_plaintext({
+    #     key_id: "KeyIdType", # required
+    #     encryption_context: {
+    #       "EncryptionContextKey" => "EncryptionContextValue",
+    #     },
+    #     key_spec: "AES_256", # accepts AES_256, AES_128
     #     number_of_bytes: 1,
     #     grant_tokens: ["GrantTokenType"],
     #   })
@@ -2270,9 +3010,13 @@ module Aws::KMS
     # key material][1] is enabled for the specified customer master key
     # (CMK).
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
+    # You cannot enable automatic rotation of asymmetric CMKs, CMKs with
+    # imported key material, or CMKs in a [custom key store][2]. The key
+    # rotation status for these CMKs is always `false`.
+    #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][3] in the *AWS Key Management Service Developer Guide*.
     #
     # * Disabled: The key rotation status does not change when you disable a
     #   CMK. However, while the CMK is disabled, AWS KMS does not rotate the
@@ -2289,7 +3033,8 @@ module Aws::KMS
     #
     #
     # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
-    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
+    # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String] :key_id
     #   A unique identifier for the customer master key (CMK).
@@ -2343,29 +3088,32 @@ module Aws::KMS
       req.send_request(options)
     end
 
-    # Returns the items you need in order to import key material into AWS
-    # KMS from your existing key management infrastructure. For more
-    # information about importing key material into AWS KMS, see [Importing
-    # Key Material][1] in the *AWS Key Management Service Developer Guide*.
-    #
-    # You must specify the key ID of the customer master key (CMK) into
-    # which you will import key material. This CMK's `Origin` must be
-    # `EXTERNAL`. You must also specify the wrapping algorithm and type of
-    # wrapping key (public key) that you will use to encrypt the key
-    # material. You cannot perform this operation on a CMK in a different
-    # AWS account.
+    # Returns the items you need to import key material into a symmetric,
+    # customer managed customer master key (CMK). For more information about
+    # importing key material into AWS KMS, see [Importing Key Material][1]
+    # in the *AWS Key Management Service Developer Guide*.
     #
     # This operation returns a public key and an import token. Use the
-    # public key to encrypt the key material. Store the import token to send
-    # with a subsequent ImportKeyMaterial request. The public key and import
-    # token from the same response must be used together. These items are
-    # valid for 24 hours. When they expire, they cannot be used for a
-    # subsequent ImportKeyMaterial request. To get new ones, send another
+    # public key to encrypt the symmetric key material. Store the import
+    # token to send with a subsequent ImportKeyMaterial request.
+    #
+    # You must specify the key ID of the symmetric CMK into which you will
+    # import key material. This CMK's `Origin` must be `EXTERNAL`. You must
+    # also specify the wrapping algorithm and type of wrapping key (public
+    # key) that you will use to encrypt the key material. You cannot perform
+    # this operation on an asymmetric CMK or on any CMK in a different AWS
+    # account.
+    #
+    # To import key material, you must use the public key and import token
+    # from the same response. These items are valid for 24 hours. The
+    # expiration date and time appear in the `GetParametersForImport`
+    # response. You cannot use an expired token in an ImportKeyMaterial
+    # request. If your key and token expire, send another
     # `GetParametersForImport` request.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][2] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
@@ -2373,8 +3121,8 @@ module Aws::KMS
     # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String] :key_id
-    #   The identifier of the CMK into which you will import key material. The
-    #   CMK's `Origin` must be `EXTERNAL`.
+    #   The identifier of the symmetric CMK into which you will import key
+    #   material. The `Origin` of the CMK must be `EXTERNAL`.
     #
     #   Specify the key ID or the Amazon Resource Name (ARN) of the CMK.
     #
@@ -2451,12 +3199,136 @@ module Aws::KMS
       req.send_request(options)
     end
 
-    # Imports key material into an existing AWS KMS customer master key
-    # (CMK) that was created without key material. You cannot perform this
-    # operation on a CMK in a different AWS account. For more information
-    # about creating CMKs with no key material and then importing key
-    # material, see [Importing Key Material][1] in the *AWS Key Management
-    # Service Developer Guide*.
+    # Returns the public key of an asymmetric CMK. Unlike the private key of
+    # a asymmetric CMK, which never leaves AWS KMS unencrypted, callers with
+    # `kms:GetPublicKey` permission can download the public key of an
+    # asymmetric CMK. You can share the public key to allow others to
+    # encrypt messages and verify signatures outside of AWS KMS. For
+    # information about symmetric and asymmetric CMKs, see [Using Symmetric
+    # and Asymmetric CMKs][1] in the *AWS Key Management Service Developer
+    # Guide*.
+    #
+    # You do not need to download the public key. Instead, you can use the
+    # public key within AWS KMS by calling the Encrypt, ReEncrypt, or Verify
+    # operations with the identifier of an asymmetric CMK. When you use the
+    # public key within AWS KMS, you benefit from the authentication,
+    # authorization, and logging that are part of every AWS KMS operation.
