@alliander-opensource/aws-jwt-sts 0.3.5 → 0.3.7

package/node_modules/@aws-sdk/client-kms/dist-types/models/models_0.d.ts

@@ -1,21 +1,4 @@
-import { ExceptionOptionType as __ExceptionOptionType } from "@smithy/smithy-client";
-import { KMSServiceException as __BaseException } from "./KMSServiceException";
-/**
- * @public
- * @enum
- */
-export declare const AlgorithmSpec: {
-    readonly RSAES_OAEP_SHA_1: "RSAES_OAEP_SHA_1";
-    readonly RSAES_OAEP_SHA_256: "RSAES_OAEP_SHA_256";
-    readonly RSAES_PKCS1_V1_5: "RSAES_PKCS1_V1_5";
-    readonly RSA_AES_KEY_WRAP_SHA_1: "RSA_AES_KEY_WRAP_SHA_1";
-    readonly RSA_AES_KEY_WRAP_SHA_256: "RSA_AES_KEY_WRAP_SHA_256";
-    readonly SM2PKE: "SM2PKE";
-};
-/**
- * @public
- */
-export type AlgorithmSpec = (typeof AlgorithmSpec)[keyof typeof AlgorithmSpec];
+import type { AlgorithmSpec, ConnectionErrorCodeType, ConnectionStateType, CustomerMasterKeySpec, CustomKeyStoreType, DataKeyPairSpec, DataKeySpec, DryRunModifierType, EncryptionAlgorithmSpec, ExpirationModelType, GrantOperation, ImportState, ImportType, IncludeKeyMaterial, KeyAgreementAlgorithmSpec, KeyEncryptionMechanism, KeyLastUsageTrackingOperation, KeyManagerType, KeyMaterialState, KeySpec, KeyState, KeyUsageType, MacAlgorithmSpec, MessageType, MultiRegionKeyType, OriginType, RotationType, SigningAlgorithmSpec, WrappingKeySpec, XksProxyConnectivityType } from "./enums";
 /**
  * <p>Contains information about an alias.</p>
  * @public
@@ -49,19 +32,6 @@ export interface AliasListEntry {
      */
     LastUpdatedDate?: Date | undefined;
 }
-/**
- * <p>The request was rejected because it attempted to create a resource that already
- *       exists.</p>
- * @public
- */
-export declare class AlreadyExistsException extends __BaseException {
-    readonly name: "AlreadyExistsException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<AlreadyExistsException, __BaseException>);
-}
 /**
  * @public
  */
@@ -95,207 +65,6 @@ export interface CancelKeyDeletionResponse {
      */
     KeyId?: string | undefined;
 }
-/**
- * <p>The system timed out while trying to fulfill the request. You can retry the
- *       request.</p>
- * @public
- */
-export declare class DependencyTimeoutException extends __BaseException {
-    readonly name: "DependencyTimeoutException";
-    readonly $fault: "server";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<DependencyTimeoutException, __BaseException>);
-}
-/**
- * <p>The request was rejected because a specified ARN, or an ARN in a key policy, is not
- *       valid.</p>
- * @public
- */
-export declare class InvalidArnException extends __BaseException {
-    readonly name: "InvalidArnException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<InvalidArnException, __BaseException>);
-}
-/**
- * <p>The request was rejected because an internal exception occurred. The request can be
- *       retried.</p>
- * @public
- */
-export declare class KMSInternalException extends __BaseException {
-    readonly name: "KMSInternalException";
-    readonly $fault: "server";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<KMSInternalException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the state of the specified resource is not valid for this
- *       request.</p>
- *          <p>This exceptions means one of the following:</p>
- *          <ul>
- *             <li>
- *                <p>The key state of the KMS key is not compatible with the operation. </p>
- *                <p>To find the key state, use the <a>DescribeKey</a> operation. For more
- *           information about which key states are compatible with each KMS operation, see
- *           <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>
- *                      <i>Key Management Service Developer Guide</i>
- *                   </i>.</p>
- *             </li>
- *             <li>
- *                <p>For cryptographic operations on KMS keys in custom key stores, this exception
- *           represents a general failure with many possible causes. To identify the cause, see the
- *           error message that accompanies the exception.</p>
- *             </li>
- *          </ul>
- * @public
- */
-export declare class KMSInvalidStateException extends __BaseException {
-    readonly name: "KMSInvalidStateException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<KMSInvalidStateException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the specified entity or resource could not be
- *       found.</p>
- * @public
- */
-export declare class NotFoundException extends __BaseException {
-    readonly name: "NotFoundException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<NotFoundException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the specified CloudHSM cluster is already associated with an
- *       CloudHSM key store in the account, or it shares a backup history with an CloudHSM key store in the
- *       account. Each CloudHSM key store in the account must be associated with a different CloudHSM
- *       cluster.</p>
- *          <p>CloudHSM clusters that share a backup history have the same cluster certificate. To view the
- *       cluster certificate of an CloudHSM cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation.</p>
- * @public
- */
-export declare class CloudHsmClusterInUseException extends __BaseException {
-    readonly name: "CloudHsmClusterInUseException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<CloudHsmClusterInUseException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the associated CloudHSM cluster did not meet the
- *       configuration requirements for an CloudHSM key store.</p>
- *          <ul>
- *             <li>
- *                <p>The CloudHSM cluster must be configured with private subnets in at least two different
- *           Availability Zones in the Region.</p>
- *             </li>
- *             <li>
- *                <p>The <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/configure-sg.html">security group for
- *             the cluster</a> (cloudhsm-cluster-<i><cluster-id></i>-sg) must
- *           include inbound rules and outbound rules that allow TCP traffic on ports 2223-2225. The
- *             <b>Source</b> in the inbound rules and the <b>Destination</b> in the outbound rules must match the security group
- *           ID. These rules are set by default when you create the CloudHSM cluster. Do not delete or
- *           change them. To get information about a particular security group, use the <a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html">DescribeSecurityGroups</a> operation.</p>
- *             </li>
- *             <li>
- *                <p>The CloudHSM cluster must contain at least as many HSMs as the operation requires. To add
- *           HSMs, use the CloudHSM <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html">CreateHsm</a> operation.</p>
- *                <p>For the <a>CreateCustomKeyStore</a>, <a>UpdateCustomKeyStore</a>, and <a>CreateKey</a> operations, the CloudHSM cluster must have at least two
- *           active HSMs, each in a different Availability Zone. For the <a>ConnectCustomKeyStore</a> operation, the CloudHSM must contain at least one active
- *           HSM.</p>
- *             </li>
- *          </ul>
- *          <p>For information about the requirements for an CloudHSM cluster that is associated with an
- *       CloudHSM key store, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore">Assemble the Prerequisites</a>
- *       in the <i>Key Management Service Developer Guide</i>. For information about creating a private subnet for an CloudHSM cluster,
- *       see <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/create-subnets.html">Create a Private
- *         Subnet</a> in the <i>CloudHSM User Guide</i>. For information about cluster security groups, see
- *         <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/configure-sg.html">Configure a Default Security
- *         Group</a> in the <i>
- *                <i>CloudHSM User Guide</i>
- *             </i>. </p>
- * @public
- */
-export declare class CloudHsmClusterInvalidConfigurationException extends __BaseException {
-    readonly name: "CloudHsmClusterInvalidConfigurationException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<CloudHsmClusterInvalidConfigurationException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the CloudHSM cluster associated with the CloudHSM key store is
- *       not active. Initialize and activate the cluster and try the command again. For detailed
- *       instructions, see <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started.html">Getting
- *         Started</a> in the <i>CloudHSM User Guide</i>.</p>
- * @public
- */
-export declare class CloudHsmClusterNotActiveException extends __BaseException {
-    readonly name: "CloudHsmClusterNotActiveException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<CloudHsmClusterNotActiveException, __BaseException>);
-}
-/**
- * <p>The request was rejected because KMS cannot find the CloudHSM cluster with the specified
- *       cluster ID. Retry the request with a different cluster ID.</p>
- * @public
- */
-export declare class CloudHsmClusterNotFoundException extends __BaseException {
-    readonly name: "CloudHsmClusterNotFoundException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<CloudHsmClusterNotFoundException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the specified CloudHSM cluster has a different cluster
- *       certificate than the original cluster. You cannot use the operation to specify an unrelated
- *       cluster for an CloudHSM key store.</p>
- *          <p>Specify an CloudHSM cluster that shares a backup history with the original cluster. This
- *       includes clusters that were created from a backup of the current cluster, and clusters that
- *       were created from the same backup that produced the current cluster.</p>
- *          <p>CloudHSM clusters that share a backup history have the same cluster certificate. To view the
- *       cluster certificate of an CloudHSM cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation.</p>
- * @public
- */
-export declare class CloudHsmClusterNotRelatedException extends __BaseException {
-    readonly name: "CloudHsmClusterNotRelatedException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<CloudHsmClusterNotRelatedException, __BaseException>);
-}
-/**
- * <p>The request was rejected because an automatic rotation of this key is currently in
- *       progress or scheduled to begin within the next 20 minutes. </p>
- * @public
- */
-export declare class ConflictException extends __BaseException {
-    readonly name: "ConflictException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<ConflictException, __BaseException>);
-}
 /**
  * @public
  */
@@ -312,107 +81,6 @@ export interface ConnectCustomKeyStoreRequest {
  */
 export interface ConnectCustomKeyStoreResponse {
 }
-/**
- * <p>The request was rejected because of the <code>ConnectionState</code> of the custom key
- *       store. To get the <code>ConnectionState</code> of a custom key store, use the <a>DescribeCustomKeyStores</a> operation.</p>
- *          <p>This exception is thrown under the following conditions:</p>
- *          <ul>
- *             <li>
- *                <p>You requested the <a>ConnectCustomKeyStore</a> operation on a custom key
- *           store with a <code>ConnectionState</code> of <code>DISCONNECTING</code> or
- *             <code>FAILED</code>. This operation is valid for all other <code>ConnectionState</code>
- *           values. To reconnect a custom key store in a <code>FAILED</code> state, disconnect it
- *             (<a>DisconnectCustomKeyStore</a>), then connect it
- *             (<code>ConnectCustomKeyStore</code>).</p>
- *             </li>
- *             <li>
- *                <p>You requested the <a>CreateKey</a> operation in a custom key store that is
- *           not connected. This operations is valid only when the custom key store
- *             <code>ConnectionState</code> is <code>CONNECTED</code>.</p>
- *             </li>
- *             <li>
- *                <p>You requested the <a>DisconnectCustomKeyStore</a> operation on a custom key
- *           store with a <code>ConnectionState</code> of <code>DISCONNECTING</code> or
- *             <code>DISCONNECTED</code>. This operation is valid for all other
- *             <code>ConnectionState</code> values.</p>
- *             </li>
- *             <li>
- *                <p>You requested the <a>UpdateCustomKeyStore</a> or <a>DeleteCustomKeyStore</a> operation on a custom key store that is not
- *           disconnected. This operation is valid only when the custom key store
- *             <code>ConnectionState</code> is <code>DISCONNECTED</code>.</p>
- *             </li>
- *             <li>
- *                <p>You requested the <a>GenerateRandom</a> operation in an CloudHSM key store
