aws-sdk-kms 1.99.0 → 1.112.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +65 -0
  3. data/VERSION +1 -1
  4. data/lib/aws-sdk-kms/client.rb +817 -583
  5. data/lib/aws-sdk-kms/client_api.rb +37 -4
  6. data/lib/aws-sdk-kms/types.rb +497 -212
  7. data/lib/aws-sdk-kms.rb +1 -1
  8. data/sig/client.rbs +33 -13
  9. data/sig/resource.rbs +1 -0
  10. data/sig/types.rbs +40 -12
  11. metadata +6 -9
data/lib/aws-sdk-kms/client.rb CHANGED
@@ -95,8 +95,8 @@ module Aws::KMS
95
95
  # class name or an instance of a plugin class.
96
96
  #
97
97
  # @option options [required, Aws::CredentialProvider] :credentials
98
- # Your AWS credentials. This can be an instance of any one of the
99
- # following classes:
98
+ # Your AWS credentials used for authentication. This can be any class that includes and implements
99
+ # `Aws::CredentialProvider`, or instance of any one of the following classes:
100
100
  #
101
101
  # * `Aws::Credentials` - Used for configuring static, non-refreshing
102
102
  # credentials.
@@ -124,22 +124,24 @@ module Aws::KMS
124
124
  # * `Aws::CognitoIdentityCredentials` - Used for loading credentials
125
125
  # from the Cognito Identity service.
126
126
  #
127
- # When `:credentials` are not configured directly, the following
128
- # locations will be searched for credentials:
127
+ # When `:credentials` are not configured directly, the following locations will be searched for credentials:
129
128
  #
130
129
  # * `Aws.config[:credentials]`
130
+ #
131
131
  # * The `:access_key_id`, `:secret_access_key`, `:session_token`, and
132
132
  # `:account_id` options.
133
- # * ENV['AWS_ACCESS_KEY_ID'], ENV['AWS_SECRET_ACCESS_KEY'],
134
- # ENV['AWS_SESSION_TOKEN'], and ENV['AWS_ACCOUNT_ID']
133
+ #
134
+ # * `ENV['AWS_ACCESS_KEY_ID']`, `ENV['AWS_SECRET_ACCESS_KEY']`,
135
+ # `ENV['AWS_SESSION_TOKEN']`, and `ENV['AWS_ACCOUNT_ID']`.
136
+ #
135
137
  # * `~/.aws/credentials`
138
+ #
136
139
  # * `~/.aws/config`
137
- # * EC2/ECS IMDS instance profile - When used by default, the timeouts
138
- # are very aggressive. Construct and pass an instance of
139
- # `Aws::InstanceProfileCredentials` or `Aws::ECSCredentials` to
140
- # enable retries and extended timeouts. Instance profile credential
141
- # fetching can be disabled by setting ENV['AWS_EC2_METADATA_DISABLED']
142
- # to true.
140
+ #
141
+ # * EC2/ECS IMDS instance profile - When used by default, the timeouts are very aggressive.
142
+ # Construct and pass an instance of `Aws::InstanceProfileCredentials` or `Aws::ECSCredentials` to
143
+ # enable retries and extended timeouts. Instance profile credential fetching can be disabled by
144
+ # setting `ENV['AWS_EC2_METADATA_DISABLED']` to `true`.
143
145
  #
144
146
  # @option options [required, String] :region
145
147
  # The AWS region to connect to. The configured `:region` is
@@ -167,6 +169,11 @@ module Aws::KMS
167
169
  # When false, the request will raise a `RetryCapacityNotAvailableError` and will
168
170
  # not retry instead of sleeping.
169
171
  #
172
+ # @option options [Array<String>] :auth_scheme_preference
173
+ # A list of preferred authentication schemes to use when making a request. Supported values are:
174
+ # `sigv4`, `sigv4a`, `httpBearerAuth`, and `noAuth`. When set using `ENV['AWS_AUTH_SCHEME_PREFERENCE']` or in
175
+ # shared config as `auth_scheme_preference`, the value should be a comma-separated list.
176
+ #
170
177
  # @option options [Boolean] :client_side_monitoring (false)
171
178
  # When `true`, client-side metrics will be collected for all API requests from
172
179
  # this client.
@@ -200,8 +207,7 @@ module Aws::KMS
200
207
  # accepted modes and the configuration defaults that are included.
201
208
  #
202
209
  # @option options [Boolean] :disable_host_prefix_injection (false)
203
- # Set to true to disable SDK automatically adding host prefix
204
- # to default service endpoint when available.
210
+ # When `true`, the SDK will not prepend the modeled host prefix to the endpoint.
205
211
  #
206
212
  # @option options [Boolean] :disable_request_compression (false)
207
213
  # When set to 'true' the request body will not be compressed
@@ -254,8 +260,8 @@ module Aws::KMS
254
260
  # 4 times. Used in `standard` and `adaptive` retry modes.
255
261
  #
256
262
  # @option options [String] :profile ("default")
257
- # Used when loading credentials from the shared credentials file
258
- # at HOME/.aws/credentials. When not specified, 'default' is used.
263
+ # Used when loading credentials from the shared credentials file at `HOME/.aws/credentials`.
264
+ # When not specified, 'default' is used.
259
265
  #
260
266
  # @option options [String] :request_checksum_calculation ("when_supported")
261
267
  # Determines when a checksum will be calculated for request payloads. Values are:
@@ -375,8 +381,8 @@ module Aws::KMS
375
381
  # `Aws::Telemetry::OTelProvider` for telemetry provider.
376
382
  #
377
383
  # @option options [Aws::TokenProvider] :token_provider
378
- # A Bearer Token Provider. This can be an instance of any one of the
379
- # following classes:
384
+ # Your Bearer token used for authentication. This can be any class that includes and implements
385
+ # `Aws::TokenProvider`, or instance of any one of the following classes:
380
386
  #
381
387
  # * `Aws::StaticTokenProvider` - Used for configuring static, non-refreshing
382
388
  # tokens.
@@ -504,7 +510,7 @@ module Aws::KMS
504
510
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
505
511
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
506
512
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
507
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
513
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
508
514
  #
509
515
  # @option params [required, String] :key_id
510
516
  # Identifies the KMS key whose deletion is being canceled.
@@ -576,9 +582,9 @@ module Aws::KMS
576
582
  # custom key store is connected. To get the connection state of the
577
583
  # custom key store, use the DescribeCustomKeyStores operation.
578
584
  #
579
- # This operation is part of the [custom key stores][1] feature in KMS,
580
- # which combines the convenience and extensive integration of KMS with
581
- # the isolation and control of a key store that you own and manage.
585
+ # This operation is part of the custom key stores feature in KMS, which
586
+ # combines the convenience and extensive integration of KMS with the
587
+ # isolation and control of a key store that you own and manage.
582
588
  #
583
589
  # The `ConnectCustomKeyStore` operation might fail for various reasons.
584
590
  # To find the reason, use the DescribeCustomKeyStores operation and see
@@ -652,14 +658,14 @@ module Aws::KMS
652
658
  #
653
659
  #
654
660
  #
655
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
661
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
656
662
  # [2]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html
657
663
  # [3]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html
658
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
664
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
659
665
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
660
666
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
661
667
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
662
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
668
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
663
669
  #
664
670
  # @option params [required, String] :custom_key_store_id
665
671
  # Enter the key store ID of the custom key store that you want to
@@ -721,7 +727,7 @@ module Aws::KMS
721
727
  #
722
728
  # The alias must be unique in the account and Region, but you can have
723
729
  # aliases with the same name in different Regions. For detailed
724
- # information about aliases, see [Using aliases][3] in the *Key
730
+ # information about aliases, see [Aliases in KMS][3] in the *Key
725
731
  # Management Service Developer Guide*.
726
732
  #
727
733
  # This operation does not return a response. To get the alias that you
@@ -757,12 +763,12 @@ module Aws::KMS
757
763
  #
758
764
  #
759
765
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
760
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
766
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
761
767
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
762
768
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
763
769
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
764
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
765
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
770
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html
771
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
766
772
  #
767
773
  # @option params [required, String] :alias_name
768
774
  # Specifies the alias name. This value must begin with `alias/` followed
@@ -780,7 +786,7 @@ module Aws::KMS
780
786
  #
781
787
  #
782
788
  #
783
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
789
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
784
790
  #
785
791
  # @option params [required, String] :target_key_id
786
792
  # Associates the alias with the specified [customer managed key][1]. The
@@ -789,7 +795,7 @@ module Aws::KMS
789
795
  # A valid key ID is required. If you supply a null or empty string
790
796
  # value, this operation returns an error.
791
797
  #
792
- # For help finding the key ID and ARN, see [Finding the Key ID and
798
+ # For help finding the key ID and ARN, see [Find the key ID and key
793
799
  # ARN][2] in the <i> <i>Key Management Service Developer Guide</i> </i>.
794
800
  #
795
801
  # Specify the key ID or key ARN of the KMS key.
@@ -806,8 +812,8 @@ module Aws::KMS
806
812
  #
807
813
  #
808
814
  #
809
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
810
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn
815
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
816
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html
811
817
  #
812
818
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
813
819
  #
@@ -845,9 +851,9 @@ module Aws::KMS
845
851
  # stores][4] backed by an external key store proxy and external key
846
852
  # manager outside of Amazon Web Services.
847
853
  #
848
- # This operation is part of the [custom key stores][1] feature in KMS,
849
- # which combines the convenience and extensive integration of KMS with
850
- # the isolation and control of a key store that you own and manage.
854
+ # This operation is part of the custom key stores feature in KMS, which
855
+ # combines the convenience and extensive integration of KMS with the
856
+ # isolation and control of a key store that you own and manage.
851
857
  #
852
858
  # Before you create the custom key store, the required elements must be
853
859
  # in place and operational. We recommend that you use the test tools
@@ -900,9 +906,6 @@ module Aws::KMS
900
906
  # immediately, you might want to connect it to verify that all settings
901
907
  # are correct and then disconnect it until you are ready to use it.
902
908
  #
903
- # For help with failures, see [Troubleshooting a custom key store][7] in
904
- # the *Key Management Service Developer Guide*.
905
- #
906
909
  # **Cross-account use**: No. You cannot perform this operation on a
907
910
  # custom key store in a different Amazon Web Services account.
908
911
  #
@@ -925,7 +928,7 @@ module Aws::KMS
925
928
  #
926
929
  #
927
930
  #
928
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
931
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
929
932
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
930
933
  # [3]: https://docs.aws.amazon.com/cloudhsm/latest/userguide/clusters.html
931
934
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
@@ -934,7 +937,7 @@ module Aws::KMS
934
937
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
935
938
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
936
939
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
937
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
940
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
938
941
  #
939
942
  # @option params [required, String] :custom_key_store_name
940
943
  # Specifies a friendly name for the custom key store. The name must be
@@ -988,7 +991,7 @@ module Aws::KMS
988
991
  #
989
992
  #
990
993
  #
991
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser
994
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser
992
995
  #
993
996
  # @option params [String] :custom_key_store_type
994
997
  # Specifies the type of custom key store. The default value is
@@ -1089,7 +1092,7 @@ module Aws::KMS
1089
1092
  # `RawSecretAccessKey`, a secret key, and `AccessKeyId`, a unique
1090
1093
  # identifier for the `RawSecretAccessKey`. For character requirements,
1091
1094
  # see
1092
- # [XksProxyAuthenticationCredentialType](kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html).
1095
+ # [XksProxyAuthenticationCredentialType](API_XksProxyAuthenticationCredentialType.html).
1093
1096
  #
1094
1097
  # KMS uses this authentication credential to sign requests to the
1095
1098
  # external key store proxy on your behalf. This credential is unrelated
@@ -1129,7 +1132,7 @@ module Aws::KMS
1129
1132
  #
1130
1133
  #
1131
1134
  #
1132
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity
1135
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/choose-xks-connectivity.html
1133
1136
  #
1134
1137
  # @return [Types::CreateCustomKeyStoreResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
1135
1138
  #
@@ -1238,8 +1241,9 @@ module Aws::KMS
1238
1241
  #
1239
1242
  # For detailed information about grants, including grant terminology,
1240
1243
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
1241
- # Guide</i> </i>. For examples of working with grants in several
1242
- # programming languages, see [Programming grants][2].
1244
+ # Guide</i> </i>. For examples of creating grants in several programming
1245
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
1246
+ # CLI][2].
1243
1247
  #
1244
1248
  # The `CreateGrant` operation returns a `GrantToken` and a `GrantId`.
1245
1249
  #
@@ -1285,11 +1289,11 @@ module Aws::KMS
1285
1289
  #
1286
1290
  #
1287
1291
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
1288
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
1289
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1292
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
1293
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1290
1294
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
1291
1295
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1292
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
1296
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
1293
1297
  #
1294
1298
  # @option params [required, String] :key_id
1295
1299
  # Identifies the KMS key for the grant. The grant gives principals
@@ -1342,7 +1346,7 @@ module Aws::KMS
1342
1346
  #
1343
1347
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
1344
1348
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns
1345
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
1349
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
1346
1350
  #
1347
1351
  # @option params [required, Array<String>] :operations
1348
1352
  # A list of operations that the grant permits.
@@ -1411,7 +1415,7 @@ module Aws::KMS
1411
1415
  #
1412
1416
  #
1413
1417
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
1414
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
1418
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
1415
1419
  #
1416
1420
  # @option params [String] :name
1417
1421
  # A friendly name for the grant. Use this value to prevent the
@@ -1437,12 +1441,12 @@ module Aws::KMS
1437
1441
  # Checks if your request will succeed. `DryRun` is an optional
1438
1442
  # parameter.
1439
1443
  #
1440
- # To learn more about how to use this parameter, see [Testing your KMS
1441
- # API calls][1] in the *Key Management Service Developer Guide*.
1444
+ # To learn more about how to use this parameter, see [Testing your
1445
+ # permissions][1] in the *Key Management Service Developer Guide*.
1442
1446
  #
1443
1447
  #
1444
1448
  #
1445
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
1449
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
1446
1450
  #
1447
1451
  # @return [Types::CreateGrantResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
1448
1452
  #
@@ -1512,16 +1516,15 @@ module Aws::KMS
1512
1516
  # A KMS key is a logical representation of a cryptographic key. In
1513
1517
  # addition to the key material used in cryptographic operations, a KMS
1514
1518
  # key includes metadata, such as the key ID, key policy, creation date,
1515
- # description, and key state. For details, see [Managing keys][2] in the
1516
- # *Key Management Service Developer Guide*
1519
+ # description, and key state.
1517
1520
  #
1518
1521
  # Use the parameters of `CreateKey` to specify the type of KMS key, the
1519
1522
  # source of its key material, its key policy, description, tags, and
1520
1523
  # other properties.
1521
1524
  #
1522
- # <note markdown="1"> KMS has replaced the term *customer master key (CMK)* with *KMS key*
1523
- # and *KMS key*. The concept has not changed. To prevent breaking
1524
- # changes, KMS is keeping some variations of this term.
1525
+ # <note markdown="1"> KMS has replaced the term *customer master key (CMK)* with *Key
1526
+ # Management Service key* and *KMS key*. The concept has not changed. To
1527
+ # prevent breaking changes, KMS is keeping some variations of this term.
1525
1528
  #
1526
1529
  # </note>
1527
1530
  #
@@ -1559,20 +1562,21 @@ module Aws::KMS
1559
1562
  # properties after the KMS key is created.
1560
1563
  #
1561
1564
  # Asymmetric KMS keys contain an RSA key pair, Elliptic Curve (ECC)
1562
- # key pair, or an SM2 key pair (China Regions only). The private key
1563
- # in an asymmetric KMS key never leaves KMS unencrypted. However, you
1564
- # can use the GetPublicKey operation to download the public key so it
1565
- # can be used outside of KMS. Each KMS key can have only one key
1566
- # usage. KMS keys with RSA key pairs can be used to encrypt and
1567
- # decrypt data or sign and verify messages (but not both). KMS keys
1568
- # with NIST-recommended ECC key pairs can be used to sign and verify
1569
- # messages or derive shared secrets (but not both). KMS keys with
1570
- # `ECC_SECG_P256K1` can be used only to sign and verify messages. KMS
1571
- # keys with SM2 key pairs (China Regions only) can be used to either
1572
- # encrypt and decrypt data, sign and verify messages, or derive shared
1573
- # secrets (you must choose one key usage type). For information about
1574
- # asymmetric KMS keys, see [Asymmetric KMS keys][3] in the *Key
1575
- # Management Service Developer Guide*.
1565
+ # key pair, ML-DSA key pair or an SM2 key pair (China Regions only).
1566
+ # The private key in an asymmetric KMS key never leaves KMS
1567
+ # unencrypted. However, you can use the GetPublicKey operation to
1568
+ # download the public key so it can be used outside of KMS. Each KMS
1569
+ # key can have only one key usage. KMS keys with RSA key pairs can be
1570
+ # used to encrypt and decrypt data or sign and verify messages (but
1571
+ # not both). KMS keys with NIST-recommended ECC key pairs can be used
1572
+ # to sign and verify messages or derive shared secrets (but not both).
1573
+ # KMS keys with `ECC_SECG_P256K1` can be used only to sign and verify
1574
+ # messages. KMS keys with ML-DSA key pairs can be used to sign and
1575
+ # verify messages. KMS keys with SM2 key pairs (China Regions only)
1576
+ # can be used to either encrypt and decrypt data, sign and verify
1577
+ # messages, or derive shared secrets (you must choose one key usage
1578
+ # type). For information about asymmetric KMS keys, see [Asymmetric
1579
+ # KMS keys][2] in the *Key Management Service Developer Guide*.
1576
1580
  #
1577
1581
  #
1578
1582
  #
@@ -1615,7 +1619,7 @@ module Aws::KMS
1615
1619
  # to encrypt data in one Amazon Web Services Region and decrypt it in
1616
1620
  # a different Amazon Web Services Region without re-encrypting the
1617
1621
  # data or making a cross-Region call. For more information about
1618
- # multi-Region keys, see [Multi-Region keys in KMS][4] in the *Key
1622
+ # multi-Region keys, see [Multi-Region keys in KMS][3] in the *Key
1619
1623
  # Management Service Developer Guide*.
1620
1624
  #
1621
1625
  #
@@ -1627,7 +1631,7 @@ module Aws::KMS
1627
1631
  # token. Use the wrapping public key to encrypt your key material.
1628
1632
  # Then, use ImportKeyMaterial with your import token to import the key
1629
1633
  # material. For step-by-step instructions, see [Importing Key
1630
- # Material][5] in the <i> <i>Key Management Service Developer
1634
+ # Material][4] in the <i> <i>Key Management Service Developer
1631
1635
  # Guide</i> </i>.
1632
1636
  #
1633
1637
  # You can import key material into KMS keys of all supported KMS key
@@ -1640,23 +1644,22 @@ module Aws::KMS
1640
1644
  # the `Origin` parameter of `CreateKey` with a value of `EXTERNAL` and
1641
1645
  # the `MultiRegion` parameter with a value of `True`. To create
1642
1646
  # replicas of the multi-Region primary key, use the ReplicateKey
1643
- # operation. For instructions, see [Importing key material into
1644
- # multi-Region keys][6]. For more information about multi-Region keys,
1645
- # see [Multi-Region keys in KMS][4] in the *Key Management Service
1646
- # Developer Guide*.
1647
+ # operation. For instructions, see [Importing key material step 1][5].
1648
+ # For more information about multi-Region keys, see [Multi-Region keys
1649
+ # in KMS][3] in the *Key Management Service Developer Guide*.
