aws-sdk-kms 1.94.0 → 1.118.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +120 -0
  3. data/VERSION +1 -1
  4. data/lib/aws-sdk-kms/client.rb +1152 -777
  5. data/lib/aws-sdk-kms/client_api.rb +41 -4
  6. data/lib/aws-sdk-kms/customizations.rb +0 -8
  7. data/lib/aws-sdk-kms/endpoint_parameters.rb +13 -10
  8. data/lib/aws-sdk-kms/endpoint_provider.rb +13 -17
  9. data/lib/aws-sdk-kms/endpoints.rb +2 -581
  10. data/lib/aws-sdk-kms/plugins/endpoints.rb +1 -112
  11. data/lib/aws-sdk-kms/types.rb +707 -330
  12. data/lib/aws-sdk-kms.rb +1 -1
  13. data/sig/client.rbs +41 -17
  14. data/sig/resource.rbs +3 -0
  15. data/sig/types.rbs +47 -16
  16. metadata +6 -9
data/lib/aws-sdk-kms/types.rb CHANGED
@@ -291,7 +291,7 @@ module Aws::KMS
291
291
  #
292
292
  #
293
293
  #
294
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
294
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
295
295
  # @return [String]
296
296
  #
297
297
  # @!attribute [rw] target_key_id
@@ -301,7 +301,7 @@ module Aws::KMS
301
301
  # A valid key ID is required. If you supply a null or empty string
302
302
  # value, this operation returns an error.
303
303
  #
304
- # For help finding the key ID and ARN, see [Finding the Key ID and
304
+ # For help finding the key ID and ARN, see [Find the key ID and key
305
305
  # ARN][2] in the <i> <i>Key Management Service Developer Guide</i>
306
306
  # </i>.
307
307
  #
@@ -319,8 +319,8 @@ module Aws::KMS
319
319
  #
320
320
  #
321
321
  #
322
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
323
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn
322
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
323
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html
324
324
  # @return [String]
325
325
  #
326
326
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateAliasRequest AWS API Documentation
@@ -387,7 +387,7 @@ module Aws::KMS
387
387
  #
388
388
  #
389
389
  #
390
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
390
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
391
391
  # @return [String]
392
392
  #
393
393
  # @!attribute [rw] custom_key_store_type
@@ -485,6 +485,14 @@ module Aws::KMS
485
485
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keystore.html#xks-requirements
486
486
  # @return [String]
487
487
  #
488
+ # @!attribute [rw] xks_proxy_vpc_endpoint_service_owner
489
+ # Specifies the Amazon Web Services account ID that owns the Amazon
490
+ # VPC service endpoint for the interface that is used to communicate
491
+ # with your external key store proxy (XKS proxy). This parameter is
492
+ # optional. If not provided, the Amazon Web Services account ID
493
+ # calling the action will be used.
494
+ # @return [String]
495
+ #
488
496
  # @!attribute [rw] xks_proxy_authentication_credential
489
497
  # Specifies an authentication credential for the external key store
490
498
  # proxy (XKS proxy). This parameter is required for all custom key
@@ -494,7 +502,7 @@ module Aws::KMS
494
502
  # `RawSecretAccessKey`, a secret key, and `AccessKeyId`, a unique
495
503
  # identifier for the `RawSecretAccessKey`. For character requirements,
496
504
  # see
497
- # [XksProxyAuthenticationCredentialType](kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html).
505
+ # [XksProxyAuthenticationCredentialType](API_XksProxyAuthenticationCredentialType.html).
498
506
  #
499
507
  # KMS uses this authentication credential to sign requests to the
500
508
  # external key store proxy on your behalf. This credential is
@@ -535,7 +543,7 @@ module Aws::KMS
535
543
  #
536
544
  #
537
545
  #
538
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity
546
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/choose-xks-connectivity.html
539
547
  # @return [String]
540
548
  #
541
549
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateCustomKeyStoreRequest AWS API Documentation
@@ -549,6 +557,7 @@ module Aws::KMS
549
557
  :xks_proxy_uri_endpoint,
550
558
  :xks_proxy_uri_path,
551
559
  :xks_proxy_vpc_endpoint_service_name,
560
+ :xks_proxy_vpc_endpoint_service_owner,
552
561
  :xks_proxy_authentication_credential,
553
562
  :xks_proxy_connectivity)
554
563
  SENSITIVE = [:key_store_password]
@@ -621,7 +630,7 @@ module Aws::KMS
621
630
  #
622
631
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
623
632
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns
624
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
633
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
625
634
  # @return [String]
626
635
  #
627
636
  # @!attribute [rw] operations
@@ -694,7 +703,7 @@ module Aws::KMS
694
703
  #
695
704
  #
696
705
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
697
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
706
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
698
707
  # @return [Array<String>]
699
708
  #
700
709
  # @!attribute [rw] name
@@ -722,12 +731,12 @@ module Aws::KMS
722
731
  # Checks if your request will succeed. `DryRun` is an optional
723
732
  # parameter.
724
733
  #
725
- # To learn more about how to use this parameter, see [Testing your KMS
726
- # API calls][1] in the *Key Management Service Developer Guide*.
734
+ # To learn more about how to use this parameter, see [Testing your
735
+ # permissions][1] in the *Key Management Service Developer Guide*.
727
736
  #
728
737
  #
729
738
  #
730
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
739
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
731
740
  # @return [Boolean]
732
741
  #
733
742
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateGrantRequest AWS API Documentation
@@ -756,7 +765,7 @@ module Aws::KMS
756
765
  #
757
766
  #
758
767
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
759
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
768
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
760
769
  # @return [String]
761
770
  #
762
771
  # @!attribute [rw] grant_id
@@ -796,22 +805,38 @@ module Aws::KMS
796
805
  # that I make are not always immediately visible][2] in the *Amazon
797
806
  # Web Services Identity and Access Management User Guide*.
798
807
  #
808
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are
809
+ # missing from a key policy statement, the policy statement has no
810
+ # effect. When a key policy statement is missing one of these
811
+ # elements, the KMS console correctly reports an error, but the
812
+ # `CreateKey` and `PutKeyPolicy` API requests succeed, even though the
813
+ # policy statement is ineffective.
814
+ #
815
+ # For more information on required key policy elements, see [Elements
816
+ # in a key policy][3] in the *Key Management Service Developer Guide*.
817
+ #
818
+ # </note>
819
+ #
799
820
  # If you do not provide a key policy, KMS attaches a default key
800
821
  # policy to the KMS key. For more information, see [Default key
801
- # policy][3] in the *Key Management Service Developer Guide*.
822
+ # policy][4] in the *Key Management Service Developer Guide*.
802
823
  #
803
- # The key policy size quota is 32 kilobytes (32768 bytes).
824
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
825
+ # `LimitExceededException`.
826
+ #
827
+ # </note>
804
828
  #
805
829
  # For help writing and formatting a JSON policy document, see the [IAM
806
- # JSON Policy Reference][4] in the <i> <i>Identity and Access
830
+ # JSON Policy Reference][5] in the <i> <i>Identity and Access
807
831
  # Management User Guide</i> </i>.
808
832
  #
809
833
  #
810
834
  #
811
835
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
812
836
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
813
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
814
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
837
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
838
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
839
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
815
840
  # @return [String]
816
841
  #
817
842
  # @!attribute [rw] description
@@ -831,8 +856,11 @@ module Aws::KMS
831
856
  # Determines the [cryptographic operations][1] for which you can use
832
857
  # the KMS key. The default value is `ENCRYPT_DECRYPT`. This parameter
833
858
  # is optional when you are creating a symmetric encryption KMS key;
834
- # otherwise, it is required. You can't change the `KeyUsage` value
835
- # after the KMS key is created.
859
+ # otherwise, it is required. You can't change the [ `KeyUsage` ][2]
860
+ # value after the KMS key is created. Each KMS key can have only one
861
+ # key usage. This follows key usage best practices according to [NIST
862
+ # SP 800-57 Recommendations for Key Management][3], section 5.2, Key
863
+ # usage.
836
864
  #
837
865
  # Select only one valid value.
838
866
  #
@@ -844,10 +872,13 @@ module Aws::KMS
844
872
  # * For asymmetric KMS keys with RSA key pairs, specify
845
873
  # `ENCRYPT_DECRYPT` or `SIGN_VERIFY`.
846
874
  #
847
- # * For asymmetric KMS keys with NIST-recommended elliptic curve key
875
+ # * For asymmetric KMS keys with NIST-standard elliptic curve key
848
876
  # pairs, specify `SIGN_VERIFY` or `KEY_AGREEMENT`.
849
877
  #
850
- # * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs specify
878
+ # * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs, specify
879
+ # `SIGN_VERIFY`.
880
+ #
881
+ # * For asymmetric KMS keys with ML-DSA key pairs, specify
851
882
  # `SIGN_VERIFY`.
852
883
  #
853
884
  # * For asymmetric KMS keys with SM2 key pairs (China Regions only),
@@ -855,7 +886,9 @@ module Aws::KMS
855
886
  #
856
887
  #
857
888
  #
858
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
889
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
890
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html#key-usage
891
+ # [3]: https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final
859
892
  # @return [String]
860
893
  #
861
894
  # @!attribute [rw] customer_master_key_spec
@@ -872,8 +905,8 @@ module Aws::KMS
872
905
  # `SYMMETRIC_DEFAULT`, creates a KMS key with a 256-bit AES-GCM key
873
906
  # that is used for encryption and decryption, except in China Regions,
874
907
  # where it creates a 128-bit symmetric key that uses SM4 encryption.
875
- # For help choosing a key spec for your KMS key, see [Choosing a KMS
876
- # key type][1] in the <i> <i>Key Management Service Developer
908
+ # For a detailed description of all supported key specs, see [Key spec
909
+ # reference][1] in the <i> <i>Key Management Service Developer
877
910
  # Guide</i> </i>.
878
911
  #
879
912
  # The `KeySpec` determines whether the KMS key contains a symmetric
@@ -882,10 +915,11 @@ module Aws::KMS
882
915
  # KMS key is created. To further restrict the algorithms that can be
883
916
  # used with the KMS key, use a condition key in its key policy or IAM
884
917
  # policy. For more information, see [kms:EncryptionAlgorithm][2],
885
- # [kms:MacAlgorithm][3] or [kms:Signing Algorithm][4] in the <i>
886
- # <i>Key Management Service Developer Guide</i> </i>.
918
+ # [kms:MacAlgorithm][3], [kms:KeyAgreementAlgorithm][4], or
919
+ # [kms:SigningAlgorithm][5] in the <i> <i>Key Management Service
920
+ # Developer Guide</i> </i>.
887
921
  #
888
- # [Amazon Web Services services that are integrated with KMS][5] use
922
+ # [Amazon Web Services services that are integrated with KMS][6] use
889
923
  # symmetric encryption KMS keys to protect your data. These services
890
924
  # do not support asymmetric KMS keys or HMAC KMS keys.
891
925
  #
@@ -896,7 +930,6 @@ module Aws::KMS
896
930
  # * `SYMMETRIC_DEFAULT`
897
931
  #
898
932
  # ^
899
- #
900
933
  # * HMAC keys (symmetric)
901
934
  #
902
935
  # * `HMAC_224`
@@ -906,7 +939,6 @@ module Aws::KMS
906
939
  # * `HMAC_384`
907
940
  #
908
941
  # * `HMAC_512`
909
- #
910
942
  # * Asymmetric RSA key pairs (encryption and decryption -or- signing
911
943
  # and verification)
912
944
  #
@@ -915,8 +947,7 @@ module Aws::KMS
915
947
  # * `RSA_3072`
916
948
  #
917
949
  # * `RSA_4096`
918
- #
919
- # * Asymmetric NIST-recommended elliptic curve key pairs (signing and
950
+ # * Asymmetric NIST-standard elliptic curve key pairs (signing and
920
951
  # verification -or- deriving shared secrets)
921
952
  #
922
953
  # * `ECC_NIST_P256` (secp256r1)
@@ -925,6 +956,18 @@ module Aws::KMS
925
956
  #
926
957
  # * `ECC_NIST_P521` (secp521r1)
927
958
  #
959
+ # * `ECC_NIST_EDWARDS25519` (ed25519) - signing and verification
960
+ # only
961
+ #
962
+ # * **Note:** For ECC\_NIST\_EDWARDS25519 KMS keys, the
963
+ # ED25519\_SHA\_512 signing algorithm requires [
964
+ # `MessageType:RAW`
965
+ # ](kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType),
966
+ # while ED25519\_PH\_SHA\_512 requires [ `MessageType:DIGEST`
967
+ # ](kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType).
