aws-sdk-states 1.72.0 → 1.73.0

data/lib/aws-sdk-states/errors.rb

@@ -27,6 +27,7 @@ module Aws::States
   # See {Seahorse::Client::RequestContext} for more information.
   #
   # ## Error Classes
+  # * {ActivityAlreadyExists}
   # * {ActivityDoesNotExist}
   # * {ActivityLimitExceeded}
   # * {ActivityWorkerLimitExceeded}
@@ -37,12 +38,16 @@ module Aws::States
   # * {ExecutionNotRedrivable}
   # * {InvalidArn}
   # * {InvalidDefinition}
+  # * {InvalidEncryptionConfiguration}
   # * {InvalidExecutionInput}
   # * {InvalidLoggingConfiguration}
   # * {InvalidName}
   # * {InvalidOutput}
   # * {InvalidToken}
   # * {InvalidTracingConfiguration}
+  # * {KmsAccessDeniedException}
+  # * {KmsInvalidStateException}
+  # * {KmsThrottlingException}
   # * {MissingRequiredParameter}
   # * {ResourceNotFound}
   # * {ServiceQuotaExceededException}
@@ -62,6 +67,21 @@ module Aws::States
 
     extend Aws::Errors::DynamicErrors
 
+    class ActivityAlreadyExists < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::States::Types::ActivityAlreadyExists] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+    end
+
     class ActivityDoesNotExist < ServiceError
 
       # @param [Seahorse::Client::RequestContext] context
@@ -212,6 +232,21 @@ module Aws::States
       end
     end
 
+    class InvalidEncryptionConfiguration < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::States::Types::InvalidEncryptionConfiguration] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+    end
+
     class InvalidExecutionInput < ServiceError
 
       # @param [Seahorse::Client::RequestContext] context
@@ -302,6 +337,56 @@ module Aws::States
       end
     end
 
+    class KmsAccessDeniedException < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::States::Types::KmsAccessDeniedException] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+    end
+
+    class KmsInvalidStateException < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::States::Types::KmsInvalidStateException] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def kms_key_state
+        @data[:kms_key_state]
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+    end
+
+    class KmsThrottlingException < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::States::Types::KmsThrottlingException] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+    end
+
     class MissingRequiredParameter < ServiceError
 