1647
1650
  #
1648
1651
  #
1649
1652
  #
1650
1653
  # Custom key store
1651
1654
  #
1652
- # : A [custom key store][7] lets you protect your Amazon Web Services
1655
+ # : A [custom key store][6] lets you protect your Amazon Web Services
1653
1656
  # resources using keys in a backing key store that you own and manage.
1654
1657
  # When you request a cryptographic operation with a KMS key in a
1655
1658
  # custom key store, the operation is performed in the backing key
1656
1659
  # store using its cryptographic keys.
1657
1660
  #
1658
- # KMS supports [CloudHSM key stores][8] backed by an CloudHSM cluster
1659
- # and [external key stores][9] backed by an external key manager
1661
+ # KMS supports [CloudHSM key stores][7] backed by an CloudHSM cluster
1662
+ # and [external key stores][8] backed by an external key manager
1660
1663
  # outside of Amazon Web Services. When you create a KMS key in an
1661
1664
  # CloudHSM key store, KMS generates an encryption key in the CloudHSM
1662
1665
  # cluster and associates it with the KMS key. When you create a KMS
@@ -1681,13 +1684,13 @@ module Aws::KMS
1681
1684
  # `ENCRYPT_DECRYPT` to create a symmetric encryption key. No other key
1682
1685
  # type is supported in a custom key store.
1683
1686
  #
1684
- # To create a KMS key in an [CloudHSM key store][8], use the `Origin`
1687
+ # To create a KMS key in an [CloudHSM key store][9], use the `Origin`
1685
1688
  # parameter with a value of `AWS_CLOUDHSM`. The CloudHSM cluster that
1686
1689
  # is associated with the custom key store must have at least two
1687
1690
  # active HSMs in different Availability Zones in the Amazon Web
1688
1691
  # Services Region.
1689
1692
  #
1690
- # To create a KMS key in an [external key store][9], use the `Origin`
1693
+ # To create a KMS key in an [external key store][10], use the `Origin`
1691
1694
  # parameter with a value of `EXTERNAL_KEY_STORE` and an `XksKeyId`
1692
1695
  # parameter that identifies an existing external key.
1693
1696
  #
@@ -1700,10 +1703,10 @@ module Aws::KMS
1700
1703
  # **Cross-account use**: No. You cannot use this operation to create a
1701
1704
  # KMS key in a different Amazon Web Services account.
1702
1705
  #
1703
- # **Required permissions**: [kms:CreateKey][10] (IAM policy). To use the
1704
- # `Tags` parameter, [kms:TagResource][10] (IAM policy). For examples and
1706
+ # **Required permissions**: [kms:CreateKey][11] (IAM policy). To use the
1707
+ # `Tags` parameter, [kms:TagResource][11] (IAM policy). For examples and
1705
1708
  # information about related permissions, see [Allow a user to create KMS
1706
- # keys][11] in the *Key Management Service Developer Guide*.
1709
+ # keys][12] in the *Key Management Service Developer Guide*.
1707
1710
  #
1708
1711
  # **Related operations:**
1709
1712
  #
@@ -1714,22 +1717,23 @@ module Aws::KMS
1714
1717
  # * ScheduleKeyDeletion
1715
1718
  #
1716
1719
  # **Eventual consistency**: The KMS API follows an eventual consistency
1717
- # model. For more information, see [KMS eventual consistency][12].
1720
+ # model. For more information, see [KMS eventual consistency][13].
1718
1721
  #
1719
1722
  #
1720
1723
  #
1721
1724
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys
1722
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html
1723
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
1724
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
1725
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
1726
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html
1727
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1728
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
1729
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1730
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1731
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html#iam-policy-example-create-key
1732
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
1725
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
1726
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
1727
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
1728
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html
1729
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1730
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
1731
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
1732
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html
1733
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html
1734
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
1735
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/customer-managed-policies.html#iam-policy-example-create-key
1736
+ # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
1733
1737
  #
1734
1738
  # @option params [String] :policy
1735
1739
  # The key policy to attach to the KMS key.
@@ -1751,22 +1755,38 @@ module Aws::KMS
1751
1755
  # not always immediately visible][2] in the *Amazon Web Services
1752
1756
  # Identity and Access Management User Guide*.
1753
1757
  #
1758
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are missing
1759
+ # from a key policy statement, the policy statement has no effect. When
1760
+ # a key policy statement is missing one of these elements, the KMS
1761
+ # console correctly reports an error, but the `CreateKey` and
1762
+ # `PutKeyPolicy` API requests succeed, even though the policy statement
1763
+ # is ineffective.
1764
+ #
1765
+ # For more information on required key policy elements, see [Elements in
1766
+ # a key policy][3] in the *Key Management Service Developer Guide*.
1767
+ #
1768
+ # </note>
1769
+ #
1754
1770
  # If you do not provide a key policy, KMS attaches a default key policy
1755
- # to the KMS key. For more information, see [Default key policy][3] in
1771
+ # to the KMS key. For more information, see [Default key policy][4] in
1756
1772
  # the *Key Management Service Developer Guide*.
1757
1773
  #
1758
- # The key policy size quota is 32 kilobytes (32768 bytes).
1774
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
1775
+ # `LimitExceededException`.
1776
+ #
1777
+ # </note>
1759
1778
  #
1760
1779
  # For help writing and formatting a JSON policy document, see the [IAM
1761
- # JSON Policy Reference][4] in the <i> <i>Identity and Access Management
1780
+ # JSON Policy Reference][5] in the <i> <i>Identity and Access Management
1762
1781
  # User Guide</i> </i>.
1763
1782
  #
1764
1783
  #
1765
1784
  #
1766
1785
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
1767
1786
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
1768
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
1769
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
1787
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
1788
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
1789
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
1770
1790
  #
1771
1791
  # @option params [String] :description
1772
1792
  # A description of the KMS key. Use a description that helps you decide
@@ -1800,7 +1820,10 @@ module Aws::KMS
1800
1820
  # * For asymmetric KMS keys with NIST-recommended elliptic curve key
1801
1821
  # pairs, specify `SIGN_VERIFY` or `KEY_AGREEMENT`.
1802
1822
  #
1803
- # * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs specify
1823
+ # * For asymmetric KMS keys with `ECC_SECG_P256K1` key pairs, specify
1824
+ # `SIGN_VERIFY`.
1825
+ #
1826
+ # * For asymmetric KMS keys with ML-DSA key pairs, specify
1804
1827
  # `SIGN_VERIFY`.
1805
1828
  #
1806
1829
  # * For asymmetric KMS keys with SM2 key pairs (China Regions only),
@@ -1808,7 +1831,7 @@ module Aws::KMS
1808
1831
  #
1809
1832
  #
1810
1833
  #
1811
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
1834
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
1812
1835
  #
1813
1836
  # @option params [String] :customer_master_key_spec
1814
1837
  # Instead, use the `KeySpec` parameter.
@@ -1822,20 +1845,21 @@ module Aws::KMS
1822
1845
  # Specifies the type of KMS key to create. The default value,
1823
1846
  # `SYMMETRIC_DEFAULT`, creates a KMS key with a 256-bit AES-GCM key that
1824
1847
  # is used for encryption and decryption, except in China Regions, where
1825
- # it creates a 128-bit symmetric key that uses SM4 encryption. For help
1826
- # choosing a key spec for your KMS key, see [Choosing a KMS key type][1]
1827
- # in the <i> <i>Key Management Service Developer Guide</i> </i>.
1848
+ # it creates a 128-bit symmetric key that uses SM4 encryption. For a
1849
+ # detailed description of all supported key specs, see [Key spec
1850
+ # reference][1] in the <i> <i>Key Management Service Developer Guide</i>
1851
+ # </i>.
1828
1852
  #
1829
1853
  # The `KeySpec` determines whether the KMS key contains a symmetric key
1830
1854
  # or an asymmetric key pair. It also determines the algorithms that the
1831
1855
  # KMS key supports. You can't change the `KeySpec` after the KMS key is
1832
1856
  # created. To further restrict the algorithms that can be used with the
1833
1857
  # KMS key, use a condition key in its key policy or IAM policy. For more
1834
- # information, see [kms:EncryptionAlgorithm][2], [kms:MacAlgorithm][3]
1835
- # or [kms:Signing Algorithm][4] in the <i> <i>Key Management Service
1836
- # Developer Guide</i> </i>.
1858
+ # information, see [kms:EncryptionAlgorithm][2], [kms:MacAlgorithm][3],
1859
+ # [kms:KeyAgreementAlgorithm][4], or [kms:SigningAlgorithm][5] in the
1860
+ # <i> <i>Key Management Service Developer Guide</i> </i>.
1837
1861
  #
1838
- # [Amazon Web Services services that are integrated with KMS][5] use
1862
+ # [Amazon Web Services services that are integrated with KMS][6] use
1839
1863
  # symmetric encryption KMS keys to protect your data. These services do
1840
1864
  # not support asymmetric KMS keys or HMAC KMS keys.
1841
1865
  #
@@ -1876,6 +1900,13 @@ module Aws::KMS
1876
1900
  # * `ECC_SECG_P256K1` (secp256k1), commonly used for cryptocurrencies.
1877
1901
  #
1878
1902
  # ^
1903
+ # * Asymmetric ML-DSA key pairs (signing and verification)
1904
+ #
1905
+ # * `ML_DSA_44`
1906
+ #
1907
+ # * `ML_DSA_65`
1908
+ #
1909
+ # * `ML_DSA_87`
1879
1910
  # * SM2 key pairs (encryption and decryption -or- signing and
1880
1911
  # verification -or- deriving shared secrets)
1881
1912
  #
@@ -1885,11 +1916,12 @@ module Aws::KMS
1885
1916
  #
1886
1917
  #
1887
1918
  #
1888
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose
1889
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm
1890
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm
1891
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm
1892
- # [5]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
1919
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html
1920
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-algorithm
1921
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-mac-algorithm
1922
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-agreement-algorithm
1923
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-signing-algorithm
1924
+ # [6]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
1893
1925
  #
1894
1926
  # @option params [String] :origin
1895
1927
  # The source of the key material for the KMS key. You cannot change the
@@ -1939,7 +1971,7 @@ module Aws::KMS
1939
1971
  #
1940
1972
  #
1941
1973
  #
1942
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
1974
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
1943
1975
  #
1944
1976
  # @option params [Boolean] :bypass_policy_lockout_safety_check
1945
1977
  # Skips ("bypasses") the key policy lockout safety check. The default
@@ -1987,7 +2019,7 @@ module Aws::KMS
1987
2019
  # When you add tags to an Amazon Web Services resource, Amazon Web
1988
2020
  # Services generates a cost allocation report with usage and costs
1989
2021
  # aggregated by tags. Tags can also be used to control access to a KMS
1990
- # key. For details, see [Tagging Keys][3].
2022
+ # key. For details, see [Tags in KMS][3].
1991
2023
  #
1992
2024
  #
1993
2025
  #
@@ -2058,7 +2090,7 @@ module Aws::KMS
2058
2090
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
2059
2091
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
2060
2092
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy
2061
- # [4]: https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements
2093
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html#xks-key-requirements
2062
2094
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption
2063
2095
  #
2064
2096
  # @return [Types::CreateKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
@@ -2080,6 +2112,7 @@ module Aws::KMS
2080
2112
  # aws_account_id: "111122223333",
2081
2113
  # arn: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
2082
2114
  # creation_date: Time.parse("2017-07-05T14:04:55-07:00"),
2115
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
2083
2116
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
2084
2117
  # description: "",
2085
2118
  # enabled: true,
@@ -2132,8 +2165,7 @@ module Aws::KMS
2132
2165
  # @example Example: To create an asymmetric elliptic curve KMS key for signing and verification
2133
2166
  #
2134
2167
  # # This example creates a KMS key that contains an asymmetric elliptic curve (ECC) key pair for signing and verification.
2135
- # # The key usage is required even though "SIGN_VERIFY" is the only valid value for ECC KMS keys. The key spec and key usage
2136
- # # can't be changed after the key is created.
2168
+ # # The key spec and key usage can't be changed after the key is created.
2137
2169
  #
2138
2170
  # resp = client.create_key({
2139
2171
  # key_spec: "ECC_NIST_P521", # Describes the type of key material in the KMS key.
@@ -2194,6 +2226,38 @@ module Aws::KMS
2194
2226
  # }, # Detailed information about the KMS key that this operation creates.
2195
2227
  # }
2196
2228
  #
2229
+ # @example Example: To create an asymmetric ML-DSA KMS key for signing and verification
2230
+ #
2231
+ # # This example creates a module-lattice digital signature algorithm (ML-DSA) key for signing and verification. The
2232
+ # # key-usage parameter is required even though SIGN_VERIFY is the only valid value for ML-DSA keys.
2233
+ #
2234
+ # resp = client.create_key({
2235
+ # key_spec: "ML_DSA_65", # Describes the type of key material in the KMS key.
2236
+ # key_usage: "SIGN_VERIFY", # The cryptographic operations for which you can use the KMS key.
2237
+ # })
2238
+ #
2239
+ # resp.to_h outputs the following:
2240
+ # {
2241
+ # key_metadata: {
2242
+ # aws_account_id: "111122223333",
2243
+ # arn: "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
2244
+ # creation_date: Time.parse(1748371316.734),
2245
+ # customer_master_key_spec: "ML_DSA_65",
2246
+ # description: "",
2247
+ # enabled: true,
2248
+ # key_id: "1234abcd-12ab-34cd-56ef-1234567890ab",
2249
+ # key_manager: "CUSTOMER",
2250
+ # key_spec: "ML_DSA_65",
2251
+ # key_state: "Enabled",
2252
+ # key_usage: "SIGN_VERIFY",
2253
+ # multi_region: false,
2254
+ # origin: "AWS_KMS",
2255
+ # signing_algorithms: [
2256
+ # "ML_DSA_SHAKE_256",
2257
+ # ],
2258
+ # }, # Detailed information about the KMS key that this operation creates.
2259
+ # }
2260
+ #
2197
2261
  # @example Example: To create a multi-Region primary KMS key
2198
2262
  #
2199
2263
  # # This example creates a multi-Region primary symmetric encryption key. Because the default values for all parameters
@@ -2209,6 +2273,7 @@ module Aws::KMS
2209
2273
  # aws_account_id: "111122223333",
2210
2274
  # arn: "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef12345678990ab",
2211
2275
  # creation_date: Time.parse("2021-09-02T016:15:21-09:00"),
2276
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
2212
2277
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
2213
2278
  # description: "",
2214
2279
  # enabled: true,
@@ -2345,7 +2410,7 @@ module Aws::KMS
2345
2410
  # description: "DescriptionType",
2346
2411
  # key_usage: "SIGN_VERIFY", # accepts SIGN_VERIFY, ENCRYPT_DECRYPT, GENERATE_VERIFY_MAC, KEY_AGREEMENT
2347
2412
  # customer_master_key_spec: "RSA_2048", # accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, SYMMETRIC_DEFAULT, HMAC_224, HMAC_256, HMAC_384, HMAC_512, SM2
2348
- # key_spec: "RSA_2048", # accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, SYMMETRIC_DEFAULT, HMAC_224, HMAC_256, HMAC_384, HMAC_512, SM2
2413
+ # key_spec: "RSA_2048", # accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1, SYMMETRIC_DEFAULT, HMAC_224, HMAC_256, HMAC_384, HMAC_512, SM2, ML_DSA_44, ML_DSA_65, ML_DSA_87
2349
2414
  # origin: "AWS_KMS", # accepts AWS_KMS, EXTERNAL, AWS_CLOUDHSM, EXTERNAL_KEY_STORE
2350
2415
  # custom_key_store_id: "CustomKeyStoreIdType",
2351
2416
  # bypass_policy_lockout_safety_check: false,
@@ -2377,11 +2442,11 @@ module Aws::KMS
2377
2442
  # resp.key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
2378
2443
  # resp.key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
2379
2444
  # resp.key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
2380
- # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
2445
+ # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
2381
2446
  # resp.key_metadata.encryption_algorithms #=> Array
2382
2447
  # resp.key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
2383
2448
  # resp.key_metadata.signing_algorithms #=> Array
2384
- # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
2449
+ # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
2385
2450
  # resp.key_metadata.key_agreement_algorithms #=> Array
2386
2451
  # resp.key_metadata.key_agreement_algorithms[0] #=> String, one of "ECDH"
2387
2452
  # resp.key_metadata.multi_region #=> Boolean
@@ -2395,6 +2460,7 @@ module Aws::KMS
2395
2460
  # resp.key_metadata.mac_algorithms #=> Array
2396
2461
  # resp.key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
2397
2462
  # resp.key_metadata.xks_key_configuration.id #=> String
2463
+ # resp.key_metadata.current_key_material_id #=> String
2398
2464
  #
2399
2465
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/CreateKey AWS API Documentation
2400
2466
  #
@@ -2445,15 +2511,14 @@ module Aws::KMS
2445
2511
  # key that you intend.
2446
2512
  #
2447
2513
  # Whenever possible, use key policies to give users permission to call
2448
- # the `Decrypt` operation on a particular KMS key, instead of using
2449
- # &amp;IAM; policies. Otherwise, you might create an &amp;IAM; policy
2450
- # that gives the user `Decrypt` permission on all KMS keys. This user
2451
- # could decrypt ciphertext that was encrypted by KMS keys in other
2452
- # accounts if the key policy for the cross-account KMS key permits it.
2453
- # If you must use an IAM policy for `Decrypt` permissions, limit the
2454
- # user to particular KMS keys or particular trusted accounts. For
2455
- # details, see [Best practices for IAM policies][4] in the *Key
2456
- # Management Service Developer Guide*.
2514
+ # the `Decrypt` operation on a particular KMS key, instead of using IAM
2515
+ # policies. Otherwise, you might create an IAM policy that gives the
2516
+ # user `Decrypt` permission on all KMS keys. This user could decrypt
2517
+ # ciphertext that was encrypted by KMS keys in other accounts if the key
2518
+ # policy for the cross-account KMS key permits it. If you must use an
2519
+ # IAM policy for `Decrypt` permissions, limit the user to particular KMS
2520
+ # keys or particular trusted accounts. For details, see [Best practices
2521
+ # for IAM policies][4] in the *Key Management Service Developer Guide*.
2457
2522
  #
2458
2523
  # `Decrypt` also supports [Amazon Web Services Nitro Enclaves][5], which
2459
2524
  # provide an isolated compute environment in Amazon EC2. To call
@@ -2501,7 +2566,7 @@ module Aws::KMS
2501
2566
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
2502
2567
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
2503
2568
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2504
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2569
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2505
2570
  #
2506
2571
  # @option params [required, String, StringIO, File] :ciphertext_blob
2507
2572
  # Ciphertext to be decrypted. The blob includes metadata.
@@ -2526,8 +2591,8 @@ module Aws::KMS
2526
2591
  #
2527
2592
  #
2528
2593
  #
2529
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2530
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
2594
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2595
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
2531
2596
  #
2532
2597
  # @option params [Array<String>] :grant_tokens
2533
2598
  # A list of grant tokens.
@@ -2540,7 +2605,7 @@ module Aws::KMS
2540
2605
  #
2541
2606
  #
2542
2607
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
2543
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
2608
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
2544
2609
  #
2545
2610
  # @option params [String] :key_id
2546
2611
  # Specifies the KMS key that KMS uses to decrypt the ciphertext.
@@ -2616,12 +2681,12 @@ module Aws::KMS
2616
2681
  # Checks if your request will succeed. `DryRun` is an optional
2617
2682
  # parameter.
2618
2683
  #
2619
- # To learn more about how to use this parameter, see [Testing your KMS
2620
- # API calls][1] in the *Key Management Service Developer Guide*.