968
+ # These message types cannot be used interchangeably.
969
+ #
970
+ # ^
928
971
  # * Other asymmetric elliptic curve key pairs (signing and
929
972
  # verification)
930
973
  #
@@ -932,7 +975,13 @@ module Aws::KMS
932
975
  # cryptocurrencies.
933
976
  #
934
977
  # ^
978
+ # * Asymmetric ML-DSA key pairs (signing and verification)
979
+ #
980
+ # * `ML_DSA_44`
935
981
  #
982
+ # * `ML_DSA_65`
983
+ #
984
+ # * `ML_DSA_87`
936
985
  # * SM2 key pairs (encryption and decryption -or- signing and
937
986
  # verification -or- deriving shared secrets)
938
987
  #
@@ -942,11 +991,12 @@ module Aws::KMS
942
991
  #
943
992
  #
944
993
  #
945
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose
946
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm
947
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm
948
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm
949
- # [5]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
994
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html
995
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-algorithm
996
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-mac-algorithm
997
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-agreement-algorithm
998
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-signing-algorithm
999
+ # [6]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
950
1000
  # @return [String]
951
1001
  #
952
1002
  # @!attribute [rw] origin
@@ -999,7 +1049,7 @@ module Aws::KMS
999
1049
  #
1000
1050
  #
1001
1051
  #
1002
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1052
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1003
1053
  # @return [String]
1004
1054
  #
1005
1055
  # @!attribute [rw] bypass_policy_lockout_safety_check
@@ -1050,7 +1100,7 @@ module Aws::KMS
1050
1100
  # When you add tags to an Amazon Web Services resource, Amazon Web
1051
1101
  # Services generates a cost allocation report with usage and costs
1052
1102
  # aggregated by tags. Tags can also be used to control access to a KMS
1053
- # key. For details, see [Tagging Keys][3].
1103
+ # key. For details, see [Tags in KMS][3].
1054
1104
  #
1055
1105
  #
1056
1106
  #
@@ -1123,7 +1173,7 @@ module Aws::KMS
1123
1173
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
1124
1174
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1125
1175
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy
1126
- # [4]: https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements
1176
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html#xks-key-requirements
1127
1177
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption
1128
1178
  # @return [String]
1129
1179
  #
@@ -1452,7 +1502,6 @@ module Aws::KMS
1452
1502
  #
1453
1503
  # * The [TLS certificate][6] specifies the private DNS hostname at
1454
1504
  # which the endpoint is reachable.
1455
- #
1456
1505
  # * `XKS_VPC_ENDPOINT_SERVICE_NOT_FOUND` — KMS can't find the VPC
1457
1506
  # endpoint service that it uses to communicate with the external key
1458
1507
  # store proxy. Verify that the `XksProxyVpcEndpointServiceName` is
@@ -1532,8 +1581,8 @@ module Aws::KMS
1532
1581
  #
1533
1582
  #
1534
1583
  #
1535
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
1536
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
1584
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
1585
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
1537
1586
  # @return [Hash<String,String>]
1538
1587
  #
1539
1588
  # @!attribute [rw] grant_tokens
@@ -1547,7 +1596,7 @@ module Aws::KMS
1547
1596
  #
1548
1597
  #
1549
1598
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
1550
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1599
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1551
1600
  # @return [Array<String>]
1552
1601
  #
1553
1602
  # @!attribute [rw] key_id
@@ -1598,42 +1647,44 @@ module Aws::KMS
1598
1647
  #
1599
1648
  # @!attribute [rw] recipient
1600
1649
  # A signed [attestation document][1] from an Amazon Web Services Nitro
1601
- # enclave and the encryption algorithm to use with the enclave's
1602
- # public key. The only valid encryption algorithm is
1603
- # `RSAES_OAEP_SHA_256`.
1650
+ # enclave or NitroTPM, and the encryption algorithm to use with the
1651
+ # public key in the attestation document. The only valid encryption
1652
+ # algorithm is `RSAES_OAEP_SHA_256`.
1604
1653
  #
1605
- # This parameter only supports attestation documents for Amazon Web
1606
- # Services Nitro Enclaves. To include this parameter, use the [Amazon
1607
- # Web Services Nitro Enclaves SDK][2] or any Amazon Web Services SDK.
1654
+ # This parameter supports the [Amazon Web Services Nitro Enclaves
1655
+ # SDK][2] or any Amazon Web Services SDK for Amazon Web Services Nitro
1656
+ # Enclaves. It supports any Amazon Web Services SDK for Amazon Web
1657
+ # Services NitroTPM.
1608
1658
  #
1609
1659
  # When you use this parameter, instead of returning the plaintext
1610
1660
  # data, KMS encrypts the plaintext data with the public key in the
1611
1661
  # attestation document, and returns the resulting ciphertext in the
1612
1662
  # `CiphertextForRecipient` field in the response. This ciphertext can
1613
- # be decrypted only with the private key in the enclave. The
1614
- # `Plaintext` field in the response is null or empty.
1663
+ # be decrypted only with the private key in the attested environment.
1664
+ # The `Plaintext` field in the response is null or empty.
1615
1665
  #
1616
1666
  # For information about the interaction between KMS and Amazon Web
1617
- # Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
1618
- # uses KMS][3] in the *Key Management Service Developer Guide*.
1667
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM, see
1668
+ # [Cryptographic attestation support in KMS][3] in the *Key Management
1669
+ # Service Developer Guide*.
1619
1670
  #
1620
1671
  #
1621
1672
  #
1622
1673
  # [1]: https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave-concepts.html#term-attestdoc
1623
1674
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
1624
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
1675
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
1625
1676
  # @return [Types::RecipientInfo]
1626
1677
  #
1627
1678
  # @!attribute [rw] dry_run
1628
1679
  # Checks if your request will succeed. `DryRun` is an optional
1629
1680
  # parameter.
1630
1681
  #
1631
- # To learn more about how to use this parameter, see [Testing your KMS
1632
- # API calls][1] in the *Key Management Service Developer Guide*.
1682
+ # To learn more about how to use this parameter, see [Testing your
1683
+ # permissions][1] in the *Key Management Service Developer Guide*.
1633
1684
  #
1634
1685
  #
1635
1686
  #
1636
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
1687
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
1637
1688
  # @return [Boolean]
1638
1689
  #
1639
1690
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DecryptRequest AWS API Documentation
@@ -1673,19 +1724,28 @@ module Aws::KMS
1673
1724
  # @return [String]
1674
1725
  #
1675
1726
  # @!attribute [rw] ciphertext_for_recipient
1676
- # The plaintext data encrypted with the public key in the attestation
1677
- # document.
1727
+ # The plaintext data encrypted with the public key from the
1728
+ # attestation document. This ciphertext can be decrypted only by using
1729
+ # a private key from the attested environment.
1678
1730
  #
1679
1731
  # This field is included in the response only when the `Recipient`
1680
1732
  # parameter in the request includes a valid attestation document from
1681
- # an Amazon Web Services Nitro enclave. For information about the
1682
- # interaction between KMS and Amazon Web Services Nitro Enclaves, see
1683
- # [How Amazon Web Services Nitro Enclaves uses KMS][1] in the *Key
1684
- # Management Service Developer Guide*.
1733
+ # an Amazon Web Services Nitro enclave or NitroTPM. For information
1734
+ # about the interaction between KMS and Amazon Web Services Nitro
1735
+ # Enclaves or Amazon Web Services NitroTPM, see [Cryptographic
1736
+ # attestation support in KMS][1] in the *Key Management Service
1737
+ # Developer Guide*.
1685
1738
  #
1686
1739
  #
1687
1740
  #
1688
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
1741
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
1742
+ # @return [String]
1743
+ #
1744
+ # @!attribute [rw] key_material_id
1745
+ # The identifier of the key material used to decrypt the ciphertext.
1746
+ # This field is present only when the operation uses a symmetric
1747
+ # encryption KMS key. This field is omitted if the request includes
1748
+ # the `Recipient` parameter.
1689
1749
  # @return [String]
1690
1750
  #
1691
1751
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DecryptResponse AWS API Documentation
@@ -1694,7 +1754,8 @@ module Aws::KMS
1694
1754
  :key_id,
1695
1755
  :plaintext,
1696
1756
  :encryption_algorithm,
1697
- :ciphertext_for_recipient)
1757
+ :ciphertext_for_recipient,
1758
+ :key_material_id)
1698
1759
  SENSITIVE = [:plaintext]
1699
1760
  include Aws::Structure
1700
1761
  end
@@ -1746,10 +1807,43 @@ module Aws::KMS
1746
1807
  # DescribeKey.
1747
1808
  # @return [String]
1748
1809
  #
1810
+ # @!attribute [rw] key_material_id
1811
+ # Identifies the imported key material you are deleting.
1812
+ #
1813
+ # If no KeyMaterialId is specified, KMS deletes the current key
1814
+ # material.
1815
+ #
1816
+ # To get the list of key material IDs associated with a KMS key, use
1817
+ # ListKeyRotations.
1818
+ # @return [String]
1819
+ #
1749
1820
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterialRequest AWS API Documentation
1750
1821
  #
1751
1822
  class DeleteImportedKeyMaterialRequest < Struct.new(
1752
- :key_id)
1823
+ :key_id,
1824
+ :key_material_id)
1825
+ SENSITIVE = []
1826
+ include Aws::Structure
1827
+ end
1828
+
1829
+ # @!attribute [rw] key_id
1830
+ # The Amazon Resource Name ([key ARN][1]) of the KMS key from which
1831
+ # the key material was deleted.
1832
+ #
1833
+ #
1834
+ #
1835
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
1836
+ # @return [String]
1837
+ #
1838
+ # @!attribute [rw] key_material_id
1839
+ # Identifies the deleted key material.
1840
+ # @return [String]
1841
+ #
1842
+ # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterialResponse AWS API Documentation
1843
+ #
1844
+ class DeleteImportedKeyMaterialResponse < Struct.new(
1845
+ :key_id,
1846
+ :key_material_id)
1753
1847
  SENSITIVE = []
1754
1848
  include Aws::Structure
1755
1849
  end
@@ -1769,7 +1863,7 @@ module Aws::KMS
1769
1863
  end
1770
1864
 
1771
1865
  # @!attribute [rw] key_id
1772
- # Identifies an asymmetric NIST-recommended ECC or SM2 (China Regions
1866
+ # Identifies an asymmetric NIST-standard ECC or SM2 (China Regions
1773
1867
  # only) KMS key. KMS uses the private key in the specified key pair to
1774
1868
  # derive the shared secret. The key usage of the KMS key must be
1775
1869
  # `KEY_AGREEMENT`. To find the `KeyUsage` of a KMS key, use the
@@ -1801,7 +1895,7 @@ module Aws::KMS
1801
1895
  # @return [String]
1802
1896
  #
1803
1897
  # @!attribute [rw] public_key
1804
- # Specifies the public key in your peer's NIST-recommended elliptic
1898
+ # Specifies the public key in your peer's NIST-standard elliptic
1805
1899
  # curve (ECC) or SM2 (China Regions only) key pair.
1806
1900
  #
1807
1901
  # The public key must be a DER-encoded X.509 public key, also known as
@@ -1837,54 +1931,58 @@ module Aws::KMS
1837
1931
  #
1838
1932
  #
1839
1933
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
1840
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1934
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1841
1935
  # @return [Array<String>]
1842
1936
  #
1843
1937
  # @!attribute [rw] dry_run
1844
1938
  # Checks if your request will succeed. `DryRun` is an optional
1845
1939
  # parameter.
1846
1940
  #
1847
- # To learn more about how to use this parameter, see [Testing your KMS
1848
- # API calls][1] in the *Key Management Service Developer Guide*.
1941
+ # To learn more about how to use this parameter, see [Testing your
1942
+ # permissions][1] in the *Key Management Service Developer Guide*.