- *           that is not connected. This operation is valid only when the CloudHSM key store
- *             <code>ConnectionState</code> is <code>CONNECTED</code>. </p>
- *             </li>
- *          </ul>
- * @public
- */
-export declare class CustomKeyStoreInvalidStateException extends __BaseException {
-    readonly name: "CustomKeyStoreInvalidStateException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<CustomKeyStoreInvalidStateException, __BaseException>);
-}
-/**
- * <p>The request was rejected because KMS cannot find a custom key store with the specified
- *       key store name or ID.</p>
- * @public
- */
-export declare class CustomKeyStoreNotFoundException extends __BaseException {
-    readonly name: "CustomKeyStoreNotFoundException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<CustomKeyStoreNotFoundException, __BaseException>);
-}
-/**
- * @public
- * @enum
- */
-export declare const ConnectionErrorCodeType: {
-    readonly CLUSTER_NOT_FOUND: "CLUSTER_NOT_FOUND";
-    readonly INSUFFICIENT_CLOUDHSM_HSMS: "INSUFFICIENT_CLOUDHSM_HSMS";
-    readonly INSUFFICIENT_FREE_ADDRESSES_IN_SUBNET: "INSUFFICIENT_FREE_ADDRESSES_IN_SUBNET";
-    readonly INTERNAL_ERROR: "INTERNAL_ERROR";
-    readonly INVALID_CREDENTIALS: "INVALID_CREDENTIALS";
-    readonly NETWORK_ERRORS: "NETWORK_ERRORS";
-    readonly SUBNET_NOT_FOUND: "SUBNET_NOT_FOUND";
-    readonly USER_LOCKED_OUT: "USER_LOCKED_OUT";
-    readonly USER_LOGGED_IN: "USER_LOGGED_IN";
-    readonly USER_NOT_FOUND: "USER_NOT_FOUND";
-    readonly XKS_PROXY_ACCESS_DENIED: "XKS_PROXY_ACCESS_DENIED";
-    readonly XKS_PROXY_INVALID_CONFIGURATION: "XKS_PROXY_INVALID_CONFIGURATION";
-    readonly XKS_PROXY_INVALID_RESPONSE: "XKS_PROXY_INVALID_RESPONSE";
-    readonly XKS_PROXY_INVALID_TLS_CONFIGURATION: "XKS_PROXY_INVALID_TLS_CONFIGURATION";
-    readonly XKS_PROXY_NOT_REACHABLE: "XKS_PROXY_NOT_REACHABLE";
-    readonly XKS_PROXY_TIMED_OUT: "XKS_PROXY_TIMED_OUT";
-    readonly XKS_VPC_ENDPOINT_SERVICE_INVALID_CONFIGURATION: "XKS_VPC_ENDPOINT_SERVICE_INVALID_CONFIGURATION";
-    readonly XKS_VPC_ENDPOINT_SERVICE_NOT_FOUND: "XKS_VPC_ENDPOINT_SERVICE_NOT_FOUND";
-};
-/**
- * @public
- */
-export type ConnectionErrorCodeType = (typeof ConnectionErrorCodeType)[keyof typeof ConnectionErrorCodeType];
-/**
- * @public
- * @enum
- */
-export declare const ConnectionStateType: {
-    readonly CONNECTED: "CONNECTED";
-    readonly CONNECTING: "CONNECTING";
-    readonly DISCONNECTED: "DISCONNECTED";
-    readonly DISCONNECTING: "DISCONNECTING";
-    readonly FAILED: "FAILED";
-};
-/**
- * @public
- */
-export type ConnectionStateType = (typeof ConnectionStateType)[keyof typeof ConnectionStateType];
 /**
  * @public
  */
@@ -426,14 +94,14 @@ export interface CreateAliasRequest {
      *          <p>The <code>AliasName</code> value must be string of 1-256 characters. It can contain only
      *       alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). The alias name
      *       cannot begin with <code>alias/aws/</code>. The <code>alias/aws/</code> prefix is reserved for
-     *         <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed
+     *         <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key">Amazon Web Services managed
      *         keys</a>.</p>
      * @public
      */
     AliasName: string | undefined;
     /**
-     * <p>Associates the alias with the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>. The KMS key must
-     *       be in the same Amazon Web Services Region. </p>
+     * <p>Associates the alias with the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key">customer managed key</a>. The KMS key
+     *       must be in the same Amazon Web Services Region. </p>
      *          <p>A valid key ID is required. If you supply a null or empty string value, this operation
      *       returns an error.</p>
      *          <p>For help finding the key ID and ARN, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html">Find the key ID and key ARN</a> in
@@ -457,44 +125,6 @@ export interface CreateAliasRequest {
      */
     TargetKeyId: string | undefined;
 }
-/**
- * <p>The request was rejected because the specified alias name is not valid.</p>
- * @public
- */
-export declare class InvalidAliasNameException extends __BaseException {
-    readonly name: "InvalidAliasNameException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<InvalidAliasNameException, __BaseException>);
-}
-/**
- * <p>The request was rejected because a length constraint or quota was exceeded. For more
- *       information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/limits.html">Quotas</a> in
- *       the <i>Key Management Service Developer Guide</i>.</p>
- * @public
- */
-export declare class LimitExceededException extends __BaseException {
-    readonly name: "LimitExceededException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<LimitExceededException, __BaseException>);
-}
-/**
- * @public
- * @enum
- */
-export declare const CustomKeyStoreType: {
-    readonly AWS_CLOUDHSM: "AWS_CLOUDHSM";
-    readonly EXTERNAL_KEY_STORE: "EXTERNAL_KEY_STORE";
-};
-/**
- * @public
- */
-export type CustomKeyStoreType = (typeof CustomKeyStoreType)[keyof typeof CustomKeyStoreType];
 /**
  * <p>KMS uses the authentication credential to sign requests that it sends to the external
  *       key store proxy (XKS proxy) on your behalf. You establish these credentials on your external
@@ -515,18 +145,6 @@ export interface XksProxyAuthenticationCredentialType {
      */
     RawSecretAccessKey: string | undefined;
 }
-/**
- * @public
- * @enum
- */
-export declare const XksProxyConnectivityType: {
-    readonly PUBLIC_ENDPOINT: "PUBLIC_ENDPOINT";
-    readonly VPC_ENDPOINT_SERVICE: "VPC_ENDPOINT_SERVICE";
-};
-/**
- * @public
- */
-export type XksProxyConnectivityType = (typeof XksProxyConnectivityType)[keyof typeof XksProxyConnectivityType];
 /**
  * @public
  */
@@ -662,6 +280,13 @@ export interface CreateCustomKeyStoreRequest {
      * @public
      */
     XksProxyVpcEndpointServiceName?: string | undefined;
+    /**
+     * <p>Specifies the Amazon Web Services account ID that owns the Amazon VPC service endpoint for the interface that
+     *       is used to communicate with your external key store proxy (XKS proxy). This parameter is
+     *       optional. If not provided, the Amazon Web Services account ID calling the action will be used.</p>
+     * @public
+     */
+    XksProxyVpcEndpointServiceOwner?: string | undefined;
     /**
      * <p>Specifies an authentication credential for the external key store proxy (XKS proxy). This
      *       parameter is required for all custom key stores with a <code>CustomKeyStoreType</code> of
@@ -709,169 +334,6 @@ export interface CreateCustomKeyStoreResponse {
      */
     CustomKeyStoreId?: string | undefined;
 }
-/**
- * <p>The request was rejected because the specified custom key store name is already assigned
- *       to another custom key store in the account. Try again with a custom key store name that is
- *       unique in the account.</p>
- * @public
- */
-export declare class CustomKeyStoreNameInUseException extends __BaseException {
-    readonly name: "CustomKeyStoreNameInUseException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<CustomKeyStoreNameInUseException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the trust anchor certificate in the request to create an
- *       CloudHSM key store is not the trust anchor certificate for the specified CloudHSM cluster.</p>
- *          <p>When you <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr">initialize the CloudHSM cluster</a>, you create the trust anchor certificate and save it
- *       in the <code>customerCA.crt</code> file.</p>
- * @public
- */
-export declare class IncorrectTrustAnchorException extends __BaseException {
-    readonly name: "IncorrectTrustAnchorException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<IncorrectTrustAnchorException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the proxy credentials failed to authenticate to the
- *       specified external key store proxy. The specified external key store proxy rejected a status
- *       request from KMS due to invalid credentials. This can indicate an error in the credentials
- *       or in the identification of the external key store proxy.</p>
- * @public
- */
-export declare class XksProxyIncorrectAuthenticationCredentialException extends __BaseException {
-    readonly name: "XksProxyIncorrectAuthenticationCredentialException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksProxyIncorrectAuthenticationCredentialException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the external key store proxy is not configured correctly.
- *       To identify the cause, see the error message that accompanies the exception.</p>
- * @public
- */
-export declare class XksProxyInvalidConfigurationException extends __BaseException {
-    readonly name: "XksProxyInvalidConfigurationException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksProxyInvalidConfigurationException, __BaseException>);
-}
-/**
- * <p></p>
- *          <p>KMS cannot interpret the response it received from the external key store proxy. The
- *       problem might be a poorly constructed response, but it could also be a transient network
- *       issue. If you see this error repeatedly, report it to the proxy vendor.</p>
- * @public
- */
-export declare class XksProxyInvalidResponseException extends __BaseException {
-    readonly name: "XksProxyInvalidResponseException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksProxyInvalidResponseException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the <code>XksProxyUriEndpoint</code> is already
- *       associated with another external key store in this Amazon Web Services Region. To identify the cause, see
- *       the error message that accompanies the exception. </p>
- * @public
- */
-export declare class XksProxyUriEndpointInUseException extends __BaseException {
-    readonly name: "XksProxyUriEndpointInUseException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksProxyUriEndpointInUseException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the concatenation of the <code>XksProxyUriEndpoint</code>
- *       and <code>XksProxyUriPath</code> is already associated with another external key store in this
- *       Amazon Web Services Region. Each external key store in a Region must use a unique external key store proxy
- *       API address.</p>
- * @public
- */
-export declare class XksProxyUriInUseException extends __BaseException {
-    readonly name: "XksProxyUriInUseException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksProxyUriInUseException, __BaseException>);
-}
-/**
- * <p>KMS was unable to reach the specified <code>XksProxyUriPath</code>. The path must be
- *       reachable before you create the external key store or update its settings.</p>
- *          <p>This exception is also thrown when the external key store proxy response to a
- *         <code>GetHealthStatus</code> request indicates that all external key manager instances are
- *       unavailable.</p>
- * @public
- */
-export declare class XksProxyUriUnreachableException extends __BaseException {
-    readonly name: "XksProxyUriUnreachableException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksProxyUriUnreachableException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the specified Amazon VPC endpoint service is already
- *       associated with another external key store in this Amazon Web Services Region. Each external key store in a
- *       Region must use a different Amazon VPC endpoint service.</p>
- * @public
- */
-export declare class XksProxyVpcEndpointServiceInUseException extends __BaseException {
-    readonly name: "XksProxyVpcEndpointServiceInUseException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksProxyVpcEndpointServiceInUseException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the Amazon VPC endpoint service configuration does not fulfill
- *       the requirements for an external key store. To identify the cause, see the error message that
- *       accompanies the exception and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/vpc-connectivity.html#xks-vpc-requirements">review the
- *         requirements</a> for Amazon VPC endpoint service connectivity for an external key
- *       store.</p>
- * @public
- */
-export declare class XksProxyVpcEndpointServiceInvalidConfigurationException extends __BaseException {
-    readonly name: "XksProxyVpcEndpointServiceInvalidConfigurationException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksProxyVpcEndpointServiceInvalidConfigurationException, __BaseException>);
-}
-/**
- * <p>The request was rejected because KMS could not find the specified VPC endpoint service.