2684
+ # To learn more about how to use this parameter, see [Testing your
2685
+ # permissions][1] in the *Key Management Service Developer Guide*.
2621
2686
  #
2622
2687
  #
2623
2688
  #
2624
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
2689
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
2625
2690
  #
2626
2691
  # @return [Types::DecryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
2627
2692
  #
@@ -2629,6 +2694,7 @@ module Aws::KMS
2629
2694
  # * {Types::DecryptResponse#plaintext #plaintext} => String
2630
2695
  # * {Types::DecryptResponse#encryption_algorithm #encryption_algorithm} => String
2631
2696
  # * {Types::DecryptResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
2697
+ # * {Types::DecryptResponse#key_material_id #key_material_id} => String
2632
2698
  #
2633
2699
  #
2634
2700
  # @example Example: To decrypt data with a symmetric encryption KMS key
@@ -2645,6 +2711,7 @@ module Aws::KMS
2645
2711
  # {
2646
2712
  # encryption_algorithm: "SYMMETRIC_DEFAULT", # The encryption algorithm that was used to decrypt the ciphertext. SYMMETRIC_DEFAULT is the only valid value for symmetric encryption in AWS KMS.
2647
2713
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The Amazon Resource Name (ARN) of the KMS key that was used to decrypt the data.
2714
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to decrypt the ciphertext.
2648
2715
  # plaintext: "<binary data>", # The decrypted (plaintext) data.
2649
2716
  # }
2650
2717
  #
@@ -2711,6 +2778,7 @@ module Aws::KMS
2711
2778
  # resp.plaintext #=> String
2712
2779
  # resp.encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
2713
2780
  # resp.ciphertext_for_recipient #=> String
2781
+ # resp.key_material_id #=> String
2714
2782
  #
2715
2783
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Decrypt AWS API Documentation
2716
2784
  #
@@ -2767,7 +2835,7 @@ module Aws::KMS
2767
2835
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
2768
2836
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2769
2837
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
2770
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2838
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2771
2839
  #
2772
2840
  # @option params [required, String] :alias_name
2773
2841
  # The alias to be deleted. The alias name must begin with `alias/`
@@ -2806,9 +2874,9 @@ module Aws::KMS
2806
2874
  # does not affect the external key store proxy, external key manager, or
2807
2875
  # any external keys.
2808
2876
  #
2809
- # This operation is part of the [custom key stores][1] feature in KMS,
2810
- # which combines the convenience and extensive integration of KMS with
2811
- # the isolation and control of a key store that you own and manage.
2877
+ # This operation is part of the custom key stores feature in KMS, which
2878
+ # combines the convenience and extensive integration of KMS with the
2879
+ # isolation and control of a key store that you own and manage.
2812
2880
  #
2813
2881
  # The custom key store that you delete cannot contain any [KMS keys][2].
2814
2882
  # Before deleting the key store, verify that you will never need to use
@@ -2859,12 +2927,12 @@ module Aws::KMS
2859
2927
  #
2860
2928
  #
2861
2929
  #
2862
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
2930
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
2863
2931
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys
2864
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
2932
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
2865
2933
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
2866
2934
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2867
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
2935
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2868
2936
  #
2869
2937
  # @option params [required, String] :custom_key_store_id
2870
2938
  # Enter the ID of the custom key store you want to delete. To find the
@@ -2926,6 +2994,8 @@ module Aws::KMS
2926
2994
  #
2927
2995
  # * GetParametersForImport
2928
2996
  #
2997
+ # * ListKeyRotations
2998
+ #
2929
2999
  # * ImportKeyMaterial
2930
3000
  #
2931
3001
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -2936,7 +3006,7 @@ module Aws::KMS
2936
3006
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
2937
3007
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
2938
3008
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
2939
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3009
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
2940
3010
  #
2941
3011
  # @option params [required, String] :key_id
2942
3012
  # Identifies the KMS key from which you are deleting imported key
@@ -2954,7 +3024,19 @@ module Aws::KMS
2954
3024
  # To get the key ID and key ARN for a KMS key, use ListKeys or
2955
3025
  # DescribeKey.
2956
3026
  #
2957
- # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
3027
+ # @option params [String] :key_material_id
3028
+ # Identifies the imported key material you are deleting.
3029
+ #
3030
+ # If no KeyMaterialId is specified, KMS deletes the current key
3031
+ # material.
3032
+ #
3033
+ # To get the list of key material IDs associated with a KMS key, use
3034
+ # ListKeyRotations.
3035
+ #
3036
+ # @return [Types::DeleteImportedKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
3037
+ #
3038
+ # * {Types::DeleteImportedKeyMaterialResponse#key_id #key_id} => String
3039
+ # * {Types::DeleteImportedKeyMaterialResponse#key_material_id #key_material_id} => String
2958
3040
  #
2959
3041
  #
2960
3042
  # @example Example: To delete imported key material
@@ -2963,14 +3045,21 @@ module Aws::KMS
2963
3045
  #
2964
3046
  # resp = client.delete_imported_key_material({
2965
3047
  # key_id: "1234abcd-12ab-34cd-56ef-1234567890ab", # The identifier of the KMS key whose imported key material you are deleting. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
3048
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # Identifies the deleted key material.
2966
3049
  # })
2967
3050
  #
2968
3051
  # @example Request syntax with placeholder values
2969
3052
  #
2970
3053
  # resp = client.delete_imported_key_material({
2971
3054
  # key_id: "KeyIdType", # required
3055
+ # key_material_id: "BackingKeyIdType",
2972
3056
  # })
2973
3057
  #
3058
+ # @example Response structure
3059
+ #
3060
+ # resp.key_id #=> String
3061
+ # resp.key_material_id #=> String
3062
+ #
2974
3063
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DeleteImportedKeyMaterial AWS API Documentation
2975
3064
  #
2976
3065
  # @overload delete_imported_key_material(params = {})
@@ -3073,7 +3162,7 @@ module Aws::KMS
3073
3162
  # [2]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf
3074
3163
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3075
3164
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3076
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3165
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3077
3166
  #
3078
3167
  # @option params [required, String] :key_id
3079
3168
  # Identifies an asymmetric NIST-recommended ECC or SM2 (China Regions
@@ -3141,18 +3230,18 @@ module Aws::KMS
3141
3230
  #
3142
3231
  #
3143
3232
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3144
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3233
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3145
3234
  #
3146
3235
  # @option params [Boolean] :dry_run
3147
3236
  # Checks if your request will succeed. `DryRun` is an optional
3148
3237
  # parameter.
3149
3238
  #
3150
- # To learn more about how to use this parameter, see [Testing your KMS
3151
- # API calls][1] in the *Key Management Service Developer Guide*.
3239
+ # To learn more about how to use this parameter, see [Testing your
3240
+ # permissions][1] in the *Key Management Service Developer Guide*.
3152
3241
  #
3153
3242
  #
3154
3243
  #
3155
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
3244
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
3156
3245
  #
3157
3246
  # @option params [Types::RecipientInfo] :recipient
3158
3247
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -3247,9 +3336,9 @@ module Aws::KMS
3247
3336
  # Gets information about [custom key stores][1] in the account and
3248
3337
  # Region.
3249
3338
  #
3250
- # This operation is part of the [custom key stores][1] feature in KMS,
3251
- # which combines the convenience and extensive integration of KMS with
3252
- # the isolation and control of a key store that you own and manage.
3339
+ # This operation is part of the custom key stores feature in KMS, which
3340
+ # combines the convenience and extensive integration of KMS with the
3341
+ # isolation and control of a key store that you own and manage.
3253
3342
  #
3254
3343
  # By default, this operation returns information about all custom key
3255
3344
  # stores in the account and Region. To get only information about a
@@ -3302,11 +3391,11 @@ module Aws::KMS
3302
3391
  #
3303
3392
  #
3304
3393
  #
3305
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
3394
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
3306
3395
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html
3307
3396
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html
3308
3397
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3309
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3398
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3310
3399
  #
3311
3400
  # @option params [String] :custom_key_store_id
3312
3401
  # Gets only information about the specified custom key store. Enter the
@@ -3504,8 +3593,8 @@ module Aws::KMS
3504
3593
  # * Whether automatic key rotation is enabled on the KMS key. To get
3505
3594
  # this information, use GetKeyRotationStatus. Also, some key states
3506
3595
  # prevent a KMS key from being automatically rotated. For details, see
3507
- # [How Automatic Key Rotation Works][6] in the *Key Management Service
3508
- # Developer Guide*.
3596
+ # [How key rotation works][6] in the *Key Management Service Developer
3597
+ # Guide*.
3509
3598
  #
3510
3599
  # * Tags on the KMS key. To get this information, use ListResourceTags.
3511
3600
  #
@@ -3544,14 +3633,14 @@ module Aws::KMS
3544
3633
  #
3545
3634
  #
3546
3635
  #
3547
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
3548
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
3636
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
3637
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
3549
3638
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
3550
3639
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html
3551
3640
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
3552
3641
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-how-it-works
3553
3642
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3554
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3643
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3555
3644
  #
3556
3645
  # @option params [required, String] :key_id
3557
3646
  # Describes the specified KMS key.
@@ -3582,7 +3671,7 @@ module Aws::KMS
3582
3671
  #
3583
3672
  #
3584
3673
  #
3585
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html##aws-managed-cmk
3674
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
3586
3675
  #
3587
3676
  # @option params [Array<String>] :grant_tokens
3588
3677
  # A list of grant tokens.
@@ -3595,7 +3684,7 @@ module Aws::KMS
3595
3684
  #
3596
3685
  #
3597
3686
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
3598
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
3687
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
3599
3688
  #
3600
3689
  # @return [Types::DescribeKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
3601
3690
  #
@@ -3616,6 +3705,7 @@ module Aws::KMS
3616
3705
  # aws_account_id: "111122223333",
3617
3706
  # arn: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
3618
3707
  # creation_date: Time.parse("2017-07-05T14:04:55-07:00"),
3708
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
3619
3709
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
3620
3710
  # description: "",
3621
3711
  # enabled: true,
@@ -3682,6 +3772,7 @@ module Aws::KMS
3682
3772
  # aws_account_id: "111122223333",
3683
3773
  # arn: "arn:aws:kms:ap-northeast-1:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab",
3684
3774
  # creation_date: Time.parse(1586329200.918),
3775
+ # current_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
3685
3776
  # customer_master_key_spec: "SYMMETRIC_DEFAULT",
3686
3777
  # description: "",
3687
3778
  # enabled: true,
@@ -3838,11 +3929,11 @@ module Aws::KMS
3838
3929
  # resp.key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
3839
3930
  # resp.key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
3840
3931
  # resp.key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
3841
- # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
3932
+ # resp.key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
3842
3933
  # resp.key_metadata.encryption_algorithms #=> Array
3843
3934
  # resp.key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
3844
3935
  # resp.key_metadata.signing_algorithms #=> Array
3845
- # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
3936
+ # resp.key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
3846
3937
  # resp.key_metadata.key_agreement_algorithms #=> Array
3847
3938
  # resp.key_metadata.key_agreement_algorithms[0] #=> String, one of "ECDH"
3848
3939
  # resp.key_metadata.multi_region #=> Boolean
@@ -3856,6 +3947,7 @@ module Aws::KMS
3856
3947
  # resp.key_metadata.mac_algorithms #=> Array
3857
3948
  # resp.key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
3858
3949
  # resp.key_metadata.xks_key_configuration.id #=> String
3950
+ # resp.key_metadata.current_key_material_id #=> String
3859
3951
  #
3860
3952
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/DescribeKey AWS API Documentation
3861
3953
  #
@@ -3869,13 +3961,10 @@ module Aws::KMS
3869
3961
  # Sets the state of a KMS key to disabled. This change temporarily
3870
3962
  # prevents use of the KMS key for [cryptographic operations][1].
3871
3963
  #
3872
- # For more information about how key state affects the use of a KMS key,
3873
- # see [Key states of KMS keys][2] in the <i> <i>Key Management Service
3874
- # Developer Guide</i> </i>.
3875
- #
3876
3964
  # The KMS key that you use for this operation must be in a compatible
3877
- # key state. For details, see [Key states of KMS keys][2] in the *Key
3878
- # Management Service Developer Guide*.
3965
+ # key state. For more information about how key state affects the use of
3966
+ # a KMS key, see [Key states of KMS keys][2] in the <i> <i>Key
3967
+ # Management Service Developer Guide</i> </i>.
3879
3968
  #
3880
3969
  # **Cross-account use**: No. You cannot perform this operation on a KMS
3881
3970
  # key in a different Amazon Web Services account.
@@ -3889,10 +3978,10 @@ module Aws::KMS
3889
3978
  #
3890
3979
  #
3891
3980
  #
3892
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
3981
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
3893
3982
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3894
3983
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3895
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
3984
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3896
3985
  #
3897
3986
  # @option params [required, String] :key_id
3898
3987
  # Identifies the KMS key to disable.
@@ -3981,18 +4070,18 @@ module Aws::KMS
3981
4070
  #
3982
4071
  #
3983
4072
  #
3984
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
4073
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
3985
4074
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
3986
4075
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
3987
4076
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
3988
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
3989
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
3990
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
3991
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
3992
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
4077
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4078
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4079
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
4080
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
4081
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key
3993
4082
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
3994
4083
  # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
3995
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4084
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
3996
4085
  #
3997
4086
  # @option params [required, String] :key_id
3998
4087
  # Identifies a symmetric encryption KMS key. You cannot enable or
@@ -4017,7 +4106,7 @@ module Aws::KMS
4017
4106
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks
4018
4107
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4019
4108
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4020
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4109
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4021
4110
  #
4022
4111
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
4023
4112
  #
@@ -4051,9 +4140,9 @@ module Aws::KMS
4051
4140
  # external key store proxy that communicates with your external key
4052
4141
  # manager.
4053
4142
  #
4054
- # This operation is part of the [custom key stores][1] feature in KMS,
4055
- # which combines the convenience and extensive integration of KMS with
4056
- # the isolation and control of a key store that you own and manage.
4143
+ # This operation is part of the custom key stores feature in KMS, which
4144
+ # combines the convenience and extensive integration of KMS with the
4145
+ # isolation and control of a key store that you own and manage.
4057
4146
  #
4058
4147
  # While a custom key store is disconnected, you can manage the custom
4059
4148
  # key store and its KMS keys, but you cannot create or use its KMS keys.
@@ -4097,10 +4186,10 @@ module Aws::KMS
4097
4186
  #
4098
4187
  #
4099
4188
  #
4100
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4101
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4189
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4190
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4102
4191
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4103
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4192
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4104
4193
  #
4105
4194
  # @option params [required, String] :custom_key_store_id
4106
4195
  # Enter the ID of the custom key store you want to disconnect. To find
@@ -4159,10 +4248,10 @@ module Aws::KMS
4159
4248
  #
4160
4249
  #
4161
4250
  #
4162
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4251
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4163
4252
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4164
4253
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4165
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4254
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4166
4255
  #
4167
4256
  # @option params [required, String] :key_id
4168
4257
  # Identifies the KMS key to enable.
@@ -4223,17 +4312,17 @@ module Aws::KMS
4223
4312
  # any in progress rotations. You can use the ListKeyRotations operation
4224
4313
  # to view the details of completed rotations.
4225
4314
  #
4226
- # Automatic key rotation is supported only on [symmetric encryption KMS
4227
- # keys][3]. You cannot enable automatic rotation of [asymmetric KMS
4228
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
4229
- # material][6], or KMS keys in a [custom key store][7]. To enable or
4230
- # disable automatic rotation of a set of related [multi-Region keys][8],
4315
+ # Automatic key rotation is supported only on symmetric encryption KMS
4316
+ # keys. You cannot enable automatic rotation of [asymmetric KMS
4317
+ # keys][3], [HMAC KMS keys][4], KMS keys with [imported key
4318
+ # material][5], or KMS keys in a [custom key store][6]. To enable or
4319
+ # disable automatic rotation of a set of related [multi-Region keys][7],
4231
4320
  # set the property on the primary key.
4232
4321
  #
4233
4322
  # You cannot enable or disable automatic rotation of [Amazon Web
4234
- # Services managed KMS keys][9]. KMS always rotates the key material of
4323
+ # Services managed KMS keys][8]. KMS always rotates the key material of
4235
4324
  # Amazon Web Services managed keys every year. Rotation of [Amazon Web
4236
- # Services owned KMS keys][10] is managed by the Amazon Web Services
4325
+ # Services owned KMS keys][9] is managed by the Amazon Web Services
4237
4326
  # service that owns the key.
4238
4327
  #
4239
4328
  # <note markdown="1"> In May 2022, KMS changed the rotation schedule for Amazon Web Services
@@ -4249,13 +4338,13 @@ module Aws::KMS
4249
4338
  # </note>
4250
4339
  #
4251
4340
  # The KMS key that you use for this operation must be in a compatible
4252
- # key state. For details, see [Key states of KMS keys][11] in the *Key
4341
+ # key state. For details, see [Key states of KMS keys][10] in the *Key
4253
4342
  # Management Service Developer Guide*.
4254
4343
  #
4255
4344
  # **Cross-account use**: No. You cannot perform this operation on a KMS
4256
4345
  # key in a different Amazon Web Services account.
4257
4346
  #
4258
- # **Required permissions**: [kms:EnableKeyRotation][12] (key policy)
4347
+ # **Required permissions**: [kms:EnableKeyRotation][11] (key policy)
4259
4348
  #
4260
4349
  # **Related operations:**
4261
4350
  #
@@ -4274,23 +4363,22 @@ module Aws::KMS
4274
4363
  # </note>
4275
4364
  #
4276
4365
  # **Eventual consistency**: The KMS API follows an eventual consistency
4277
- # model. For more information, see [KMS eventual consistency][13].
4366
+ # model. For more information, see [KMS eventual consistency][12].
4278
4367
  #
4279
4368
  #
4280
4369
  #
4281
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
4282
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
4283
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
4284
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4285
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4286
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4287
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4288
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4289
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
4290
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
4291
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4292
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4293
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4370
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
4371
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
4372
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4373
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4374
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4375
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4376
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4377
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
4378
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key
4379
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4380
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4381
+ # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4294
4382
  #
4295
4383
  # @option params [required, String] :key_id
4296
4384
  # Identifies a symmetric encryption KMS key. You cannot enable automatic
@@ -4316,8 +4404,8 @@ module Aws::KMS
4316
4404
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
4317
4405
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
4318
4406
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
4319
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
4320
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
4407
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
4408
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
4321
4409
  #
4322
4410
  # @option params [Integer] :rotation_period_in_days
4323
4411
  # Use this parameter to specify a custom period of time between each
@@ -4449,10 +4537,10 @@ module Aws::KMS
4449
4537
  #
4450
4538
  #
4451
4539
  #
4452
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4540
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4453
4541
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
4454
4542
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4455
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4543
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4456
4544
  #
4457
4545
  # @option params [required, String] :key_id
4458
4546
  # Identifies the KMS key to use in the encryption operation. The KMS key
@@ -4505,8 +4593,8 @@ module Aws::KMS
4505
4593
  #
4506
4594
  #
4507
4595
  #
4508
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations
4509
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4596
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations
4597
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4510
4598
  #
4511
4599
  # @option params [Array<String>] :grant_tokens
4512
4600
  # A list of grant tokens.
@@ -4519,7 +4607,7 @@ module Aws::KMS
4519
4607
  #
4520
4608
  #
4521
4609
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
4522
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
4610
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
4523
4611
  #
4524
4612
  # @option params [String] :encryption_algorithm
4525
4613
  # Specifies the encryption algorithm that KMS will use to encrypt the
@@ -4537,12 +4625,12 @@ module Aws::KMS
4537
4625
  # Checks if your request will succeed. `DryRun` is an optional
4538
4626
  # parameter.
4539
4627
  #
4540
- # To learn more about how to use this parameter, see [Testing your KMS
4541
- # API calls][1] in the *Key Management Service Developer Guide*.