1849
1943
  #
1850
1944
  #
1851
1945
  #
1852
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
1946
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
1853
1947
  # @return [Boolean]
1854
1948
  #
1855
1949
  # @!attribute [rw] recipient
1856
1950
  # A signed [attestation document][1] from an Amazon Web Services Nitro
1857
- # enclave and the encryption algorithm to use with the enclave's
1858
- # public key. The only valid encryption algorithm is
1859
- # `RSAES_OAEP_SHA_256`.
1951
+ # enclave or NitroTPM, and the encryption algorithm to use with the
1952
+ # public key in the attestation document. The only valid encryption
1953
+ # algorithm is `RSAES_OAEP_SHA_256`.
1860
1954
  #
1861
1955
  # This parameter only supports attestation documents for Amazon Web
1862
- # Services Nitro Enclaves. To call DeriveSharedSecret for an Amazon
1863
- # Web Services Nitro Enclaves, use the [Amazon Web Services Nitro
1864
- # Enclaves SDK][2] to generate the attestation document and then use
1865
- # the Recipient parameter from any Amazon Web Services SDK to provide
1866
- # the attestation document for the enclave.
1956
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM. To call
1957
+ # DeriveSharedSecret generate an attestation document use either
1958
+ # [Amazon Web Services Nitro Enclaves SDK][2] for an Amazon Web
1959
+ # Services Nitro Enclaves or [Amazon Web Services NitroTPM tools][3]
1960
+ # for Amazon Web Services NitroTPM. Then use the Recipient parameter
1961
+ # from any Amazon Web Services SDK to provide the attestation document
1962
+ # for the attested environment.
1867
1963
  #
1868
1964
  # When you use this parameter, instead of returning a plaintext copy
1869
1965
  # of the shared secret, KMS encrypts the plaintext shared secret under
1870
1966
  # the public key in the attestation document, and returns the
1871
1967
  # resulting ciphertext in the `CiphertextForRecipient` field in the
1872
1968
  # response. This ciphertext can be decrypted only with the private key
1873
- # in the enclave. The `CiphertextBlob` field in the response contains
1874
- # the encrypted shared secret derived from the KMS key specified by
1875
- # the `KeyId` parameter and public key specified by the `PublicKey`
1876
- # parameter. The `SharedSecret` field in the response is null or
1877
- # empty.
1969
+ # in the attested environment. The `CiphertextBlob` field in the
1970
+ # response contains the encrypted shared secret derived from the KMS
1971
+ # key specified by the `KeyId` parameter and public key specified by
1972
+ # the `PublicKey` parameter. The `SharedSecret` field in the response
1973
+ # is null or empty.
1878
1974
  #
1879
1975
  # For information about the interaction between KMS and Amazon Web
1880
- # Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
1881
- # uses KMS][3] in the *Key Management Service Developer Guide*.
1976
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM, see
1977
+ # [Cryptographic attestation support in KMS][4] in the *Key Management
1978
+ # Service Developer Guide*.
1882
1979
  #
1883
1980
  #
1884
1981
  #
1885
1982
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc
1886
1983
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
1887
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
1984
+ # [3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attestation-get-doc.html
1985
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
1888
1986
  # @return [Types::RecipientInfo]
1889
1987
  #
1890
1988
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeriveSharedSecretRequest AWS API Documentation
@@ -1913,19 +2011,21 @@ module Aws::KMS
1913
2011
  # @return [String]
1914
2012
  #
1915
2013
  # @!attribute [rw] ciphertext_for_recipient
1916
- # The plaintext shared secret encrypted with the public key in the
1917
- # attestation document.
2014
+ # The plaintext shared secret encrypted with the public key from the
2015
+ # attestation document. This ciphertext can be decrypted only by using
2016
+ # a private key from the attested environment.
1918
2017
  #
1919
2018
  # This field is included in the response only when the `Recipient`
1920
2019
  # parameter in the request includes a valid attestation document from
1921
- # an Amazon Web Services Nitro enclave. For information about the
1922
- # interaction between KMS and Amazon Web Services Nitro Enclaves, see
1923
- # [How Amazon Web Services Nitro Enclaves uses KMS][1] in the *Key
1924
- # Management Service Developer Guide*.
2020
+ # an Amazon Web Services Nitro enclave or NitroTPM. For information
2021
+ # about the interaction between KMS and Amazon Web Services Nitro
2022
+ # Enclaves or Amazon Web Services NitroTPM, see [Cryptographic
2023
+ # attestation support in KMS][1] in the *Key Management Service
2024
+ # Developer Guide*.
1925
2025
  #
1926
2026
  #
1927
2027
  #
1928
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2028
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
1929
2029
  # @return [String]
1930
2030
  #
1931
2031
  # @!attribute [rw] key_agreement_algorithm
@@ -2055,7 +2155,7 @@ module Aws::KMS
2055
2155
  #
2056
2156
  #
2057
2157
  #
2058
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html##aws-managed-cmk
2158
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
2059
2159
  # @return [String]
2060
2160
  #
2061
2161
  # @!attribute [rw] grant_tokens
@@ -2069,7 +2169,7 @@ module Aws::KMS
2069
2169
  #
2070
2170
  #
2071
2171
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2072
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2172
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2073
2173
  # @return [Array<String>]
2074
2174
  #
2075
2175
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeKeyRequest AWS API Documentation
@@ -2140,7 +2240,7 @@ module Aws::KMS
2140
2240
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks
2141
2241
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
2142
2242
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
2143
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
2243
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
2144
2244
  # @return [String]
2145
2245
  #
2146
2246
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DisableKeyRotationRequest AWS API Documentation
@@ -2243,8 +2343,8 @@ module Aws::KMS
2243
2343
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
2244
2344
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
2245
2345
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
2246
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
2247
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
2346
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
2347
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
2248
2348
  # @return [String]
2249
2349
  #
2250
2350
  # @!attribute [rw] rotation_period_in_days
@@ -2330,8 +2430,8 @@ module Aws::KMS
2330
2430
  #
2331
2431
  #
2332
2432
  #
2333
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2334
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2433
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2434
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2335
2435
  # @return [Hash<String,String>]
2336
2436
  #
2337
2437
  # @!attribute [rw] grant_tokens
@@ -2345,7 +2445,7 @@ module Aws::KMS
2345
2445
  #
2346
2446
  #
2347
2447
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2348
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2448
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2349
2449
  # @return [Array<String>]
2350
2450
  #
2351
2451
  # @!attribute [rw] encryption_algorithm
@@ -2365,12 +2465,12 @@ module Aws::KMS
2365
2465
  # Checks if your request will succeed. `DryRun` is an optional
2366
2466
  # parameter.
2367
2467
  #
2368
- # To learn more about how to use this parameter, see [Testing your KMS
2369
- # API calls][1] in the *Key Management Service Developer Guide*.
2468
+ # To learn more about how to use this parameter, see [Testing your
2469
+ # permissions][1] in the *Key Management Service Developer Guide*.
2370
2470
  #
2371
2471
  #
2372
2472
  #
2373
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2473
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2374
2474
  # @return [Boolean]
2375
2475
  #
2376
2476
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/EncryptRequest AWS API Documentation
@@ -2453,7 +2553,7 @@ module Aws::KMS
2453
2553
  #
2454
2554
  #
2455
2555
  #
2456
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2556
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2457
2557
  # @return [Hash<String,String>]
2458
2558
  #
2459
2559
  # @!attribute [rw] key_id
@@ -2487,9 +2587,11 @@ module Aws::KMS
2487
2587
  #
2488
2588
  # The KMS rule that restricts the use of asymmetric RSA and SM2 KMS
2489
2589
  # keys to encrypt and decrypt or to sign and verify (but not both),
2490
- # and the rule that permits you to use ECC KMS keys only to sign and
2491
- # verify, are not effective on data key pairs, which are used outside
2492
- # of KMS. The SM2 key spec is only available in China Regions.
2590
+ # the rule that permits you to use ECC KMS keys only to sign and
2591
+ # verify, and the rule that permits you to use ML-DSA key pairs to
2592
+ # sign and verify only are not effective on data key pairs, which are
2593
+ # used outside of KMS. The SM2 key spec is only available in China
2594
+ # Regions.
2493
2595
  # @return [String]
2494
2596
  #
2495
2597
  # @!attribute [rw] grant_tokens
@@ -2503,53 +2605,57 @@ module Aws::KMS
2503
2605
  #
2504
2606
  #
2505
2607
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2506
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2608
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2507
2609
  # @return [Array<String>]
2508
2610
  #
2509
2611
  # @!attribute [rw] recipient
2510
2612
  # A signed [attestation document][1] from an Amazon Web Services Nitro
2511
- # enclave and the encryption algorithm to use with the enclave's
2512
- # public key. The only valid encryption algorithm is
2513
- # `RSAES_OAEP_SHA_256`.
2613
+ # enclave or NitroTPM, and the encryption algorithm to use with the
2614
+ # public key in the attestation document. The only valid encryption
2615
+ # algorithm is `RSAES_OAEP_SHA_256`.
2514
2616
  #
2515
2617
  # This parameter only supports attestation documents for Amazon Web
2516
- # Services Nitro Enclaves. To call DeriveSharedSecret for an Amazon
2517
- # Web Services Nitro Enclaves, use the [Amazon Web Services Nitro
2518
- # Enclaves SDK][2] to generate the attestation document and then use
2519
- # the Recipient parameter from any Amazon Web Services SDK to provide
2520
- # the attestation document for the enclave.
2618
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM. To call
2619
+ # GenerateDataKeyPair generate an attestation document use either
2620
+ # [Amazon Web Services Nitro Enclaves SDK][2] for an Amazon Web
2621
+ # Services Nitro Enclaves or [Amazon Web Services NitroTPM tools][3]
2622
+ # for Amazon Web Services NitroTPM. Then use the Recipient parameter
2623
+ # from any Amazon Web Services SDK to provide the attestation document
2624
+ # for the attested environment.
2521
2625
  #
2522
2626
  # When you use this parameter, instead of returning a plaintext copy
2523
2627
  # of the private data key, KMS encrypts the plaintext private data key
2524
2628
  # under the public key in the attestation document, and returns the
2525
2629
  # resulting ciphertext in the `CiphertextForRecipient` field in the
2526
2630
  # response. This ciphertext can be decrypted only with the private key
2527
- # in the enclave. The `CiphertextBlob` field in the response contains
2528
- # a copy of the private data key encrypted under the KMS key specified
2529
- # by the `KeyId` parameter. The `PrivateKeyPlaintext` field in the
2530
- # response is null or empty.
2631
+ # in the attested environment. The `CiphertextBlob` field in the
2632
+ # response contains a copy of the private data key encrypted under the
2633
+ # KMS key specified by the `KeyId` parameter. The
2634
+ # `PrivateKeyPlaintext` field in the response is null or empty.
2531
2635
  #
2532
2636
  # For information about the interaction between KMS and Amazon Web
2533
- # Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
2534
- # uses KMS][3] in the *Key Management Service Developer Guide*.
2637
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM, see
2638
+ # [Cryptographic attestation support in KMS][4] in the *Key Management
2639
+ # Service Developer Guide*.
2535
2640
  #
2536
2641
  #
2537
2642
  #
2538
2643
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc
2539
2644
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
2540
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2645
+ # [3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attestation-get-doc.html
2646
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
2541
2647
  # @return [Types::RecipientInfo]
2542
2648
  #
2543
2649
  # @!attribute [rw] dry_run
2544
2650
  # Checks if your request will succeed. `DryRun` is an optional
2545
2651
  # parameter.
2546
2652
  #
2547
- # To learn more about how to use this parameter, see [Testing your KMS
2548
- # API calls][1] in the *Key Management Service Developer Guide*.
2653
+ # To learn more about how to use this parameter, see [Testing your
2654
+ # permissions][1] in the *Key Management Service Developer Guide*.
2549
2655
  #
2550
2656
  #
2551
2657
  #
2552
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2658
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2553
2659
  # @return [Boolean]
2554
2660
  #
2555
2661
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairRequest AWS API Documentation
@@ -2601,19 +2707,24 @@ module Aws::KMS
2601
2707
  #
2602
2708
  # @!attribute [rw] ciphertext_for_recipient
2603
2709
  # The plaintext private data key encrypted with the public key from
2604
- # the Nitro enclave. This ciphertext can be decrypted only by using a
2605
- # private key in the Nitro enclave.