+    # You also reduce of risk of encrypting data that cannot be decrypted.
+    # These features are not effective outside of AWS KMS. For details, see
+    # [Special Considerations for Downloading Public
+    # Keys](kms/latest/developerguide/get-public-key.html#get-public-key-considerations).
+    #
+    # To help you use the public key safely outside of AWS KMS,
+    # `GetPublicKey` returns important information about the public key in
+    # the response, including:
+    #
+    # * [CustomerMasterKeySpec][2]\: The type of key material in the public
+    #   key, such as `RSA_4096` or `ECC_NIST_P521`.
+    #
+    # * [KeyUsage][3]\: Whether the key is used for encryption or signing.
+    #
+    # * [EncryptionAlgorithms][4] or [SigningAlgorithms][5]\: A list of the
+    #   encryption algorithms or the signing algorithms for the key.
+    #
+    # Although AWS KMS cannot enforce these restrictions on external
+    # operations, it is crucial that you use this information to prevent the
+    # public key from being used improperly. For example, you can prevent a
+    # public signing key from being used encrypt data, or prevent a public
+    # key from being used with an encryption algorithm that is not supported
+    # by AWS KMS. You can also avoid errors, such as using the wrong signing
+    # algorithm in a verification operation.
+    #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][6] in the *AWS Key Management Service Developer Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
+    # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-CustomerMasterKeySpec
+    # [3]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyUsage
+    # [4]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-EncryptionAlgorithms
+    # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
+    # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    #
+    # @option params [required, String] :key_id
+    #   Identifies the asymmetric CMK that includes the public key.
+    #
+    #   To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
+    #   name, or alias ARN. When using an alias name, prefix it with
+    #   `"alias/"`. To specify a CMK in a different AWS account, you must use
+    #   the key ARN or alias ARN.
+    #
+    #   For example:
+    #
+    #   * Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Key ARN:
+    #     `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Alias name: `alias/ExampleAlias`
+    #
+    #   * Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
+    #
+    #   To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.
+    #   To get the alias name and alias ARN, use ListAliases.
+    #
+    # @option params [Array<String>] :grant_tokens
+    #   A list of grant tokens.
+    #
+    #   For more information, see [Grant Tokens][1] in the *AWS Key Management
+    #   Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
+    #
+    # @return [Types::GetPublicKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetPublicKeyResponse#key_id #key_id} => String
+    #   * {Types::GetPublicKeyResponse#public_key #public_key} => String
+    #   * {Types::GetPublicKeyResponse#customer_master_key_spec #customer_master_key_spec} => String
+    #   * {Types::GetPublicKeyResponse#key_usage #key_usage} => String
+    #   * {Types::GetPublicKeyResponse#encryption_algorithms #encryption_algorithms} => Array&lt;String&gt;
+    #   * {Types::GetPublicKeyResponse#signing_algorithms #signing_algorithms} => Array&lt;String&gt;
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_public_key({
+    #     key_id: "KeyIdType", # required
+    #     grant_tokens: ["GrantTokenType"],
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.key_id #=> String
+    #   resp.public_key #=> String
+    #   resp.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT"
+    #   resp.key_usage #=> String, one of "SIGN_VERIFY", "ENCRYPT_DECRYPT"
+    #   resp.encryption_algorithms #=> Array
+    #   resp.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256"
+    #   resp.signing_algorithms #=> Array
+    #   resp.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GetPublicKey AWS API Documentation
+    #
+    # @overload get_public_key(params = {})
+    # @param [Hash] params ({})
+    def get_public_key(params = {}, options = {})
+      req = build_request(:get_public_key, params)
+      req.send_request(options)
+    end
+
+    # Imports key material into an existing symmetric AWS KMS customer
+    # master key (CMK) that was created without key material. After you
+    # successfully import key material into a CMK, you can [reimport the
+    # same key material][1] into that CMK, but you cannot import different
+    # key material.
+    #
+    # You cannot perform this operation on an asymmetric CMK or on any CMK
+    # in a different AWS account. For more information about creating CMKs
+    # with no key material and then importing key material, see [Importing
+    # Key Material][2] in the *AWS Key Management Service Developer Guide*.
     #
     # Before using this operation, call GetParametersForImport. Its response
     # includes a public key and an import token. Use the public key to
@@ -2475,35 +3347,43 @@ module Aws::KMS
     # * The encrypted key material. To get the public key to encrypt the key
     #   material, call GetParametersForImport.
     #
-    # * The import token that GetParametersForImport returned. This token
-    #   and the public key used to encrypt the key material must have come
-    #   from the same response.
+    # * The import token that GetParametersForImport returned. You must use
+    #   a public key and token from the same `GetParametersForImport`
+    #   response.
     #
     # * Whether the key material expires and if so, when. If you set an
-    #   expiration date, you can change it only by reimporting the same key
-    #   material and specifying a new expiration date. If the key material
-    #   expires, AWS KMS deletes the key material and the CMK becomes
-    #   unusable. To use the CMK again, you must reimport the same key
-    #   material.