4628
+ # To learn more about how to use this parameter, see [Testing your
4629
+ # permissions][1] in the *Key Management Service Developer Guide*.
4542
4630
  #
4543
4631
  #
4544
4632
  #
4545
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
4633
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
4546
4634
  #
4547
4635
  # @return [Types::EncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
4548
4636
  #
@@ -4717,7 +4805,7 @@ module Aws::KMS
4717
4805
  #
4718
4806
  #
4719
4807
  #
4720
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4808
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4721
4809
  # [2]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
4722
4810
  # [3]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
4723
4811
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
@@ -4726,7 +4814,7 @@ module Aws::KMS
4726
4814
  # [7]: https://docs.aws.amazon.com/dynamodb-encryption-client/latest/devguide/
4727
4815
  # [8]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
4728
4816
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
4729
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
4817
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
4730
4818
  #
4731
4819
  # @option params [required, String] :key_id
4732
4820
  # Specifies the symmetric encryption KMS key that encrypts the data key.
@@ -4774,7 +4862,7 @@ module Aws::KMS
4774
4862
  #
4775
4863
  #
4776
4864
  #
4777
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
4865
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
4778
4866
  #
4779
4867
  # @option params [Integer] :number_of_bytes
4780
4868
  # Specifies the length of the data key in bytes. For example, use the
@@ -4804,7 +4892,7 @@ module Aws::KMS
4804
4892
  #
4805
4893
  #
4806
4894
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
4807
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
4895
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
4808
4896
  #
4809
4897
  # @option params [Types::RecipientInfo] :recipient
4810
4898
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -4838,12 +4926,12 @@ module Aws::KMS
4838
4926
  # Checks if your request will succeed. `DryRun` is an optional
4839
4927
  # parameter.
4840
4928
  #
4841
- # To learn more about how to use this parameter, see [Testing your KMS
4842
- # API calls][1] in the *Key Management Service Developer Guide*.
4929
+ # To learn more about how to use this parameter, see [Testing your
4930
+ # permissions][1] in the *Key Management Service Developer Guide*.
4843
4931
  #
4844
4932
  #
4845
4933
  #
4846
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
4934
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
4847
4935
  #
4848
4936
  # @return [Types::GenerateDataKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
4849
4937
  #
@@ -4851,6 +4939,7 @@ module Aws::KMS
4851
4939
  # * {Types::GenerateDataKeyResponse#plaintext #plaintext} => String
4852
4940
  # * {Types::GenerateDataKeyResponse#key_id #key_id} => String
4853
4941
  # * {Types::GenerateDataKeyResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
4942
+ # * {Types::GenerateDataKeyResponse#key_material_id #key_material_id} => String
4854
4943
  #
4855
4944
  #
4856
4945
  # @example Example: To generate a data key
@@ -4867,6 +4956,7 @@ module Aws::KMS
4867
4956
  # {
4868
4957
  # ciphertext_blob: "<binary data>", # The encrypted data key.
4869
4958
  # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the KMS key that was used to encrypt the data key.
4959
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the data key.
4870
4960
  # plaintext: "<binary data>", # The unencrypted (plaintext) data key.
4871
4961
  # }
4872
4962
  #
@@ -4918,6 +5008,7 @@ module Aws::KMS
4918
5008
  # resp.plaintext #=> String
4919
5009
  # resp.key_id #=> String
4920
5010
  # resp.ciphertext_for_recipient #=> String
5011
+ # resp.key_material_id #=> String
4921
5012
  #
4922
5013
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKey AWS API Documentation
4923
5014
  #
@@ -5026,10 +5117,10 @@ module Aws::KMS
5026
5117
  # [3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
5027
5118
  # [4]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
5028
5119
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5029
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5120
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5030
5121
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5031
5122
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5032
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5123
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5033
5124
  #
5034
5125
  # @option params [Hash<String,String>] :encryption_context
5035
5126
  # Specifies the encryption context that will be used when encrypting the
@@ -5052,7 +5143,7 @@ module Aws::KMS
5052
5143
  #
5053
5144
  #
5054
5145
  #
5055
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5146
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5056
5147
  #
5057
5148
  # @option params [required, String] :key_id
5058
5149
  # Specifies the symmetric encryption KMS key that encrypts the private
@@ -5083,10 +5174,11 @@ module Aws::KMS
5083
5174
  # Determines the type of data key pair that is generated.
5084
5175
  #
5085
5176
  # The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys
5086
- # to encrypt and decrypt or to sign and verify (but not both), and the
5087
- # rule that permits you to use ECC KMS keys only to sign and verify, are
5088
- # not effective on data key pairs, which are used outside of KMS. The
5089
- # SM2 key spec is only available in China Regions.
5177
+ # to encrypt and decrypt or to sign and verify (but not both), the rule
5178
+ # that permits you to use ECC KMS keys only to sign and verify, and the
5179
+ # rule that permits you to use ML-DSA key pairs to sign and verify only
5180
+ # are not effective on data key pairs, which are used outside of KMS.
5181
+ # The SM2 key spec is only available in China Regions.
5090
5182
  #
5091
5183
  # @option params [Array<String>] :grant_tokens
5092
5184
  # A list of grant tokens.
@@ -5099,7 +5191,7 @@ module Aws::KMS
5099
5191
  #
5100
5192
  #
5101
5193
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5102
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5194
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5103
5195
  #
5104
5196
  # @option params [Types::RecipientInfo] :recipient
5105
5197
  # A signed [attestation document][1] from an Amazon Web Services Nitro
@@ -5137,12 +5229,12 @@ module Aws::KMS
5137
5229
  # Checks if your request will succeed. `DryRun` is an optional
5138
5230
  # parameter.
5139
5231
  #
5140
- # To learn more about how to use this parameter, see [Testing your KMS
5141
- # API calls][1] in the *Key Management Service Developer Guide*.
5232
+ # To learn more about how to use this parameter, see [Testing your
5233
+ # permissions][1] in the *Key Management Service Developer Guide*.
5142
5234
  #
5143
5235
  #
5144
5236
  #
5145
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5237
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5146
5238
  #
5147
5239
  # @return [Types::GenerateDataKeyPairResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5148
5240
  #
@@ -5152,6 +5244,7 @@ module Aws::KMS
5152
5244
  # * {Types::GenerateDataKeyPairResponse#key_id #key_id} => String
5153
5245
  # * {Types::GenerateDataKeyPairResponse#key_pair_spec #key_pair_spec} => String
5154
5246
  # * {Types::GenerateDataKeyPairResponse#ciphertext_for_recipient #ciphertext_for_recipient} => String
5247
+ # * {Types::GenerateDataKeyPairResponse#key_material_id #key_material_id} => String
5155
5248
  #
5156
5249
  #
5157
5250
  # @example Example: To generate an RSA key pair for encryption and decryption
@@ -5167,6 +5260,7 @@ module Aws::KMS
5167
5260
  # resp.to_h outputs the following:
5168
5261
  # {
5169
5262
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The key ARN of the symmetric encryption KMS key that was used to encrypt the private key.
5263
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the private key.
5170
5264
  # key_pair_spec: "RSA_3072", # The actual key spec of the RSA data key pair.
5171
5265
  # private_key_ciphertext_blob: "<binary data>", # The encrypted private key of the RSA data key pair.
5172
5266
  # private_key_plaintext: "<binary data>", # The plaintext private key of the RSA data key pair.
@@ -5194,6 +5288,7 @@ module Aws::KMS
5194
5288
  # {
5195
5289
  # ciphertext_for_recipient: "<binary data>", # The private key of the RSA data key pair encrypted by the public key from the attestation document
5196
5290
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The key ARN of the symmetric encryption KMS key that was used to encrypt the PrivateKeyCiphertextBlob.
5291
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the private key.
5197
5292
  # key_pair_spec: "RSA_3072", # The actual key spec of the RSA data key pair.
5198
5293
  # private_key_ciphertext_blob: "<binary data>", # The private key of the RSA data key pair encrypted by the KMS key.
5199
5294
  # private_key_plaintext: "", # This field is null or empty
@@ -5224,6 +5319,7 @@ module Aws::KMS
5224
5319
  # resp.key_id #=> String
5225
5320
  # resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SM2"
5226
5321
  # resp.ciphertext_for_recipient #=> String
5322
+ # resp.key_material_id #=> String
5227
5323
  #
5228
5324
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPair AWS API Documentation
5229
5325
  #
@@ -5302,10 +5398,10 @@ module Aws::KMS
5302
5398
  #
5303
5399
  #
5304
5400
  # [1]: https://tools.ietf.org/html/rfc5280
5305
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5401
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5306
5402
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5307
5403
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5308
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5404
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5309
5405
  #
5310
5406
  # @option params [Hash<String,String>] :encryption_context
5311
5407
  # Specifies the encryption context that will be used when encrypting the
@@ -5328,7 +5424,7 @@ module Aws::KMS
5328
5424
  #
5329
5425
  #
5330
5426
  #
5331
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5427
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5332
5428
  #
5333
5429
  # @option params [required, String] :key_id
5334
5430
  # Specifies the symmetric encryption KMS key that encrypts the private
@@ -5359,10 +5455,11 @@ module Aws::KMS
5359
5455
  # Determines the type of data key pair that is generated.
5360
5456
  #
5361
5457
  # The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys
5362
- # to encrypt and decrypt or to sign and verify (but not both), and the
5363
- # rule that permits you to use ECC KMS keys only to sign and verify, are
5364
- # not effective on data key pairs, which are used outside of KMS. The
5365
- # SM2 key spec is only available in China Regions.
5458
+ # to encrypt and decrypt or to sign and verify (but not both), the rule
5459
+ # that permits you to use ECC KMS keys only to sign and verify, and the
5460
+ # rule that permits you to use ML-DSA key pairs to sign and verify only
5461
+ # are not effective on data key pairs, which are used outside of KMS.
5462
+ # The SM2 key spec is only available in China Regions.
5366
5463
  #
5367
5464
  # @option params [Array<String>] :grant_tokens
5368
5465
  # A list of grant tokens.
@@ -5375,18 +5472,18 @@ module Aws::KMS
5375
5472
  #
5376
5473
  #
5377
5474
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5378
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5475
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5379
5476
  #
5380
5477
  # @option params [Boolean] :dry_run
5381
5478
  # Checks if your request will succeed. `DryRun` is an optional
5382
5479
  # parameter.
5383
5480
  #
5384
- # To learn more about how to use this parameter, see [Testing your KMS
5385
- # API calls][1] in the *Key Management Service Developer Guide*.
5481
+ # To learn more about how to use this parameter, see [Testing your
5482
+ # permissions][1] in the *Key Management Service Developer Guide*.
5386
5483
  #
5387
5484
  #
5388
5485
  #
5389
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5486
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5390
5487
  #
5391
5488
  # @return [Types::GenerateDataKeyPairWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5392
5489
  #
@@ -5394,6 +5491,7 @@ module Aws::KMS
5394
5491
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#public_key #public_key} => String
5395
5492
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_id #key_id} => String
5396
5493
  # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_pair_spec #key_pair_spec} => String
5494
+ # * {Types::GenerateDataKeyPairWithoutPlaintextResponse#key_material_id #key_material_id} => String
5397
5495
  #
5398
5496
  #
5399
5497
  # @example Example: To generate an asymmetric data key pair without a plaintext key
@@ -5409,6 +5507,7 @@ module Aws::KMS
5409
5507
  # resp.to_h outputs the following:
5410
5508
  # {
5411
5509
  # key_id: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The key ARN of the symmetric encryption KMS key that encrypted the private key in the ECC asymmetric data key pair.
5510
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the private key.
5412
5511
  # key_pair_spec: "ECC_NIST_P521", # The actual key spec of the ECC asymmetric data key pair.
5413
5512
  # private_key_ciphertext_blob: "<binary data>", # The encrypted private key of the asymmetric ECC data key pair.
5414
5513
  # public_key: "<binary data>", # The public key (plaintext).
@@ -5432,6 +5531,7 @@ module Aws::KMS
5432
5531
  # resp.public_key #=> String
5433
5532
  # resp.key_id #=> String
5434
5533
  # resp.key_pair_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SM2"
5534
+ # resp.key_material_id #=> String
5435
5535
  #
5436
5536
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintext AWS API Documentation
5437
5537
  #
@@ -5521,10 +5621,10 @@ module Aws::KMS
5521
5621
  #
5522
5622
  #
5523
5623
  #
5524
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5624
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5525
5625
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5526
5626
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5527
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5627
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5528
5628
  #
5529
5629
  # @option params [required, String] :key_id
5530
5630
  # Specifies the symmetric encryption KMS key that encrypts the data key.
@@ -5572,7 +5672,7 @@ module Aws::KMS
5572
5672
  #
5573
5673
  #
5574
5674
  #
5575
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
5675
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
5576
5676
  #
5577
5677
  # @option params [String] :key_spec
5578
5678
  # The length of the data key. Use `AES_128` to generate a 128-bit
@@ -5595,23 +5695,24 @@ module Aws::KMS
5595
5695
  #
5596
5696
  #
5597
5697
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5598
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5698
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5599
5699
  #
5600
5700
  # @option params [Boolean] :dry_run
5601
5701
  # Checks if your request will succeed. `DryRun` is an optional
5602
5702
  # parameter.
5603
5703
  #
5604
- # To learn more about how to use this parameter, see [Testing your KMS
5605
- # API calls][1] in the *Key Management Service Developer Guide*.
5704
+ # To learn more about how to use this parameter, see [Testing your
5705
+ # permissions][1] in the *Key Management Service Developer Guide*.
5606
5706
  #
5607
5707
  #
5608
5708
  #
5609
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5709
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5610
5710
  #
5611
5711
  # @return [Types::GenerateDataKeyWithoutPlaintextResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5612
5712
  #
5613
5713
  # * {Types::GenerateDataKeyWithoutPlaintextResponse#ciphertext_blob #ciphertext_blob} => String
5614
5714
  # * {Types::GenerateDataKeyWithoutPlaintextResponse#key_id #key_id} => String
5715
+ # * {Types::GenerateDataKeyWithoutPlaintextResponse#key_material_id #key_material_id} => String
5615
5716
  #
5616
5717
  #
5617
5718
  # @example Example: To generate an encrypted data key
@@ -5628,6 +5729,7 @@ module Aws::KMS
5628
5729
  # {
5629
5730
  # ciphertext_blob: "<binary data>", # The encrypted data key.
5630
5731
  # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the KMS key that was used to encrypt the data key.
5732
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to encrypt the data key.
5631
5733
  # }
5632
5734
  #
5633
5735
  # @example Request syntax with placeholder values
@@ -5647,6 +5749,7 @@ module Aws::KMS
5647
5749
  #
5648
5750
  # resp.ciphertext_blob #=> String
5649
5751
  # resp.key_id #=> String
5752
+ # resp.key_material_id #=> String
5650
5753
  #
5651
5754
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyWithoutPlaintext AWS API Documentation
5652
5755
  #
@@ -5701,7 +5804,7 @@ module Aws::KMS
5701
5804
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
5702
5805
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
5703
5806
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5704
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5807
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5705
5808
  #
5706
5809
  # @option params [required, String, StringIO, File] :message
5707
5810
  # The message to be hashed. Specify a message of up to 4,096 bytes.
@@ -5740,18 +5843,18 @@ module Aws::KMS
5740
5843
  #
5741
5844
  #
5742
5845
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
5743
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
5846
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
5744
5847
  #
5745
5848
  # @option params [Boolean] :dry_run
5746
5849
  # Checks if your request will succeed. `DryRun` is an optional
5747
5850
  # parameter.
5748
5851
  #
5749
- # To learn more about how to use this parameter, see [Testing your KMS
5750
- # API calls][1] in the *Key Management Service Developer Guide*.
5852
+ # To learn more about how to use this parameter, see [Testing your
5853
+ # permissions][1] in the *Key Management Service Developer Guide*.
5751
5854
  #
5752
5855
  #
5753
5856
  #
5754
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
5857
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
5755
5858
  #
5756
5859
  # @return [Types::GenerateMacResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
5757
5860
  #
@@ -5825,7 +5928,8 @@ module Aws::KMS
5825
5928
  # Management Service Developer Guide*.
5826
5929
  #
5827
5930
  # For more information about entropy and random number generation, see
5828
- # [Key Management Service Cryptographic Details][4].
5931
+ # [Entropy and random number generation][4] in the *Key Management
5932
+ # Service Developer Guide*.
5829
5933
  #
5830
5934
  # **Cross-account use**: Not applicable. `GenerateRandom` does not use
5831
5935
  # any account-specific resources, such as KMS keys.
@@ -5840,9 +5944,9 @@ module Aws::KMS
5840
5944
  # [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave.html
5841
5945
  # [2]: https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk
5842
5946
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html
5843
- # [4]: https://docs.aws.amazon.com/kms/latest/cryptographic-details/
5947
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#entropy-and-random-numbers
5844
5948
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5845
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
5949
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5846
5950
  #
5847
5951
  # @option params [Integer] :number_of_bytes
5848
5952
  # The length of the random byte string. This parameter is required.
@@ -5962,7 +6066,7 @@ module Aws::KMS
5962
6066
  #
5963
6067
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
5964
6068
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
5965
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6069
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
5966
6070
  #
5967
6071
  # @option params [required, String] :key_id
5968
6072
  # Gets the key policy for the specified KMS key.
@@ -6030,16 +6134,16 @@ module Aws::KMS
6030
6134
  # enabled for the specified KMS key, the [rotation period][2], and the
6031
6135
  # next scheduled rotation date.
6032
6136
  #
6033
- # Automatic key rotation is supported only on [symmetric encryption KMS
6034
- # keys][3]. You cannot enable automatic rotation of [asymmetric KMS
6035
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
6036
- # material][6], or KMS keys in a [custom key store][7]. To enable or
6037
- # disable automatic rotation of a set of related [multi-Region keys][8],
6038
- # set the property on the primary key..
6137
+ # Automatic key rotation is supported only on symmetric encryption KMS
6138
+ # keys. You cannot enable automatic rotation of [asymmetric KMS
6139
+ # keys][3], [HMAC KMS keys][4], KMS keys with [imported key
6140
+ # material][5], or KMS keys in a [custom key store][6]. To enable or
6141
+ # disable automatic rotation of a set of related [multi-Region keys][7],
6142
+ # set the property on the primary key.