2710
+ # the attestation document. This ciphertext can be decrypted only by
2711
+ # using a private key from the attested environment.
2606
2712
  #
2607
2713
  # This field is included in the response only when the `Recipient`
2608
2714
  # parameter in the request includes a valid attestation document from
2609
- # an Amazon Web Services Nitro enclave. For information about the
2610
- # interaction between KMS and Amazon Web Services Nitro Enclaves, see
2611
- # [How Amazon Web Services Nitro Enclaves uses KMS][1] in the *Key
2612
- # Management Service Developer Guide*.
2715
+ # an Amazon Web Services Nitro enclave or NitroTPM. For information
2716
+ # about the interaction between KMS and Amazon Web Services Nitro
2717
+ # Enclaves or Amazon Web Services NitroTPM, see [Cryptographic
2718
+ # attestation support in KMS][1] in the *Key Management Service
2719
+ # Developer Guide*.
2720
+ #
2613
2721
  #
2614
2722
  #
2723
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
2724
+ # @return [String]
2615
2725
  #
2616
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2726
+ # @!attribute [rw] key_material_id
2727
+ # The identifier of the key material used to encrypt the private key.
2617
2728
  # @return [String]
2618
2729
  #
2619
2730
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairResponse AWS API Documentation
@@ -2624,7 +2735,8 @@ module Aws::KMS
2624
2735
  :public_key,
2625
2736
  :key_id,
2626
2737
  :key_pair_spec,
2627
- :ciphertext_for_recipient)
2738
+ :ciphertext_for_recipient,
2739
+ :key_material_id)
2628
2740
  SENSITIVE = [:private_key_plaintext]
2629
2741
  include Aws::Structure
2630
2742
  end
@@ -2651,7 +2763,7 @@ module Aws::KMS
2651
2763
  #
2652
2764
  #
2653
2765
  #
2654
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2766
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2655
2767
  # @return [Hash<String,String>]
2656
2768
  #
2657
2769
  # @!attribute [rw] key_id
@@ -2685,9 +2797,11 @@ module Aws::KMS
2685
2797
  #
2686
2798
  # The KMS rule that restricts the use of asymmetric RSA and SM2 KMS
2687
2799
  # keys to encrypt and decrypt or to sign and verify (but not both),
2688
- # and the rule that permits you to use ECC KMS keys only to sign and
2689
- # verify, are not effective on data key pairs, which are used outside
2690
- # of KMS. The SM2 key spec is only available in China Regions.
2800
+ # the rule that permits you to use ECC KMS keys only to sign and
2801
+ # verify, and the rule that permits you to use ML-DSA key pairs to
2802
+ # sign and verify only are not effective on data key pairs, which are
2803
+ # used outside of KMS. The SM2 key spec is only available in China
2804
+ # Regions.
2691
2805
  # @return [String]
2692
2806
  #
2693
2807
  # @!attribute [rw] grant_tokens
@@ -2701,19 +2815,19 @@ module Aws::KMS
2701
2815
  #
2702
2816
  #
2703
2817
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2704
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2818
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2705
2819
  # @return [Array<String>]
2706
2820
  #
2707
2821
  # @!attribute [rw] dry_run
2708
2822
  # Checks if your request will succeed. `DryRun` is an optional
2709
2823
  # parameter.
2710
2824
  #
2711
- # To learn more about how to use this parameter, see [Testing your KMS
2712
- # API calls][1] in the *Key Management Service Developer Guide*.
2825
+ # To learn more about how to use this parameter, see [Testing your
2826
+ # permissions][1] in the *Key Management Service Developer Guide*.
2713
2827
  #
2714
2828
  #
2715
2829
  #
2716
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2830
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2717
2831
  # @return [Boolean]
2718
2832
  #
2719
2833
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintextRequest AWS API Documentation
@@ -2753,13 +2867,18 @@ module Aws::KMS
2753
2867
  # The type of data key pair that was generated.
2754
2868
  # @return [String]
2755
2869
  #
2870
+ # @!attribute [rw] key_material_id
2871
+ # The identifier of the key material used to encrypt the private key.
2872
+ # @return [String]
2873
+ #
2756
2874
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintextResponse AWS API Documentation
2757
2875
  #
2758
2876
  class GenerateDataKeyPairWithoutPlaintextResponse < Struct.new(
2759
2877
  :private_key_ciphertext_blob,
2760
2878
  :public_key,
2761
2879
  :key_id,
2762
- :key_pair_spec)
2880
+ :key_pair_spec,
2881
+ :key_material_id)
2763
2882
  SENSITIVE = []
2764
2883
  include Aws::Structure
2765
2884
  end
@@ -2812,7 +2931,7 @@ module Aws::KMS
2812
2931
  #
2813
2932
  #
2814
2933
  #
2815
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2934
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2816
2935
  # @return [Hash<String,String>]
2817
2936
  #
2818
2937
  # @!attribute [rw] number_of_bytes
@@ -2845,18 +2964,19 @@ module Aws::KMS
2845
2964
  #
2846
2965
  #
2847
2966
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2848
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2967
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2849
2968
  # @return [Array<String>]
2850
2969
  #
2851
2970
  # @!attribute [rw] recipient
2852
2971
  # A signed [attestation document][1] from an Amazon Web Services Nitro
2853
- # enclave and the encryption algorithm to use with the enclave's
2854
- # public key. The only valid encryption algorithm is
2855
- # `RSAES_OAEP_SHA_256`.
2972
+ # enclave or NitroTPM, and the encryption algorithm to use with the
2973
+ # public key in the attestation document. The only valid encryption
2974
+ # algorithm is `RSAES_OAEP_SHA_256`.
2856
2975
  #
2857
- # This parameter only supports attestation documents for Amazon Web
2858
- # Services Nitro Enclaves. To include this parameter, use the [Amazon
2859
- # Web Services Nitro Enclaves SDK][2] or any Amazon Web Services SDK.
2976
+ # This parameter supports the [Amazon Web Services Nitro Enclaves
2977
+ # SDK][2] or any Amazon Web Services SDK for Amazon Web Services Nitro
2978
+ # Enclaves. It supports any Amazon Web Services SDK for Amazon Web
2979
+ # Services NitroTPM.
2860
2980
  #
2861
2981
  # When you use this parameter, instead of returning the plaintext data
2862
2982
  # key, KMS encrypts the plaintext data key under the public key in the
@@ -2868,26 +2988,27 @@ module Aws::KMS
2868
2988
  # The `Plaintext` field in the response is null or empty.
2869
2989
  #
2870
2990
  # For information about the interaction between KMS and Amazon Web
2871
- # Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
2872
- # uses KMS][3] in the *Key Management Service Developer Guide*.
2991
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM, see
2992
+ # [Cryptographic attestation support in KMS][3] in the *Key Management
2993
+ # Service Developer Guide*.
2873
2994
  #
2874
2995
  #
2875
2996
  #
2876
2997
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc
2877
2998
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
2878
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2999
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
2879
3000
  # @return [Types::RecipientInfo]
2880
3001
  #
2881
3002
  # @!attribute [rw] dry_run
2882
3003
  # Checks if your request will succeed. `DryRun` is an optional
2883
3004
  # parameter.
2884
3005
  #
2885
- # To learn more about how to use this parameter, see [Testing your KMS
2886
- # API calls][1] in the *Key Management Service Developer Guide*.
3006
+ # To learn more about how to use this parameter, see [Testing your
3007
+ # permissions][1] in the *Key Management Service Developer Guide*.
2887
3008
  #
2888
3009
  #
2889
3010
  #
2890
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3011
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2891
3012
  # @return [Boolean]
2892
3013
  #
2893
3014
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyRequest AWS API Documentation
@@ -2930,20 +3051,27 @@ module Aws::KMS
2930
3051
  # @return [String]
2931
3052
  #
2932
3053
  # @!attribute [rw] ciphertext_for_recipient
2933
- # The plaintext data key encrypted with the public key from the Nitro
2934
- # enclave. This ciphertext can be decrypted only by using a private
2935
- # key in the Nitro enclave.
3054
+ # The plaintext data key encrypted with the public key from the
3055
+ # attestation document. This ciphertext can be decrypted only by using
3056
+ # a private key from the attested environment.
2936
3057
  #
2937
3058
  # This field is included in the response only when the `Recipient`
2938
3059
  # parameter in the request includes a valid attestation document from
2939
- # an Amazon Web Services Nitro enclave. For information about the
2940
- # interaction between KMS and Amazon Web Services Nitro Enclaves, see
2941
- # [How Amazon Web Services Nitro Enclaves uses KMS][1] in the *Key
2942
- # Management Service Developer Guide*.
3060
+ # an Amazon Web Services Nitro enclave or NitroTPM. For information
3061
+ # about the interaction between KMS and Amazon Web Services Nitro
3062
+ # Enclaves or Amazon Web Services NitroTPM, see [Cryptographic
3063
+ # attestation support in KMS][1] in the *Key Management Service
3064
+ # Developer Guide*.
2943
3065
  #
2944
3066
  #
2945
3067
  #
2946
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
3068
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
3069
+ # @return [String]
3070
+ #
3071
+ # @!attribute [rw] key_material_id
3072
+ # The identifier of the key material used to encrypt the data key.
3073
+ # This field is omitted if the request includes the `Recipient`
3074
+ # parameter.
2947
3075
  # @return [String]
2948
3076
  #
2949
3077
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyResponse AWS API Documentation
@@ -2952,7 +3080,8 @@ module Aws::KMS
2952
3080
  :ciphertext_blob,
2953
3081
  :plaintext,
2954
3082
  :key_id,
2955
- :ciphertext_for_recipient)
3083
+ :ciphertext_for_recipient,
3084
+ :key_material_id)
2956
3085
  SENSITIVE = [:plaintext]
2957
3086
  include Aws::Structure
2958
3087
  end
@@ -3005,7 +3134,7 @@ module Aws::KMS
3005
3134
  #
3006
3135
  #
3007
3136
  #
3008
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
3137
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
3009
3138
  # @return [Hash<String,String>]
3010
3139
  #
3011
3140
  # @!attribute [rw] key_spec
@@ -3031,19 +3160,19 @@ module Aws::KMS
3031
3160
  #
3032
3161
  #
3033
3162
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3034
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3163
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3035
3164
  # @return [Array<String>]
3036
3165
  #
3037
3166
  # @!attribute [rw] dry_run
3038
3167
  # Checks if your request will succeed. `DryRun` is an optional
3039
3168
  # parameter.
3040
3169
  #
3041
- # To learn more about how to use this parameter, see [Testing your KMS
3042
- # API calls][1] in the *Key Management Service Developer Guide*.
3170
+ # To learn more about how to use this parameter, see [Testing your
3171
+ # permissions][1] in the *Key Management Service Developer Guide*.
3043
3172
  #
3044
3173
  #
3045
3174
  #
3046
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3175
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
3047
3176
  # @return [Boolean]
3048
3177
  #
3049
3178
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintextRequest AWS API Documentation
@@ -3074,11 +3203,16 @@ module Aws::KMS
3074
3203
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
3075
3204
  # @return [String]
3076
3205
  #
3206
+ # @!attribute [rw] key_material_id
3207
+ # The identifier of the key material used to encrypt the data key.
3208
+ # @return [String]
3209
+ #
3077
3210
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintextResponse AWS API Documentation
3078
3211
  #
3079
3212
  class GenerateDataKeyWithoutPlaintextResponse < Struct.new(
3080
3213
  :ciphertext_blob,
3081
- :key_id)
3214
+ :key_id,
3215
+ :key_material_id)
3082
3216
  SENSITIVE = []
3083
3217
  include Aws::Structure
3084
3218
  end
@@ -3123,19 +3257,19 @@ module Aws::KMS
3123
3257
  #
3124
3258
  #
3125
3259
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3126
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3260
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3127
3261
  # @return [Array<String>]
3128
3262
  #
3129
3263
  # @!attribute [rw] dry_run
3130
3264
  # Checks if your request will succeed. `DryRun` is an optional
3131
3265
  # parameter.
3132
3266
  #
3133
- # To learn more about how to use this parameter, see [Testing your KMS
3134
- # API calls][1] in the *Key Management Service Developer Guide*.
3267
+ # To learn more about how to use this parameter, see [Testing your
3268
+ # permissions][1] in the *Key Management Service Developer Guide*.