+    #   expiration date, AWS KMS deletes the key material from the CMK on
+    #   the specified date, and the CMK becomes unusable. To use the CMK
+    #   again, you must reimport the same key material. The only way to
+    #   change an expiration date is by reimporting the same key material
+    #   and specifying a new expiration date.
     #
     # When this operation is successful, the key state of the CMK changes
-    # from `PendingImport` to `Enabled`, and you can use the CMK. After you
-    # successfully import key material into a CMK, you can reimport the same
-    # key material into that CMK, but you cannot import different key
-    # material.
+    # from `PendingImport` to `Enabled`, and you can use the CMK.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
+    # If this operation fails, use the exception to help determine the
+    # problem. If the error is related to the key material, the import
+    # token, or wrapping key, use GetParametersForImport to get a new public
+    # key and import token for the CMK and repeat the import procedure. For
+    # help, see [How To Import Key Material][3] in the *AWS Key Management
+    # Service Developer Guide*.
     #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][4] in the *AWS Key Management Service Developer Guide*.
     #
     #
-    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
-    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    #
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
+    # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#importing-keys-overview
+    # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String] :key_id
-    #   The identifier of the CMK to import the key material into. The CMK's
-    #   `Origin` must be `EXTERNAL`.
+    #   The identifier of the symmetric CMK that receives the imported key
+    #   material. The CMK's `Origin` must be `EXTERNAL`. This must be the
+    #   same CMK specified in the `KeyID` parameter of the corresponding
+    #   GetParametersForImport request.
     #
     #   Specify the key ID or the Amazon Resource Name (ARN) of the CMK.
     #
@@ -2522,10 +3402,10 @@ module Aws::KMS
     #   contained the public key that you used to encrypt the key material.
     #
     # @option params [required, String, IO] :encrypted_key_material
-    #   The encrypted key material to import. It must be encrypted with the
-    #   public key that you received in the response to a previous
-    #   GetParametersForImport request, using the wrapping algorithm that you
-    #   specified in that request.
+    #   The encrypted key material to import. The key material must be
+    #   encrypted with the public wrapping key that GetParametersForImport
+    #   returned, using the wrapping algorithm that you specified in the same
+    #   `GetParametersForImport` request.
     #
     # @option params [Time,DateTime,Date,Integer,String] :valid_to
     #   The time at which the imported key material expires. When the key
@@ -2831,7 +3711,7 @@ module Aws::KMS
     #   resp.grants[0].retiring_principal #=> String
     #   resp.grants[0].issuing_account #=> String
     #   resp.grants[0].operations #=> Array
-    #   resp.grants[0].operations[0] #=> String, one of "Decrypt", "Encrypt", "GenerateDataKey", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo", "CreateGrant", "RetireGrant", "DescribeKey"
+    #   resp.grants[0].operations[0] #=> String, one of "Decrypt", "Encrypt", "GenerateDataKey", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo", "Sign", "Verify", "GetPublicKey", "CreateGrant", "RetireGrant", "DescribeKey", "GenerateDataKeyPair", "GenerateDataKeyPairWithoutPlaintext"
     #   resp.grants[0].constraints.encryption_context_subset #=> Hash
     #   resp.grants[0].constraints.encryption_context_subset["EncryptionContextKey"] #=> String
     #   resp.grants[0].constraints.encryption_context_equals #=> Hash
@@ -2932,7 +3812,7 @@ module Aws::KMS
     end
 
     # Gets a list of all customer master keys (CMKs) in the caller's AWS
-    # account and region.
+    # account and Region.
     #
     # @option params [Integer] :limit
     #   Use this parameter to specify the maximum number of items to return.
@@ -3202,7 +4082,7 @@ module Aws::KMS
     #   resp.grants[0].retiring_principal #=> String
     #   resp.grants[0].issuing_account #=> String
     #   resp.grants[0].operations #=> Array
-    #   resp.grants[0].operations[0] #=> String, one of "Decrypt", "Encrypt", "GenerateDataKey", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo", "CreateGrant", "RetireGrant", "DescribeKey"
+    #   resp.grants[0].operations[0] #=> String, one of "Decrypt", "Encrypt", "GenerateDataKey", "GenerateDataKeyWithoutPlaintext", "ReEncryptFrom", "ReEncryptTo", "Sign", "Verify", "GetPublicKey", "CreateGrant", "RetireGrant", "DescribeKey", "GenerateDataKeyPair", "GenerateDataKeyPairWithoutPlaintext"
     #   resp.grants[0].constraints.encryption_context_subset #=> Hash
     #   resp.grants[0].constraints.encryption_context_subset["EncryptionContextKey"] #=> String
     #   resp.grants[0].constraints.encryption_context_equals #=> Hash
@@ -3326,40 +4206,142 @@ module Aws::KMS
       req.send_request(options)
     end
 
-    # Encrypts data on the server side with a new customer master key (CMK)
-    # without exposing the plaintext of the data on the client side. The
-    # data is first decrypted and then reencrypted. You can also use this
-    # operation to change the encryption context of a ciphertext.