6039
6143
  #
6040
6144
  # You can enable (EnableKeyRotation) and disable automatic rotation
6041
6145
  # (DisableKeyRotation) of the key material in customer managed KMS keys.
6042
- # Key material rotation of [Amazon Web Services managed KMS keys][9] is
6146
+ # Key material rotation of [Amazon Web Services managed KMS keys][8] is
6043
6147
  # not configurable. KMS always rotates the key material in Amazon Web
6044
6148
  # Services managed KMS keys every year. The key rotation status for
6045
6149
  # Amazon Web Services managed KMS keys is always `true`.
@@ -6058,7 +6162,7 @@ module Aws::KMS
6058
6162
  # </note>
6059
6163
  #
6060
6164
  # The KMS key that you use for this operation must be in a compatible
6061
- # key state. For details, see [Key states of KMS keys][10] in the *Key
6165
+ # key state. For details, see [Key states of KMS keys][9] in the *Key
6062
6166
  # Management Service Developer Guide*.
6063
6167
  #
6064
6168
  # * Disabled: The key rotation status does not change when you disable a
@@ -6079,7 +6183,7 @@ module Aws::KMS
6079
6183
  # a different Amazon Web Services account, specify the key ARN in the
6080
6184
  # value of the `KeyId` parameter.
6081
6185
  #
6082
- # **Required permissions**: [kms:GetKeyRotationStatus][11] (key policy)
6186
+ # **Required permissions**: [kms:GetKeyRotationStatus][10] (key policy)
6083
6187
  #
6084
6188
  # **Related operations:**
6085
6189
  #
@@ -6092,22 +6196,21 @@ module Aws::KMS
6092
6196
  # * RotateKeyOnDemand
6093
6197
  #
6094
6198
  # **Eventual consistency**: The KMS API follows an eventual consistency
6095
- # model. For more information, see [KMS eventual consistency][12].
6199
+ # model. For more information, see [KMS eventual consistency][11].
6096
6200
  #
6097
6201
  #
6098
6202
  #
6099
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
6203
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
6100
6204
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotation-period
6101
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
6102
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
6103
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
6104
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6105
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
6106
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
6107
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
6108
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6109
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6110
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6205
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
6206
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
6207
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6208
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6209
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
6210
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
6211
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6212
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6213
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6111
6214
  #
6112
6215
  # @option params [required, String] :key_id
6113
6216
  # Gets the rotation status for the specified KMS key.
@@ -6181,9 +6284,7 @@ module Aws::KMS
6181
6284
  # By default, KMS keys are created with key material that KMS generates.
6182
6285
  # This operation supports [Importing key material][1], an advanced
6183
6286
  # feature that lets you generate and import the cryptographic key
6184
- # material for a KMS key. For more information about importing key
6185
- # material into KMS, see [Importing key material][1] in the *Key
6186
- # Management Service Developer Guide*.
6287
+ # material for a KMS key.
6187
6288
  #
6188
6289
  # Before calling `GetParametersForImport`, use the CreateKey operation
6189
6290
  # with an `Origin` value of `EXTERNAL` to create a KMS key with no key
@@ -6252,11 +6353,11 @@ module Aws::KMS
6252
6353
  #
6253
6354
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6254
6355
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6255
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
6256
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
6356
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6357
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#reimport-key-material
6257
6358
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6258
6359
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6259
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6360
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6260
6361
  #
6261
6362
  # @option params [required, String] :key_id
6262
6363
  # The identifier of the KMS key that will be associated with the
@@ -6280,9 +6381,8 @@ module Aws::KMS
6280
6381
  # @option params [required, String] :wrapping_algorithm
6281
6382
  # The algorithm you will use with the RSA public key (`PublicKey`) in
6282
6383
  # the response to protect your key material during import. For more
6283
- # information, see [Select a wrapping
6284
- # algorithm](kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm)
6285
- # in the *Key Management Service Developer Guide*.
6384
+ # information, see [Select a wrapping algorithm][1] in the *Key
6385
+ # Management Service Developer Guide*.
6286
6386
  #
6287
6387
  # For RSA\_AES wrapping algorithms, you encrypt your key material with
6288
6388
  # an AES key that you generate, then encrypt your AES key with the RSA
@@ -6314,6 +6414,10 @@ module Aws::KMS
6314
6414
  # * **RSAES\_PKCS1\_V1\_5** (Deprecated) — As of October 10, 2023, KMS
6315
6415
  # does not support the RSAES\_PKCS1\_V1\_5 wrapping algorithm.
6316
6416
  #
6417
+ #
6418
+ #
6419
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm
6420
+ #
6317
6421
  # @option params [required, String] :wrapping_key_spec
6318
6422
  # The type of RSA public key to return in the response. You will use
6319
6423
  # this wrapping key with the specified wrapping algorithm to protect
@@ -6461,8 +6565,9 @@ module Aws::KMS
6461
6565
  # * [KeyUsage][3]: Whether the key is used for encryption, signing, or
6462
6566
  # deriving a shared secret.
6463
6567
  #
6464
- # * [EncryptionAlgorithms][4] or [SigningAlgorithms][5]: A list of the
6465
- # encryption algorithms or the signing algorithms for the key.
6568
+ # * [EncryptionAlgorithms][4], [KeyAgreementAlgorithms][5], or
6569
+ # [SigningAlgorithms][6]: A list of the encryption algorithms, key
6570
+ # agreement algorithms, or signing algorithms for the key.
6466
6571
  #
6467
6572
  # Although KMS cannot enforce these restrictions on external operations,
6468
6573
  # it is crucial that you use this information to prevent the public key
@@ -6475,22 +6580,22 @@ module Aws::KMS
6475
6580
  # To verify a signature outside of KMS with an SM2 public key (China
6476
6581
  # Regions only), you must specify the distinguishing ID. By default, KMS
6477
6582
  # uses `1234567812345678` as the distinguishing ID. For more
6478
- # information, see [Offline verification with SM2 key pairs][6].
6583
+ # information, see [Offline verification with SM2 key pairs][7].
6479
6584
  #
6480
6585
  # The KMS key that you use for this operation must be in a compatible
6481
- # key state. For details, see [Key states of KMS keys][7] in the *Key
6586
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
6482
6587
  # Management Service Developer Guide*.
6483
6588
  #
6484
6589
  # **Cross-account use**: Yes. To perform this operation with a KMS key
6485
6590
  # in a different Amazon Web Services account, specify the key ARN or
6486
6591
  # alias ARN in the value of the `KeyId` parameter.
6487
6592
  #
6488
- # **Required permissions**: [kms:GetPublicKey][8] (key policy)
6593
+ # **Required permissions**: [kms:GetPublicKey][9] (key policy)
6489
6594
  #
6490
6595
  # **Related operations**: CreateKey
6491
6596
  #
6492
6597
  # **Eventual consistency**: The KMS API follows an eventual consistency
6493
- # model. For more information, see [KMS eventual consistency][9].
6598
+ # model. For more information, see [KMS eventual consistency][10].
6494
6599
  #
6495
6600
  #
6496
6601
  #
@@ -6498,11 +6603,12 @@ module Aws::KMS
6498
6603
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeySpec
6499
6604
  # [3]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyUsage
6500
6605
  # [4]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-EncryptionAlgorithms
6501
- # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
6502
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
6503
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6504
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6505
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6606
+ # [5]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-KeyAgreementAlgorithms
6607
+ # [6]: https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html#KMS-GetPublicKey-response-SigningAlgorithms
6608
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
6609
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6610
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6611
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6506
6612
  #
6507
6613
  # @option params [required, String] :key_id
6508
6614
  # Identifies the asymmetric KMS key that includes the public key.
@@ -6537,7 +6643,7 @@ module Aws::KMS
6537
6643
  #
6538
6644
  #
6539
6645
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
6540
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
6646
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
6541
6647
  #
6542
6648
  # @return [Types::GetPublicKeyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
6543
6649
  #
@@ -6585,12 +6691,12 @@ module Aws::KMS
6585
6691
  # resp.key_id #=> String
6586
6692
  # resp.public_key #=> String
6587
6693
  # resp.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
6588
- # resp.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
6694
+ # resp.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
6589
6695
  # resp.key_usage #=> String, one of "SIGN_VERIFY", "ENCRYPT_DECRYPT", "GENERATE_VERIFY_MAC", "KEY_AGREEMENT"
6590
6696
  # resp.encryption_algorithms #=> Array
6591
6697
  # resp.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
6592
6698
  # resp.signing_algorithms #=> Array
6593
- # resp.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
6699
+ # resp.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
6594
6700
  # resp.key_agreement_algorithms #=> Array
6595
6701
  # resp.key_agreement_algorithms[0] #=> String, one of "ECDH"
6596
6702
  #
@@ -6604,53 +6710,47 @@ module Aws::KMS
6604
6710
  end
6605
6711
 
6606
6712
  # Imports or reimports key material into an existing KMS key that was
6607
- # created without key material. `ImportKeyMaterial` also sets the
6608
- # expiration model and expiration date of the imported key material.
6609
- #
6610
- # By default, KMS keys are created with key material that KMS generates.
6611
- # This operation supports [Importing key material][1], an advanced
6612
- # feature that lets you generate and import the cryptographic key
6613
- # material for a KMS key. For more information about importing key
6614
- # material into KMS, see [Importing key material][1] in the *Key
6615
- # Management Service Developer Guide*.
6713
+ # created without key material. You can also use this operation to set
6714
+ # or update the expiration model and expiration date of the imported key
6715
+ # material.
6616
6716
  #
6617
- # After you successfully import key material into a KMS key, you can
6618
- # [reimport the same key material][2] into that KMS key, but you cannot
6619
- # import different key material. You might reimport key material to
6620
- # replace key material that expired or key material that you deleted.
6621
- # You might also reimport key material to change the expiration model or
6622
- # expiration date of the key material.
6717
+ # By default, KMS creates KMS keys with key material that it generates.
6718
+ # You can also generate and import your own key material. For more
6719
+ # information about importing key material, see [Importing key
6720
+ # material][1].
6721
+ #
6722
+ # For asymmetric, HMAC and multi-Region keys, you cannot change the key
6723
+ # material after the initial import. You can import multiple key
6724
+ # materials into single-Region, symmetric encryption keys and rotate the
6725
+ # key material on demand using `RotateKeyOnDemand`.
6726
+ #
6727
+ # After you import key material, you can [reimport the same key
6728
+ # material][2] into that KMS key or, if the key supports on-demand
6729
+ # rotation, import new key material. You can use the `ImportType`
6730
+ # parameter to indicate whether you are importing new key material or
6731
+ # re-importing previously imported key material. You might reimport key
6732
+ # material to replace key material that expired or key material that you
6733
+ # deleted. You might also reimport key material to change the expiration
6734
+ # model or expiration date of the key material.
6623
6735
  #
6624
6736
  # Each time you import key material into KMS, you can determine whether
6625
6737
  # (`ExpirationModel`) and when (`ValidTo`) the key material expires. To
6626
6738
  # change the expiration of your key material, you must import it again,
6627
6739
  # either by calling `ImportKeyMaterial` or using the [import
6628
- # features](kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console)
6629
- # of the KMS console.
6740
+ # features][3] of the KMS console.
6630
6741
  #
6631
- # Before calling `ImportKeyMaterial`:
6742
+ # Before you call `ImportKeyMaterial`, complete these steps:
6632
6743
  #
6633
- # * Create or identify a KMS key with no key material. The KMS key must
6634
- # have an `Origin` value of `EXTERNAL`, which indicates that the KMS
6635
- # key is designed for imported key material.
6744
+ # * Create or identify a KMS key with `EXTERNAL` origin, which indicates
6745
+ # that the KMS key is designed for imported key material.
6636
6746
  #
6637
- # To create an new KMS key for imported key material, call the
6747
+ # To create a new KMS key for imported key material, call the
6638
6748
  # CreateKey operation with an `Origin` value of `EXTERNAL`. You can
6639
6749
  # create a symmetric encryption KMS key, HMAC KMS key, asymmetric
6640
- # encryption KMS key, or asymmetric signing KMS key. You can also
6641
- # import key material into a [multi-Region
6642
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of
6643
- # any supported type. However, you can't import key material into a
6644
- # KMS key in a [custom key
6645
- # store](kms/latest/developerguide/custom-key-store-overview.html).
6646
- #
6647
- # * Use the DescribeKey operation to verify that the `KeyState` of the
6648
- # KMS key is `PendingImport`, which indicates that the KMS key has no
6649
- # key material.
6650
- #
6651
- # If you are reimporting the same key material into an existing KMS
6652
- # key, you might need to call the DeleteImportedKeyMaterial to delete
6653
- # its existing key material.
6750
+ # encryption KMS key, asymmetric key agreement key, or asymmetric
6751
+ # signing KMS key. You can also import key material into a
6752
+ # [multi-Region key][4] of any supported type. However, you can't
6753
+ # import key material into a KMS key in a [custom key store][5].
6654
6754
  #
6655
6755
  # * Call the GetParametersForImport operation to get a public key and
6656
6756
  # import token set for importing key material.
@@ -6665,10 +6765,9 @@ module Aws::KMS
6665
6765
  # * The key ID or key ARN of the KMS key to associate with the imported
6666
6766
  # key material. Its `Origin` must be `EXTERNAL` and its `KeyState`
6667
6767
  # must be `PendingImport`. You cannot perform this operation on a KMS
6668
- # key in a [custom key
6669
- # store](kms/latest/developerguide/custom-key-store-overview.html), or
6670
- # on a KMS key in a different Amazon Web Services account. To get the
6671
- # `Origin` and `KeyState` of a KMS key, call DescribeKey.
6768
+ # key in a [custom key store][5], or on a KMS key in a different
6769
+ # Amazon Web Services account. To get the `Origin` and `KeyState` of a
6770
+ # KMS key, call DescribeKey.
6672
6771
  #
6673
6772
  # * The encrypted key material.
6674
6773
  #
@@ -6678,7 +6777,7 @@ module Aws::KMS
6678
6777
  #
6679
6778
  # * Whether the key material expires (`ExpirationModel`) and, if so,
6680
6779
  # when (`ValidTo`). For help with this choice, see [Setting an
6681
- # expiration time][3] in the *Key Management Service Developer Guide*.
6780
+ # expiration time][6] in the *Key Management Service Developer Guide*.
6682
6781
  #
6683
6782
  # If you set an expiration date, KMS deletes the key material from the
6684
6783
  # KMS key on the specified date, making the KMS key unusable. To use
@@ -6690,23 +6789,27 @@ module Aws::KMS
6690
6789
  #
6691
6790
  # When this operation is successful, the key state of the KMS key
6692
6791
  # changes from `PendingImport` to `Enabled`, and you can use the KMS key
6693
- # in cryptographic operations.
6792
+ # in cryptographic operations. For single-Region, symmetric encryption
6793
+ # keys, you will need to import all of the key materials associated with
6794
+ # the KMS key to change its state to `Enabled`. Use the
6795
+ # `ListKeyRotations` operation to list the ID and import state of each
6796
+ # key material associated with a KMS key.
6694
6797
  #
6695
6798
  # If this operation fails, use the exception to help determine the
6696
6799
  # problem. If the error is related to the key material, the import
6697
6800
  # token, or wrapping key, use GetParametersForImport to get a new public
6698
6801
  # key and import token for the KMS key and repeat the import procedure.
6699
- # For help, see [How To Import Key Material][4] in the *Key Management
6700
- # Service Developer Guide*.
6802
+ # For help, see [Create a KMS key with imported key material][7] in the
6803
+ # *Key Management Service Developer Guide*.
6701
6804
  #
6702
6805
  # The KMS key that you use for this operation must be in a compatible
6703
- # key state. For details, see [Key states of KMS keys][5] in the *Key
6806
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
6704
6807
  # Management Service Developer Guide*.
6705
6808
  #
6706
6809
  # **Cross-account use**: No. You cannot perform this operation on a KMS
6707
6810
  # key in a different Amazon Web Services account.
6708
6811
  #
6709
- # **Required permissions**: [kms:ImportKeyMaterial][6] (key policy)
6812
+ # **Required permissions**: [kms:ImportKeyMaterial][9] (key policy)
6710
6813
  #
6711
6814
  # **Related operations:**
6712
6815
  #
@@ -6714,18 +6817,25 @@ module Aws::KMS
6714
6817
  #
6715
6818
  # * GetParametersForImport
6716
6819
  #
6820
+ # * ListKeyRotations
6821
+ #
6822
+ # * RotateKeyOnDemand
6823
+ #
6717
6824
  # **Eventual consistency**: The KMS API follows an eventual consistency
6718
- # model. For more information, see [KMS eventual consistency][7].
6825
+ # model. For more information, see [KMS eventual consistency][10].
6719
6826
  #
6720
6827
  #
6721
6828
  #
6722
6829
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
6723
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
6724
- # [3]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
6725
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#importing-keys-overview
6726
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6727
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6728
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
6830
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#reimport-key-material
6831
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console
6832
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6833
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
6834
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
6835
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-conceptual.html
6836
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
6837
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6838
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6729
6839
  #
6730
6840
  # @option params [required, String] :key_id
6731
6841
  # The identifier of the KMS key that will be associated with the
@@ -6736,11 +6846,9 @@ module Aws::KMS
6736
6846
  #
6737
6847
  # The KMS key can be a symmetric encryption KMS key, HMAC KMS key,
6738
6848
  # asymmetric encryption KMS key, or asymmetric signing KMS key,
6739
- # including a [multi-Region
6740
- # key](kms/latest/developerguide/multi-region-keys-overview.html) of any
6741
- # supported type. You cannot perform this operation on a KMS key in a
6742
- # custom key store, or on a KMS key in a different Amazon Web Services
6743
- # account.
6849
+ # including a [multi-Region key][1] of any supported type. You cannot
6850
+ # perform this operation on a KMS key in a custom key store, or on a KMS
6851
+ # key in a different Amazon Web Services account.
6744
6852
  #
6745
6853
  # Specify the key ID or key ARN of the KMS key.
6746
6854
  #
@@ -6754,6 +6862,10 @@ module Aws::KMS
6754
6862
  # To get the key ID and key ARN for a KMS key, use ListKeys or
6755
6863
  # DescribeKey.
6756
6864
  #
6865
+ #
6866
+ #
6867
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
6868
+ #
6757
6869
  # @option params [required, String, StringIO, File] :import_token
6758
6870
  # The import token that you received in the response to a previous
6759
6871
  # GetParametersForImport request. It must be from the same response that
@@ -6798,9 +6910,48 @@ module Aws::KMS
6798
6910
  #
6799
6911
  #
6800
6912
  #
6801
- # [1]: https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration
6913
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-expiration
6802
6914
  #
6803
- # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
6915
+ # @option params [String] :import_type
6916
+ # Indicates whether the key material being imported is previously
6917
+ # associated with this KMS key or not. This parameter is optional and
6918
+ # only usable with symmetric encryption keys. If no key material has
6919
+ # ever been imported into the KMS key, and this parameter is omitted,
6920
+ # the parameter defaults to `NEW_KEY_MATERIAL`. After the first key
6921
+ # material is imported, if this parameter is omitted then the parameter
6922
+ # defaults to `EXISTING_KEY_MATERIAL`.
6923
+ #
6924
+ # @option params [String] :key_material_description
6925
+ # Description for the key material being imported. This parameter is
6926
+ # optional and only usable with symmetric encryption keys. If you do not
6927
+ # specify a key material description, KMS retains the value you
6928
+ # specified when you last imported the same key material into this KMS
6929
+ # key.
6930
+ #
6931
+ # @option params [String] :key_material_id
6932
+ # Identifies the key material being imported. This parameter is optional
6933
+ # and only usable with symmetric encryption keys. You cannot specify a
6934
+ # key material ID with `ImportType` set to `NEW_KEY_MATERIAL`. Whenever
6935
+ # you import key material into a symmetric encryption key, KMS assigns a
6936
+ # unique identifier to the key material based on the KMS key ID and the
6937
+ # imported key material. When you re-import key material with a
6938
+ # specified key material ID, KMS:
6939
+ #
6940
+ # * Computes the identifier for the key material
6941
+ #
6942
+ # * Matches the computed identifier against the specified key material
6943
+ # ID
6944
+ #
6945
+ # * Verifies that the key material ID is already associated with the KMS
6946
+ # key
6947
+ #
6948
+ # To get the list of key material IDs associated with a KMS key, use
6949
+ # ListKeyRotations.