       # @param [Seahorse::Client::RequestContext] context

data/lib/aws-sdk-states/types.rb

@@ -10,6 +10,19 @@
 module Aws::States
   module Types
 
+    # Activity already exists. `EncryptionConfiguration` may not be updated.
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/ActivityAlreadyExists AWS API Documentation
+    #
+    class ActivityAlreadyExists < Struct.new(
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # The specified activity does not exist.
     #
     # @!attribute [rw] message
@@ -328,11 +341,16 @@ module Aws::States
     #   [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html
     #   @return [Array<Types::Tag>]
     #
+    # @!attribute [rw] encryption_configuration
+    #   Settings to configure server-side encryption.
+    #   @return [Types::EncryptionConfiguration]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/CreateActivityInput AWS API Documentation
     #
     class CreateActivityInput < Struct.new(
       :name,
-      :tags)
+      :tags,
+      :encryption_configuration)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -488,6 +506,10 @@ module Aws::States
     #   `false`, this API action throws `ValidationException`.
     #   @return [String]
     #
+    # @!attribute [rw] encryption_configuration
+    #   Settings to configure server-side encryption.
+    #   @return [Types::EncryptionConfiguration]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/CreateStateMachineInput AWS API Documentation
     #
     class CreateStateMachineInput < Struct.new(
@@ -499,7 +521,8 @@ module Aws::States
       :tags,
       :tracing_configuration,
       :publish,
-      :version_description)
+      :version_description,
+      :encryption_configuration)
       SENSITIVE = [:definition, :version_description]
       include Aws::Structure
     end
@@ -633,12 +656,17 @@ module Aws::States
     #   The date the activity is created.
     #   @return [Time]
     #
+    # @!attribute [rw] encryption_configuration
+    #   Settings for configured server-side encryption.
+    #   @return [Types::EncryptionConfiguration]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/DescribeActivityOutput AWS API Documentation
     #
     class DescribeActivityOutput < Struct.new(
       :activity_arn,
       :name,
-      :creation_date)
+      :creation_date,
+      :encryption_configuration)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -647,10 +675,19 @@ module Aws::States
     #   The Amazon Resource Name (ARN) of the execution to describe.
     #   @return [String]
     #
+    # @!attribute [rw] included_data
+    #   If your state machine definition is encrypted with a KMS key,
+    #   callers must have `kms:Decrypt` permission to decrypt the
+    #   definition. Alternatively, you can call DescribeStateMachine API
+    #   with `includedData = METADATA_ONLY` to get a successful response
+    #   without the encrypted definition.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/DescribeExecutionInput AWS API Documentation
     #
     class DescribeExecutionInput < Struct.new(
-      :execution_arn)
+      :execution_arn,
+      :included_data)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -998,10 +1035,19 @@ module Aws::States
     #   machine information for.
     #   @return [String]
     #
+    # @!attribute [rw] included_data
+    #   If your state machine definition is encrypted with a KMS key,
+    #   callers must have `kms:Decrypt` permission to decrypt the
+    #   definition. Alternatively, you can call the API with `includedData =
+    #   METADATA_ONLY` to get a successful response without the encrypted
+    #   definition.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/DescribeStateMachineForExecutionInput AWS API Documentation
     #
     class DescribeStateMachineForExecutionInput < Struct.new(
-      :execution_arn)
+      :execution_arn,
+      :included_data)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -1067,6 +1113,10 @@ module Aws::States
     #   `definition` and `roleArn`.
     #   @return [String]
     #
+    # @!attribute [rw] encryption_configuration
+    #   Settings to configure server-side encryption.
+    #   @return [Types::EncryptionConfiguration]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/DescribeStateMachineForExecutionOutput AWS API Documentation
     #
     class DescribeStateMachineForExecutionOutput < Struct.new(
@@ -1079,7 +1129,8 @@ module Aws::States
       :tracing_configuration,
       :map_run_arn,
       :label,
-      :revision_id)
+      :revision_id,
+      :encryption_configuration)
       SENSITIVE = [:definition]
       include Aws::Structure
     end
@@ -1094,10 +1145,27 @@ module Aws::States
     #   example, `stateMachineARN:1`.
     #   @return [String]
     #
+    # @!attribute [rw] included_data
+    #   If your state machine definition is encrypted with a KMS key,
+    #   callers must have `kms:Decrypt` permission to decrypt the
+    #   definition. Alternatively, you can call the API with `includedData =
+    #   METADATA_ONLY` to get a successful response without the encrypted
+    #   definition.
+    #
+    #   <note markdown="1"> When calling a labelled ARN for an encrypted state machine, the
+    #   `includedData = METADATA_ONLY` parameter will not apply because Step
+    #   Functions needs to decrypt the entire state machine definition to
+    #   get the Distributed Map state’s definition. In this case, the API
+    #   caller needs to have `kms:Decrypt` permission.
+    #
+    #    </note>
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/DescribeStateMachineInput AWS API Documentation
     #
     class DescribeStateMachineInput < Struct.new(
-      :state_machine_arn)
+      :state_machine_arn,
+      :included_data)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -1138,6 +1206,9 @@ module Aws::States
     #   The Amazon States Language definition of the state machine. See
     #   [Amazon States Language][1].
     #
+    #   If called with `includedData = METADATA_ONLY`, the returned
+    #   definition will be `\{\}`.
+    #
     #
     #
     #   [1]: https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html
@@ -1187,6 +1258,10 @@ module Aws::States
     #   The description of the state machine version.
     #   @return [String]
     #
+    # @!attribute [rw] encryption_configuration
+    #   Settings to configure server-side encryption.
+    #   @return [Types::EncryptionConfiguration]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/DescribeStateMachineOutput AWS API Documentation
     #
     class DescribeStateMachineOutput < Struct.new(
@@ -1201,11 +1276,63 @@ module Aws::States
       :tracing_configuration,
       :label,
       :revision_id,
-      :description)
+      :description,
+      :encryption_configuration)
       SENSITIVE = [:definition, :description]
       include Aws::Structure
     end
 