-    #
-    # You can reencrypt data using CMKs in different AWS accounts.
-    #
-    # Unlike other operations, `ReEncrypt` is authorized twice, once as
-    # `ReEncryptFrom` on the source CMK and once as `ReEncryptTo` on the
-    # destination CMK. We recommend that you include the `"kms:ReEncrypt*"`
-    # permission in your [key policies][1] to permit reencryption from or to
-    # the CMK. This permission is automatically included in the key policy
-    # when you create a CMK through the console. But you must include it
-    # manually when you create a CMK programmatically or when you set a key
-    # policy with the PutKeyPolicy operation.
-    #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
+    # Decrypts ciphertext and then reencrypts it entirely within AWS KMS.
+    # You can use this operation to change the customer master key (CMK)
+    # under which data is encrypted, such as when you [manually
+    # rotate](kms/latest/developerguide/rotate-keys.html#rotate-keys-manually)
+    # a CMK or change the CMK that protects a ciphertext. You can also use
+    # it to reencrypt ciphertext under the same CMK, such as to change the
+    # encryption context of a ciphertext.
+    #
+    # The `ReEncrypt` operation can decrypt ciphertext that was encrypted by
+    # using an AWS KMS CMK in an AWS KMS operation, such as Encrypt or
+    # GenerateDataKey. It can also decrypt ciphertext that was encrypted by
+    # using the public key of an asymmetric CMK outside of AWS KMS. However,
+    # it cannot decrypt ciphertext produced by other libraries, such as the
+    # [AWS Encryption SDK][1] or [Amazon S3 client-side encryption][2].
+    # These libraries return a ciphertext format that is incompatible with
+    # AWS KMS.
+    #
+    # When you use the `ReEncrypt` operation, you need to provide
+    # information for the decrypt operation and the subsequent encrypt
+    # operation.
     #
+    # * If your ciphertext was encrypted under an asymmetric CMK, you must
+    #   identify the *source CMK*, that is, the CMK that encrypted the
+    #   ciphertext. You must also supply the encryption algorithm that was
+    #   used. This information is required to decrypt the data.
+    #
+    # * It is optional, but you can specify a source CMK even when the
+    #   ciphertext was encrypted under a symmetric CMK. This ensures that
+    #   the ciphertext is decrypted only by using a particular CMK. If the
+    #   CMK that you specify cannot decrypt the ciphertext, the `ReEncrypt`
+    #   operation fails.
+    #
+    # * To reencrypt the data, you must specify the *destination CMK*, that
+    #   is, the CMK that re-encrypts the data after it is decrypted. You can
+    #   select a symmetric or asymmetric CMK. If the destination CMK is an
+    #   asymmetric CMK, you must also provide the encryption algorithm. The
+    #   algorithm that you choose must be compatible with the CMK.
+    #
+    #   When you use an asymmetric CMK to encrypt or reencrypt data, be sure
+    #   to record the CMK and encryption algorithm that you choose. You will
+    #   be required to provide the same CMK and encryption algorithm when
+    #   you decrypt the data. If the CMK and algorithm do not match the
+    #   values used to encrypt the data, the decrypt operation fails.
+    #
+    #    You are not required to supply the CMK ID and encryption algorithm
+    #   when you decrypt with symmetric CMKs because AWS KMS stores this
+    #   information in the ciphertext blob. AWS KMS cannot store metadata in
+    #   ciphertext generated with asymmetric keys. The standard format for
+    #   asymmetric key ciphertext does not include configurable fields.
+    #
+    # Unlike other AWS KMS API operations, `ReEncrypt` callers must have two
+    # permissions:
+    #
+    # * `kms:EncryptFrom` permission on the source CMK
+    #
+    # * `kms:EncryptTo` permission on the destination CMK
+    #
+    # To permit reencryption from
+    #
+    # or to a CMK, include the `"kms:ReEncrypt*"` permission in your [key
+    # policy][3]. This permission is automatically included in the key
+    # policy when you use the console to create a CMK. But you must include
+    # it manually when you create a CMK programmatically or when you use the
+    # PutKeyPolicy operation set a key policy.
+    #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][4] in the *AWS Key Management Service Developer Guide*.
     #
     #
-    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
-    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    #
+    # [1]: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/
+    # [2]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
+    # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
+    # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String, IO] :ciphertext_blob
     #   Ciphertext of the data to reencrypt.
     #
     # @option params [Hash<String,String>] :source_encryption_context
-    #   Encryption context used to encrypt and decrypt the data specified in
-    #   the `CiphertextBlob` parameter.
+    #   Specifies the encryption context to use to decrypt the ciphertext.
+    #   Enter the same encryption context that was used to encrypt the
+    #   ciphertext.