6950
+ #
6951
+ # @return [Types::ImportKeyMaterialResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
6952
+ #
6953
+ # * {Types::ImportKeyMaterialResponse#key_id #key_id} => String
6954
+ # * {Types::ImportKeyMaterialResponse#key_material_id #key_material_id} => String
6804
6955
  #
6805
6956
  #
6806
6957
  # @example Example: To import key material into a KMS key
@@ -6814,6 +6965,12 @@ module Aws::KMS
6814
6965
  # key_id: "1234abcd-12ab-34cd-56ef-1234567890ab", # The identifier of the KMS key to import the key material into. You can use the key ID or the Amazon Resource Name (ARN) of the KMS key.
6815
6966
  # })
6816
6967
  #
6968
+ # resp.to_h outputs the following:
6969
+ # {
6970
+ # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The Amazon Resource Name (ARN) of the KMS key into which key material was imported.
6971
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # Identifies the imported key material.
6972
+ # }
6973
+ #
6817
6974
  # @example Example: To import key material into a KMS key
6818
6975
  #
6819
6976
  # # The following example imports key material that expires in 3 days. It might be part of an application that frequently
@@ -6827,6 +6984,12 @@ module Aws::KMS
6827
6984
  # valid_to: Time.parse("2023-09-30T00:00:00-00:00"), # Specifies the date and time when the imported key material expires.
6828
6985
  # })
6829
6986
  #
6987
+ # resp.to_h outputs the following:
6988
+ # {
6989
+ # key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The Amazon Resource Name (ARN) of the KMS key into which key material was imported.
6990
+ # key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # Identifies the imported key material.
6991
+ # }
6992
+ #
6830
6993
  # @example Request syntax with placeholder values
6831
6994
  #
6832
6995
  # resp = client.import_key_material({
@@ -6835,8 +6998,16 @@ module Aws::KMS
6835
6998
  # encrypted_key_material: "data", # required
6836
6999
  # valid_to: Time.now,
6837
7000
  # expiration_model: "KEY_MATERIAL_EXPIRES", # accepts KEY_MATERIAL_EXPIRES, KEY_MATERIAL_DOES_NOT_EXPIRE
7001
+ # import_type: "NEW_KEY_MATERIAL", # accepts NEW_KEY_MATERIAL, EXISTING_KEY_MATERIAL
7002
+ # key_material_description: "KeyMaterialDescriptionType",
7003
+ # key_material_id: "BackingKeyIdType",
6838
7004
  # })
6839
7005
  #
7006
+ # @example Response structure
7007
+ #
7008
+ # resp.key_id #=> String
7009
+ # resp.key_material_id #=> String
7010
+ #
6840
7011
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ImportKeyMaterial AWS API Documentation
6841
7012
  #
6842
7013
  # @overload import_key_material(params = {})
@@ -6887,10 +7058,10 @@ module Aws::KMS
6887
7058
  #
6888
7059
  #
6889
7060
  #
6890
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/limits.html#aliases-limit
7061
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/resource-limits.html#aliases-per-key
6891
7062
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
6892
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
6893
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7063
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html
7064
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
6894
7065
  #
6895
7066
  # @option params [String] :key_id
6896
7067
  # Lists only aliases that are associated with the specified KMS key.
@@ -7022,8 +7193,9 @@ module Aws::KMS
7022
7193
  #
7023
7194
  # For detailed information about grants, including grant terminology,
7024
7195
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
7025
- # Guide</i> </i>. For examples of working with grants in several
7026
- # programming languages, see [Programming grants][2].
7196
+ # Guide</i> </i>. For examples of creating grants in several programming
7197
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
7198
+ # CLI][2].
7027
7199
  #
7028
7200
  # <note markdown="1"> The `GranteePrincipal` field in the `ListGrants` response usually
7029
7201
  # contains the user or role designated as the grantee principal in the
@@ -7056,10 +7228,10 @@ module Aws::KMS
7056
7228
  #
7057
7229
  #
7058
7230
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
7059
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
7231
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
7060
7232
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services
7061
7233
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7062
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7234
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7063
7235
  #
7064
7236
  # @option params [Integer] :limit
7065
7237
  # Use this parameter to specify the maximum number of items to return.
@@ -7235,7 +7407,7 @@ module Aws::KMS
7235
7407
  #
7236
7408
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7237
7409
  # [2]: https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
7238
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7410
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7239
7411
  #
7240
7412
  # @option params [required, String] :key_id
7241
7413
  # Gets the names of key policies for the specified KMS key.
@@ -7317,14 +7489,15 @@ module Aws::KMS
7317
7489
  req.send_request(options)
7318
7490
  end
7319
7491
 
7320
- # Returns information about all completed key material rotations for the
7321
- # specified KMS key.
7492
+ # Returns information about the key materials associated with the
7493
+ # specified KMS key. You can use the optional `IncludeKeyMaterial`
7494
+ # parameter to control which key materials are included in the response.
7322
7495
  #
7323
7496
  # You must specify the KMS key in all requests. You can refine the key
7324
7497
  # rotations list by limiting the number of rotations returned.
7325
7498
  #
7326
7499
  # For detailed information about automatic and on-demand key rotations,
7327
- # see [Rotating KMS keys][1] in the *Key Management Service Developer
7500
+ # see [Rotate KMS keys][1] in the *Key Management Service Developer
7328
7501
  # Guide*.
7329
7502
  #
7330
7503
  # **Cross-account use**: No. You cannot perform this operation on a KMS
@@ -7336,10 +7509,14 @@ module Aws::KMS
7336
7509
  #
7337
7510
  # * EnableKeyRotation
7338
7511
  #
7512
+ # * DeleteImportedKeyMaterial
7513
+ #
7339
7514
  # * DisableKeyRotation
7340
7515
  #
7341
7516
  # * GetKeyRotationStatus
7342
7517
  #
7518
+ # * ImportKeyMaterial
7519
+ #
7343
7520
  # * RotateKeyOnDemand
7344
7521
  #
7345
7522
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -7349,7 +7526,7 @@ module Aws::KMS
7349
7526
  #
7350
7527
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
7351
7528
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7352
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7529
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7353
7530
  #
7354
7531
  # @option params [required, String] :key_id
7355
7532
  # Gets the key rotations for the specified KMS key.
@@ -7366,6 +7543,16 @@ module Aws::KMS
7366
7543
  # To get the key ID and key ARN for a KMS key, use ListKeys or
7367
7544
  # DescribeKey.
7368
7545
  #
7546
+ # @option params [String] :include_key_material
7547
+ # Use this optional parameter to control which key materials associated
7548
+ # with this key are listed in the response. The default value of this
7549
+ # parameter is `ROTATIONS_ONLY`. If you omit this parameter, KMS returns
7550
+ # information on the key materials created by automatic or on-demand key
7551
+ # rotation. When you specify a value of `ALL_KEY_MATERIAL`, KMS adds the
7552
+ # first key material and any imported key material pending rotation to
7553
+ # the response. This parameter can only be used with KMS keys that
7554
+ # support automatic or on-demand key rotation.
7555
+ #
7369
7556
  # @option params [Integer] :limit
7370
7557
  # Use this parameter to specify the maximum number of items to return.
7371
7558
  # When this value is present, KMS does not return more than the
@@ -7418,6 +7605,7 @@ module Aws::KMS
7418
7605
  #
7419
7606
  # resp = client.list_key_rotations({
7420
7607
  # key_id: "KeyIdType", # required
7608
+ # include_key_material: "ALL_KEY_MATERIAL", # accepts ALL_KEY_MATERIAL, ROTATIONS_ONLY
7421
7609
  # limit: 1,
7422
7610
  # marker: "MarkerType",
7423
7611
  # })
@@ -7426,6 +7614,12 @@ module Aws::KMS
7426
7614
  #
7427
7615
  # resp.rotations #=> Array
7428
7616
  # resp.rotations[0].key_id #=> String
7617
+ # resp.rotations[0].key_material_id #=> String
7618
+ # resp.rotations[0].key_material_description #=> String
7619
+ # resp.rotations[0].import_state #=> String, one of "IMPORTED", "PENDING_IMPORT"
7620
+ # resp.rotations[0].key_material_state #=> String, one of "NON_CURRENT", "CURRENT", "PENDING_ROTATION"
7621
+ # resp.rotations[0].expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
7622
+ # resp.rotations[0].valid_to #=> Time
7429
7623
  # resp.rotations[0].rotation_date #=> Time
7430
7624
  # resp.rotations[0].rotation_type #=> String, one of "AUTOMATIC", "ON_DEMAND"
7431
7625
  # resp.next_marker #=> String
@@ -7464,7 +7658,7 @@ module Aws::KMS
7464
7658
  #
7465
7659
  #
7466
7660
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7467
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7661
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7468
7662
  #
7469
7663
  # @option params [Integer] :limit
7470
7664
  # Use this parameter to specify the maximum number of items to return.
@@ -7560,7 +7754,7 @@ module Aws::KMS
7560
7754
  # For general information about tags, including the format and syntax,
7561
7755
  # see [Tagging Amazon Web Services resources][1] in the *Amazon Web
7562
7756
  # Services General Reference*. For information about using tags in KMS,
7563
- # see [Tagging keys][2].
7757
+ # see [Tags in KMS][2].
7564
7758
  #
7565
7759
  # **Cross-account use**: No. You cannot perform this operation on a KMS
7566
7760
  # key in a different Amazon Web Services account.
@@ -7585,7 +7779,7 @@ module Aws::KMS
7585
7779
  # [1]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
7586
7780
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
7587
7781
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7588
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7782
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7589
7783
  #
7590
7784
  # @option params [required, String] :key_id
7591
7785
  # Gets tags on the specified KMS key.
@@ -7690,8 +7884,9 @@ module Aws::KMS
7690
7884
  #
7691
7885
  # For detailed information about grants, including grant terminology,
7692
7886
  # see [Grants in KMS][1] in the <i> <i>Key Management Service Developer
7693
- # Guide</i> </i>. For examples of working with grants in several
7694
- # programming languages, see [Programming grants][2].
7887
+ # Guide</i> </i>. For examples of creating grants in several programming
7888
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
7889
+ # CLI][2].
7695
7890
  #
7696
7891
  # **Cross-account use**: You must specify a principal in your Amazon Web
7697
7892
  # Services account. This operation returns a list of grants where the
@@ -7729,9 +7924,9 @@ module Aws::KMS
7729
7924
  #
7730
7925
  #
7731
7926
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
7732
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
7927
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
7733
7928
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7734
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
7929
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7735
7930
  #
7736
7931
  # @option params [Integer] :limit
7737
7932
  # Use this parameter to specify the maximum number of items to return.
@@ -7841,8 +8036,9 @@ module Aws::KMS
7841
8036
  # formatting a JSON policy document, see the [IAM JSON Policy
7842
8037
  # Reference][2] in the <i> <i>Identity and Access Management User
7843
8038
  # Guide</i> </i>. For examples of adding a key policy in multiple
7844
- # programming languages, see [Setting a key policy][3] in the *Key
7845
- # Management Service Developer Guide*.
8039
+ # programming languages, see [Use PutKeyPolicy with an Amazon Web
8040
+ # Services SDK or CLI][3] in the *Key Management Service Developer
8041
+ # Guide*.
7846
8042
  #
7847
8043
  # **Cross-account use**: No. You cannot perform this operation on a KMS
7848
8044
  # key in a different Amazon Web Services account.
@@ -7858,9 +8054,9 @@ module Aws::KMS
7858
8054
  #
7859
8055
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
7860
8056
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
7861
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-key-policies.html#put-policy
8057
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_PutKeyPolicy_section.html
7862
8058
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
7863
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8059
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
7864
8060
  #
7865
8061
  # @option params [required, String] :key_id
7866
8062
  # Sets the key policy on the specified KMS key.
@@ -7901,6 +8097,17 @@ module Aws::KMS
7901
8097
  # not always immediately visible][2] in the *Amazon Web Services
7902
8098
  # Identity and Access Management User Guide*.
7903
8099
  #
8100
+ # <note markdown="1"> If either of the required `Resource` or `Action` elements are missing
8101
+ # from a key policy statement, the policy statement has no effect. When
8102
+ # a key policy statement is missing one of these elements, the KMS
8103
+ # console correctly reports an error, but the `PutKeyPolicy` API request
8104
+ # succeeds, even though the policy statement is ineffective.
8105
+ #
8106
+ # For more information on required key policy elements, see [Elements in
8107
+ # a key policy][3] in the *Key Management Service Developer Guide*.
8108
+ #
8109
+ # </note>
8110
+ #
7904
8111
  # A key policy document can include only the following characters:
7905
8112
  #
7906
8113
  # * Printable ASCII characters from the space character (`\u0020`)
@@ -7912,18 +8119,24 @@ module Aws::KMS
7912
8119
  # * The tab (`\u0009`), line feed (`\u000A`), and carriage return
7913
8120
  # (`\u000D`) special characters
7914
8121
  #
7915
- # For information about key policies, see [Key policies in KMS][3] in
8122
+ # <note markdown="1"> If the key policy exceeds the length constraint, KMS returns a
8123
+ # `LimitExceededException`.
8124
+ #
8125
+ # </note>
8126
+ #
8127
+ # For information about key policies, see [Key policies in KMS][4] in
7916
8128
  # the *Key Management Service Developer Guide*.For help writing and
7917
8129
  # formatting a JSON policy document, see the [IAM JSON Policy
7918
- # Reference][4] in the <i> <i>Identity and Access Management User
8130
+ # Reference][5] in the <i> <i>Identity and Access Management User
7919
8131
  # Guide</i> </i>.
7920
8132
  #
7921
8133
  #
7922
8134
  #
7923
8135
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
7924
8136
  # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
7925
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
7926
- # [4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
8137
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
8138
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8139
+ # [5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
7927
8140
  #
7928
8141
  # @option params [Boolean] :bypass_policy_lockout_safety_check
7929
8142
  # Skips ("bypasses") the key policy lockout safety check. The default
@@ -8072,15 +8285,15 @@ module Aws::KMS
8072
8285
  #
8073
8286
  #
8074
8287
  #
8075
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-manually
8076
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8077
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#asymmetric-cmks
8288
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys-manually.html
8289
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8290
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
8078
8291
  # [4]: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/
8079
8292
  # [5]: https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html
8080
8293
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8081
8294
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8082
8295
  # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8083
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8296
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8084
8297
  #
8085
8298
  # @option params [required, String, StringIO, File] :ciphertext_blob
8086
8299
  # Ciphertext of the data to reencrypt.
@@ -8103,7 +8316,7 @@ module Aws::KMS
8103
8316
  #
8104
8317
  #
8105
8318
  #
8106
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8319
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8107
8320
  #
8108
8321
  # @option params [String] :source_key_id
8109
8322
  # Specifies the KMS key that KMS will use to decrypt the ciphertext
@@ -8189,7 +8402,7 @@ module Aws::KMS
8189
8402
  #
8190
8403
  #
8191
8404
  #
8192
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
8405
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html
8193
8406
  #
8194
8407
  # @option params [String] :source_encryption_algorithm
8195
8408
  # Specifies the encryption algorithm that KMS will use to decrypt the
@@ -8223,18 +8436,18 @@ module Aws::KMS
8223
8436
  #
8224
8437
  #
8225
8438
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
8226
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
8439
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
8227
8440
  #
8228
8441
  # @option params [Boolean] :dry_run
8229
8442
  # Checks if your request will succeed. `DryRun` is an optional
8230
8443
  # parameter.
8231
8444
  #
8232
- # To learn more about how to use this parameter, see [Testing your KMS
8233
- # API calls][1] in the *Key Management Service Developer Guide*.
8445
+ # To learn more about how to use this parameter, see [Testing your
8446
+ # permissions][1] in the *Key Management Service Developer Guide*.
8234
8447
  #
8235
8448
  #
8236
8449
  #
8237
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
8450
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8238
8451
  #
8239
8452
  # @return [Types::ReEncryptResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
8240
8453
  #
@@ -8243,6 +8456,8 @@ module Aws::KMS
8243
8456
  # * {Types::ReEncryptResponse#key_id #key_id} => String
8244
8457
  # * {Types::ReEncryptResponse#source_encryption_algorithm #source_encryption_algorithm} => String
8245
8458
  # * {Types::ReEncryptResponse#destination_encryption_algorithm #destination_encryption_algorithm} => String
8459
+ # * {Types::ReEncryptResponse#source_key_material_id #source_key_material_id} => String
8460
+ # * {Types::ReEncryptResponse#destination_key_material_id #destination_key_material_id} => String
8246
8461
  #
8247
8462
  #
8248
8463
  # @example Example: To reencrypt data
@@ -8257,8 +8472,12 @@ module Aws::KMS
8257
8472
  # resp.to_h outputs the following:
8258
8473
  # {
8259
8474
  # ciphertext_blob: "<binary data>", # The reencrypted data.
8475
+ # destination_encryption_algorithm: "SYMMETRIC_DEFAULT", # The encryption algorithm that was used to reencrypt the data.
8476
+ # destination_key_material_id: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to reencrypt the data.
8260
8477
  # key_id: "arn:aws:kms:us-east-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321", # The ARN of the KMS key that was used to reencrypt the data.
8478
+ # source_encryption_algorithm: "SYMMETRIC_DEFAULT", # The encryption algorithm that was used to decrypt the ciphertext before it was reencrypted.
8261
8479
  # source_key_id: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", # The ARN of the KMS key that was originally used to encrypt the data.
8480
+ # source_key_material_id: "1c6be7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", # The identifier of the key material used to originally encrypt the data.
8262
8481
  # }
8263
8482
  #
8264
8483
  # @example Request syntax with placeholder values
@@ -8286,6 +8505,8 @@ module Aws::KMS
8286
8505
  # resp.key_id #=> String
8287
8506
  # resp.source_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8288
8507
  # resp.destination_encryption_algorithm #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8508
+ # resp.source_key_material_id #=> String
8509
+ # resp.destination_key_material_id #=> String
8289
8510
  #
8290
8511
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/ReEncrypt AWS API Documentation
8291
8512
  #
@@ -8317,12 +8538,12 @@ module Aws::KMS
8317
8538
  # independently of its primary and peer replica keys. A primary key and
8318
8539
  # its replica keys share properties that make them interoperable. They
8319
8540
  # have the same [key ID][2] and key material. They also have the same
8320
- # [key spec][3], [key usage][4], [key material origin][5], and
8321
- # [automatic key rotation status][6]. KMS automatically synchronizes
8322
- # these shared properties among related multi-Region keys. All other
8323
- # properties of a replica key can differ, including its [key policy][7],
8324
- # [tags][8], [aliases][9], and [Key states of KMS keys][10]. KMS pricing
8325
- # and quotas for KMS keys apply to each primary key and replica key.
8541
+ # key spec, key usage, key material origin, and automatic key rotation
8542
+ # status. KMS automatically synchronizes these shared properties among
8543
+ # related multi-Region keys. All other properties of a replica key can
8544
+ # differ, including its [key policy][3], [tags][4], [aliases][5], and
8545
+ # [key state][6]. KMS pricing and quotas for KMS keys apply to each
8546
+ # primary key and replica key.