- *       Use <a>DescribeCustomKeyStores</a> to verify the VPC endpoint service name for the
- *       external key store. Also, confirm that the <code>Allow principals</code> list for the VPC
- *       endpoint service includes the KMS service principal for the Region, such as
- *         <code>cks.kms.us-east-1.amazonaws.com</code>.</p>
- * @public
- */
-export declare class XksProxyVpcEndpointServiceNotFoundException extends __BaseException {
-    readonly name: "XksProxyVpcEndpointServiceNotFoundException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksProxyVpcEndpointServiceNotFoundException, __BaseException>);
-}
 /**
  * <p>Use this structure to allow <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations">cryptographic operations</a> in the grant only when the operation request
  *       includes the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html">encryption context</a>. </p>
@@ -912,33 +374,6 @@ export interface GrantConstraints {
      */
     EncryptionContextEquals?: Record<string, string> | undefined;
 }
-/**
- * @public
- * @enum
- */
-export declare const GrantOperation: {
-    readonly CreateGrant: "CreateGrant";
-    readonly Decrypt: "Decrypt";
-    readonly DeriveSharedSecret: "DeriveSharedSecret";
-    readonly DescribeKey: "DescribeKey";
-    readonly Encrypt: "Encrypt";
-    readonly GenerateDataKey: "GenerateDataKey";
-    readonly GenerateDataKeyPair: "GenerateDataKeyPair";
-    readonly GenerateDataKeyPairWithoutPlaintext: "GenerateDataKeyPairWithoutPlaintext";
-    readonly GenerateDataKeyWithoutPlaintext: "GenerateDataKeyWithoutPlaintext";
-    readonly GenerateMac: "GenerateMac";
-    readonly GetPublicKey: "GetPublicKey";
-    readonly ReEncryptFrom: "ReEncryptFrom";
-    readonly ReEncryptTo: "ReEncryptTo";
-    readonly RetireGrant: "RetireGrant";
-    readonly Sign: "Sign";
-    readonly Verify: "Verify";
-    readonly VerifyMac: "VerifyMac";
-};
-/**
- * @public
- */
-export type GrantOperation = (typeof GrantOperation)[keyof typeof GrantOperation];
 /**
  * @public
  */
@@ -1080,119 +515,6 @@ export interface CreateGrantResponse {
      */
     GrantId?: string | undefined;
 }
-/**
- * <p>The request was rejected because the specified KMS key is not enabled.</p>
- * @public
- */
-export declare class DisabledException extends __BaseException {
-    readonly name: "DisabledException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<DisabledException, __BaseException>);
-}
-/**
- * <p> The request was rejected because the DryRun parameter was specified. </p>
- * @public
- */
-export declare class DryRunOperationException extends __BaseException {
-    readonly name: "DryRunOperationException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<DryRunOperationException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the specified grant token is not valid.</p>
- * @public
- */
-export declare class InvalidGrantTokenException extends __BaseException {
-    readonly name: "InvalidGrantTokenException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<InvalidGrantTokenException, __BaseException>);
-}
-/**
- * @public
- * @enum
- */
-export declare const CustomerMasterKeySpec: {
-    readonly ECC_NIST_P256: "ECC_NIST_P256";
-    readonly ECC_NIST_P384: "ECC_NIST_P384";
-    readonly ECC_NIST_P521: "ECC_NIST_P521";
-    readonly ECC_SECG_P256K1: "ECC_SECG_P256K1";
-    readonly HMAC_224: "HMAC_224";
-    readonly HMAC_256: "HMAC_256";
-    readonly HMAC_384: "HMAC_384";
-    readonly HMAC_512: "HMAC_512";
-    readonly RSA_2048: "RSA_2048";
-    readonly RSA_3072: "RSA_3072";
-    readonly RSA_4096: "RSA_4096";
-    readonly SM2: "SM2";
-    readonly SYMMETRIC_DEFAULT: "SYMMETRIC_DEFAULT";
-};
-/**
- * @public
- */
-export type CustomerMasterKeySpec = (typeof CustomerMasterKeySpec)[keyof typeof CustomerMasterKeySpec];
-/**
- * @public
- * @enum
- */
-export declare const KeySpec: {
-    readonly ECC_NIST_P256: "ECC_NIST_P256";
-    readonly ECC_NIST_P384: "ECC_NIST_P384";
-    readonly ECC_NIST_P521: "ECC_NIST_P521";
-    readonly ECC_SECG_P256K1: "ECC_SECG_P256K1";
-    readonly HMAC_224: "HMAC_224";
-    readonly HMAC_256: "HMAC_256";
-    readonly HMAC_384: "HMAC_384";
-    readonly HMAC_512: "HMAC_512";
-    readonly ML_DSA_44: "ML_DSA_44";
-    readonly ML_DSA_65: "ML_DSA_65";
-    readonly ML_DSA_87: "ML_DSA_87";
-    readonly RSA_2048: "RSA_2048";
-    readonly RSA_3072: "RSA_3072";
-    readonly RSA_4096: "RSA_4096";
-    readonly SM2: "SM2";
-    readonly SYMMETRIC_DEFAULT: "SYMMETRIC_DEFAULT";
-};
-/**
- * @public
- */
-export type KeySpec = (typeof KeySpec)[keyof typeof KeySpec];
-/**
- * @public
- * @enum
- */
-export declare const KeyUsageType: {
-    readonly ENCRYPT_DECRYPT: "ENCRYPT_DECRYPT";
-    readonly GENERATE_VERIFY_MAC: "GENERATE_VERIFY_MAC";
-    readonly KEY_AGREEMENT: "KEY_AGREEMENT";
-    readonly SIGN_VERIFY: "SIGN_VERIFY";
-};
-/**
- * @public
- */
-export type KeyUsageType = (typeof KeyUsageType)[keyof typeof KeyUsageType];
-/**
- * @public
- * @enum
- */
-export declare const OriginType: {
-    readonly AWS_CLOUDHSM: "AWS_CLOUDHSM";
-    readonly AWS_KMS: "AWS_KMS";
-    readonly EXTERNAL: "EXTERNAL";
-    readonly EXTERNAL_KEY_STORE: "EXTERNAL_KEY_STORE";
-};
-/**
- * @public
- */
-export type OriginType = (typeof OriginType)[keyof typeof OriginType];
 /**
  * <p>A key-value pair. A tag consists of a tag key and a tag value. Tag keys and tag values are
  *       both required, but tag values can be empty (null) strings.</p>
@@ -1273,8 +595,11 @@ export interface CreateKeyRequest {
     /**
      * <p>Determines the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations">cryptographic operations</a> for which you can use the KMS key. The default value is
      *         <code>ENCRYPT_DECRYPT</code>. This parameter is optional when you are creating a symmetric
-     *       encryption KMS key; otherwise, it is required. You can't change the <code>KeyUsage</code>
-     *       value after the KMS key is created.</p>
+     *       encryption KMS key; otherwise, it is required. You can't change the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html#key-usage">
+     *                <code>KeyUsage</code>
+     *             </a> value after the KMS key is created. Each KMS key can have
+     *       only one key usage. This follows key usage best practices according to <a href="https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final">NIST SP 800-57 Recommendations for
+     *         Key Management</a>, section 5.2, Key usage.</p>
      *          <p>Select only one valid value.</p>
      *          <ul>
      *             <li>
@@ -1289,7 +614,7 @@ export interface CreateKeyRequest {
      *             <code>SIGN_VERIFY</code>.</p>
      *             </li>
      *             <li>
-     *                <p>For asymmetric KMS keys with NIST-recommended elliptic curve key pairs, specify
+     *                <p>For asymmetric KMS keys with NIST-standard elliptic curve key pairs, specify
      *             <code>SIGN_VERIFY</code> or <code>KEY_AGREEMENT</code>.</p>
      *             </li>
      *             <li>
@@ -1315,7 +640,7 @@ export interface CreateKeyRequest {
      *       way. Only the names differ. We recommend that you use <code>KeySpec</code> parameter in your
      *       code. However, to avoid breaking changes, KMS supports both parameters.</p>
      *
-     * @deprecated
+     * @deprecated This parameter has been deprecated. Instead, use the KeySpec parameter.