+    # Settings to configure server-side encryption.
+    #
+    # For additional control over security, you can encrypt your data using
+    # a **customer-managed key** for Step Functions state machines and
+    # activities. You can configure a symmetric KMS key and data key reuse
+    # period when creating or updating a **State Machine**, and when
+    # creating an **Activity**. The execution history and state machine
+    # definition will be encrypted with the key applied to the State
+    # Machine. Activity inputs will be encrypted with the key applied to the
+    # Activity.
+    #
+    # <note markdown="1"> Step Functions automatically enables encryption at rest using Amazon
+    # Web Services owned keys at no charge. However, KMS charges apply when
+    # using a customer managed key. For more information about pricing, see
+    # [Key Management Service pricing][1].
+    #
+    #  </note>
+    #
+    # For more information on KMS, see [What is Key Management Service?][2]
+    #
+    #
+    #
+    # [1]: https://aws.amazon.com/kms/pricing/
+    # [2]: https://docs.aws.amazon.com/kms/latest/developerguide/overview.html
+    #
+    # @!attribute [rw] kms_key_id
+    #   An alias, alias ARN, key ID, or key ARN of a symmetric encryption
+    #   KMS key to encrypt data. To specify a KMS key in a different Amazon
+    #   Web Services account, you must use the key ARN or alias ARN.
+    #   @return [String]
+    #
+    # @!attribute [rw] kms_data_key_reuse_period_seconds
+    #   Maximum duration that Step Functions will reuse data keys. When the
+    #   period expires, Step Functions will call `GenerateDataKey`. Only
+    #   applies to customer managed keys.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] type
+    #   Encryption type
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/EncryptionConfiguration AWS API Documentation
+    #
+    class EncryptionConfiguration < Struct.new(
+      :kms_key_id,
+      :kms_data_key_reuse_period_seconds,
+      :type)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains details about an abort of an execution.
     #
     # @!attribute [rw] error
@@ -2018,6 +2145,23 @@ module Aws::States
       include Aws::Structure
     end
 
+    # Received when `encryptionConfiguration` is specified but various
+    # conditions exist which make the configuration invalid. For example, if
+    # `type` is set to `CUSTOMER_MANAGED_KMS_KEY`, but `kmsKeyId` is null,
+    # or `kmsDataKeyReusePeriodSeconds` is not between 60 and 900, or the
+    # KMS key is not symmetric or inactive.
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/InvalidEncryptionConfiguration AWS API Documentation
+    #
+    class InvalidEncryptionConfiguration < Struct.new(
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # The provided JSON input data is not valid.
     #
     # @!attribute [rw] message
@@ -2031,6 +2175,8 @@ module Aws::States
       include Aws::Structure
     end
 
+    # Configuration is not valid.
+    #
     # @!attribute [rw] message
     #   @return [String]
     #
@@ -2095,6 +2241,53 @@ module Aws::States
       include Aws::Structure
     end
 