+    #
+    #   An *encryption context* is a collection of non-secret key-value pairs
+    #   that represents additional authenticated data. When you use an
+    #   encryption context to encrypt data, you must specify the same (an
+    #   exact case-sensitive match) encryption context to decrypt the data. An
+    #   encryption context is optional when encrypting with a symmetric CMK,
+    #   but it is highly recommended.
+    #
+    #   For more information, see [Encryption Context][1] in the *AWS Key
+    #   Management Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
+    #
+    # @option params [String] :source_key_id
+    #   A unique identifier for the CMK that is used to decrypt the ciphertext
+    #   before it reencrypts it using the destination CMK.
+    #
+    #   This parameter is required only when the ciphertext was encrypted
+    #   under an asymmetric CMK. Otherwise, AWS KMS uses the metadata that it
+    #   adds to the ciphertext blob to determine which CMK was used to encrypt
+    #   the ciphertext. However, you can use this parameter to ensure that a
+    #   particular CMK (of any kind) is used to decrypt the ciphertext before
+    #   it is reencrypted.
+    #
+    #   If you specify a `KeyId` value, the decrypt part of the `ReEncrypt`
+    #   operation succeeds only if the specified CMK was used to encrypt the
+    #   ciphertext.
+    #
+    #   To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
+    #   name, or alias ARN. When using an alias name, prefix it with
+    #   `"alias/"`.
+    #
+    #   For example:
+    #
+    #   * Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Key ARN:
+    #     `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Alias name: `alias/ExampleAlias`
+    #
+    #   * Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
+    #
+    #   To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.
+    #   To get the alias name and alias ARN, use ListAliases.
     #
     # @option params [required, String] :destination_key_id
     #   A unique identifier for the CMK that is used to reencrypt the data.
+    #   Specify a symmetric or asymmetric CMK with a `KeyUsage` value of
+    #   `ENCRYPT_DECRYPT`. To find the `KeyUsage` value of a CMK, use the
+    #   DescribeKey operation.
     #
     #   To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
     #   name, or alias ARN. When using an alias name, prefix it with
@@ -3381,7 +4363,46 @@ module Aws::KMS
     #   To get the alias name and alias ARN, use ListAliases.
     #
     # @option params [Hash<String,String>] :destination_encryption_context
-    #   Encryption context to use when the data is reencrypted.
+    #   Specifies that encryption context to use when the reencrypting the
+    #   data.
+    #
+    #   A destination encryption context is valid only when the destination
+    #   CMK is a symmetric CMK. The standard ciphertext format for asymmetric
+    #   CMKs does not include fields for metadata.
+    #
+    #   An *encryption context* is a collection of non-secret key-value pairs
+    #   that represents additional authenticated data. When you use an
+    #   encryption context to encrypt data, you must specify the same (an
+    #   exact case-sensitive match) encryption context to decrypt the data. An
+    #   encryption context is optional when encrypting with a symmetric CMK,
+    #   but it is highly recommended.
+    #
+    #   For more information, see [Encryption Context][1] in the *AWS Key
+    #   Management Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
+    #
+    # @option params [String] :source_encryption_algorithm
+    #   Specifies the encryption algorithm that AWS KMS will use to decrypt
+    #   the ciphertext before it is reencrypted. The default value,
+    #   `SYMMETRIC_DEFAULT`, represents the algorithm used for symmetric CMKs.
+    #
+    #   Specify the same algorithm that was used to encrypt the ciphertext. If
+    #   you specify a different algorithm, the decrypt attempt fails.
+    #
+    #   This parameter is required only when the ciphertext was encrypted
+    #   under an asymmetric CMK.
+    #
+    # @option params [String] :destination_encryption_algorithm
+    #   Specifies the encryption algorithm that AWS KMS will use to reecrypt
+    #   the data after it has decrypted it. The default value,
+    #   `SYMMETRIC_DEFAULT`, represents the encryption algorithm used for
+    #   symmetric CMKs.
+    #
+    #   This parameter is required only when the destination CMK is an
+    #   asymmetric CMK.