      * @public
      */
     CustomerMasterKeySpec?: CustomerMasterKeySpec | undefined;
@@ -1399,7 +724,7 @@ export interface CreateKeyRequest {
      *                </ul>
      *             </li>
      *             <li>
-     *                <p>Asymmetric NIST-recommended elliptic curve key pairs (signing and verification -or-
+     *                <p>Asymmetric NIST-standard elliptic curve key pairs (signing and verification -or-
      *           deriving shared secrets)</p>
      *                <ul>
      *                   <li>
@@ -1414,6 +739,21 @@ export interface CreateKeyRequest {
      *                      <p>
      *                         <code>ECC_NIST_P521</code> (secp521r1)</p>
      *                   </li>
+     *                   <li>
+     *                      <p>
+     *                         <code>ECC_NIST_EDWARDS25519</code> (ed25519) - signing and verification only</p>
+     *                      <ul>
+     *                         <li>
+     *                            <p>
+     *                               <b>Note:</b> For ECC_NIST_EDWARDS25519 KMS keys, the
+     *                           ED25519_SHA_512 signing algorithm requires <a href="kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType">
+     *                                  <code>MessageType:RAW</code>
+     *                               </a>, while ED25519_PH_SHA_512 requires <a href="kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType">
+     *                                  <code>MessageType:DIGEST</code>
+     *                               </a>. These message types cannot be used interchangeably.</p>
+     *                         </li>
+     *                      </ul>
+     *                   </li>
      *                </ul>
      *             </li>
      *             <li>
@@ -1572,99 +912,6 @@ export interface CreateKeyRequest {
      */
     XksKeyId?: string | undefined;
 }
-/**
- * @public
- * @enum
- */
-export declare const EncryptionAlgorithmSpec: {
-    readonly RSAES_OAEP_SHA_1: "RSAES_OAEP_SHA_1";
-    readonly RSAES_OAEP_SHA_256: "RSAES_OAEP_SHA_256";
-    readonly SM2PKE: "SM2PKE";
-    readonly SYMMETRIC_DEFAULT: "SYMMETRIC_DEFAULT";
-};
-/**
- * @public
- */
-export type EncryptionAlgorithmSpec = (typeof EncryptionAlgorithmSpec)[keyof typeof EncryptionAlgorithmSpec];
-/**
- * @public
- * @enum
- */
-export declare const ExpirationModelType: {
-    readonly KEY_MATERIAL_DOES_NOT_EXPIRE: "KEY_MATERIAL_DOES_NOT_EXPIRE";
-    readonly KEY_MATERIAL_EXPIRES: "KEY_MATERIAL_EXPIRES";
-};
-/**
- * @public
- */
-export type ExpirationModelType = (typeof ExpirationModelType)[keyof typeof ExpirationModelType];
-/**
- * @public
- * @enum
- */
-export declare const KeyAgreementAlgorithmSpec: {
-    readonly ECDH: "ECDH";
-};
-/**
- * @public
- */
-export type KeyAgreementAlgorithmSpec = (typeof KeyAgreementAlgorithmSpec)[keyof typeof KeyAgreementAlgorithmSpec];
-/**
- * @public
- * @enum
- */
-export declare const KeyManagerType: {
-    readonly AWS: "AWS";
-    readonly CUSTOMER: "CUSTOMER";
-};
-/**
- * @public
- */
-export type KeyManagerType = (typeof KeyManagerType)[keyof typeof KeyManagerType];
-/**
- * @public
- * @enum
- */
-export declare const KeyState: {
-    readonly Creating: "Creating";
-    readonly Disabled: "Disabled";
-    readonly Enabled: "Enabled";
-    readonly PendingDeletion: "PendingDeletion";
-    readonly PendingImport: "PendingImport";
-    readonly PendingReplicaDeletion: "PendingReplicaDeletion";
-    readonly Unavailable: "Unavailable";
-    readonly Updating: "Updating";
-};
-/**
- * @public
- */
-export type KeyState = (typeof KeyState)[keyof typeof KeyState];
-/**
- * @public
- * @enum
- */
-export declare const MacAlgorithmSpec: {
-    readonly HMAC_SHA_224: "HMAC_SHA_224";
-    readonly HMAC_SHA_256: "HMAC_SHA_256";
-    readonly HMAC_SHA_384: "HMAC_SHA_384";
-    readonly HMAC_SHA_512: "HMAC_SHA_512";
-};
-/**
- * @public
- */
-export type MacAlgorithmSpec = (typeof MacAlgorithmSpec)[keyof typeof MacAlgorithmSpec];
-/**
- * @public
- * @enum
- */
-export declare const MultiRegionKeyType: {
-    readonly PRIMARY: "PRIMARY";
-    readonly REPLICA: "REPLICA";
-};
-/**
- * @public
- */
-export type MultiRegionKeyType = (typeof MultiRegionKeyType)[keyof typeof MultiRegionKeyType];
 /**
  * <p>Describes the primary or replica key in a multi-Region key.</p>
  * @public
@@ -1708,27 +955,6 @@ export interface MultiRegionConfiguration {
      */
     ReplicaKeys?: MultiRegionKey[] | undefined;
 }
-/**
- * @public
- * @enum
- */
-export declare const SigningAlgorithmSpec: {
-    readonly ECDSA_SHA_256: "ECDSA_SHA_256";
-    readonly ECDSA_SHA_384: "ECDSA_SHA_384";
-    readonly ECDSA_SHA_512: "ECDSA_SHA_512";
-    readonly ML_DSA_SHAKE_256: "ML_DSA_SHAKE_256";
-    readonly RSASSA_PKCS1_V1_5_SHA_256: "RSASSA_PKCS1_V1_5_SHA_256";
-    readonly RSASSA_PKCS1_V1_5_SHA_384: "RSASSA_PKCS1_V1_5_SHA_384";
-    readonly RSASSA_PKCS1_V1_5_SHA_512: "RSASSA_PKCS1_V1_5_SHA_512";
-    readonly RSASSA_PSS_SHA_256: "RSASSA_PSS_SHA_256";
-    readonly RSASSA_PSS_SHA_384: "RSASSA_PSS_SHA_384";
-    readonly RSASSA_PSS_SHA_512: "RSASSA_PSS_SHA_512";
-    readonly SM2DSA: "SM2DSA";
-};
-/**
- * @public
- */
-export type SigningAlgorithmSpec = (typeof SigningAlgorithmSpec)[keyof typeof SigningAlgorithmSpec];
 /**
  * <p>Information about the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key">external key </a>that is
  *       associated with a KMS key in an external key store. </p>
@@ -1859,7 +1085,7 @@ export interface KeyMetadata {
      *       value. We recommend that you use the <code>KeySpec</code> field in your code. However, to
      *       avoid breaking changes, KMS supports both fields.</p>
      *
-     * @deprecated
+     * @deprecated This field has been deprecated. Instead, use the KeySpec field.
      * @public
      */
     CustomerMasterKeySpec?: CustomerMasterKeySpec | undefined;
@@ -1955,11 +1181,10 @@ export interface KeyMetadata {
     XksKeyConfiguration?: XksKeyConfigurationType | undefined;
     /**
      * <p>Identifies the current key material. This value is present for symmetric encryption keys
-     *       with <code>AWS_KMS</code> origin and single-Region, symmetric encryption keys with
-     *         <code>EXTERNAL</code> origin. These KMS keys support automatic or on-demand key rotation and
-     *       can have multiple key materials associated with them. KMS uses the current key material for
-     *       both encryption and decryption, and the non-current key material for decryption operations
-     *       only.</p>
+     *       with <code>AWS_KMS</code> or <code>EXTERNAL</code> origin. These KMS keys support automatic
+     *       or on-demand key rotation and can have multiple key materials associated with them. KMS uses
+     *       the current key material for both encryption and decryption, and the non-current key material
+     *       for decryption operations only.</p>
      * @public
      */
     CurrentKeyMaterialId?: string | undefined;
@@ -1974,106 +1199,6 @@ export interface CreateKeyResponse {
      */
     KeyMetadata?: KeyMetadata | undefined;
 }
-/**
- * <p>The request was rejected because the specified policy is not syntactically or semantically
- *       correct.</p>
- * @public
- */
-export declare class MalformedPolicyDocumentException extends __BaseException {
-    readonly name: "MalformedPolicyDocumentException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<MalformedPolicyDocumentException, __BaseException>);
-}
-/**
- * <p>The request was rejected because one or more tags are not valid.</p>
- * @public
- */
-export declare class TagException extends __BaseException {
-    readonly name: "TagException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<TagException, __BaseException>);
-}
-/**
- * <p>The request was rejected because a specified parameter is not supported or a specified
- *       resource is not valid for this operation.</p>
- * @public
- */
-export declare class UnsupportedOperationException extends __BaseException {
-    readonly name: "UnsupportedOperationException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<UnsupportedOperationException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the (<code>XksKeyId</code>) is already associated with
- *       another KMS key in this external key store. Each KMS key in an external key store must be
- *       associated with a different external key.</p>
- * @public
- */
-export declare class XksKeyAlreadyInUseException extends __BaseException {
-    readonly name: "XksKeyAlreadyInUseException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksKeyAlreadyInUseException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the external key specified by the <code>XksKeyId</code>
- *       parameter did not meet the configuration requirements for an external key store.</p>
- *          <p>The external key must be an AES-256 symmetric key that is enabled and performs encryption
- *       and decryption.</p>
- * @public
- */
-export declare class XksKeyInvalidConfigurationException extends __BaseException {
-    readonly name: "XksKeyInvalidConfigurationException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksKeyInvalidConfigurationException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the external key store proxy could not find the external
- *       key. This exception is thrown when the value of the <code>XksKeyId</code> parameter doesn't
- *       identify a key in the external key manager associated with the external key proxy.</p>
- *          <p>Verify that the <code>XksKeyId</code> represents an existing key in the external key
- *       manager. Use the key identifier that the external key store proxy uses to identify the key.