+    # Either your KMS key policy or API caller does not have the required
+    # permissions.
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/KmsAccessDeniedException AWS API Documentation
+    #
+    class KmsAccessDeniedException < Struct.new(
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The KMS key is not in valid state, for example: Disabled or Deleted.
+    #
+    # @!attribute [rw] kms_key_state
+    #   Current status of the KMS; key. For example: `DISABLED`,
+    #   `PENDING_DELETION`, `PENDING_IMPORT`, `UNAVAILABLE`, `CREATING`.
+    #   @return [String]
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/KmsInvalidStateException AWS API Documentation
+    #
+    class KmsInvalidStateException < Struct.new(
+      :kms_key_state,
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Received when KMS returns `ThrottlingException` for a KMS call that
+    # Step Functions makes on behalf of the caller.
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/KmsThrottlingException AWS API Documentation
+    #
+    class KmsThrottlingException < Struct.new(
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains details about a Lambda function that failed during an
     # execution.
     #
@@ -3358,13 +3551,22 @@ module Aws::States
     #   in the request payload.
     #   @return [String]
     #
+    # @!attribute [rw] included_data
+    #   If your state machine definition is encrypted with a KMS key,
+    #   callers must have `kms:Decrypt` permission to decrypt the
+    #   definition. Alternatively, you can call the API with `includedData =
+    #   METADATA_ONLY` to get a successful response without the encrypted
+    #   definition.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/StartSyncExecutionInput AWS API Documentation
     #
     class StartSyncExecutionInput < Struct.new(
       :state_machine_arn,
       :name,
       :input,
-      :trace_header)
+      :trace_header,
+      :included_data)
       SENSITIVE = [:input]
       include Aws::Structure
     end
@@ -3640,6 +3842,8 @@ module Aws::States
       include Aws::Structure
     end
 
+    # State machine type is not supported.
+    #
     # @!attribute [rw] message
     #   @return [String]
     #
@@ -4333,6 +4537,10 @@ module Aws::States
     #   set `publish` to `true`.
     #   @return [String]
     #
+    # @!attribute [rw] encryption_configuration
+    #   Settings to configure server-side encryption.
+    #   @return [Types::EncryptionConfiguration]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/states-2016-11-23/UpdateStateMachineInput AWS API Documentation
     #
     class UpdateStateMachineInput < Struct.new(
@@ -4342,7 +4550,8 @@ module Aws::States
       :logging_configuration,
       :tracing_configuration,
       :publish,
-      :version_description)
+      :version_description,
+      :encryption_configuration)
       SENSITIVE = [:definition, :version_description]
       include Aws::Structure
     end

data/lib/aws-sdk-states.rb

@@ -52,6 +52,6 @@ require_relative 'aws-sdk-states/customizations'
 # @!group service
 module Aws::States
 
-  GEM_VERSION = '1.72.0'
+  GEM_VERSION = '1.73.0'
 
 end

data/sig/client.rbs

@@ -87,7 +87,12 @@ module Aws
                                  key: ::String?,
                                  value: ::String?
                                },
-                             ]
+                             ],
+                             ?encryption_configuration: {
+                               kms_key_id: ::String?,
+                               kms_data_key_reuse_period_seconds: ::Integer?,
+                               type: ("AWS_OWNED_KEY" | "CUSTOMER_MANAGED_KMS_KEY")
+                             }
                            ) -> _CreateActivityResponseSuccess
                          | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _CreateActivityResponseSuccess
 
@@ -124,7 +129,12 @@ module Aws
                                     enabled: bool?
                                   },
                                   ?publish: bool,
-                                  ?version_description: ::String
+                                  ?version_description: ::String,
+                                  ?encryption_configuration: {
+                                    kms_key_id: ::String?,
+                                    kms_data_key_reuse_period_seconds: ::Integer?,
+                                    type: ("AWS_OWNED_KEY" | "CUSTOMER_MANAGED_KMS_KEY")
+                                  }
                                 ) -> _CreateStateMachineResponseSuccess
                               | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _CreateStateMachineResponseSuccess
 
@@ -187,6 +197,7 @@ module Aws
         def activity_arn: () -> ::String
         def name: () -> ::String
         def creation_date: () -> ::Time
+        def encryption_configuration: () -> Types::EncryptionConfiguration
       end
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/States/Client.html#describe_activity-instance_method
       def describe_activity: (
@@ -218,7 +229,8 @@ module Aws
       end
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/States/Client.html#describe_execution-instance_method
       def describe_execution: (
-                                execution_arn: ::String
+                                execution_arn: ::String,
+                                ?included_data: ("ALL_DATA" | "METADATA_ONLY")
                               ) -> _DescribeExecutionResponseSuccess
                             | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DescribeExecutionResponseSuccess
 