8326
8547
  #
8327
8548
  # When this operation completes, the new replica key has a transient key
8328
8549
  # state of `Creating`. This key state changes to `Enabled` (or
@@ -8332,7 +8553,7 @@ module Aws::KMS
8332
8553
  # If you are creating and using the replica key programmatically, retry
8333
8554
  # on `KMSInvalidStateException` or call `DescribeKey` to check its
8334
8555
  # `KeyState` value before using it. For details about the `Creating` key
8335
- # state, see [Key states of KMS keys][10] in the *Key Management Service
8556
+ # state, see [Key states of KMS keys][6] in the *Key Management Service
8336
8557
  # Developer Guide*.
8337
8558
  #
8338
8559
  # You cannot create more than one replica of a primary key in any
@@ -8341,7 +8562,7 @@ module Aws::KMS
8341
8562
  # `AlreadyExistsException` error. If the key state of the existing
8342
8563
  # replica is `PendingDeletion`, you can cancel the scheduled key
8343
8564
  # deletion (CancelKeyDeletion) or wait for the key to be deleted. The
8344
- # new replica key you create will have the same [shared properties][11]
8565
+ # new replica key you create will have the same [shared properties][7]
8345
8566
  # as the original replica key.
8346
8567
  #
8347
8568
  # The CloudTrail log of a `ReplicateKey` operation records a
@@ -8351,8 +8572,6 @@ module Aws::KMS
8351
8572
  # If you replicate a multi-Region primary key with imported key
8352
8573
  # material, the replica key is created with no key material. You must
8353
8574
  # import the same key material that you imported into the primary key.
8354
- # For details, see [Importing key material into multi-Region keys][12]
8355
- # in the *Key Management Service Developer Guide*.
8356
8575
  #
8357
8576
  # To convert a replica key to a primary key, use the UpdatePrimaryRegion
8358
8577
  # operation.
@@ -8383,23 +8602,18 @@ module Aws::KMS
8383
8602
  # * UpdatePrimaryRegion
8384
8603
  #
8385
8604
  # **Eventual consistency**: The KMS API follows an eventual consistency
8386
- # model. For more information, see [KMS eventual consistency][13].
8605
+ # model. For more information, see [KMS eventual consistency][8].
8387
8606
  #
8388
8607
  #
8389
8608
  #
8390
8609
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
8391
8610
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id
8392
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec
8393
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-usage
8394
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-origin
8395
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
8396
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8397
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
8398
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
8399
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8400
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties
8401
- # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html
8402
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8611
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
8612
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
8613
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
8614
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8615
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties
8616
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8403
8617
  #
8404
8618
  # @option params [required, String] :key_id
8405
8619
  # Identifies the multi-Region primary key that is being replicated. To
@@ -8427,33 +8641,23 @@ module Aws::KMS
8427
8641
  # [KMS service endpoints][1] in the *Amazon Web Services General
8428
8642
  # Reference*.
8429
8643
  #
8430
- # <note markdown="1"> HMAC KMS keys are not supported in all Amazon Web Services Regions. If
8431
- # you try to replicate an HMAC KMS key in an Amazon Web Services Region
8432
- # in which HMAC keys are not supported, the `ReplicateKey` operation
8433
- # returns an `UnsupportedOperationException`. For a list of Regions in
8434
- # which HMAC KMS keys are supported, see [HMAC keys in KMS][2] in the
8435
- # *Key Management Service Developer Guide*.
8436
- #
8437
- # </note>
8438
- #
8439
8644
  # The replica must be in a different Amazon Web Services Region than its
8440
8645
  # primary key and other replicas of that primary key, but in the same
8441
8646
  # Amazon Web Services partition. KMS must be available in the replica
8442
8647
  # Region. If the Region is not enabled by default, the Amazon Web
8443
8648
  # Services account must be enabled in the Region. For information about
8444
- # Amazon Web Services partitions, see [Amazon Resource Names (ARNs)][3]
8649
+ # Amazon Web Services partitions, see [Amazon Resource Names (ARNs)][2]
8445
8650
  # in the *Amazon Web Services General Reference*. For information about
8446
- # enabling and disabling Regions, see [Enabling a Region][4] and
8447
- # [Disabling a Region][5] in the *Amazon Web Services General
8651
+ # enabling and disabling Regions, see [Enabling a Region][3] and
8652
+ # [Disabling a Region][4] in the *Amazon Web Services General
8448
8653
  # Reference*.
8449
8654
  #
8450
8655
  #
8451
8656
  #
8452
8657
  # [1]: https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region
8453
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
8454
- # [3]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
8455
- # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
8456
- # [5]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
8658
+ # [2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
8659
+ # [3]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable
8660
+ # [4]: https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable
8457
8661
  #
8458
8662
  # @option params [String] :policy
8459
8663
  # The key policy to attach to the KMS key. This parameter is optional.
@@ -8501,7 +8705,7 @@ module Aws::KMS
8501
8705
  #
8502
8706
  #
8503
8707
  #
8504
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
8708
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
8505
8709
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
8506
8710
  # [3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
8507
8711
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
@@ -8570,7 +8774,7 @@ module Aws::KMS
8570
8774
  # When you add tags to an Amazon Web Services resource, Amazon Web
8571
8775
  # Services generates a cost allocation report with usage and costs
8572
8776
  # aggregated by tags. Tags can also be used to control access to a KMS
8573
- # key. For details, see [Tagging Keys][3].
8777
+ # key. For details, see [Tags in KMS][3].
8574
8778
  #
8575
8779
  #
8576
8780
  #
@@ -8665,11 +8869,11 @@ module Aws::KMS
8665
8869
  # resp.replica_key_metadata.expiration_model #=> String, one of "KEY_MATERIAL_EXPIRES", "KEY_MATERIAL_DOES_NOT_EXPIRE"
8666
8870
  # resp.replica_key_metadata.key_manager #=> String, one of "AWS", "CUSTOMER"
8667
8871
  # resp.replica_key_metadata.customer_master_key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
8668
- # resp.replica_key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2"
8872
+ # resp.replica_key_metadata.key_spec #=> String, one of "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521", "ECC_SECG_P256K1", "SYMMETRIC_DEFAULT", "HMAC_224", "HMAC_256", "HMAC_384", "HMAC_512", "SM2", "ML_DSA_44", "ML_DSA_65", "ML_DSA_87"
8669
8873
  # resp.replica_key_metadata.encryption_algorithms #=> Array
8670
8874
  # resp.replica_key_metadata.encryption_algorithms[0] #=> String, one of "SYMMETRIC_DEFAULT", "RSAES_OAEP_SHA_1", "RSAES_OAEP_SHA_256", "SM2PKE"
8671
8875
  # resp.replica_key_metadata.signing_algorithms #=> Array
8672
- # resp.replica_key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
8876
+ # resp.replica_key_metadata.signing_algorithms[0] #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
8673
8877
  # resp.replica_key_metadata.key_agreement_algorithms #=> Array
8674
8878
  # resp.replica_key_metadata.key_agreement_algorithms[0] #=> String, one of "ECDH"
8675
8879
  # resp.replica_key_metadata.multi_region #=> Boolean
@@ -8683,6 +8887,7 @@ module Aws::KMS
8683
8887
  # resp.replica_key_metadata.mac_algorithms #=> Array
8684
8888
  # resp.replica_key_metadata.mac_algorithms[0] #=> String, one of "HMAC_SHA_224", "HMAC_SHA_256", "HMAC_SHA_384", "HMAC_SHA_512"
8685
8889
  # resp.replica_key_metadata.xks_key_configuration.id #=> String
8890
+ # resp.replica_key_metadata.current_key_material_id #=> String
8686
8891
  # resp.replica_policy #=> String
8687
8892
  # resp.replica_tags #=> Array
8688
8893
  # resp.replica_tags[0].tag_key #=> String
@@ -8706,20 +8911,20 @@ module Aws::KMS
8706
8911
  # by the *grantee principal* if the grant allows the `RetireGrant`
8707
8912
  # operation, and by the Amazon Web Services account in which the grant
8708
8913
  # is created. It can also be called by principals to whom permission for
8709
- # retiring a grant is delegated. For details, see [Retiring and revoking
8710
- # grants][2] in the *Key Management Service Developer Guide*.
8914
+ # retiring a grant is delegated.
8711
8915
  #
8712
8916
  # For detailed information about grants, including grant terminology,
8713
- # see [Grants in KMS][3] in the <i> <i>Key Management Service Developer
8714
- # Guide</i> </i>. For examples of working with grants in several
8715
- # programming languages, see [Programming grants][4].
8917
+ # see [Grants in KMS][2] in the <i> <i>Key Management Service Developer
8918
+ # Guide</i> </i>. For examples of creating grants in several programming
8919
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
8920
+ # CLI][3].
8716
8921
  #
8717
8922
  # **Cross-account use**: Yes. You can retire a grant on a KMS key in a
8718
8923
  # different Amazon Web Services account.
8719
8924
  #
8720
8925
  # **Required permissions**: Permission to retire a grant is determined
8721
8926
  # primarily by the grant. For details, see [Retiring and revoking
8722
- # grants][2] in the *Key Management Service Developer Guide*.
8927
+ # grants][4] in the *Key Management Service Developer Guide*.
8723
8928
  #
8724
8929
  # **Related operations:**
8725
8930
  #
@@ -8737,10 +8942,10 @@ module Aws::KMS
8737
8942
  #
8738
8943
  #
8739
8944
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
8740
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
8741
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8742
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
8743
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
8945
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8946
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
8947
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
8948
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8744
8949
  #
8745
8950
  # @option params [String] :grant_token
8746
8951
  # Identifies the grant to be retired. You can use a grant token to
@@ -8775,12 +8980,12 @@ module Aws::KMS
8775
8980
  # Checks if your request will succeed. `DryRun` is an optional
8776
8981
  # parameter.
8777
8982
  #
8778
- # To learn more about how to use this parameter, see [Testing your KMS
8779
- # API calls][1] in the *Key Management Service Developer Guide*.
8983
+ # To learn more about how to use this parameter, see [Testing your
8984
+ # permissions][1] in the *Key Management Service Developer Guide*.
8780
8985
  #
8781
8986
  #
8782
8987
  #
8783
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
8988
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8784
8989
  #
8785
8990
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
8786
8991
  #
@@ -8825,8 +9030,9 @@ module Aws::KMS
8825
9030
  #
8826
9031
  # For detailed information about grants, including grant terminology,
8827
9032
  # see [Grants in KMS][3] in the <i> <i>Key Management Service Developer
8828
- # Guide</i> </i>. For examples of working with grants in several
8829
- # programming languages, see [Programming grants][4].
9033
+ # Guide</i> </i>. For examples of creating grants in several programming
9034
+ # languages, see [Use CreateGrant with an Amazon Web Services SDK or
9035
+ # CLI][4].
8830
9036
  #
8831
9037
  # **Cross-account use**: Yes. To perform this operation on a KMS key in
8832
9038
  # a different Amazon Web Services account, specify the key ARN in the
@@ -8849,12 +9055,12 @@ module Aws::KMS
8849
9055
  #
8850
9056
  #
8851
9057
  #
8852
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete
9058
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-delete.html
8853
9059
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-eventual-consistency
8854
9060
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html
8855
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html
9061
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html
8856
9062
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8857
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9063
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8858
9064
  #
8859
9065
  # @option params [required, String] :key_id
8860
9066
  # A unique identifier for the KMS key associated with the grant. To get
@@ -8881,12 +9087,12 @@ module Aws::KMS
8881
9087
  # Checks if your request will succeed. `DryRun` is an optional
8882
9088
  # parameter.
8883
9089
  #
8884
- # To learn more about how to use this parameter, see [Testing your KMS
8885
- # API calls][1] in the *Key Management Service Developer Guide*.
9090
+ # To learn more about how to use this parameter, see [Testing your
9091
+ # permissions][1] in the *Key Management Service Developer Guide*.
8886
9092
  #
8887
9093
  #
8888
9094
  #
8889
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
9095
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
8890
9096
  #
8891
9097
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
8892
9098
  #
@@ -8942,10 +9148,15 @@ module Aws::KMS
8942
9148
  # of the key material for your KMS keys in CloudTrail and Amazon
8943
9149
  # CloudWatch.
8944
9150
  #
8945
- # On-demand key rotation is supported only on [symmetric encryption KMS
8946
- # keys][3]. You cannot perform on-demand rotation of [asymmetric KMS
8947
- # keys][4], [HMAC KMS keys][5], KMS keys with [imported key
8948
- # material][6], or KMS keys in a [custom key store][7]. To perform
9151
+ # On-demand key rotation is supported only on symmetric encryption KMS
9152
+ # keys. You cannot perform on-demand rotation of [asymmetric KMS
9153
+ # keys][3], [HMAC KMS keys][4], multi-Region KMS keys with [imported key
9154
+ # material][5], or KMS keys in a [custom key store][6]. When you
9155
+ # initiate on-demand key rotation on a symmetric encryption KMS key with
9156
+ # imported key material, you must have already imported [new key
9157
+ # material][7] and that key material's state should be
9158
+ # `PENDING_ROTATION`. Use the `ListKeyRotations` operation to check the
9159
+ # state of all key materials associated with a KMS key. To perform
8949
9160
  # on-demand rotation of a set of related [multi-Region keys][8], invoke
8950
9161
  # the on-demand rotation on the primary key.
8951
9162
  #
@@ -8972,6 +9183,8 @@ module Aws::KMS
8972
9183
  #
8973
9184
  # * GetKeyRotationStatus
8974
9185
  #
9186
+ # * ImportKeyMaterial
9187
+ #
8975
9188
  # * ListKeyRotations
8976
9189
  #
8977
9190
  # **Eventual consistency**: The KMS API follows an eventual consistency
@@ -8979,27 +9192,27 @@ module Aws::KMS
8979
9192
  #
8980
9193
  #
8981
9194
  #
8982
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-on-demand
8983
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotating-keys-enable-disable
8984
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks
8985
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
8986
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
8987
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
8988
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
8989
- # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
8990
- # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
8991
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
9195
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html
9196
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html
9197
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9198
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
9199
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
9200
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9201
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html
9202
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
9203
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
9204
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key
8992
9205
  # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
8993
9206
  # [12]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
8994
- # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9207
+ # [13]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
8995
9208
  #
8996
9209
  # @option params [required, String] :key_id
8997
9210
  # Identifies a symmetric encryption KMS key. You cannot perform
8998
9211
  # on-demand rotation of [asymmetric KMS keys][1], [HMAC KMS keys][2],
8999
- # KMS keys with [imported key material][3], or KMS keys in a [custom key
9000
- # store][4]. To perform on-demand rotation of a set of related
9001
- # [multi-Region keys][5], invoke the on-demand rotation on the primary
9002
- # key.
9212
+ # multi-Region KMS keys with [imported key material][3], or KMS keys in
9213
+ # a [custom key store][4]. To perform on-demand rotation of a set of
9214
+ # related [multi-Region keys][5], invoke the on-demand rotation on the
9215
+ # primary key.
9003
9216
  #
9004
9217
  # Specify the key ID or key ARN of the KMS key.
9005
9218
  #
@@ -9018,8 +9231,8 @@ module Aws::KMS
9018
9231
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9019
9232
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
9020
9233
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html
9021
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
9022
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate
9234
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9235
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#multi-region-rotate
9023
9236
  #
9024
9237
  # @return [Types::RotateKeyOnDemandResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
9025
9238
  #
@@ -9073,9 +9286,8 @@ module Aws::KMS
9073
9286
  # operation. When a KMS key is deleted, all data that was encrypted
9074
9287
  # under the KMS key is unrecoverable. (The only exception is a
9075
9288
  # [multi-Region replica key][1], or an [asymmetric or HMAC KMS key with
9076
- # imported key
9077
- # material](kms/latest/developerguide/importing-keys-managing.html#import-delete-key).)
9078
- # To prevent the use of a KMS key without deleting it, use DisableKey.
9289
+ # imported key material][2].) To prevent the use of a KMS key without
9290
+ # deleting it, use DisableKey.
9079
9291
  #
9080
9292
  # You can schedule the deletion of a multi-Region primary key and its
9081
9293
  # replica keys at any time. However, KMS will not delete a multi-Region
@@ -9086,13 +9298,13 @@ module Aws::KMS
9086
9298
  # the last of its replicas keys is deleted (not just scheduled), the key
9087
9299
  # state of the primary key changes to `PendingDeletion` and its waiting
9088
9300
  # period (`PendingWindowInDays`) begins. For details, see [Deleting
9089
- # multi-Region keys][1] in the *Key Management Service Developer Guide*.
9301
+ # multi-Region keys][3] in the *Key Management Service Developer Guide*.
9090
9302
  #
9091
- # When KMS [deletes a KMS key from an CloudHSM key store][2], it makes a
9303
+ # When KMS [deletes a KMS key from an CloudHSM key store][4], it makes a
9092
9304
  # best effort to delete the associated key material from the associated
9093
9305
  # CloudHSM cluster. However, you might need to manually [delete the
9094
- # orphaned key material][3] from the cluster and its backups. [Deleting
9095
- # a KMS key from an external key store][4] has no effect on the
9306
+ # orphaned key material][5] from the cluster and its backups. [Deleting
9307
+ # a KMS key from an external key store][6] has no effect on the
9096
9308
  # associated external key. However, for both types of custom key stores,
9097
9309
  # deleting a KMS key is destructive and irreversible. You cannot decrypt
9098
9310
  # ciphertext encrypted under the KMS key by using only its associated
@@ -9101,11 +9313,11 @@ module Aws::KMS
9101
9313
  # material.
9102
9314
  #
9103
9315
  # For more information about scheduling a KMS key for deletion, see
9104
- # [Deleting KMS keys][5] in the *Key Management Service Developer
9316
+ # [Deleting KMS keys][7] in the *Key Management Service Developer
9105
9317
  # Guide*.
9106
9318
  #
9107
9319
  # The KMS key that you use for this operation must be in a compatible
9108
- # key state. For details, see [Key states of KMS keys][6] in the *Key
9320
+ # key state. For details, see [Key states of KMS keys][8] in the *Key
9109
9321
  # Management Service Developer Guide*.
9110
9322
  #
9111
9323
  # **Cross-account use**: No. You cannot perform this operation on a KMS
@@ -9120,17 +9332,19 @@ module Aws::KMS
9120
9332
  # * DisableKey
9121
9333
  #
9122
9334
  # **Eventual consistency**: The KMS API follows an eventual consistency
9123
- # model. For more information, see [KMS eventual consistency][7].
9335
+ # model. For more information, see [KMS eventual consistency][9].
9124
9336
  #
9125
9337
  #
9126
9338
  #
9127
9339
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-delete.html
9128
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/delete-cmk-keystore.html
9129
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
9130
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/delete-xks-key.html
9131
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
9132
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9133
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9340
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#import-delete-key
9341
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#deleting-mrks
9342
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#delete-cmk-keystore
9343
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key
9344
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#delete-xks-key
9345
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
9346
+ # [8]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9347
+ # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9134
9348
  #
9135
9349
  # @option params [required, String] :key_id
9136
9350
  # The unique identifier of the KMS key to delete.
@@ -9219,11 +9433,11 @@ module Aws::KMS
9219
9433
  # Developer Guide*.
9220
9434
  #
9221
9435
  # Digital signatures are generated and verified by using asymmetric key
9222
- # pair, such as an RSA or ECC pair that is represented by an asymmetric
9223
- # KMS key. The key owner (or an authorized user) uses their private key
9224
- # to sign a message. Anyone with the public key can verify that the
9225
- # message was signed with that particular private key and that the
9226
- # message hasn't changed since it was signed.