- *       For details, see the documentation provided with your external key store proxy or key
- *       manager.</p>
- * @public
- */
-export declare class XksKeyNotFoundException extends __BaseException {
-    readonly name: "XksKeyNotFoundException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<XksKeyNotFoundException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the custom key store contains KMS keys. After verifying
- *       that you do not need to use the KMS keys, use the <a>ScheduleKeyDeletion</a>
- *       operation to delete the KMS keys. After they are deleted, you can delete the custom key
- *       store.</p>
- * @public
- */
-export declare class CustomKeyStoreHasCMKsException extends __BaseException {
-    readonly name: "CustomKeyStoreHasCMKsException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<CustomKeyStoreHasCMKsException, __BaseException>);
-}
 /**
  * <p>Detailed information about the external key store proxy (XKS proxy). Your external key
  *       store proxy translates KMS requests into a format that your external key manager can
@@ -2113,7 +1238,14 @@ export interface XksProxyConfigurationType {
      *       communicate with KMS.</p>
      * @public
      */
-    VpcEndpointServiceName?: string | undefined;
+    VpcEndpointServiceName?: string | undefined;
+    /**
+     * <p>The Amazon Web Services account ID that owns the Amazon VPC endpoint service used to communicate with the
+     *       external key store proxy (XKS). This field appears only when the XKS uses an VPC endpoint
+     *       service to communicate with KMS.</p>
+     * @public
+     */
+    VpcEndpointServiceOwner?: string | undefined;
 }
 /**
  * <p>Contains information about each custom key store in the custom key store list.</p>
@@ -2379,65 +1511,24 @@ export interface CustomKeyStoresListEntry {
      */
     XksProxyConfiguration?: XksProxyConfigurationType | undefined;
 }
-/**
- * @public
- * @enum
- */
-export declare const DataKeyPairSpec: {
-    readonly ECC_NIST_P256: "ECC_NIST_P256";
-    readonly ECC_NIST_P384: "ECC_NIST_P384";
-    readonly ECC_NIST_P521: "ECC_NIST_P521";
-    readonly ECC_SECG_P256K1: "ECC_SECG_P256K1";
-    readonly RSA_2048: "RSA_2048";
-    readonly RSA_3072: "RSA_3072";
-    readonly RSA_4096: "RSA_4096";
-    readonly SM2: "SM2";
-};
-/**
- * @public
- */
-export type DataKeyPairSpec = (typeof DataKeyPairSpec)[keyof typeof DataKeyPairSpec];
-/**
- * @public
- * @enum
- */
-export declare const DataKeySpec: {
-    readonly AES_128: "AES_128";
-    readonly AES_256: "AES_256";
-};
-/**
- * @public
- */
-export type DataKeySpec = (typeof DataKeySpec)[keyof typeof DataKeySpec];
-/**
- * @public
- * @enum
- */
-export declare const KeyEncryptionMechanism: {
-    readonly RSAES_OAEP_SHA_256: "RSAES_OAEP_SHA_256";
-};
-/**
- * @public
- */
-export type KeyEncryptionMechanism = (typeof KeyEncryptionMechanism)[keyof typeof KeyEncryptionMechanism];
 /**
  * <p>Contains information about the party that receives the response from the API
  *       operation.</p>
- *          <p>This data type is designed to support Amazon Web Services Nitro Enclaves, which lets you create an isolated
- *       compute environment in Amazon EC2. For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+ *          <p>This data type is designed to support Amazon Web Services Nitro Enclaves and Amazon Web Services NitroTPM,
+ *       which lets you create an attested environment in Amazon EC2. For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
  * @public
  */
 export interface RecipientInfo {
     /**
      * <p>The encryption algorithm that KMS should use with the public key for an Amazon Web Services Nitro
-     *       Enclave to encrypt plaintext values for the response. The only valid value is
+     *       Enclave or NitroTPM to encrypt plaintext values for the response. The only valid value is
      *         <code>RSAES_OAEP_SHA_256</code>.</p>
      * @public
      */
     KeyEncryptionAlgorithm?: KeyEncryptionMechanism | undefined;
     /**
-     * <p>The attestation document for an Amazon Web Services Nitro Enclave. This document includes the enclave's
-     *       public key.</p>
+     * <p>The attestation document for an Amazon Web Services Nitro Enclave or a NitroTPM. This document includes
+     *       the enclave's public key.</p>
      * @public
      */
     AttestationDocument?: Uint8Array | undefined;
@@ -2448,9 +1539,10 @@ export interface RecipientInfo {
 export interface DecryptRequest {
     /**
      * <p>Ciphertext to be decrypted. The blob includes metadata.</p>
+     *          <p>This parameter is required in all cases except when <code>DryRun</code> is <code>true</code> and <code>DryRunModifiers</code> is set to <code>IGNORE_CIPHERTEXT</code>.</p>
      * @public
      */
-    CiphertextBlob: Uint8Array | undefined;
+    CiphertextBlob?: Uint8Array | undefined;
     /**
      * <p>Specifies the encryption context to use when decrypting the data.
      *       An encryption context is valid only for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations">cryptographic operations</a> with a symmetric encryption KMS key. The standard asymmetric encryption algorithms and HMAC algorithms that KMS uses do not support an encryption context.</p>
@@ -2475,10 +1567,10 @@ export interface DecryptRequest {
      *       different KMS key, the <code>Decrypt</code> operation throws an
      *         <code>IncorrectKeyException</code>.</p>
      *          <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS
-     *       key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that
+     *       key or when <code>DryRun</code> is <code>true</code> and <code>DryRunModifiers</code> is set to <code>IGNORE_CIPHERTEXT</code>. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that
      *       it adds to the symmetric ciphertext blob. However, it is always recommended as a best
      *       practice. This practice ensures that you use the KMS key that you intend.</p>
-     *          <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
+     *          <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you should use the key ARN or alias ARN.</p>
      *          <p>For example:</p>
      *          <ul>
      *             <li>
@@ -2514,16 +1606,17 @@ export interface DecryptRequest {
     EncryptionAlgorithm?: EncryptionAlgorithmSpec | undefined;
     /**
      * <p>A signed <a href="https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave-concepts.html#term-attestdoc">attestation
-     *         document</a> from an Amazon Web Services Nitro enclave and the encryption algorithm to use with the
-     *       enclave's public key. The only valid encryption algorithm is <code>RSAES_OAEP_SHA_256</code>. </p>
-     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves. To include this
-     *       parameter, use the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK.</p>
+     *         document</a> from an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to
+     *       use with the public key in the attestation document. The only valid encryption algorithm is
+     *         <code>RSAES_OAEP_SHA_256</code>. </p>
+     *          <p>This parameter supports the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK for
+     *       Amazon Web Services Nitro Enclaves. It supports any Amazon Web Services SDK for Amazon Web Services NitroTPM. </p>
      *          <p>When you use this parameter, instead of returning the plaintext data, KMS encrypts the
      *       plaintext data with the public key in the attestation document, and returns the resulting
      *       ciphertext in the <code>CiphertextForRecipient</code> field in the response. This ciphertext
-     *       can be decrypted only with the private key in the enclave. The <code>Plaintext</code> field in
-     *       the response is null or empty.</p>
-     *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       can be decrypted only with the private key in the attested environment. The
+     *         <code>Plaintext</code> field in the response is null or empty.</p>
+     *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
     Recipient?: RecipientInfo | undefined;
@@ -2533,6 +1626,16 @@ export interface DecryptRequest {
      * @public
      */
     DryRun?: boolean | undefined;
+    /**
+     * <p>Specifies the modifiers to apply to the dry run operation. <code>DryRunModifiers</code> is an optional parameter that only applies when <code>DryRun</code> is
+     *         set to <code>true</code>.</p>
+     *          <p>When set to <code>IGNORE_CIPHERTEXT</code>, KMS performs only authorization validation without ciphertext validation. This allows you to test permissions
+     *         without requiring a valid ciphertext blob.</p>
+     *          <p>To learn more about how to use this parameter, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html">Testing your
+     *         permissions</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * @public
+     */
+    DryRunModifiers?: DryRunModifierType[] | undefined;
 }
 /**
  * @public
@@ -2556,10 +1659,11 @@ export interface DecryptResponse {
      */
     EncryptionAlgorithm?: EncryptionAlgorithmSpec | undefined;
     /**
-     * <p>The plaintext data encrypted with the public key in the attestation document. </p>
+     * <p>The plaintext data encrypted with the public key from the attestation document. This
+     *       ciphertext can be decrypted only by using a private key from the attested environment. </p>
      *          <p>This field is included in the response only when the <code>Recipient</code> parameter in
-     *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave.
-     *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave or NitroTPM.
+     *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
     CiphertextForRecipient?: Uint8Array | undefined;
@@ -2571,82 +1675,6 @@ export interface DecryptResponse {
      */
     KeyMaterialId?: string | undefined;
 }
-/**
- * <p>The request was rejected because the specified KMS key cannot decrypt the data. The
- *         <code>KeyId</code> in a <a>Decrypt</a> request and the <code>SourceKeyId</code>
- *       in a <a>ReEncrypt</a> request must identify the same KMS key that was used to
- *       encrypt the ciphertext.</p>
- * @public
- */
-export declare class IncorrectKeyException extends __BaseException {
-    readonly name: "IncorrectKeyException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<IncorrectKeyException, __BaseException>);
-}
-/**
- * <p>From the <a>Decrypt</a> or <a>ReEncrypt</a> operation, the request
- *       was rejected because the specified ciphertext, or additional authenticated data incorporated
- *       into the ciphertext, such as the encryption context, is corrupted, missing, or otherwise
- *       invalid.</p>
- *          <p>From the <a>ImportKeyMaterial</a> operation, the request was rejected because
- *       KMS could not decrypt the encrypted (wrapped) key material. </p>
- * @public
- */
-export declare class InvalidCiphertextException extends __BaseException {
-    readonly name: "InvalidCiphertextException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<InvalidCiphertextException, __BaseException>);
-}
-/**
- * <p>The request was rejected for one of the following reasons: </p>
- *          <ul>
- *             <li>
- *                <p>The <code>KeyUsage</code> value of the KMS key is incompatible with the API
- *           operation.</p>
- *             </li>
- *             <li>
- *                <p>The encryption algorithm or signing algorithm specified for the operation is
- *           incompatible with the type of key material in the KMS key <code>(KeySpec</code>).</p>
- *             </li>
- *          </ul>
- *          <p>For encrypting, decrypting, re-encrypting, and generating data keys, the
- *         <code>KeyUsage</code> must be <code>ENCRYPT_DECRYPT</code>. For signing and verifying
- *       messages, the <code>KeyUsage</code> must be <code>SIGN_VERIFY</code>. For generating and
- *       verifying message authentication codes (MACs), the <code>KeyUsage</code> must be
- *         <code>GENERATE_VERIFY_MAC</code>. For deriving key agreement secrets, the
- *         <code>KeyUsage</code> must be <code>KEY_AGREEMENT</code>. To find the <code>KeyUsage</code>
- *       of a KMS key, use the <a>DescribeKey</a> operation.</p>
- *          <p>To find the encryption or signing algorithms supported for a particular KMS key, use the
- *         <a>DescribeKey</a> operation.</p>
- * @public
- */
-export declare class InvalidKeyUsageException extends __BaseException {
-    readonly name: "InvalidKeyUsageException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<InvalidKeyUsageException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the specified KMS key was not available. You can retry
- *       the request.</p>
- * @public
- */
-export declare class KeyUnavailableException extends __BaseException {
-    readonly name: "KeyUnavailableException";
-    readonly $fault: "server";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<KeyUnavailableException, __BaseException>);
-}
 /**
  * @public
  */
@@ -2726,7 +1754,7 @@ export interface DeleteImportedKeyMaterialResponse {
  */
 export interface DeriveSharedSecretRequest {
     /**
-     * <p>Identifies an asymmetric NIST-recommended ECC or SM2 (China Regions only) KMS key. KMS
+     * <p>Identifies an asymmetric NIST-standard ECC or SM2 (China Regions only) KMS key. KMS
      *       uses the private key in the specified key pair to derive the shared secret. The key usage of
      *       the KMS key must be <code>KEY_AGREEMENT</code>. To find the <code>KeyUsage</code> of a KMS
      *       key, use the <a>DescribeKey</a> operation.</p>
@@ -2761,7 +1789,7 @@ export interface DeriveSharedSecretRequest {
      */
     KeyAgreementAlgorithm: KeyAgreementAlgorithmSpec | undefined;
     /**
-     * <p>Specifies the public key in your peer's NIST-recommended elliptic curve (ECC) or SM2
+     * <p>Specifies the public key in your peer's NIST-standard elliptic curve (ECC) or SM2
      *       (China Regions only) key pair.</p>
      *          <p>The public key must be a DER-encoded X.509 public key, also known as
      *         <code>SubjectPublicKeyInfo</code> (SPKI), as defined in <a href="https://tools.ietf.org/html/rfc5280">RFC 5280</a>.</p>
@@ -2793,21 +1821,23 @@ export interface DeriveSharedSecretRequest {
     DryRun?: boolean | undefined;
     /**
      * <p>A signed <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc">attestation document</a> from
-     *       an Amazon Web Services Nitro enclave and the encryption algorithm to use with the enclave's public key. The
-     *       only valid encryption algorithm is <code>RSAES_OAEP_SHA_256</code>. </p>
-     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves. To call
-     *       DeriveSharedSecret for an Amazon Web Services Nitro Enclaves, use the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> to generate the
-     *       attestation document and then use the Recipient parameter from any Amazon Web Services SDK to provide the
-     *       attestation document for the enclave.</p>
+     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in
+     *       the attestation document. The only valid encryption algorithm is
+     *         <code>RSAES_OAEP_SHA_256</code>. </p>
+     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves or
+     *       Amazon Web Services NitroTPM. To call DeriveSharedSecret generate an attestation document use either
+     *       <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> for an Amazon Web Services Nitro Enclaves or <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attestation-get-doc.html">Amazon Web Services NitroTPM tools</a> for
+     *       Amazon Web Services NitroTPM. Then use the Recipient parameter from any Amazon Web Services SDK to provide the
+     *       attestation document for the attested environment.</p>
      *          <p>When you use this parameter, instead of returning a plaintext copy of the shared secret,
      *       KMS encrypts the plaintext shared secret under the public key in the attestation document,
      *       and returns the resulting ciphertext in the <code>CiphertextForRecipient</code> field in the
-     *       response. This ciphertext can be decrypted only with the private key in the enclave. The
-     *         <code>CiphertextBlob</code> field in the response contains the encrypted shared secret
-     *       derived from the KMS key specified by the <code>KeyId</code> parameter and public key
-     *       specified by the <code>PublicKey</code> parameter. The <code>SharedSecret</code> field in the
-     *       response is null or empty.</p>
-     *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       response. This ciphertext can be decrypted only with the private key in the attested
+     *       environment. The <code>CiphertextBlob</code> field in the response contains the encrypted
+     *       shared secret derived from the KMS key specified by the <code>KeyId</code> parameter and
+     *       public key specified by the <code>PublicKey</code> parameter. The <code>SharedSecret</code>
+     *       field in the response is null or empty.</p>
+     *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
     Recipient?: RecipientInfo | undefined;
@@ -2830,11 +1860,11 @@ export interface DeriveSharedSecretResponse {
      */
     SharedSecret?: Uint8Array | undefined;
     /**
-     * <p>The plaintext shared secret encrypted with the public key in the attestation
-     *       document.</p>
+     * <p>The plaintext shared secret encrypted with the public key from the attestation document.