     #
     # @option params [Array<String>] :grant_tokens
     #   A list of grant tokens.
@@ -3398,6 +4419,8 @@ module Aws::KMS
     #   * {Types::ReEncryptResponse#ciphertext_blob #ciphertext_blob} => String
     #   * {Types::ReEncryptResponse#source_key_id #source_key_id} => String
     #   * {Types::ReEncryptResponse#key_id #key_id} => String
+    #   * {Types::ReEncryptResponse#source_encryption_algorithm #source_encryption_algorithm} => String
+    #   * {Types::ReEncryptResponse#destination_encryption_algorithm #destination_encryption_algorithm} => String
     #
     #
     # @example Example: To reencrypt data
@@ -3423,10 +4446,13 @@ module Aws::KMS
     #     source_encryption_context: {
     #       "EncryptionContextKey" => "EncryptionContextValue",
     #     },
+    #     source_key_id: "KeyIdType",
     #     destination_key_id: "KeyIdType", # required
     #     destination_encryption_context: {
     #       "EncryptionContextKey" => "EncryptionContextValue",
     #     },
+    #     source_encryption_algorithm: "SYMMETRIC_DEFAULT", # accepts SYMMETRIC_DEFAULT, RSAES_OAEP_SHA_1, RSAES_OAEP_SHA_256
+    #     destination_encryption_algorithm: "SYMMETRIC_DEFAULT", # accepts SYMMETRIC_DEFAULT, RSAES_OAEP_SHA_1, RSAES_OAEP_SHA_256
     #     grant_tokens: ["GrantTokenType"],
     #   })
     #
@@ -3435,6 +4461,8 @@ module Aws::KMS
     #   resp.ciphertext_blob #=> String
     #   resp.source_key_id #=> String
     #   resp.key_id #=> String
+    #   resp.source_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256"
+    #   resp.destination_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256"
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncrypt AWS API Documentation
     #
@@ -3591,9 +4619,9 @@ module Aws::KMS
     # [Deleting Customer Master Keys][3] in the *AWS Key Management Service
     # Developer Guide*.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][4]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][4] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
@@ -3665,6 +4693,138 @@ module Aws::KMS
       req.send_request(options)
     end
 
+    # Creates a [digital signature][1] for a message or message digest by
+    # using the private key in an asymmetric CMK. To verify the signature,
+    # use the Verify operation, or use the public key in the same asymmetric
+    # CMK outside of AWS KMS. For information about symmetric and asymmetric
+    # CMKs, see [Using Symmetric and Asymmetric CMKs][2] in the *AWS Key
+    # Management Service Developer Guide*.
+    #
+    # Digital signatures are generated and verified by using asymmetric key
+    # pair, such as an RSA or ECC pair that is represented by an asymmetric
+    # customer master key (CMK). The key owner (or an authorized user) uses
+    # their private key to sign a message. Anyone with the public key can
+    # verify that the message was signed with that particular private key
+    # and that the message hasn't changed since it was signed.
+    #
+    # To use the `Sign` operation, provide the following information:
+    #
+    # * Use the `KeyId` parameter to identify an asymmetric CMK with a
+    #   `KeyUsage` value of `SIGN_VERIFY`. To get the `KeyUsage` value of a
+    #   CMK, use the DescribeKey operation. The caller must have `kms:Sign`
+    #   permission on the CMK.
+    #
+    # * Use the `Message` parameter to specify the message or message digest
+    #   to sign. You can submit messages of up to 4096 bytes. To sign a
+    #   larger message, generate a hash digest of the message, and then
+    #   provide the hash digest in the `Message` parameter. To indicate
+    #   whether the message is a full message or a digest, use the
+    #   `MessageType` parameter.
+    #
+    # * Choose a signing algorithm that is compatible with the CMK.
+    #
+    # When signing a message, be sure to record the CMK and the signing
+    # algorithm. This information is required to verify the signature.
+    #
+    # To verify the signature that this operation generates, use the Verify
+    # operation. Or use the GetPublicKey operation to download the public
+    # key and then use the public key to verify the signature outside of AWS
+    # KMS.
+    #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][3] in the *AWS Key Management Service Developer Guide*.
+    #
+    #
+    #
+    # [1]: https://en.wikipedia.org/wiki/Digital_signature
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
+    # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    #
+    # @option params [required, String] :key_id
+    #   Identifies an asymmetric CMK. AWS KMS uses the private key in the
+    #   asymmetric CMK to sign the message. The `KeyUsage` type of the CMK
+    #   must be `SIGN_VERIFY`. To find the `KeyUsage` of a CMK, use the
+    #   DescribeKey operation.
+    #
+    #   To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
+    #   name, or alias ARN. When using an alias name, prefix it with
+    #   `"alias/"`. To specify a CMK in a different AWS account, you must use
+    #   the key ARN or alias ARN.
+    #
+    #   For example:
+    #
+    #   * Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Key ARN:
+    #     `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Alias name: `alias/ExampleAlias`
+    #
+    #   * Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
+    #
+    #   To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.
+    #   To get the alias name and alias ARN, use ListAliases.
+    #
+    # @option params [required, String, IO] :message
+    #   Specifies the message or message digest to sign. Messages can be
+    #   0-4096 bytes. To sign a larger message, provide the message digest.
+    #
+    #   If you provide a message, AWS KMS generates a hash digest of the
+    #   message and then signs it.
+    #
+    # @option params [String] :message_type
+    #   Tells AWS KMS whether the value of the `Message` parameter is a
+    #   message or message digest. To indicate a message, enter `RAW`. To
+    #   indicate a message digest, enter `DIGEST`.
+    #
+    # @option params [Array<String>] :grant_tokens
+    #   A list of grant tokens.
+    #
+    #   For more information, see [Grant Tokens][1] in the *AWS Key Management
+    #   Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
+    #
+    # @option params [required, String] :signing_algorithm
+    #   Specifies the signing algorithm to use when signing the message.
+    #
+    #   Choose an algorithm that is compatible with the type and size of the
+    #   specified asymmetric CMK.