9436
+ # pair, such as an RSA, ECC, or ML-DSA pair that is represented by an
9437
+ # asymmetric KMS key. The key owner (or an authorized user) uses their
9438
+ # private key to sign a message. Anyone with the public key can verify
9439
+ # that the message was signed with that particular private key and that
9440
+ # the message hasn't changed since it was signed.
9227
9441
  #
9228
9442
  # To use the `Sign` operation, provide the following information:
9229
9443
  #
@@ -9236,8 +9450,8 @@ module Aws::KMS
9236
9450
  # to sign. You can submit messages of up to 4096 bytes. To sign a
9237
9451
  # larger message, generate a hash digest of the message, and then
9238
9452
  # provide the hash digest in the `Message` parameter. To indicate
9239
- # whether the message is a full message or a digest, use the
9240
- # `MessageType` parameter.
9453
+ # whether the message is a full message, a digest, or an ML-DSA
9454
+ # EXTERNAL\_MU, use the `MessageType` parameter.
9241
9455
  #
9242
9456
  # * Choose a signing algorithm that is compatible with the KMS key.
9243
9457
  #
@@ -9279,7 +9493,7 @@ module Aws::KMS
9279
9493
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
9280
9494
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9281
9495
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9282
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9496
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9283
9497
  #
9284
9498
  # @option params [required, String] :key_id
9285
9499
  # Identifies an asymmetric KMS key. KMS uses the private key in the
@@ -9317,26 +9531,34 @@ module Aws::KMS
9317
9531
  # @option params [String] :message_type
9318
9532
  # Tells KMS whether the value of the `Message` parameter should be
9319
9533
  # hashed as part of the signing algorithm. Use `RAW` for unhashed
9320
- # messages; use `DIGEST` for message digests, which are already hashed.
9534
+ # messages; use `DIGEST` for message digests, which are already hashed;
9535
+ # use `EXTERNAL_MU` for 64-byte representative μ used in ML-DSA signing
9536
+ # as defined in NIST FIPS 204 Section 6.2.
9321
9537
  #
9322
9538
  # When the value of `MessageType` is `RAW`, KMS uses the standard
9323
9539
  # signing algorithm, which begins with a hash function. When the value
9324
- # is `DIGEST`, KMS skips the hashing step in the signing algorithm.
9540
+ # is `DIGEST`, KMS skips the hashing step in the signing algorithm. When
9541
+ # the value is `EXTERNAL_MU` KMS skips the concatenated hashing of the
9542
+ # public key hash and the message done in the ML-DSA signing algorithm.
9325
9543
  #
9326
- # Use the `DIGEST` value only when the value of the `Message` parameter
9327
- # is a message digest. If you use the `DIGEST` value with an unhashed
9328
- # message, the security of the signing operation can be compromised.
9544
+ # Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
9545
+ # `Message` parameter is a message digest. If you use the `DIGEST` value
9546
+ # with an unhashed message, the security of the signing operation can be
9547
+ # compromised.
9329
9548
  #
9330
- # When the value of `MessageType`is `DIGEST`, the length of the
9549
+ # When the value of `MessageType` is `DIGEST`, the length of the
9331
9550
  # `Message` value must match the length of hashed messages for the
9332
9551
  # specified signing algorithm.
9333
9552
  #
9553
+ # When the value of `MessageType` is `EXTERNAL_MU` the length of the
9554
+ # `Message` value must be 64 bytes.
9555
+ #
9334
9556
  # You can submit a message digest and omit the `MessageType` or specify
9335
9557
  # `RAW` so the digest is hashed again while signing. However, this can
9336
9558
  # cause verification failures when verifying with a system that assumes
9337
9559
  # a single hash.
9338
9560
  #
9339
- # The hashing algorithm in that `Sign` uses is based on the
9561
+ # The hashing algorithm that `Sign` uses is based on the
9340
9562
  # `SigningAlgorithm` value.
9341
9563
  #
9342
9564
  # * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
@@ -9348,12 +9570,15 @@ module Aws::KMS
9348
9570
  # * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
9349
9571
  # algorithm.
9350
9572
  #
9573
+ # * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256 hashing
9574
+ # algorithm.
9575
+ #
9351
9576
  # * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
9352
9577
  # verification with SM2 key pairs][1].
9353
9578
  #
9354
9579
  #
9355
9580
  #
9356
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
9581
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
9357
9582
  #
9358
9583
  # @option params [Array<String>] :grant_tokens
9359
9584
  # A list of grant tokens.
@@ -9366,7 +9591,7 @@ module Aws::KMS
9366
9591
  #
9367
9592
  #
9368
9593
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
9369
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
9594
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
9370
9595
  #
9371
9596
  # @option params [required, String] :signing_algorithm
9372
9597
  # Specifies the signing algorithm to use when signing the message.
@@ -9380,12 +9605,12 @@ module Aws::KMS
9380
9605
  # Checks if your request will succeed. `DryRun` is an optional
9381
9606
  # parameter.
9382
9607
  #
9383
- # To learn more about how to use this parameter, see [Testing your KMS
9384
- # API calls][1] in the *Key Management Service Developer Guide*.
9608
+ # To learn more about how to use this parameter, see [Testing your
9609
+ # permissions][1] in the *Key Management Service Developer Guide*.
9385
9610
  #
9386
9611
  #
9387
9612
  #
9388
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
9613
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
9389
9614
  #
9390
9615
  # @return [Types::SignResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
9391
9616
  #
@@ -9438,9 +9663,9 @@ module Aws::KMS
9438
9663
  # resp = client.sign({
9439
9664
  # key_id: "KeyIdType", # required
9440
9665
  # message: "data", # required
9441
- # message_type: "RAW", # accepts RAW, DIGEST
9666
+ # message_type: "RAW", # accepts RAW, DIGEST, EXTERNAL_MU
9442
9667
  # grant_tokens: ["GrantTokenType"],
9443
- # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA
9668
+ # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA, ML_DSA_SHAKE_256
9444
9669
  # dry_run: false,
9445
9670
  # })
9446
9671
  #
@@ -9448,7 +9673,7 @@ module Aws::KMS
9448
9673
  #
9449
9674
  # resp.key_id #=> String
9450
9675
  # resp.signature #=> String
9451
- # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
9676
+ # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
9452
9677
  #
9453
9678
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Sign AWS API Documentation
9454
9679
  #
@@ -9508,17 +9733,17 @@ module Aws::KMS
9508
9733
  #
9509
9734
  #
9510
9735
  #
9511
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
9736
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
9512
9737
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
9513
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
9514
- # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk
9515
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#keystore-concept
9516
- # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#alias-concept
9738
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
9739
+ # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-key
9740
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
9741
+ # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html
9517
9742
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
9518
9743
  # [8]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
9519
9744
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9520
9745
  # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9521
- # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9746
+ # [11]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9522
9747
  #
9523
9748
  # @option params [required, String] :key_id
9524
9749
  # Identifies a customer managed key in the account and Region.
@@ -9628,13 +9853,13 @@ module Aws::KMS
9628
9853
  #
9629
9854
  #
9630
9855
  #
9631
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
9856
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
9632
9857
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
9633
9858
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html
9634
9859
  # [4]: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
9635
9860
  # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9636
9861
  # [6]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9637
- # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9862
+ # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9638
9863
  #
9639
9864
  # @option params [required, String] :key_id
9640
9865
  # Identifies the KMS key from which you are removing tags.
@@ -9747,7 +9972,7 @@ module Aws::KMS
9747
9972
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
9748
9973
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9749
9974
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access
9750
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
9975
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9751
9976
  #
9752
9977
  # @option params [required, String] :alias_name
9753
9978
  # Identifies the alias that is changing its KMS key. This value must
@@ -9786,8 +10011,8 @@ module Aws::KMS
9786
10011
  #
9787
10012
  #
9788
10013
  #
9789
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk
9790
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
10014
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key
10015
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key
9791
10016
  #
9792
10017
  # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
9793
10018
  #
@@ -9827,9 +10052,9 @@ module Aws::KMS
9827
10052
  # verify the updated property values, use the DescribeCustomKeyStores
9828
10053
  # operation.
9829
10054
  #
9830
- # This operation is part of the [custom key stores][1] feature in KMS,
9831
- # which combines the convenience and extensive integration of KMS with
9832
- # the isolation and control of a key store that you own and manage.
10055
+ # This operation is part of the custom key stores feature in KMS, which
10056
+ # combines the convenience and extensive integration of KMS with the
10057
+ # isolation and control of a key store that you own and manage.
9833
10058
  #
9834
10059
  # When updating the properties of an external key store, verify that the
9835
10060
  # updated settings connect your key store, via the external key store
@@ -9899,7 +10124,7 @@ module Aws::KMS
9899
10124
  # **Cross-account use**: No. You cannot perform this operation on a
9900
10125
  # custom key store in a different Amazon Web Services account.
9901
10126
  #
9902
- # **Required permissions**: [kms:UpdateCustomKeyStore][2] (IAM policy)
10127
+ # **Required permissions**: [kms:UpdateCustomKeyStore][1] (IAM policy)
9903
10128
  #
9904
10129
  # **Related operations:**
9905
10130
  #
@@ -9914,13 +10139,12 @@ module Aws::KMS
9914
10139
  # * DisconnectCustomKeyStore
9915
10140
  #
9916
10141
  # **Eventual consistency**: The KMS API follows an eventual consistency
9917
- # model. For more information, see [KMS eventual consistency][3].
10142
+ # model. For more information, see [KMS eventual consistency][2].
9918
10143
  #
9919
10144
  #
9920
10145
  #
9921
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
9922
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
9923
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10146
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10147
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
9924
10148
  #
9925
10149
  # @option params [required, String] :custom_key_store_id
9926
10150
  # Identifies the custom key store that you want to update. Enter the ID
@@ -10198,7 +10422,7 @@ module Aws::KMS
10198
10422
  #
10199
10423
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10200
10424
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10201
- # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10425
+ # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10202
10426
  #
10203
10427
  # @option params [required, String] :key_id
10204
10428
  # Updates the description of the specified KMS key.
@@ -10258,8 +10482,8 @@ module Aws::KMS
10258
10482
  # key in `eu-west-2`. If you run `UpdatePrimaryRegion` with a
10259
10483
  # `PrimaryRegion` value of `eu-west-2`, the primary key is now the key
10260
10484
  # in `eu-west-2`, and the key in `us-east-1` becomes a replica key. For
10261
- # details, see [Updating the primary Region][1] in the *Key Management
10262
- # Service Developer Guide*.
10485
+ # details, see [Change the primary key in a set of multi-Region keys][1]
10486
+ # in the *Key Management Service Developer Guide*.
10263
10487
  #
10264
10488
  # This operation supports *multi-Region keys*, an KMS feature that lets
10265
10489
  # you create multiple interoperable KMS keys in different Amazon Web
@@ -10327,7 +10551,7 @@ module Aws::KMS
10327
10551
  #
10328
10552
  #
10329
10553
  #
10330
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-update
10554
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-update.html
10331
10555
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
10332
10556
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id
10333
10557
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec
@@ -10336,7 +10560,7 @@ module Aws::KMS
10336
10560
  # [7]: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
10337
10561
  # [8]: https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html
10338
10562
  # [9]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10339
- # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10563
+ # [10]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10340
10564
  #
10341
10565
  # @option params [required, String] :key_id
10342
10566
  # Identifies the current primary key. When the operation completes, this
@@ -10451,10 +10675,10 @@ module Aws::KMS
10451
10675
  #
10452
10676
  #
10453
10677
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html
10454
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
10678
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
10455
10679
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10456
10680
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10457
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10681
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10458
10682
  #
10459
10683
  # @option params [required, String] :key_id
10460
10684
  # Identifies the asymmetric KMS key that will be used to verify the
@@ -10493,27 +10717,34 @@ module Aws::KMS
10493
10717
  # @option params [String] :message_type
10494
10718
  # Tells KMS whether the value of the `Message` parameter should be
10495
10719
  # hashed as part of the signing algorithm. Use `RAW` for unhashed
10496
- # messages; use `DIGEST` for message digests, which are already hashed.
10720
+ # messages; use `DIGEST` for message digests, which are already hashed;
10721
+ # use `EXTERNAL_MU` for 64-byte representative μ used in ML-DSA signing
10722
+ # as defined in NIST FIPS 204 Section 6.2.
10497
10723
  #
10498
10724
  # When the value of `MessageType` is `RAW`, KMS uses the standard
10499
10725
  # signing algorithm, which begins with a hash function. When the value
10500
- # is `DIGEST`, KMS skips the hashing step in the signing algorithm.
10726
+ # is `DIGEST`, KMS skips the hashing step in the signing algorithm. When
10727
+ # the value is `EXTERNAL_MU` KMS skips the concatenated hashing of the
10728
+ # public key hash and the message done in the ML-DSA signing algorithm.
10501
10729
  #
10502
- # Use the `DIGEST` value only when the value of the `Message` parameter
10503
- # is a message digest. If you use the `DIGEST` value with an unhashed
10504
- # message, the security of the verification operation can be
10730
+ # Use the `DIGEST` or `EXTERNAL_MU` value only when the value of the
10731
+ # `Message` parameter is a message digest. If you use the `DIGEST` value
10732
+ # with an unhashed message, the security of the signing operation can be
10505
10733
  # compromised.
10506
10734
  #
10507
- # When the value of `MessageType`is `DIGEST`, the length of the
10735
+ # When the value of `MessageType` is `DIGEST`, the length of the
10508
10736
  # `Message` value must match the length of hashed messages for the
10509
10737
  # specified signing algorithm.
10510
10738
  #
10739
+ # When the value of `MessageType` is `EXTERNAL_MU` the length of the
10740
+ # `Message` value must be 64 bytes.
10741
+ #
10511
10742
  # You can submit a message digest and omit the `MessageType` or specify
10512
10743
  # `RAW` so the digest is hashed again while signing. However, if the
10513
10744
  # signed message is hashed once while signing, but twice while
10514
10745
  # verifying, verification fails, even when the message hasn't changed.
10515
10746
  #
10516
- # The hashing algorithm in that `Verify` uses is based on the
10747
+ # The hashing algorithm that `Verify` uses is based on the
10517
10748
  # `SigningAlgorithm` value.
10518
10749
  #
10519
10750
  # * Signing algorithms that end in SHA\_256 use the SHA\_256 hashing
@@ -10525,12 +10756,15 @@ module Aws::KMS
10525
10756
  # * Signing algorithms that end in SHA\_512 use the SHA\_512 hashing
10526
10757
  # algorithm.
10527
10758
  #
10759
+ # * Signing algorithms that end in SHAKE\_256 use the SHAKE\_256 hashing
10760
+ # algorithm.
10761
+ #
10528
10762
  # * SM2DSA uses the SM3 hashing algorithm. For details, see [Offline
10529
10763
  # verification with SM2 key pairs][1].
10530
10764
  #
10531
10765
  #
10532
10766
  #
10533
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification
10767
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification
10534
10768
  #
10535
10769
  # @option params [required, String, StringIO, File] :signature
10536
10770
  # The signature that the `Sign` operation generated.
@@ -10550,18 +10784,18 @@ module Aws::KMS
10550
10784
  #
10551
10785
  #
10552
10786
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
10553
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
10787
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
10554
10788
  #
10555
10789
  # @option params [Boolean] :dry_run
10556
10790
  # Checks if your request will succeed. `DryRun` is an optional
10557
10791
  # parameter.
10558
10792
  #
10559
- # To learn more about how to use this parameter, see [Testing your KMS
10560
- # API calls][1] in the *Key Management Service Developer Guide*.
10793
+ # To learn more about how to use this parameter, see [Testing your
10794
+ # permissions][1] in the *Key Management Service Developer Guide*.
10561
10795
  #
10562
10796
  #
10563
10797
  #
10564
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
10798
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
10565
10799
  #
10566
10800
  # @return [Types::VerifyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
10567
10801
  #
@@ -10616,9 +10850,9 @@ module Aws::KMS
10616
10850
  # resp = client.verify({
10617
10851
  # key_id: "KeyIdType", # required
10618
10852
  # message: "data", # required
10619
- # message_type: "RAW", # accepts RAW, DIGEST
10853
+ # message_type: "RAW", # accepts RAW, DIGEST, EXTERNAL_MU
10620
10854
  # signature: "data", # required
10621
- # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA
10855
+ # signing_algorithm: "RSASSA_PSS_SHA_256", # required, accepts RSASSA_PSS_SHA_256, RSASSA_PSS_SHA_384, RSASSA_PSS_SHA_512, RSASSA_PKCS1_V1_5_SHA_256, RSASSA_PKCS1_V1_5_SHA_384, RSASSA_PKCS1_V1_5_SHA_512, ECDSA_SHA_256, ECDSA_SHA_384, ECDSA_SHA_512, SM2DSA, ML_DSA_SHAKE_256
10622
10856
  # grant_tokens: ["GrantTokenType"],
10623
10857
  # dry_run: false,
10624
10858
  # })
@@ -10627,7 +10861,7 @@ module Aws::KMS
10627
10861
  #
10628
10862
  # resp.key_id #=> String
10629
10863
  # resp.signature_valid #=> Boolean
10630
- # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA"
10864
+ # resp.signing_algorithm #=> String, one of "RSASSA_PSS_SHA_256", "RSASSA_PSS_SHA_384", "RSASSA_PSS_SHA_512", "RSASSA_PKCS1_V1_5_SHA_256", "RSASSA_PKCS1_V1_5_SHA_384", "RSASSA_PKCS1_V1_5_SHA_512", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "SM2DSA", "ML_DSA_SHAKE_256"
10631
10865
  #
10632
10866
  # @see http://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/Verify AWS API Documentation
10633
10867
  #
@@ -10675,7 +10909,7 @@ module Aws::KMS
10675
10909
  # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html
10676
10910
  # [3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html
10677
10911
  # [4]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
10678
- # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html
10912
+ # [5]: https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency
10679
10913
  #
10680
10914
  # @option params [required, String, StringIO, File] :message
10681
10915
  # The message that will be used in the verification. Enter the same
@@ -10713,18 +10947,18 @@ module Aws::KMS
10713
10947
  #
10714
10948
  #
10715
10949
  # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
10716
- # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
10950
+ # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html
10717
10951
  #
10718
10952
  # @option params [Boolean] :dry_run
10719
10953
  # Checks if your request will succeed. `DryRun` is an optional
10720
10954
  # parameter.
10721
10955
  #
10722
- # To learn more about how to use this parameter, see [Testing your KMS
10723
- # API calls][1] in the *Key Management Service Developer Guide*.
10956
+ # To learn more about how to use this parameter, see [Testing your
10957
+ # permissions][1] in the *Key Management Service Developer Guide*.
10724
10958
  #
10725
10959
  #
10726
10960
  #
10727
- # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html
10961
+ # [1]: https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html
10728
10962
  #
10729
10963
  # @return [Types::VerifyMacResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
10730
10964
  #
@@ -10796,7 +11030,7 @@ module Aws::KMS
10796
11030
  tracer: tracer
10797
11031
  )
10798
11032
  context[:gem_name] = 'aws-sdk-kms'
10799
- context[:gem_version] = '1.99.0'
11033
+ context[:gem_version] = '1.112.0'
10800
11034
  Seahorse::Client::Request.new(handlers, context)
10801
11035
  end
10802
11036