+     *       This ciphertext can be decrypted only by using a private key from the attested environment. </p>
      *          <p>This field is included in the response only when the <code>Recipient</code> parameter in
-     *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave.
-     *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave or NitroTPM.
+     *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
     CiphertextForRecipient?: Uint8Array | undefined;
@@ -2918,19 +1948,6 @@ export interface DescribeCustomKeyStoresResponse {
      */
     Truncated?: boolean | undefined;
 }
-/**
- * <p>The request was rejected because the marker that specifies where pagination should next
- *       begin is not valid.</p>
- * @public
- */
-export declare class InvalidMarkerException extends __BaseException {
-    readonly name: "InvalidMarkerException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<InvalidMarkerException, __BaseException>);
-}
 /**
  * @public
  */
@@ -2938,8 +1955,8 @@ export interface DescribeKeyRequest {
     /**
      * <p>Describes the specified KMS key. </p>
      *          <p>If you specify a predefined Amazon Web Services alias (an Amazon Web Services alias with no key ID), KMS associates
-     *       the alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html##aws-managed-cmk">Amazon Web Services managed key</a> and returns its
-     *         <code>KeyId</code> and <code>Arn</code> in the response.</p>
+     *       the alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key">Amazon Web Services managed key</a> and returns its <code>KeyId</code> and <code>Arn</code> in the
+     *       response.</p>
      *          <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
      *          <p>For example:</p>
      *          <ul>
@@ -3201,19 +2218,6 @@ export interface EncryptResponse {
      */
     EncryptionAlgorithm?: EncryptionAlgorithmSpec | undefined;
 }
-/**
- * <p>The request was rejected because the specified import token is expired. Use <a>GetParametersForImport</a> to get a new import token and public key, use the new
- *       public key to encrypt the key material, and then try the request again.</p>
- * @public
- */
-export declare class ExpiredImportTokenException extends __BaseException {
-    readonly name: "ExpiredImportTokenException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<ExpiredImportTokenException, __BaseException>);
-}
 /**
  * @public
  */
@@ -3285,10 +2289,11 @@ export interface GenerateDataKeyRequest {
     GrantTokens?: string[] | undefined;
     /**
      * <p>A signed <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc">attestation document</a> from
-     *       an Amazon Web Services Nitro enclave and the encryption algorithm to use with the enclave's public key. The
-     *       only valid encryption algorithm is <code>RSAES_OAEP_SHA_256</code>. </p>
-     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves. To include this
-     *       parameter, use the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK.</p>
+     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in
+     *       the attestation document. The only valid encryption algorithm is
+     *         <code>RSAES_OAEP_SHA_256</code>. </p>
+     *          <p>This parameter supports the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK for
+     *       Amazon Web Services Nitro Enclaves. It supports any Amazon Web Services SDK for Amazon Web Services NitroTPM. </p>
      *          <p>When you use this parameter, instead of returning the plaintext data key, KMS encrypts
      *       the plaintext data key under the public key in the attestation document, and returns the
      *       resulting ciphertext in the <code>CiphertextForRecipient</code> field in the response. This
@@ -3296,7 +2301,7 @@ export interface GenerateDataKeyRequest {
      *         <code>CiphertextBlob</code> field in the response contains a copy of the data key encrypted
      *       under the KMS key specified by the <code>KeyId</code> parameter. The <code>Plaintext</code>
      *       field in the response is null or empty.</p>
-     *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
     Recipient?: RecipientInfo | undefined;
@@ -3330,11 +2335,11 @@ export interface GenerateDataKeyResponse {
      */
     KeyId?: string | undefined;
     /**
-     * <p>The plaintext data key encrypted with the public key from the Nitro enclave. This
-     *       ciphertext can be decrypted only by using a private key in the Nitro enclave. </p>
+     * <p>The plaintext data key encrypted with the public key from the attestation document. This
+     *       ciphertext can be decrypted only by using a private key from the attested environment. </p>
      *          <p>This field is included in the response only when the <code>Recipient</code> parameter in
-     *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave.
-     *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave or NitroTPM.
+     *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
     CiphertextForRecipient?: Uint8Array | undefined;
@@ -3406,20 +2411,22 @@ export interface GenerateDataKeyPairRequest {
     GrantTokens?: string[] | undefined;
     /**
      * <p>A signed <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc">attestation document</a> from
-     *       an Amazon Web Services Nitro enclave and the encryption algorithm to use with the enclave's public key. The
-     *       only valid encryption algorithm is <code>RSAES_OAEP_SHA_256</code>. </p>
-     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves. To call
-     *       DeriveSharedSecret for an Amazon Web Services Nitro Enclaves, use the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> to generate the
-     *       attestation document and then use the Recipient parameter from any Amazon Web Services SDK to provide the
-     *       attestation document for the enclave.</p>
+     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in
+     *       the attestation document. The only valid encryption algorithm is
+     *         <code>RSAES_OAEP_SHA_256</code>. </p>
+     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves or
+     *       Amazon Web Services NitroTPM. To call GenerateDataKeyPair generate an attestation document use either
+     *       <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> for an Amazon Web Services Nitro Enclaves or <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attestation-get-doc.html">Amazon Web Services NitroTPM tools</a> for
+     *       Amazon Web Services NitroTPM. Then use the Recipient parameter from any Amazon Web Services SDK to provide the
+     *       attestation document for the attested environment.</p>
      *          <p>When you use this parameter, instead of returning a plaintext copy of the private data
      *       key, KMS encrypts the plaintext private data key under the public key in the attestation
      *       document, and returns the resulting ciphertext in the <code>CiphertextForRecipient</code>
      *       field in the response. This ciphertext can be decrypted only with the private key in the
-     *       enclave. The <code>CiphertextBlob</code> field in the response contains a copy of the private
-     *       data key encrypted under the KMS key specified by the <code>KeyId</code> parameter. The
-     *         <code>PrivateKeyPlaintext</code> field in the response is null or empty.</p>
-     *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       attested environment. The <code>CiphertextBlob</code> field in the response contains a copy of
+     *       the private data key encrypted under the KMS key specified by the <code>KeyId</code>
+     *       parameter. The <code>PrivateKeyPlaintext</code> field in the response is null or empty.</p>
+     *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
     Recipient?: RecipientInfo | undefined;
@@ -3462,11 +2469,12 @@ export interface GenerateDataKeyPairResponse {
      */
     KeyPairSpec?: DataKeyPairSpec | undefined;
     /**
-     * <p>The plaintext private data key encrypted with the public key from the Nitro enclave. This
-     *       ciphertext can be decrypted only by using a private key in the Nitro enclave. </p>
+     * <p>The plaintext private data key encrypted with the public key from the attestation
+     *       document. This ciphertext can be decrypted only by using a private key from the attested
+     *       environment. </p>
      *          <p>This field is included in the response only when the <code>Recipient</code> parameter in
-     *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave.
-     *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave or NitroTPM.
+     *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
     CiphertextForRecipient?: Uint8Array | undefined;
@@ -3749,16 +2757,17 @@ export interface GenerateRandomRequest {
     CustomKeyStoreId?: string | undefined;
     /**
      * <p>A signed <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc">attestation document</a> from
-     *       an Amazon Web Services Nitro enclave and the encryption algorithm to use with the enclave's public key. The
-     *       only valid encryption algorithm is <code>RSAES_OAEP_SHA_256</code>. </p>
-     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves. To include this
-     *       parameter, use the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK.</p>
+     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in
+     *       the attestation document. The only valid encryption algorithm is
+     *         <code>RSAES_OAEP_SHA_256</code>. </p>
+     *          <p>This parameter supports the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK for
+     *       Amazon Web Services Nitro Enclaves. It supports any Amazon Web Services SDK for Amazon Web Services NitroTPM. </p>
      *          <p>When you use this parameter, instead of returning plaintext bytes, KMS encrypts the
      *       plaintext bytes under the public key in the attestation document, and returns the resulting
      *       ciphertext in the <code>CiphertextForRecipient</code> field in the response. This ciphertext
-     *       can be decrypted only with the private key in the enclave. The <code>Plaintext</code> field in
-     *       the response is null or empty.</p>
-     *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       can be decrypted only with the private key in the attested environment. The
+     *         <code>Plaintext</code> field in the response is null or empty.</p>
+     *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
     Recipient?: RecipientInfo | undefined;
@@ -3775,15 +2784,98 @@ export interface GenerateRandomResponse {
      */
     Plaintext?: Uint8Array | undefined;
     /**
-     * <p>The plaintext random bytes encrypted with the public key from the Nitro enclave. This
-     *       ciphertext can be decrypted only by using a private key in the Nitro enclave. </p>
+     * <p>The plaintext random bytes encrypted with the public key from the attestation document.