3135
3269
  #
3136
3270
  #
3137
3271
  #
3138
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3272
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
3139
3273
  # @return [Boolean]
3140
3274
  #
3141
3275
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateMacRequest AWS API Documentation
@@ -3195,30 +3329,32 @@ module Aws::KMS
3195
3329
  #
3196
3330
  # @!attribute [rw] recipient
3197
3331
  # A signed [attestation document][1] from an Amazon Web Services Nitro
3198
- # enclave and the encryption algorithm to use with the enclave's
3199
- # public key. The only valid encryption algorithm is
3200
- # `RSAES_OAEP_SHA_256`.
3332
+ # enclave or NitroTPM, and the encryption algorithm to use with the
3333
+ # public key in the attestation document. The only valid encryption
3334
+ # algorithm is `RSAES_OAEP_SHA_256`.
3201
3335
  #
3202
- # This parameter only supports attestation documents for Amazon Web
3203
- # Services Nitro Enclaves. To include this parameter, use the [Amazon
3204
- # Web Services Nitro Enclaves SDK][2] or any Amazon Web Services SDK.
3336
+ # This parameter supports the [Amazon Web Services Nitro Enclaves
3337
+ # SDK][2] or any Amazon Web Services SDK for Amazon Web Services Nitro
3338
+ # Enclaves. It supports any Amazon Web Services SDK for Amazon Web
3339
+ # Services NitroTPM.
3205
3340
  #
3206
3341
  # When you use this parameter, instead of returning plaintext bytes,
3207
3342
  # KMS encrypts the plaintext bytes under the public key in the
3208
3343
  # attestation document, and returns the resulting ciphertext in the
3209
3344
  # `CiphertextForRecipient` field in the response. This ciphertext can
3210
- # be decrypted only with the private key in the enclave. The
3211
- # `Plaintext` field in the response is null or empty.
3345
+ # be decrypted only with the private key in the attested environment.
3346
+ # The `Plaintext` field in the response is null or empty.
3212
3347
  #
3213
3348
  # For information about the interaction between KMS and Amazon Web
3214
- # Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
3215
- # uses KMS][3] in the *Key Management Service Developer Guide*.
3349
+ # Services Nitro Enclaves or Amazon Web Services NitroTPM, see
3350
+ # [Cryptographic attestation support in KMS][3] in the *Key Management
3351
+ # Service Developer Guide*.
3216
3352
  #
3217
3353
  #
3218
3354
  #
3219
3355
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc
3220
3356
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
3221
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
3357
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
3222
3358
  # @return [Types::RecipientInfo]
3223
3359
  #
3224
3360
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateRandomRequest AWS API Documentation
@@ -3242,19 +3378,20 @@ module Aws::KMS
3242
3378
  #
3243
3379
  # @!attribute [rw] ciphertext_for_recipient
3244
3380
  # The plaintext random bytes encrypted with the public key from the
3245
- # Nitro enclave. This ciphertext can be decrypted only by using a
3246
- # private key in the Nitro enclave.
3381
+ # attestation document. This ciphertext can be decrypted only by using
3382
+ # a private key from the attested environment.
3247
3383
  #
3248
3384
  # This field is included in the response only when the `Recipient`
3249
3385
  # parameter in the request includes a valid attestation document from
3250
- # an Amazon Web Services Nitro enclave. For information about the
3251
- # interaction between KMS and Amazon Web Services Nitro Enclaves, see
3252
- # [How Amazon Web Services Nitro Enclaves uses KMS][1] in the *Key
3253
- # Management Service Developer Guide*.
3386
+ # an Amazon Web Services Nitro enclave or NitroTPM. For information
3387
+ # about the interaction between KMS and Amazon Web Services Nitro
3388
+ # Enclaves or Amazon Web Services NitroTPM, see [Cryptographic
3389
+ # attestation support in KMS][1] in the *Key Management Service
3390
+ # Developer Guide*.
3254
3391
  #
3255
3392
  #
3256
3393
  #
3257
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
3394
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
3258
3395
  # @return [String]
3259
3396
  #
3260
3397
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateRandomResponse AWS API Documentation
@@ -3361,15 +3498,12 @@ module Aws::KMS
3361
3498
  # Identifies the date and time that an in progress on-demand rotation
3362
3499
  # was initiated.
3363
3500
  #
3364
- # The KMS API follows an [eventual consistency][1] model due to the
3365
- # distributed nature of the system. As a result, there might be a
3366
- # slight delay between initiating on-demand key rotation and the
3367
- # rotation's completion. Once the on-demand rotation is complete, use
3368
- # ListKeyRotations to view the details of the on-demand rotation.
3369
- #
3370
- #
3371
- #
3372
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3501
+ # KMS uses a background process to perform rotations. As a result,
3502
+ # there might be a slight delay between initiating on-demand key
3503
+ # rotation and the rotation's completion. Once the on-demand rotation
3504
+ # is complete, KMS removes this field from the response. You can use
3505
+ # ListKeyRotations to view the details of the completed on-demand
3506
+ # rotation.
3373
3507
  # @return [Time]
3374
3508
  #
3375
3509
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GetKeyRotationStatusResponse AWS API Documentation
@@ -3409,9 +3543,8 @@ module Aws::KMS
3409
3543
  # @!attribute [rw] wrapping_algorithm
3410
3544
  # The algorithm you will use with the RSA public key (`PublicKey`) in
3411
3545
  # the response to protect your key material during import. For more
3412
- # information, see [Select a wrapping
3413
- # algorithm](kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm)
3414
- # in the *Key Management Service Developer Guide*.
3546
+ # information, see [Select a wrapping algorithm][1] in the *Key
3547
+ # Management Service Developer Guide*.
3415
3548
  #
3416
3549
  # For RSA\_AES wrapping algorithms, you encrypt your key material with
3417
3550
  # an AES key that you generate, then encrypt your AES key with the RSA
@@ -3443,6 +3576,10 @@ module Aws::KMS
3443
3576
  #
3444
3577
  # * **RSAES\_PKCS1\_V1\_5** (Deprecated) — As of October 10, 2023, KMS
3445
3578
  # does not support the RSAES\_PKCS1\_V1\_5 wrapping algorithm.
3579
+ #
3580
+ #
3581
+ #
3582
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm
3446
3583
  # @return [String]
3447
3584
  #
3448
3585
  # @!attribute [rw] wrapping_key_spec
@@ -3538,7 +3675,7 @@ module Aws::KMS
3538
3675
  #
3539
3676
  #
3540
3677
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3541
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3678
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3542
3679
  # @return [Array<String>]
3543
3680
  #
3544
3681
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GetPublicKeyRequest AWS API Documentation
@@ -3640,9 +3777,9 @@ module Aws::KMS
3640
3777
  #
3641
3778
  # KMS applies the grant constraints only to cryptographic operations
3642
3779
  # that support an encryption context, that is, all cryptographic
3643
- # operations with a [symmetric KMS key][3]. Grant constraints are not
3644
- # applied to operations that do not support an encryption context, such
3645
- # as cryptographic operations with asymmetric KMS keys and management
3780
+ # operations with a symmetric KMS key. Grant constraints are not applied
3781
+ # to operations that do not support an encryption context, such as
3782
+ # cryptographic operations with asymmetric KMS keys and management
3646
3783
  # operations, such as DescribeKey or RetireGrant.
3647
3784
  #
3648
3785
  # In a cryptographic operation, the encryption context in the decryption
@@ -3657,15 +3794,14 @@ module Aws::KMS
3657
3794
  # differ only by case. To require a fully case-sensitive encryption
3658
3795
  # context, use the `kms:EncryptionContext:` and
3659
3796
  # `kms:EncryptionContextKeys` conditions in an IAM or key policy. For
3660
- # details, see [kms:EncryptionContext:][4] in the <i> <i>Key Management
3661
- # Service Developer Guide</i> </i>.
3797
+ # details, see [kms:EncryptionContext:context-key][3] in the <i> <i>Key
3798
+ # Management Service Developer Guide</i> </i>.
3662
3799
  #
3663
3800
  #
3664
3801
  #
3665
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3666
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
3667
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#symmetric-cmks
3668
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-context
3802
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3803
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
3804
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-context
3669
3805
  #
3670
3806
  # @!attribute [rw] encryption_context_subset
3671
3807
  # A list of key-value pairs that must be included in the encryption
@@ -3676,7 +3812,7 @@ module Aws::KMS
3676
3812
  #
3677
3813
  #
3678
3814
  #
3679
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3815
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3680
3816
  # @return [Hash<String,String>]
3681
3817
  #
3682
3818
  # @!attribute [rw] encryption_context_equals
@@ -3687,7 +3823,7 @@ module Aws::KMS
3687
3823
  #
3688
3824
  #
3689
3825
  #
3690
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3826
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3691
3827
  # @return [Hash<String,String>]
3692
3828
  #
3693
3829
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GrantConstraints AWS API Documentation
@@ -3776,11 +3912,9 @@ module Aws::KMS
3776
3912
  #
3777
3913
  # The KMS key can be a symmetric encryption KMS key, HMAC KMS key,
3778
3914
  # asymmetric encryption KMS key, or asymmetric signing KMS key,
3779
- # including a [multi-Region
3780
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of
3781
- # any supported type. You cannot perform this operation on a KMS key
3782
- # in a custom key store, or on a KMS key in a different Amazon Web
3783
- # Services account.
3915
+ # including a [multi-Region key][1] of any supported type. You cannot
3916
+ # perform this operation on a KMS key in a custom key store, or on a
3917
+ # KMS key in a different Amazon Web Services account.
3784
3918
  #
3785
3919
  # Specify the key ID or key ARN of the KMS key.
3786
3920
  #
@@ -3793,6 +3927,10 @@ module Aws::KMS
3793
3927
  #
3794
3928
  # To get the key ID and key ARN for a KMS key, use ListKeys or
3795
3929
  # DescribeKey.
3930
+ #
3931
+ #
3932
+ #
3933
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
3796
3934
  # @return [String]
3797
3935
  #
3798
3936
  # @!attribute [rw] import_token
@@ -3844,7 +3982,53 @@ module Aws::KMS
3844
3982
  #
3845
3983
  #
3846
3984
  #
3847
- # [1]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
3985
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
3986
+ # @return [String]
3987
+ #
3988
+ # @!attribute [rw] import_type
3989
+ # Indicates whether the key material being imported is previously
3990
+ # associated with this KMS key or not. This parameter is optional and
3991
+ # only usable with symmetric encryption keys. If no key material has
3992
+ # ever been imported into the KMS key, and this parameter is omitted,
3993
+ # the parameter defaults to `NEW_KEY_MATERIAL`. After the first key
3994
+ # material is imported, if this parameter is omitted then the
3995
+ # parameter defaults to `EXISTING_KEY_MATERIAL`.
3996
+ #
3997
+ # For multi-Region keys, you must first import new key material into
3998
+ # the primary Region key. You should use the `NEW_KEY_MATERIAL` import
3999
+ # type when importing key material into the primary Region key. Then,
4000
+ # you can import the same key material into the replica Region key.
4001
+ # The import type for the replica Region key should be
4002
+ # `EXISTING_KEY_MATERIAL`.
4003
+ # @return [String]
4004
+ #
4005
+ # @!attribute [rw] key_material_description
4006
+ # Description for the key material being imported. This parameter is
4007
+ # optional and only usable with symmetric encryption keys. If you do
4008
+ # not specify a key material description, KMS retains the value you
4009
+ # specified when you last imported the same key material into this KMS
4010
+ # key.
4011
+ # @return [String]
4012
+ #
4013
+ # @!attribute [rw] key_material_id
4014
+ # Identifies the key material being imported. This parameter is
4015
+ # optional and only usable with symmetric encryption keys. You cannot
4016
+ # specify a key material ID with `ImportType` set to
4017
+ # `NEW_KEY_MATERIAL`. Whenever you import key material into a
4018
+ # symmetric encryption key, KMS assigns a unique identifier to the key
4019
+ # material based on the KMS key ID and the imported key material. When
4020
+ # you re-import key material with a specified key material ID, KMS:
4021
+ #
4022
+ # * Computes the identifier for the key material
4023
+ #
4024
+ # * Matches the computed identifier against the specified key material
4025
+ # ID
4026
+ #
4027
+ # * Verifies that the key material ID is already associated with the
4028
+ # KMS key
4029
+ #
4030
+ # To get the list of key material IDs associated with a KMS key, use
4031
+ # ListKeyRotations.