+    #
+    # @return [Types::SignResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::SignResponse#key_id #key_id} => String
+    #   * {Types::SignResponse#signature #signature} => String
+    #   * {Types::SignResponse#signing_algorithm #signing_algorithm} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.sign({
+    #     key_id: "KeyIdType", # required
+    #     message: "data", # required
+    #     message_type: "RAW", # accepts RAW, DIGEST
+    #     grant_tokens: ["GrantTokenType"],
+    #     signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.key_id #=> String
+    #   resp.signature #=> String
+    #   resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Sign AWS API Documentation
+    #
+    # @overload sign(params = {})
+    # @param [Hash] params ({})
+    def sign(params = {}, options = {})
+      req = build_request(:sign, params)
+      req.send_request(options)
+    end
+
     # Adds or edits tags for a customer master key (CMK). You cannot perform
     # this operation on a CMK in a different AWS account.
     #
@@ -3679,9 +4839,9 @@ module Aws::KMS
     # see [User-Defined Tag Restrictions][1] in the *AWS Billing and Cost
     # Management User Guide*.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][2] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
@@ -3750,9 +4910,9 @@ module Aws::KMS
     # To remove a tag, specify the tag key. To change the tag value of an
     # existing tag key, use TagResource.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][1]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][1] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
@@ -3806,14 +4966,22 @@ module Aws::KMS
       req.send_request(options)
     end
 
-    # Associates an existing alias with a different customer master key
-    # (CMK). Each CMK can have multiple aliases, but the aliases must be
-    # unique within the account and region. You cannot perform this
+    # Associates an existing AWS KMS alias with a different customer master
+    # key (CMK). Each alias is associated with only one CMK at a time,
+    # although a CMK can have multiple aliases. The alias and the CMK must
+    # be in the same AWS account and region. You cannot perform this
     # operation on an alias in a different AWS account.
     #
-    # This operation works only on existing aliases. To change the alias of
-    # a CMK to a new value, use CreateAlias to create a new alias and
-    # DeleteAlias to delete the old alias.
+    # The current and new CMK must be the same type (both symmetric or both
+    # asymmetric), and they must have the same key usage (`ENCRYPT_DECRYPT`
+    # or `SIGN_VERIFY`). This restriction prevents errors in code that uses
+    # aliases. If you must assign an alias to a different type of CMK, use
+    # DeleteAlias to delete the old alias and CreateAlias to create a new
+    # alias.
+    #
+    # You cannot use `UpdateAlias` to change an alias name. To change an
+    # alias name, use DeleteAlias to delete the old alias and CreateAlias to
+    # create a new alias.
     #
     # Because an alias is not a property of a CMK, you can create, update,
     # and delete the aliases of a CMK without affecting the CMK. Also,
@@ -3821,29 +4989,28 @@ module Aws::KMS
     # To get the aliases of all CMKs in the account, use the ListAliases
     # operation.
     #
-    # The alias name must begin with `alias/` followed by a name, such as
-    # `alias/ExampleAlias`. It can contain only alphanumeric characters,
-    # forward slashes (/), underscores (\_), and dashes (-). The alias name
-    # cannot begin with `alias/aws/`. The `alias/aws/` prefix is reserved
-    # for [AWS managed CMKs][1].
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][1] in the *AWS Key Management Service Developer Guide*.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][2]
-    # in the *AWS Key Management Service Developer Guide*.
     #
     #
-    #
-    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
-    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
     #
     # @option params [required, String] :alias_name
-    #   Specifies the name of the alias to change. This value must begin with
-    #   `alias/` followed by the alias name, such as `alias/ExampleAlias`.
+    #   Identifies the alias that is changing its CMK. This value must begin
+    #   with `alias/` followed by the alias name, such as
+    #   `alias/ExampleAlias`. You cannot use UpdateAlias to change the alias
+    #   name.
     #
     # @option params [required, String] :target_key_id
-    #   Unique identifier of the customer master key (CMK) to be mapped to the
-    #   alias. When the update operation completes, the alias will point to
-    #   this CMK.
+    #   Identifies the CMK to associate with the alias. When the update
+    #   operation completes, the alias will point to this CMK.
+    #
+    #   The CMK must be in the same AWS account and Region as the alias. Also,
+    #   the new target CMK must be the same type as the current target CMK
+    #   (both symmetric or both asymmetric) and they must have the same key
+    #   usage.
     #
     #   Specify the key ID or the Amazon Resource Name (ARN) of the CMK.
     #
@@ -3994,9 +5161,9 @@ module Aws::KMS
     #
     # You cannot perform this operation on a CMK in a different AWS account.
     #
-    # The result of this operation varies with the key state of the CMK. For
-    # details, see [How Key State Affects Use of a Customer Master Key][1]
-    # in the *AWS Key Management Service Developer Guide*.
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][1] in the *AWS Key Management Service Developer Guide*.
     #
     #
     #
@@ -4047,6 +5214,138 @@ module Aws::KMS
       req.send_request(options)
     end
 
+    # Verifies a digital signature that was generated by the Sign operation.