+     *       This ciphertext can be decrypted only by using a private key from the attested environment. </p>
      *          <p>This field is included in the response only when the <code>Recipient</code> parameter in
-     *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave.
-     *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves uses KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave or NitroTPM.
+     *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
     CiphertextForRecipient?: Uint8Array | undefined;
 }
+/**
+ * @public
+ */
+export interface GetKeyLastUsageRequest {
+    /**
+     * <p>Identifies the KMS key to get usage information for. To specify a KMS key, use its key ID
+     *       or key ARN. Alias names are not supported.</p>
+     *          <p>Specify the key ID or key ARN of the KMS key.</p>
+     *          <p>For example:</p>
+     *          <ul>
+     *             <li>
+     *                <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code>
+     *                </p>
+     *             </li>
+     *             <li>
+     *                <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code>
+     *                </p>
+     *             </li>
+     *          </ul>
+     *          <p>To get the key ID and key ARN for a KMS key, use <a>ListKeys</a> or <a>DescribeKey</a>.</p>
+     * @public
+     */
+    KeyId: string | undefined;
+}
+/**
+ * <p>Contains usage information about the last time the KMS key was used for a successful cryptographic
+ *       operation.</p>
+ * @public
+ */
+export interface KeyLastUsageData {
+    /**
+     * <p>The last successful cryptographic operation the KMS key was used for. Absent if the key has not been
+     *       used since KMS began tracking.</p>
+     * @public
+     */
+    Operation?: KeyLastUsageTrackingOperation | undefined;
+    /**
+     * <p>The date and time when the KMS key was most recently used for a successful cryptographic
+     *       operation. Absent if the key has not been used since KMS began tracking.</p>
+     * @public
+     */
+    Timestamp?: Date | undefined;
+    /**
+     * <p>The CloudTrail <code>eventId</code> associated with the last successful cryptographic operation.
+     *       Absent if the key has not been used since KMS began tracking.</p>
+     * @public
+     */
+    CloudTrailEventId?: string | undefined;
+    /**
+     * <p>The KMS request ID associated with the last successful cryptographic operation. Absent if the key
+     *       has not been used since KMS began tracking.</p>
+     * @public
+     */
+    KmsRequestId?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface GetKeyLastUsageResponse {
+    /**
+     * <p>The globally unique identifier for the KMS key.</p>
+     * @public
+     */
+    KeyId?: string | undefined;
+    /**
+     * <p>Contains usage information about the last time the KMS key was used for a successful cryptographic
+     *       operation. If the key has not been used since tracking began, this response element is
+     *       empty.</p>
+     * @public
+     */
+    KeyLastUsage?: KeyLastUsageData | undefined;
+    /**
+     * <p>The date from which KMS began recording cryptographic activity for this key, or the date
+     *       the KMS key was created, whichever is later.</p>
+     * @public
+     */
+    TrackingStartDate?: Date | undefined;
+    /**
+     * <p>The date and time when the KMS key was created.</p>
+     * @public
+     */
+    KeyCreationDate?: Date | undefined;
+}
 /**
  * @public
  */
@@ -3886,20 +2978,6 @@ export interface GetKeyRotationStatusResponse {
      */
     OnDemandRotationStartDate?: Date | undefined;
 }
-/**
- * @public
- * @enum
- */
-export declare const WrappingKeySpec: {
-    readonly RSA_2048: "RSA_2048";
-    readonly RSA_3072: "RSA_3072";
-    readonly RSA_4096: "RSA_4096";
-    readonly SM2: "SM2";
-};
-/**
- * @public
- */
-export type WrappingKeySpec = (typeof WrappingKeySpec)[keyof typeof WrappingKeySpec];
 /**
  * @public
  */
@@ -4069,7 +3147,7 @@ export interface GetPublicKeyResponse {
      *       value. We recommend that you use the <code>KeySpec</code> field in your code. However, to
      *       avoid breaking changes, KMS supports both fields.</p>
      *
-     * @deprecated
+     * @deprecated This field has been deprecated. Instead, use the KeySpec field.
      * @public
      */
     CustomerMasterKeySpec?: CustomerMasterKeySpec | undefined;
@@ -4166,18 +3244,6 @@ export interface GrantListEntry {
      */
     Constraints?: GrantConstraints | undefined;
 }
-/**
- * @public
- * @enum
- */
-export declare const ImportType: {
-    readonly EXISTING_KEY_MATERIAL: "EXISTING_KEY_MATERIAL";
-    readonly NEW_KEY_MATERIAL: "NEW_KEY_MATERIAL";
-};
-/**
- * @public
- */
-export type ImportType = (typeof ImportType)[keyof typeof ImportType];
 /**
  * @public
  */
@@ -4256,6 +3322,10 @@ export interface ImportKeyMaterialRequest {
      *       parameter defaults to <code>NEW_KEY_MATERIAL</code>. After the first key material is imported,
      *       if this parameter is omitted then the parameter defaults to
      *       <code>EXISTING_KEY_MATERIAL</code>.</p>
+     *          <p>For multi-Region keys, you must first import new key material into
+     * the primary Region key. You should use the <code>NEW_KEY_MATERIAL</code> import type when importing key
+     * material into the primary Region key. Then, you can import the same key material into the replica Region
+     * key. The import type for the replica Region key should be <code>EXISTING_KEY_MATERIAL</code>.</p>
      * @public
      */
     ImportType?: ImportType | undefined;
@@ -4305,70 +3375,6 @@ export interface ImportKeyMaterialResponse {
      */
     KeyMaterialId?: string | undefined;
 }
-/**
- * <p>The request was rejected because the key material in the request is, expired, invalid, or
- *       does not meet expectations. For example, it is not the same key material that was previously
- *       imported or KMS expected new key material but the key material being imported is already
- *       associated with the KMS key.</p>
- * @public
- */
-export declare class IncorrectKeyMaterialException extends __BaseException {
-    readonly name: "IncorrectKeyMaterialException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<IncorrectKeyMaterialException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the provided import token is invalid or is associated
- *       with a different KMS key.</p>
- * @public
- */
-export declare class InvalidImportTokenException extends __BaseException {
-    readonly name: "InvalidImportTokenException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<InvalidImportTokenException, __BaseException>);
-}
-/**
- * @public
- * @enum
- */
-export declare const ImportState: {
-    readonly IMPORTED: "IMPORTED";
-    readonly PENDING_IMPORT: "PENDING_IMPORT";
-};
-/**
- * @public
- */
-export type ImportState = (typeof ImportState)[keyof typeof ImportState];
-/**
- * @public
- * @enum
- */
-export declare const IncludeKeyMaterial: {
-    readonly ALL_KEY_MATERIAL: "ALL_KEY_MATERIAL";
-    readonly ROTATIONS_ONLY: "ROTATIONS_ONLY";
-};
-/**
- * @public
- */
-export type IncludeKeyMaterial = (typeof IncludeKeyMaterial)[keyof typeof IncludeKeyMaterial];
-/**
- * <p>The request was rejected because the specified <code>GrantId</code> is not valid.</p>
- * @public
- */
-export declare class InvalidGrantIdException extends __BaseException {
-    readonly name: "InvalidGrantIdException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<InvalidGrantIdException, __BaseException>);
-}
 /**
  * <p>Contains information about each entry in the key list.</p>
  * @public
@@ -4385,47 +3391,6 @@ export interface KeyListEntry {
      */
     KeyArn?: string | undefined;
 }
-/**
- * @public
- * @enum
- */
-export declare const KeyMaterialState: {
-    readonly CURRENT: "CURRENT";
-    readonly NON_CURRENT: "NON_CURRENT";
-    readonly PENDING_ROTATION: "PENDING_ROTATION";
-};
-/**
- * @public
- */
-export type KeyMaterialState = (typeof KeyMaterialState)[keyof typeof KeyMaterialState];
-/**
- * <p>The request was rejected because the HMAC verification failed. HMAC verification fails
- *       when the HMAC computed by using the specified message, HMAC KMS key, and MAC algorithm does
- *       not match the HMAC specified in the request.</p>
- * @public
- */
-export declare class KMSInvalidMacException extends __BaseException {
-    readonly name: "KMSInvalidMacException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<KMSInvalidMacException, __BaseException>);
-}
-/**
- * <p>The request was rejected because the signature verification failed. Signature verification
- *       fails when it cannot confirm that signature was produced by signing the specified message with
- *       the specified KMS key and signing algorithm.</p>
- * @public
- */
-export declare class KMSInvalidSignatureException extends __BaseException {
-    readonly name: "KMSInvalidSignatureException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<KMSInvalidSignatureException, __BaseException>);
-}
 /**
  * @public
  */
@@ -4682,18 +3647,6 @@ export interface ListKeyRotationsRequest {
      */
     Marker?: string | undefined;
 }
-/**
- * @public
- * @enum
- */
-export declare const RotationType: {
-    readonly AUTOMATIC: "AUTOMATIC";
-    readonly ON_DEMAND: "ON_DEMAND";
-};
-/**
- * @public
- */
-export type RotationType = (typeof RotationType)[keyof typeof RotationType];
 /**
  * <p>Each entry contains information about one of the key materials associated with a KMS
  *       key.</p>
@@ -4724,14 +3677,20 @@ export interface RotationsListEntry {
      */
     ImportState?: ImportState | undefined;
     /**
-     * <p>There are three possible values for this field: <code>CURRENT</code>,
-     *         <code>NON_CURRENT</code> and <code>PENDING_ROTATION</code>. KMS uses <code>CURRENT</code>
+     * <p>There are four possible values for this field: <code>CURRENT</code>,
+     *         <code>NON_CURRENT</code>, <code>PENDING_MULTI_REGION_IMPORT_AND_ROTATION</code> and
+     *         <code>PENDING_ROTATION</code>. KMS uses <code>CURRENT</code>
      *       key material for both encryption and decryption and <code>NON_CURRENT</code> key material only
      *       for decryption. <code>PENDING_ROTATION</code> identifies key material that has been imported
-     *       for on-demand key rotation but the rotation hasn't completed. Key material in
-     *         <code>PENDING_ROTATION</code> is not permanently associated with the KMS key. You can delete
-     *       this key material and import different key material in its place. The
-     *         <code>PENDING_ROTATION</code> value is only used in symmetric encryption keys with imported
+     *       for on-demand key rotation but the rotation hasn't completed. The key material state
+     *       <code>PENDING_MULTI_REGION_IMPORT_AND_ROTATION</code> is unique to multi-region,
+     *       symmetric encryption keys with imported key material. It indicates key material that has
+     *       been imported into the primary Region key but not all of the replica Region keys. When this key material