3848
4032
  # @return [String]
3849
4033
  #
3850
4034
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterialRequest AWS API Documentation
@@ -3854,14 +4038,35 @@ module Aws::KMS
3854
4038
  :import_token,
3855
4039
  :encrypted_key_material,
3856
4040
  :valid_to,
3857
- :expiration_model)
4041
+ :expiration_model,
4042
+ :import_type,
4043
+ :key_material_description,
4044
+ :key_material_id)
3858
4045
  SENSITIVE = []
3859
4046
  include Aws::Structure
3860
4047
  end
3861
4048
 
4049
+ # @!attribute [rw] key_id
4050
+ # The Amazon Resource Name ([key ARN][1]) of the KMS key into which
4051
+ # key material was imported.
4052
+ #
4053
+ #
4054
+ #
4055
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
4056
+ # @return [String]
4057
+ #
4058
+ # @!attribute [rw] key_material_id
4059
+ # Identifies the imported key material.
4060
+ # @return [String]
4061
+ #
3862
4062
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterialResponse AWS API Documentation
3863
4063
  #
3864
- class ImportKeyMaterialResponse < Aws::EmptyStructure; end
4064
+ class ImportKeyMaterialResponse < Struct.new(
4065
+ :key_id,
4066
+ :key_material_id)
4067
+ SENSITIVE = []
4068
+ include Aws::Structure
4069
+ end
3865
4070
 
3866
4071
  # The request was rejected because the specified KMS key cannot decrypt
3867
4072
  # the data. The `KeyId` in a Decrypt request and the `SourceKeyId` in a
@@ -3880,8 +4085,10 @@ module Aws::KMS
3880
4085
  end
3881
4086
 
3882
4087
  # The request was rejected because the key material in the request is,
3883
- # expired, invalid, or is not the same key material that was previously
3884
- # imported into this KMS key.
4088
+ # expired, invalid, or does not meet expectations. For example, it is
4089
+ # not the same key material that was previously imported or KMS expected
4090
+ # new key material but the key material being imported is already
4091
+ # associated with the KMS key.
3885
4092
  #
3886
4093
  # @!attribute [rw] message
3887
4094
  # @return [String]
@@ -4188,7 +4395,7 @@ module Aws::KMS
4188
4395
  #
4189
4396
  #
4190
4397
  #
4191
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4398
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4192
4399
  # @return [String]
4193
4400
  #
4194
4401
  # @!attribute [rw] key_state
@@ -4215,11 +4422,12 @@ module Aws::KMS
4215
4422
  # @return [Time]
4216
4423
  #
4217
4424
  # @!attribute [rw] valid_to
4218
- # The time at which the imported key material expires. When the key
4219
- # material expires, KMS deletes the key material and the KMS key
4220
- # becomes unusable. This value is present only for KMS keys whose
4221
- # `Origin` is `EXTERNAL` and whose `ExpirationModel` is
4222
- # `KEY_MATERIAL_EXPIRES`, otherwise this value is omitted.
4425
+ # The earliest time at which any imported key material permanently
4426
+ # associated with this KMS key expires. When a key material expires,
4427
+ # KMS deletes the key material and the KMS key becomes unusable. This
4428
+ # value is present only for KMS keys whose `Origin` is `EXTERNAL` and
4429
+ # the `ExpirationModel` is `KEY_MATERIAL_EXPIRES`, otherwise this
4430
+ # value is omitted.
4223
4431
  # @return [Time]
4224
4432
  #
4225
4433
  # @!attribute [rw] origin
@@ -4238,7 +4446,7 @@ module Aws::KMS
4238
4446
  #
4239
4447
  #
4240
4448
  #
4241
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4449
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4242
4450
  # @return [String]
4243
4451
  #
4244
4452
  # @!attribute [rw] cloud_hsm_cluster_id
@@ -4250,7 +4458,7 @@ module Aws::KMS
4250
4458
  #
4251
4459
  #
4252
4460
  #
4253
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4461
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4254
4462
  # @return [String]
4255
4463
  #
4256
4464
  # @!attribute [rw] expiration_model
@@ -4373,6 +4581,15 @@ module Aws::KMS
4373
4581
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
4374
4582
  # @return [Types::XksKeyConfigurationType]
4375
4583
  #
4584
+ # @!attribute [rw] current_key_material_id
4585
+ # Identifies the current key material. This value is present for
4586
+ # symmetric encryption keys with `AWS_KMS` or `EXTERNAL` origin. These
4587
+ # KMS keys support automatic or on-demand key rotation and can have
4588
+ # multiple key materials associated with them. KMS uses the current
4589
+ # key material for both encryption and decryption, and the non-current
4590
+ # key material for decryption operations only.
4591
+ # @return [String]
4592
+ #
4376
4593
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/KeyMetadata AWS API Documentation
4377
4594
  #
4378
4595
  class KeyMetadata < Struct.new(
@@ -4400,7 +4617,8 @@ module Aws::KMS
4400
4617
  :multi_region_configuration,
4401
4618
  :pending_deletion_window_in_days,
4402
4619
  :mac_algorithms,
4403
- :xks_key_configuration)
4620
+ :xks_key_configuration,
4621
+ :current_key_material_id)
4404
4622
  SENSITIVE = []
4405
4623
  include Aws::Structure
4406
4624
  end
@@ -4419,9 +4637,9 @@ module Aws::KMS
4419
4637
  include Aws::Structure
4420
4638
  end
4421
4639
 
4422
- # The request was rejected because a quota was exceeded. For more
4423
- # information, see [Quotas][1] in the *Key Management Service Developer
4424
- # Guide*.
4640
+ # The request was rejected because a length constraint or quota was
4641
+ # exceeded. For more information, see [Quotas][1] in the *Key Management
4642
+ # Service Developer Guide*.
4425
4643
  #
4426
4644
  #
4427
4645
  #
@@ -4679,6 +4897,18 @@ module Aws::KMS
4679
4897
  # DescribeKey.
4680
4898
  # @return [String]
4681
4899
  #
4900
+ # @!attribute [rw] include_key_material
4901
+ # Use this optional parameter to control which key materials
4902
+ # associated with this key are listed in the response. The default
4903
+ # value of this parameter is `ROTATIONS_ONLY`. If you omit this
4904
+ # parameter, KMS returns information on the key materials created by
4905
+ # automatic or on-demand key rotation. When you specify a value of
4906
+ # `ALL_KEY_MATERIAL`, KMS adds the first key material and any imported
4907
+ # key material pending rotation to the response. This parameter can
4908
+ # only be used with KMS keys that support automatic or on-demand key
4909
+ # rotation.
4910
+ # @return [String]
4911
+ #
4682
4912
  # @!attribute [rw] limit
4683
4913
  # Use this parameter to specify the maximum number of items to return.
4684
4914
  # When this value is present, KMS does not return more than the
@@ -4699,6 +4929,7 @@ module Aws::KMS
4699
4929
  #
4700
4930
  class ListKeyRotationsRequest < Struct.new(
4701
4931
  :key_id,
4932
+ :include_key_material,
4702
4933
  :limit,
4703
4934
  :marker)
4704
4935
  SENSITIVE = []
@@ -4706,7 +4937,10 @@ module Aws::KMS
4706
4937
  end
4707
4938
 
4708
4939
  # @!attribute [rw] rotations
4709
- # A list of completed key material rotations.
4940
+ # A list of completed key material rotations. When the optional input
4941
+ # parameter `IncludeKeyMaterial` is specified with a value of
4942
+ # `ALL_KEY_MATERIAL`, this list includes the first key material and
4943
+ # any imported key material pending rotation.
4710
4944
  # @return [Array<Types::RotationsListEntry>]
4711
4945
  #
4712
4946
  # @!attribute [rw] next_marker
@@ -5029,6 +5263,18 @@ module Aws::KMS
5029
5263
  # that I make are not always immediately visible][2] in the *Amazon
5030
5264
  # Web Services Identity and Access Management User Guide*.
5031
5265
  #
5266
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are
5267
+ # missing from a key policy statement, the policy statement has no
5268
+ # effect. When a key policy statement is missing one of these
5269
+ # elements, the KMS console correctly reports an error, but the
5270
+ # `PutKeyPolicy` API request succeeds, even though the policy
5271
+ # statement is ineffective.
5272
+ #
5273
+ # For more information on required key policy elements, see [Elements
5274
+ # in a key policy][3] in the *Key Management Service Developer Guide*.
5275
+ #
5276
+ # </note>
5277
+ #
5032
5278
  # A key policy document can include only the following characters:
5033
5279
  #
5034
5280
  # * Printable ASCII characters from the space character (`\u0020`)
@@ -5040,18 +5286,24 @@ module Aws::KMS
5040
5286
  # * The tab (`\u0009`), line feed (`\u000A`), and carriage return
5041
5287
  # (`\u000D`) special characters
5042
5288
  #
5043
- # For information about key policies, see [Key policies in KMS][3] in
5289
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
5290
+ # `LimitExceededException`.
5291
+ #
5292
+ # </note>
5293
+ #
5294
+ # For information about key policies, see [Key policies in KMS][4] in
5044
5295
  # the *Key Management Service Developer Guide*.For help writing and
5045
5296
  # formatting a JSON policy document, see the [IAM JSON Policy
5046
- # Reference][4] in the <i> <i>Identity and Access Management User
5297
+ # Reference][5] in the <i> <i>Identity and Access Management User
5047
5298
  # Guide</i> </i>.
5048
5299
  #
5049
5300
  #
5050
5301
  #
5051
5302
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
5052
5303
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
5053
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
5054
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
5304
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
5305
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
5306
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
5055
5307
  # @return [String]
5056
5308
  #
5057
5309
  # @!attribute [rw] bypass_policy_lockout_safety_check
@@ -5109,7 +5361,7 @@ module Aws::KMS
5109
5361
  #
5110
5362
  #
5111
5363
  #
5112
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5364
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5113
5365
  # @return [Hash<String,String>]
5114
5366
  #
5115
5367
  # @!attribute [rw] source_key_id
@@ -5199,7 +5451,7 @@ module Aws::KMS
5199
5451
  #
5200
5452
  #
5201
5453
  #
5202
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5454
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5203
5455
  # @return [Hash<String,String>]
5204
5456
  #
5205
5457
  # @!attribute [rw] source_encryption_algorithm
@@ -5236,19 +5488,19 @@ module Aws::KMS
5236
5488
  #
5237
5489
  #
5238
5490
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5239
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5491
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5240
5492
  # @return [Array<String>]
5241
5493
  #
5242
5494
  # @!attribute [rw] dry_run
5243
5495
  # Checks if your request will succeed. `DryRun` is an optional
5244
5496
  # parameter.
5245
5497
  #
5246
- # To learn more about how to use this parameter, see [Testing your KMS
5247
- # API calls][1] in the *Key Management Service Developer Guide*.
5498
+ # To learn more about how to use this parameter, see [Testing your
5499
+ # permissions][1] in the *Key Management Service Developer Guide*.
5248
5500
  #
5249
5501
  #
5250
5502
  #
5251
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5503
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5252
5504
  # @return [Boolean]
5253
5505
  #
5254
5506
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncryptRequest AWS API Documentation
@@ -5296,6 +5548,18 @@ module Aws::KMS
5296
5548
  # The encryption algorithm that was used to reencrypt the data.
5297
5549
  # @return [String]
5298
5550
  #
5551
+ # @!attribute [rw] source_key_material_id
5552
+ # The identifier of the key material used to originally encrypt the
5553
+ # data. This field is present only when the original encryption used a
5554
+ # symmetric encryption KMS key.
5555
+ # @return [String]
5556
+ #
5557
+ # @!attribute [rw] destination_key_material_id
5558
+ # The identifier of the key material used to reencrypt the data. This
5559
+ # field is present only when data is reencrypted using a symmetric
5560
+ # encryption KMS key.