+    # This operation requires an asymmetric CMK with a `KeyUsage` value of
+    # `SIGN_VERIFY`.
+    #
+    #
+    #
+    # Verification confirms that an authorized user signed the message with
+    # the specified key and signing algorithm, and the message hasn't
+    # changed since it was signed. A digital signature is generated by using
+    # the private key in an asymmetric CMK. The signature is verified by
+    # using the public key in the same asymmetric CMK. For information about
+    # symmetric and asymmetric CMKs, see [Using Symmetric and Asymmetric
+    # CMKs][1] in the *AWS Key Management Service Developer Guide*.
+    #
+    # To verify a digital signature, you can use the `Verify` operation.
+    # Specify the same asymmetric CMK that was used by the `Sign` operation
+    # to generate the digital signature.
+    #
+    # You can also verify the digital signature by using the public key of
+    # the CMK outside of AWS KMS. Use the GetPublicKey operation to download
+    # the public key in the asymmetric CMK and then use the public key to
+    # verify the signature outside of AWS KMS.
+    #
+    # The advantage of using the `Verify` operation is that it is performed
+    # within AWS KMS. As a result, it's easy to call, the operation is
+    # performed within the FIPS boundary, it is logged in AWS CloudTrail,
+    # and you can use key policy and IAM policy to determine who is
+    # authorized to use the CMK to verify signatures.
+    #
+    # The result of the `Verify` operation, which is represented by its HTTP
+    # status code, does not indicate whether the signature verification
+    # succeeded or failed. To determine whether the signature was verified,
+    # see the `SignatureValid` field in the response.
+    #
+    # The CMK that you use for this operation must be in a compatible key
+    # state. For details, see [How Key State Affects Use of a Customer
+    # Master Key][2] in the *AWS Key Management Service Developer Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
+    #
+    # @option params [required, String] :key_id
+    #   Identifies the asymmetric CMK that will be used to verify the
+    #   signature. This must be the same CMK that was used to generate the
+    #   signature. If you specify a different CMK, the value of the
+    #   `SignatureValid` field in the response will be `False`.
+    #
+    #   To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
+    #   name, or alias ARN. When using an alias name, prefix it with
+    #   `"alias/"`. To specify a CMK in a different AWS account, you must use
+    #   the key ARN or alias ARN.
+    #
+    #   For example:
+    #
+    #   * Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Key ARN:
+    #     `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    #
+    #   * Alias name: `alias/ExampleAlias`
+    #
+    #   * Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
+    #
+    #   To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey.
+    #   To get the alias name and alias ARN, use ListAliases.
+    #
+    # @option params [required, String, IO] :message
+    #   Specifies the message that was signed, or a hash digest of that
+    #   message. Messages can be 0-4096 bytes. To verify a larger message,
+    #   provide a hash digest of the message.
+    #
+    #   If the digest of the message specified here is different from the
+    #   message digest that was signed, the `SignatureValid` value in the
+    #   response will be `False`.
+    #
+    # @option params [String] :message_type
+    #   Tells AWS KMS whether the value of the `Message` parameter is a
+    #   message or message digest. To indicate a message, enter `RAW`. To
+    #   indicate a message digest, enter `DIGEST`.
+    #
+    # @option params [required, String, IO] :signature
+    #   The signature that the `Sign` operation generated.
+    #
+    # @option params [required, String] :signing_algorithm
+    #   The signing algorithm that was used to sign the message. If you submit
+    #   a different algorithm, the value of the `SignatureValid` field in the
+    #   response will be `False`.
+    #
+    # @option params [Array<String>] :grant_tokens
+    #   A list of grant tokens.
+    #
+    #   For more information, see [Grant Tokens][1] in the *AWS Key Management
+    #   Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token
+    #
+    # @return [Types::VerifyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::VerifyResponse#key_id #key_id} => String
+    #   * {Types::VerifyResponse#signature_valid #signature_valid} => Boolean
+    #   * {Types::VerifyResponse#signing_algorithm #signing_algorithm} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.verify({
+    #     key_id: "KeyIdType", # required
+    #     message: "data", # required
+    #     message_type: "RAW", # accepts RAW, DIGEST
+    #     signature: "data", # required
+    #     signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512
+    #     grant_tokens: ["GrantTokenType"],
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.key_id #=> String
+    #   resp.signature_valid #=> Boolean
+    #   resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Verify AWS API Documentation
+    #
+    # @overload verify(params = {})
+    # @param [Hash] params ({})
+    def verify(params = {}, options = {})
+      req = build_request(:verify, params)
+      req.send_request(options)
+    end
+
     # @!endgroup
 
     # @param params ({})
@@ -4060,7 +5359,7 @@ module Aws::KMS
         params: params,
         config: config)
       context[:gem_name] = 'aws-sdk-kms'
-      context[:gem_version] = '1.25.0'
+      context[:gem_version] = '1.26.0'
       Seahorse::Client::Request.new(handlers, context)
     end