@@ -257,10 +269,12 @@ module Aws
         def label: () -> ::String
         def revision_id: () -> ::String
         def description: () -> ::String
+        def encryption_configuration: () -> Types::EncryptionConfiguration
       end
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/States/Client.html#describe_state_machine-instance_method
       def describe_state_machine: (
-                                    state_machine_arn: ::String
+                                    state_machine_arn: ::String,
+                                    ?included_data: ("ALL_DATA" | "METADATA_ONLY")
                                   ) -> _DescribeStateMachineResponseSuccess
                                 | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DescribeStateMachineResponseSuccess
 
@@ -291,10 +305,12 @@ module Aws
         def map_run_arn: () -> ::String
         def label: () -> ::String
         def revision_id: () -> ::String
+        def encryption_configuration: () -> Types::EncryptionConfiguration
       end
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/States/Client.html#describe_state_machine_for_execution-instance_method
       def describe_state_machine_for_execution: (
-                                                  execution_arn: ::String
+                                                  execution_arn: ::String,
+                                                  ?included_data: ("ALL_DATA" | "METADATA_ONLY")
                                                 ) -> _DescribeStateMachineForExecutionResponseSuccess
                                               | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DescribeStateMachineForExecutionResponseSuccess
 
@@ -503,7 +519,8 @@ module Aws
                                   state_machine_arn: ::String,
                                   ?name: ::String,
                                   ?input: ::String,
-                                  ?trace_header: ::String
+                                  ?trace_header: ::String,
+                                  ?included_data: ("ALL_DATA" | "METADATA_ONLY")
                                 ) -> _StartSyncExecutionResponseSuccess
                               | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _StartSyncExecutionResponseSuccess
 
@@ -600,7 +617,12 @@ module Aws
                                     enabled: bool?
                                   },
                                   ?publish: bool,
-                                  ?version_description: ::String
+                                  ?version_description: ::String,
+                                  ?encryption_configuration: {
+                                    kms_key_id: ::String?,
+                                    kms_data_key_reuse_period_seconds: ::Integer?,
+                                    type: ("AWS_OWNED_KEY" | "CUSTOMER_MANAGED_KMS_KEY")
+                                  }
                                 ) -> _UpdateStateMachineResponseSuccess
                               | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _UpdateStateMachineResponseSuccess
 

data/sig/errors.rbs

@@ -11,6 +11,9 @@ module Aws
       class ServiceError < ::Aws::Errors::ServiceError
       end
 
+      class ActivityAlreadyExists < ::Aws::Errors::ServiceError
+        def message: () -> ::String
+      end
       class ActivityDoesNotExist < ::Aws::Errors::ServiceError
         def message: () -> ::String
       end
@@ -41,6 +44,9 @@ module Aws
       class InvalidDefinition < ::Aws::Errors::ServiceError
         def message: () -> ::String
       end
+      class InvalidEncryptionConfiguration < ::Aws::Errors::ServiceError
+        def message: () -> ::String
+      end
       class InvalidExecutionInput < ::Aws::Errors::ServiceError
         def message: () -> ::String
       end
@@ -59,6 +65,16 @@ module Aws
       class InvalidTracingConfiguration < ::Aws::Errors::ServiceError
         def message: () -> ::String
       end
+      class KmsAccessDeniedException < ::Aws::Errors::ServiceError
+        def message: () -> ::String
+      end
+      class KmsInvalidStateException < ::Aws::Errors::ServiceError
+        def kms_key_state: () -> ::String
+        def message: () -> ::String
+      end
+      class KmsThrottlingException < ::Aws::Errors::ServiceError
+        def message: () -> ::String
+      end
       class MissingRequiredParameter < ::Aws::Errors::ServiceError
         def message: () -> ::String
       end