5561
+ # @return [String]
5562
+ #
5299
5563
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncryptResponse AWS API Documentation
5300
5564
  #
5301
5565
  class ReEncryptResponse < Struct.new(
@@ -5303,7 +5567,9 @@ module Aws::KMS
5303
5567
  :source_key_id,
5304
5568
  :key_id,
5305
5569
  :source_encryption_algorithm,
5306
- :destination_encryption_algorithm)
5570
+ :destination_encryption_algorithm,
5571
+ :source_key_material_id,
5572
+ :destination_key_material_id)
5307
5573
  SENSITIVE = []
5308
5574
  include Aws::Structure
5309
5575
  end
@@ -5312,24 +5578,26 @@ module Aws::KMS
5312
5578
  # the API operation.
5313
5579
  #
5314
5580
  # This data type is designed to support Amazon Web Services Nitro
5315
- # Enclaves, which lets you create an isolated compute environment in
5316
- # Amazon EC2. For information about the interaction between KMS and
5317
- # Amazon Web Services Nitro Enclaves, see [How Amazon Web Services Nitro
5318
- # Enclaves uses KMS][1] in the *Key Management Service Developer Guide*.
5581
+ # Enclaves and Amazon Web Services NitroTPM, which lets you create an
5582
+ # attested environment in Amazon EC2. For information about the
5583
+ # interaction between KMS and Amazon Web Services Nitro Enclaves or
5584
+ # Amazon Web Services NitroTPM, see [Cryptographic attestation support
5585
+ # in KMS][1] in the *Key Management Service Developer Guide*.
5319
5586
  #
5320
5587
  #
5321
5588
  #
5322
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5589
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html
5323
5590
  #
5324
5591
  # @!attribute [rw] key_encryption_algorithm
5325
5592
  # The encryption algorithm that KMS should use with the public key for
5326
- # an Amazon Web Services Nitro Enclave to encrypt plaintext values for
5327
- # the response. The only valid value is `RSAES_OAEP_SHA_256`.
5593
+ # an Amazon Web Services Nitro Enclave or NitroTPM to encrypt
5594
+ # plaintext values for the response. The only valid value is
5595
+ # `RSAES_OAEP_SHA_256`.
5328
5596
  # @return [String]
5329
5597
  #
5330
5598
  # @!attribute [rw] attestation_document
5331
- # The attestation document for an Amazon Web Services Nitro Enclave.
5332
- # This document includes the enclave's public key.
5599
+ # The attestation document for an Amazon Web Services Nitro Enclave or
5600
+ # a NitroTPM. This document includes the enclave's public key.
5333
5601
  # @return [String]
5334
5602
  #
5335
5603
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RecipientInfo AWS API Documentation
@@ -5369,33 +5637,23 @@ module Aws::KMS
5369
5637
  # [KMS service endpoints][1] in the *Amazon Web Services General
5370
5638
  # Reference*.
5371
5639
  #
5372
- # <note markdown="1"> HMAC KMS keys are not supported in all Amazon Web Services Regions.
5373
- # If you try to replicate an HMAC KMS key in an Amazon Web Services
5374
- # Region in which HMAC keys are not supported, the `ReplicateKey`
5375
- # operation returns an `UnsupportedOperationException`. For a list of
5376
- # Regions in which HMAC KMS keys are supported, see [HMAC keys in
5377
- # KMS][2] in the *Key Management Service Developer Guide*.
5378
- #
5379
- # </note>
5380
- #
5381
5640
  # The replica must be in a different Amazon Web Services Region than
5382
5641
  # its primary key and other replicas of that primary key, but in the
5383
5642
  # same Amazon Web Services partition. KMS must be available in the
5384
5643
  # replica Region. If the Region is not enabled by default, the Amazon
5385
5644
  # Web Services account must be enabled in the Region. For information
5386
5645
  # about Amazon Web Services partitions, see [Amazon Resource Names
5387
- # (ARNs)][3] in the *Amazon Web Services General Reference*. For
5646
+ # (ARNs)][2] in the *Amazon Web Services General Reference*. For
5388
5647
  # information about enabling and disabling Regions, see [Enabling a
5389
- # Region][4] and [Disabling a Region][5] in the *Amazon Web Services
5648
+ # Region][3] and [Disabling a Region][4] in the *Amazon Web Services
5390
5649
  # General Reference*.
5391
5650
  #
5392
5651
  #
5393
5652
  #
5394
5653
  # [1]: https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region
5395
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
5396
- # [3]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
5397
- # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
5398
- # [5]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
5654
+ # [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
5655
+ # [3]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
5656
+ # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
5399
5657
  # @return [String]
5400
5658
  #
5401
5659
  # @!attribute [rw] policy
@@ -5445,7 +5703,7 @@ module Aws::KMS
5445
5703
  #
5446
5704
  #
5447
5705
  #
5448
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
5706
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
5449
5707
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
5450
5708
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
5451
5709
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
@@ -5518,7 +5776,7 @@ module Aws::KMS
5518
5776
  # When you add tags to an Amazon Web Services resource, Amazon Web
5519
5777
  # Services generates a cost allocation report with usage and costs
5520
5778
  # aggregated by tags. Tags can also be used to control access to a KMS
5521
- # key. For details, see [Tagging Keys][3].
5779
+ # key. For details, see [Tags in KMS][3].
5522
5780
  #
5523
5781
  #
5524
5782
  #
@@ -5609,12 +5867,12 @@ module Aws::KMS
5609
5867
  # Checks if your request will succeed. `DryRun` is an optional
5610
5868
  # parameter.
5611
5869
  #
5612
- # To learn more about how to use this parameter, see [Testing your KMS
5613
- # API calls][1] in the *Key Management Service Developer Guide*.
5870
+ # To learn more about how to use this parameter, see [Testing your
5871
+ # permissions][1] in the *Key Management Service Developer Guide*.
5614
5872
  #
5615
5873
  #
5616
5874
  #
5617
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5875
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5618
5876
  # @return [Boolean]
5619
5877
  #
5620
5878
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RetireGrantRequest AWS API Documentation
@@ -5657,12 +5915,12 @@ module Aws::KMS
5657
5915
  # Checks if your request will succeed. `DryRun` is an optional
5658
5916
  # parameter.
5659
5917
  #
5660
- # To learn more about how to use this parameter, see [Testing your KMS
5661
- # API calls][1] in the *Key Management Service Developer Guide*.
5918
+ # To learn more about how to use this parameter, see [Testing your
5919
+ # permissions][1] in the *Key Management Service Developer Guide*.
5662
5920
  #
5663
5921
  #
5664
5922
  #
5665
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5923
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5666
5924
  # @return [Boolean]
5667
5925
  #
5668
5926
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RevokeGrantRequest AWS API Documentation
@@ -5678,10 +5936,10 @@ module Aws::KMS
5678
5936
  # @!attribute [rw] key_id
5679
5937
  # Identifies a symmetric encryption KMS key. You cannot perform
5680
5938
  # on-demand rotation of [asymmetric KMS keys][1], [HMAC KMS keys][2],
5681
- # KMS keys with [imported key material][3], or KMS keys in a [custom
5682
- # key store][4]. To perform on-demand rotation of a set of related
5683
- # [multi-Region keys][5], invoke the on-demand rotation on the primary
5684
- # key.
5939
+ # multi-Region KMS keys with [imported key material][3], or KMS keys
5940
+ # in a [custom key store][4]. To perform on-demand rotation of a set
5941
+ # of related [multi-Region keys][5], invoke the on-demand rotation on
5942
+ # the primary key.
5685
5943
  #
5686
5944
  # Specify the key ID or key ARN of the KMS key.
5687
5945
  #
@@ -5700,8 +5958,8 @@ module Aws::KMS
5700
5958
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
5701
5959
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
5702
5960
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
5703
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
5704
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
5961
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
5962
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
5705
5963
  # @return [String]
5706
5964
  #
5707
5965
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RotateKeyOnDemandRequest AWS API Documentation
@@ -5725,31 +5983,97 @@ module Aws::KMS
5725
5983
  include Aws::Structure
5726
5984
  end
5727
5985
 
5728
- # Contains information about completed key material rotations.
5986
+ # Each entry contains information about one of the key materials
5987
+ # associated with a KMS key.
5729
5988
  #
5730
5989
  # @!attribute [rw] key_id
5731
5990
  # Unique identifier of the key.
5732
5991
  # @return [String]
5733
5992
  #
5993
+ # @!attribute [rw] key_material_id
5994
+ # Unique identifier of the key material.
5995
+ # @return [String]
5996
+ #
5997
+ # @!attribute [rw] key_material_description
5998
+ # User-specified description of the key material. This field is only
5999
+ # present for symmetric encryption KMS keys with `EXTERNAL` origin.
6000
+ # @return [String]
6001
+ #
6002
+ # @!attribute [rw] import_state
6003
+ # Indicates if the key material is currently imported into KMS. It has
6004
+ # two possible values: `IMPORTED` or `PENDING_IMPORT`. This field is
6005
+ # only present for symmetric encryption KMS keys with `EXTERNAL`
6006
+ # origin.
6007
+ # @return [String]
6008
+ #
6009
+ # @!attribute [rw] key_material_state
6010
+ # There are four possible values for this field: `CURRENT`,
6011
+ # `NON_CURRENT`, `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` and
6012
+ # `PENDING_ROTATION`. KMS uses `CURRENT` key material for both
6013
+ # encryption and decryption and `NON_CURRENT` key material only for
6014
+ # decryption. `PENDING_ROTATION` identifies key material that has been
6015
+ # imported for on-demand key rotation but the rotation hasn't
6016
+ # completed. The key material state
6017
+ # `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` is unique to
6018
+ # multi-region, symmetric encryption keys with imported key material.
6019
+ # It indicates key material that has been imported into the primary
6020
+ # Region key but not all of the replica Region keys. When this key
6021
+ # material is imported in to all of the replica Region keys, the key
6022
+ # material state will change to `PENDING_ROTATION`. Key material in
6023
+ # `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` or `PENDING_ROTATION`
6024
+ # state is not permanently associated with the KMS key. You can delete
6025
+ # this key material and import different key material in its place.
6026
+ # The `PENDING_MULTI_REGION_IMPORT_AND_ROTATION` and
6027
+ # `PENDING_ROTATION` values are only used in symmetric encryption keys
6028
+ # with imported key material. The other values, `CURRENT` and
6029
+ # `NON_CURRENT`, are used for all KMS keys that support automatic or
6030
+ # on-demand key rotation.
6031
+ # @return [String]
6032
+ #
6033
+ # @!attribute [rw] expiration_model
6034
+ # Indicates if the key material is configured to automatically expire.
6035
+ # There are two possible values for this field: `KEY_MATERIAL_EXPIRES`
6036
+ # and `KEY_MATERIAL_DOES_NOT_EXPIRE`. For any key material that
6037
+ # expires, the expiration date and time is indicated in `ValidTo`.
6038
+ # This field is only present for symmetric encryption KMS keys with
6039
+ # `EXTERNAL` origin.
6040
+ # @return [String]
6041
+ #
6042
+ # @!attribute [rw] valid_to
6043
+ # Date and time at which the key material expires. This field is only
6044
+ # present for symmetric encryption KMS keys with `EXTERNAL` origin in
6045
+ # rotation list entries with an `ExpirationModel` value of
6046
+ # `KEY_MATERIAL_EXPIRES`.
6047
+ # @return [Time]
6048
+ #
5734
6049
  # @!attribute [rw] rotation_date
5735
6050
  # Date and time that the key material rotation completed. Formatted as
5736
- # Unix time.
6051
+ # Unix time. This field is not present for the first key material or
6052
+ # an imported key material in `PENDING_ROTATION` state.
5737
6053
  # @return [Time]
5738
6054
  #
5739
6055
  # @!attribute [rw] rotation_type
5740
6056
  # Identifies whether the key material rotation was a scheduled
5741
- # [automatic rotation][1] or an [on-demand rotation][2].
6057
+ # [automatic rotation][1] or an [on-demand rotation][2]. This field is
6058
+ # not present for the first key material or an imported key material
6059
+ # in `PENDING_ROTATION` state.