+     *       is imported in to all of the replica Region keys, the key material state will change to
+     *       <code>PENDING_ROTATION</code>. Key material in <code>PENDING_MULTI_REGION_IMPORT_AND_ROTATION</code>
+     *       or <code>PENDING_ROTATION</code> state is not permanently associated with the KMS key. You can delete
+     *       this key material and import different key material in its place. The <code>PENDING_MULTI_REGION_IMPORT_AND_ROTATION</code>
+     *       and <code>PENDING_ROTATION</code> values are only used in symmetric encryption keys with imported
      *       key material. The other values, <code>CURRENT</code> and <code>NON_CURRENT</code>, are used
      *       for all KMS keys that support automatic or on-demand key rotation.</p>
      * @public
@@ -4942,19 +3901,6 @@ export interface ListRetirableGrantsRequest {
      */
     RetiringPrincipal: string | undefined;
 }
-/**
- * @public
- * @enum
- */
-export declare const MessageType: {
-    readonly DIGEST: "DIGEST";
-    readonly EXTERNAL_MU: "EXTERNAL_MU";
-    readonly RAW: "RAW";
-};
-/**
- * @public
- */
-export type MessageType = (typeof MessageType)[keyof typeof MessageType];
 /**
  * @public
  */
@@ -5054,9 +4000,10 @@ export interface PutKeyPolicyRequest {
 export interface ReEncryptRequest {
     /**
      * <p>Ciphertext of the data to reencrypt.</p>
+     *          <p>This parameter is required in all cases except when <code>DryRun</code> is <code>true</code> and <code>DryRunModifiers</code> is set to <code>IGNORE_CIPHERTEXT</code>.</p>
      * @public
      */
-    CiphertextBlob: Uint8Array | undefined;
+    CiphertextBlob?: Uint8Array | undefined;
     /**
      * <p>Specifies the encryption context to use to decrypt the ciphertext. Enter the same
      *       encryption context that was used to encrypt the ciphertext.</p>
@@ -5075,10 +4022,11 @@ export interface ReEncryptRequest {
      *       different KMS key, the <code>ReEncrypt</code> operation throws an
      *         <code>IncorrectKeyException</code>.</p>
      *          <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS
-     *       key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that
-     *       it adds to the symmetric ciphertext blob. However, it is always recommended as a best
+     *       key or when <code>DryRun</code> is <code>true</code> and <code>DryRunModifiers</code> is set to
+     *       <code>IGNORE_CIPHERTEXT</code>. If you used a symmetric encryption KMS key, KMS can get the KMS key
+     *       from metadata that it adds to the symmetric ciphertext blob. However, it is always recommended as a best
      *       practice. This practice ensures that you use the KMS key that you intend.</p>
-     *          <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
+     *          <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you should use the key ARN or alias ARN.</p>
      *          <p>For example:</p>
      *          <ul>
      *             <li>
@@ -5180,6 +4128,16 @@ export interface ReEncryptRequest {
      * @public
      */
     DryRun?: boolean | undefined;
+    /**
+     * <p>Specifies the modifiers to apply to the dry run operation. <code>DryRunModifiers</code> is an optional parameter that only applies when <code>DryRun</code> is
+     *         set to <code>true</code>.</p>
+     *          <p>When set to <code>IGNORE_CIPHERTEXT</code>, KMS performs only authorization validation without ciphertext validation. This allows you to test permissions
+     *         without requiring a valid ciphertext blob.</p>
+     *          <p>To learn more about how to use this parameter, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html">Testing your
+     *         permissions</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * @public
+     */
+    DryRunModifiers?: DryRunModifierType[] | undefined;
 }
 /**
  * @public
@@ -5621,6 +4579,23 @@ export interface SignRequest {
      *         value with an unhashed message, the security of the signing operation can be
      *         compromised.</p>
      *          </important>
+     *          <p>When using ECC_NIST_EDWARDS25519 KMS keys:</p>
+     *          <ul>
+     *             <li>
+     *                <p>ED25519_SHA_512 signing algorithm requires KMS <code>MessageType:RAW</code>
+     *                </p>
+     *             </li>
+     *             <li>
+     *                <p>ED25519_PH_SHA_512 signing algorithm requires KMS <code>MessageType:DIGEST</code>
+     *                </p>
+     *             </li>
+     *          </ul>
+     *          <important>
+     *             <p>When you specify the ED25519_PH_SHA_512 signing algorithm with <code>MessageType:DIGEST</code>, KMS
+     *       still performs the SHA-512 prehash described in <a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf#page=39">Step 1
+     *       of Section 7.8.1 in FIPS 186-5</a>. This means the input is hashed twice: once by you and once by KMS.
+     *       </p>
+     *          </important>
      *          <p>When the value of <code>MessageType</code> is <code>DIGEST</code>, the length of the
      *         <code>Message</code> value must match the length of hashed messages for the specified
      *       signing algorithm.</p>
@@ -5787,8 +4762,9 @@ export interface UpdateAliasRequest {
      */
     AliasName: string | undefined;
     /**
-     * <p>Identifies the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a> to associate with the alias. You don't have permission to
-     *       associate an alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a>.</p>
+     * <p>Identifies the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-mgn-key">customer managed key</a> to associate
+     *       with the alias. You don't have permission to associate an alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-key">Amazon Web Services managed
+     *         key</a>.</p>
      *          <p>The KMS key must be in the same Amazon Web Services account and Region as the alias. Also, the new
      *       target KMS key must be the same type as the current target KMS key (both symmetric or both
      *       asymmetric or both HMAC) and they must have the same key usage. </p>
@@ -5826,8 +4802,7 @@ export interface UpdateCustomKeyStoreRequest {
      *          <important>
      *             <p>Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.</p>
      *          </important>
-     *          <p>To change this value, an CloudHSM key store must be disconnected. An external key store can
-     *       be connected or disconnected.</p>
+     *          <p>To change this value, the custom key store can be connected or disconnected.</p>
      * @public
      */
     NewCustomKeyStoreName?: string | undefined;
@@ -5895,6 +4870,14 @@ export interface UpdateCustomKeyStoreRequest {
      * @public
      */
     XksProxyVpcEndpointServiceName?: string | undefined;
+    /**
+     * <p>Changes the Amazon Web Services account ID that KMS uses to identify the Amazon VPC endpoint service for
+     *       your external key store proxy (XKS proxy). This parameter is optional. If not specified, the current
+     *       Amazon Web Services account ID for the VPC endpoint service will not be updated.</p>
+     *          <p>To change this value, the external key store must be disconnected.</p>
+     * @public
+     */
+    XksProxyVpcEndpointServiceOwner?: string | undefined;
     /**
      * <p>Changes the credentials that KMS uses to sign requests to the external key store proxy
      *       (XKS proxy). This parameter is valid only for custom key stores with a
@@ -6052,6 +5035,23 @@ export interface VerifyRequest {
      *         value with an unhashed message, the security of the signing operation can be
      *         compromised.</p>
      *          </important>
+     *          <p>When using ECC_NIST_EDWARDS25519 KMS keys:</p>
+     *          <ul>
+     *             <li>
+     *                <p>ED25519_SHA_512 signing algorithm requires KMS <code>MessageType:RAW</code>
+     *                </p>
+     *             </li>
+     *             <li>
+     *                <p>ED25519_PH_SHA_512 signing algorithm requires KMS <code>MessageType:DIGEST</code>
+     *                </p>
+     *             </li>
+     *          </ul>
+     *          <important>
+     *             <p>When you specify the ED25519_PH_SHA_512 signing algorithm with <code>MessageType:DIGEST</code>, KMS
+     *       still performs the SHA-512 prehash described in <a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf#page=39">Step 1
+     *       of Section 7.8.1 in FIPS 186-5</a>. This means the input is hashed twice: once by you and once by KMS.
+     *       </p>
+     *          </important>
      *          <p>When the value of <code>MessageType</code> is <code>DIGEST</code>, the length of the
      *         <code>Message</code> value must match the length of hashed messages for the specified
      *       signing algorithm.</p>
@@ -6208,71 +5208,3 @@ export interface VerifyMacResponse {
      */
     MacAlgorithm?: MacAlgorithmSpec | undefined;
 }
-/**
- * @internal
- */
-export declare const XksProxyAuthenticationCredentialTypeFilterSensitiveLog: (obj: XksProxyAuthenticationCredentialType) => any;
-/**
- * @internal
- */
-export declare const CreateCustomKeyStoreRequestFilterSensitiveLog: (obj: CreateCustomKeyStoreRequest) => any;
-/**
- * @internal
- */
-export declare const XksProxyConfigurationTypeFilterSensitiveLog: (obj: XksProxyConfigurationType) => any;
-/**
- * @internal
- */
-export declare const CustomKeyStoresListEntryFilterSensitiveLog: (obj: CustomKeyStoresListEntry) => any;
-/**
- * @internal
- */
-export declare const DecryptResponseFilterSensitiveLog: (obj: DecryptResponse) => any;
-/**
- * @internal
- */
-export declare const DeriveSharedSecretResponseFilterSensitiveLog: (obj: DeriveSharedSecretResponse) => any;
-/**
- * @internal
- */
-export declare const DescribeCustomKeyStoresResponseFilterSensitiveLog: (obj: DescribeCustomKeyStoresResponse) => any;
-/**
- * @internal
- */
-export declare const EncryptRequestFilterSensitiveLog: (obj: EncryptRequest) => any;
-/**
- * @internal
- */
-export declare const GenerateDataKeyResponseFilterSensitiveLog: (obj: GenerateDataKeyResponse) => any;
-/**
- * @internal
- */
-export declare const GenerateDataKeyPairResponseFilterSensitiveLog: (obj: GenerateDataKeyPairResponse) => any;
-/**
- * @internal
- */
-export declare const GenerateMacRequestFilterSensitiveLog: (obj: GenerateMacRequest) => any;
-/**
- * @internal
- */
-export declare const GenerateRandomResponseFilterSensitiveLog: (obj: GenerateRandomResponse) => any;
-/**
- * @internal
- */
-export declare const GetParametersForImportResponseFilterSensitiveLog: (obj: GetParametersForImportResponse) => any;
-/**
- * @internal
- */
-export declare const SignRequestFilterSensitiveLog: (obj: SignRequest) => any;
-/**
- * @internal
- */
-export declare const UpdateCustomKeyStoreRequestFilterSensitiveLog: (obj: UpdateCustomKeyStoreRequest) => any;
-/**
- * @internal
- */
-export declare const VerifyRequestFilterSensitiveLog: (obj: VerifyRequest) => any;
-/**
- * @internal
- */
-export declare const VerifyMacRequestFilterSensitiveLog: (obj: VerifyMacRequest) => any;