5742
6060
  #
5743
6061
  #
5744
6062
  #
5745
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
5746
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-on-demand
6063
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
6064
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html
5747
6065
  # @return [String]
5748
6066
  #
5749
6067
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/RotationsListEntry AWS API Documentation
5750
6068
  #
5751
6069
  class RotationsListEntry < Struct.new(
5752
6070
  :key_id,
6071
+ :key_material_id,
6072
+ :key_material_description,
6073
+ :import_state,
6074
+ :key_material_state,
6075
+ :expiration_model,
6076
+ :valid_to,
5753
6077
  :rotation_date,
5754
6078
  :rotation_type)
5755
6079
  SENSITIVE = []
@@ -5887,27 +6211,41 @@ module Aws::KMS
5887
6211
  # Tells KMS whether the value of the `Message` parameter should be
5888
6212
  # hashed as part of the signing algorithm. Use `RAW` for unhashed
5889
6213
  # messages; use `DIGEST` for message digests, which are already
5890
- # hashed.
6214
+ # hashed; use `EXTERNAL_MU` for 64-byte representative μ used in
6215
+ # ML-DSA signing as defined in NIST FIPS 204 Section 6.2.
5891
6216
  #
5892
6217
  # When the value of `MessageType` is `RAW`, KMS uses the standard
5893
6218
  # signing algorithm, which begins with a hash function. When the value
5894
6219
  # is `DIGEST`, KMS skips the hashing step in the signing algorithm.
6220
+ # When the value is `EXTERNAL_MU` KMS skips the concatenated hashing
6221
+ # of the public key hash and the message done in the ML-DSA signing
6222
+ # algorithm.
6223
+ #
6224
+ # Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
6225
+ # `Message` parameter is a message digest. If you use the `DIGEST`
6226
+ # value with an unhashed message, the security of the signing
6227
+ # operation can be compromised.
6228
+ #
6229
+ # When using ECC\_NIST\_EDWARDS25519 KMS keys:
5895
6230
  #
5896
- # Use the `DIGEST` value only when the value of the `Message`
5897
- # parameter is a message digest. If you use the `DIGEST` value with an
5898
- # unhashed message, the security of the signing operation can be
5899
- # compromised.
6231
+ # * ED25519\_SHA\_512 signing algorithm requires KMS `MessageType:RAW`
5900
6232
  #
5901
- # When the value of `MessageType`is `DIGEST`, the length of the
6233
+ # * ED25519\_PH\_SHA\_512 signing algorithm requires KMS
6234
+ # `MessageType:DIGEST`
6235
+ #
6236
+ # When the value of `MessageType` is `DIGEST`, the length of the
5902
6237
  # `Message` value must match the length of hashed messages for the
5903
6238
  # specified signing algorithm.
5904
6239
  #
6240
+ # When the value of `MessageType` is `EXTERNAL_MU` the length of the
6241
+ # `Message` value must be 64 bytes.
6242
+ #
5905
6243
  # You can submit a message digest and omit the `MessageType` or
5906
6244
  # specify `RAW` so the digest is hashed again while signing. However,
5907
6245
  # this can cause verification failures when verifying with a system
5908
6246
  # that assumes a single hash.
5909
6247
  #
5910
- # The hashing algorithm in that `Sign` uses is based on the
6248
+ # The hashing algorithm that `Sign` uses is based on the
5911
6249
  # `SigningAlgorithm` value.
5912
6250
  #
5913
6251
  # * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
@@ -5919,12 +6257,15 @@ module Aws::KMS
5919
6257
  # * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
5920
6258
  # algorithm.
5921
6259
  #
6260
+ # * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256
6261
+ # hashing algorithm.
6262
+ #
5922
6263
  # * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
5923
6264
  # verification with SM2 key pairs][1].
5924
6265
  #
5925
6266
  #
5926
6267
  #
5927
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
6268
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
5928
6269
  # @return [String]
5929
6270
  #
5930
6271
  # @!attribute [rw] grant_tokens
@@ -5938,7 +6279,7 @@ module Aws::KMS
5938
6279
  #
5939
6280
  #
5940
6281
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5941
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6282
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5942
6283
  # @return [Array<String>]
5943
6284
  #
5944
6285
  # @!attribute [rw] signing_algorithm
@@ -5954,12 +6295,12 @@ module Aws::KMS
5954
6295
  # Checks if your request will succeed. `DryRun` is an optional
5955
6296
  # parameter.
5956
6297
  #
5957
- # To learn more about how to use this parameter, see [Testing your KMS
5958
- # API calls][1] in the *Key Management Service Developer Guide*.
6298
+ # To learn more about how to use this parameter, see [Testing your
6299
+ # permissions][1] in the *Key Management Service Developer Guide*.
5959
6300
  #
5960
6301
  #
5961
6302
  #
5962
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
6303
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5963
6304
  # @return [Boolean]
5964
6305
  #
5965
6306
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/SignRequest AWS API Documentation
@@ -6184,8 +6525,8 @@ module Aws::KMS
6184
6525
  #
6185
6526
  #
6186
6527
  #
6187
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
6188
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
6528
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
6529
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
6189
6530
  # @return [String]
6190
6531
  #
6191
6532
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/UpdateAliasRequest AWS API Documentation
@@ -6299,6 +6640,16 @@ module Aws::KMS
6299
6640
  # To change this value, the external key store must be disconnected.
6300
6641
  # @return [String]
6301
6642
  #
6643
+ # @!attribute [rw] xks_proxy_vpc_endpoint_service_owner
6644
+ # Changes the Amazon Web Services account ID that KMS uses to identify
6645
+ # the Amazon VPC endpoint service for your external key store proxy
6646
+ # (XKS proxy). This parameter is optional. If not specified, the
6647
+ # current Amazon Web Services account ID for the VPC endpoint service
6648
+ # will not be updated.
6649
+ #
6650
+ # To change this value, the external key store must be disconnected.
6651
+ # @return [String]
6652
+ #
6302
6653
  # @!attribute [rw] xks_proxy_authentication_credential
6303
6654
  # Changes the credentials that KMS uses to sign requests to the
6304
6655
  # external key store proxy (XKS proxy). This parameter is valid only
@@ -6346,6 +6697,7 @@ module Aws::KMS
6346
6697
  :xks_proxy_uri_endpoint,
6347
6698
  :xks_proxy_uri_path,
6348
6699
  :xks_proxy_vpc_endpoint_service_name,
6700
+ :xks_proxy_vpc_endpoint_service_owner,
6349
6701
  :xks_proxy_authentication_credential,
6350
6702
  :xks_proxy_connectivity)
6351
6703
  SENSITIVE = [:key_store_password]
@@ -6464,19 +6816,19 @@ module Aws::KMS
6464
6816
  #
6465
6817
  #
6466
6818
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
6467
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6819
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
6468
6820
  # @return [Array<String>]
6469
6821
  #
6470
6822
  # @!attribute [rw] dry_run
6471
6823
  # Checks if your request will succeed. `DryRun` is an optional
6472
6824
  # parameter.
6473
6825
  #
6474
- # To learn more about how to use this parameter, see [Testing your KMS
6475
- # API calls][1] in the *Key Management Service Developer Guide*.
6826
+ # To learn more about how to use this parameter, see [Testing your
6827
+ # permissions][1] in the *Key Management Service Developer Guide*.
6476
6828
  #
6477
6829
  #
6478
6830
  #
6479
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
6831
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
6480
6832
  # @return [Boolean]
6481
6833
  #
6482
6834
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/VerifyMacRequest AWS API Documentation
@@ -6560,28 +6912,42 @@ module Aws::KMS
6560
6912
  # Tells KMS whether the value of the `Message` parameter should be
6561
6913
  # hashed as part of the signing algorithm. Use `RAW` for unhashed
6562
6914
  # messages; use `DIGEST` for message digests, which are already
6563
- # hashed.
6915
+ # hashed; use `EXTERNAL_MU` for 64-byte representative μ used in
6916
+ # ML-DSA signing as defined in NIST FIPS 204 Section 6.2.
6564
6917
  #
6565
6918
  # When the value of `MessageType` is `RAW`, KMS uses the standard
6566
6919
  # signing algorithm, which begins with a hash function. When the value
6567
6920
  # is `DIGEST`, KMS skips the hashing step in the signing algorithm.
6921
+ # When the value is `EXTERNAL_MU` KMS skips the concatenated hashing
6922
+ # of the public key hash and the message done in the ML-DSA signing
6923
+ # algorithm.
6924
+ #
6925
+ # Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
6926
+ # `Message` parameter is a message digest. If you use the `DIGEST`
6927
+ # value with an unhashed message, the security of the signing
6928
+ # operation can be compromised.
6929
+ #
6930
+ # When using ECC\_NIST\_EDWARDS25519 KMS keys:
6568
6931
  #
6569
- # Use the `DIGEST` value only when the value of the `Message`
6570
- # parameter is a message digest. If you use the `DIGEST` value with an
6571
- # unhashed message, the security of the verification operation can be
6572
- # compromised.
6932
+ # * ED25519\_SHA\_512 signing algorithm requires KMS `MessageType:RAW`
6573
6933
  #
6574
- # When the value of `MessageType`is `DIGEST`, the length of the
6934
+ # * ED25519\_PH\_SHA\_512 signing algorithm requires KMS
6935
+ # `MessageType:DIGEST`
6936
+ #
6937
+ # When the value of `MessageType` is `DIGEST`, the length of the
6575
6938
  # `Message` value must match the length of hashed messages for the
6576
6939
  # specified signing algorithm.
6577
6940
  #
6941
+ # When the value of `MessageType` is `EXTERNAL_MU` the length of the
6942
+ # `Message` value must be 64 bytes.
6943
+ #
6578
6944
  # You can submit a message digest and omit the `MessageType` or
6579
6945
  # specify `RAW` so the digest is hashed again while signing. However,
6580
6946
  # if the signed message is hashed once while signing, but twice while
6581
6947
  # verifying, verification fails, even when the message hasn't
6582
6948
  # changed.
6583
6949
  #
6584
- # The hashing algorithm in that `Verify` uses is based on the
6950
+ # The hashing algorithm that `Verify` uses is based on the
6585
6951
  # `SigningAlgorithm` value.
6586
6952
  #
6587
6953
  # * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
@@ -6593,12 +6959,15 @@ module Aws::KMS
6593
6959
  # * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
6594
6960
  # algorithm.
6595
6961
  #
6962
+ # * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256
6963
+ # hashing algorithm.
6964
+ #
6596
6965
  # * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
6597
6966
  # verification with SM2 key pairs][1].
6598
6967
  #
6599
6968
  #
6600
6969
  #
6601
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
6970
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
6602
6971
  # @return [String]
6603
6972
  #
6604
6973
  # @!attribute [rw] signature
@@ -6621,19 +6990,19 @@ module Aws::KMS
6621
6990
  #
6622
6991
  #
6623
6992
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
6624
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6993
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
6625
6994
  # @return [Array<String>]
6626
6995
  #
6627
6996
  # @!attribute [rw] dry_run
6628
6997
  # Checks if your request will succeed. `DryRun` is an optional
6629
6998
  # parameter.
6630
6999
  #
6631
- # To learn more about how to use this parameter, see [Testing your KMS
6632
- # API calls][1] in the *Key Management Service Developer Guide*.
7000
+ # To learn more about how to use this parameter, see [Testing your
7001
+ # permissions][1] in the *Key Management Service Developer Guide*.
6633
7002
  #
6634
7003
  #
6635
7004
  #
6636
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
7005
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
6637
7006
  # @return [Boolean]
6638
7007
  #
6639
7008
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/VerifyRequest AWS API Documentation
@@ -6834,6 +7203,13 @@ module Aws::KMS
6834
7203
  # with KMS.
6835
7204
  # @return [String]
6836
7205
  #
7206
+ # @!attribute [rw] vpc_endpoint_service_owner
7207
+ # The Amazon Web Services account ID that owns the Amazon VPC endpoint
7208
+ # service used to communicate with the external key store proxy (XKS).
7209
+ # This field appears only when the XKS uses an VPC endpoint service to
7210
+ # communicate with KMS.
7211
+ # @return [String]
7212
+ #
6837
7213
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/XksProxyConfigurationType AWS API Documentation
6838
7214
  #
6839
7215
  class XksProxyConfigurationType < Struct.new(
@@ -6841,7 +7217,8 @@ module Aws::KMS
6841
7217
  :access_key_id,
6842
7218
  :uri_endpoint,
6843
7219
  :uri_path,
6844
- :vpc_endpoint_service_name)
7220
+ :vpc_endpoint_service_name,
7221
+ :vpc_endpoint_service_owner)
6845
7222
  SENSITIVE = [:access_key_id]
6846
7223
  include Aws::Structure
6847
7224
  end