@alliander-opensource/aws-jwt-sts 0.3.6 → 0.3.7

package/node_modules/@aws-sdk/client-kms/dist-types/commands/GetKeyLastUsageCommand.d.ts

@@ -0,0 +1,188 @@
+import { Command as $Command } from "@smithy/smithy-client";
+import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
+import type { KMSClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../KMSClient";
+import type { GetKeyLastUsageRequest, GetKeyLastUsageResponse } from "../models/models_0";
+/**
+ * @public
+ */
+export type { __MetadataBearer };
+export { $Command };
+/**
+ * @public
+ *
+ * The input for {@link GetKeyLastUsageCommand}.
+ */
+export interface GetKeyLastUsageCommandInput extends GetKeyLastUsageRequest {
+}
+/**
+ * @public
+ *
+ * The output of {@link GetKeyLastUsageCommand}.
+ */
+export interface GetKeyLastUsageCommandOutput extends GetKeyLastUsageResponse, __MetadataBearer {
+}
+declare const GetKeyLastUsageCommand_base: {
+    new (input: GetKeyLastUsageCommandInput): import("@smithy/smithy-client").CommandImpl<GetKeyLastUsageCommandInput, GetKeyLastUsageCommandOutput, KMSClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
+    new (input: GetKeyLastUsageCommandInput): import("@smithy/smithy-client").CommandImpl<GetKeyLastUsageCommandInput, GetKeyLastUsageCommandOutput, KMSClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
+    getEndpointParameterInstructions(): import("@smithy/middleware-endpoint").EndpointParameterInstructions;
+};
+/**
+ * <p>Returns usage information about the last successful cryptographic operation performed with a
+ *       specified KMS key, including the operation type, timestamp, and associated CloudTrail event
+ *       ID.</p>
+ *          <p>The <code>TrackingStartDate</code> in the <code>GetKeyLastUsage</code> response indicates
+ *       the date from which KMS began recording cryptographic activity for a given key. Use this
+ *       value together with <code>KeyCreationDate</code> to understand the key's usage
+ *       history:</p>
+ *          <ul>
+ *             <li>
+ *                <p>If the <code>KeyLastUsage</code> response element is <i>present</i>,
+ *           the key has been used for a successful cryptographic operation since the
+ *           <code>TrackingStartDate</code>. The response includes the operation type, timestamp, and
+ *           associated CloudTrail event ID.</p>
+ *             </li>
+ *             <li>
+ *                <p>If the <code>KeyLastUsage</code> response element is <i>empty</i> and
+ *           <code>KeyCreationDate</code> is on or after <code>TrackingStartDate</code>, the key has
+ *           not been used for a successful cryptographic operation since it was created.</p>
+ *             </li>
+ *             <li>
+ *                <p>If the <code>KeyLastUsage</code> response element is <i>empty</i> and
+ *           <code>KeyCreationDate</code> is before <code>TrackingStartDate</code>, there is no record
+ *           of the key being used for a successful cryptographic operation since the
+ *           <code>TrackingStartDate</code>. However, the key may have been used before tracking
+ *           began. To determine whether the key was used before the <code>TrackingStartDate</code>,
+ *           examine your past CloudTrail logs.</p>
+ *             </li>
+ *          </ul>
+ *          <p>For multi-Region KMS keys, primary and replica keys track last usage independently. Each
+ *       key in a multi-Region key set maintains its own usage information.</p>
+ *          <p>The <code>ReEncrypt</code> operation uses two keys: a source key for decryption and a
+ *       destination key for encryption. Usage information is recorded for both keys independently,
+ *       each with the CloudTrail event ID from the respective key owner's account.</p>
+ *          <note>
+ *             <p>Do not use <code>GetKeyLastUsage</code> as the sole indicator when scheduling a key for
+ *         deletion. Instead, first <a href="https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html">disable the key</a> and monitor CloudTrail for
+ *         <code>DisabledException</code> entries, as there could be infrequent workflows that are
+ *         dependent on the key. By looking for this exception, you can identify potential dependencies
+ *         and workload failures before they occur.</p>
+ *          </note>
+ *          <p>
+ *             <b>Cross-account use</b>: No. You cannot perform this operation
+ *       on a KMS key in a different Amazon Web Services account.</p>
+ *          <p>
+ *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GetKeyLastUsage</a> (key policy)</p>
+ *          <p>
+ *             <b>Related operations:</b>
+ *          </p>
+ *          <ul>
+ *             <li>
+ *                <p>
+ *                   <a>DescribeKey</a>
+ *                </p>
+ *             </li>
+ *             <li>
+ *                <p>
+ *                   <a>DisableKey</a>
+ *                </p>
+ *             </li>
+ *             <li>
+ *                <p>
+ *                   <a>ScheduleKeyDeletion</a>
+ *                </p>
+ *             </li>
+ *          </ul>
+ *          <p>
+ *             <b>Eventual consistency</b>: The KMS API follows an eventual consistency model.
+ *   For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency">KMS eventual consistency</a>.</p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { KMSClient, GetKeyLastUsageCommand } from "@aws-sdk/client-kms"; // ES Modules import
+ * // const { KMSClient, GetKeyLastUsageCommand } = require("@aws-sdk/client-kms"); // CommonJS import
+ * // import type { KMSClientConfig } from "@aws-sdk/client-kms";
+ * const config = {}; // type is KMSClientConfig
+ * const client = new KMSClient(config);
+ * const input = { // GetKeyLastUsageRequest
+ *   KeyId: "STRING_VALUE", // required
+ * };
+ * const command = new GetKeyLastUsageCommand(input);
+ * const response = await client.send(command);
+ * // { // GetKeyLastUsageResponse
+ * //   KeyId: "STRING_VALUE",
+ * //   KeyLastUsage: { // KeyLastUsageData
+ * //     Operation: "Decrypt" || "DeriveSharedSecret" || "Encrypt" || "GenerateDataKey" || "GenerateDataKeyPair" || "GenerateDataKeyPairWithoutPlaintext" || "GenerateDataKeyWithoutPlaintext" || "GenerateMac" || "ReEncrypt" || "Sign" || "Verify" || "VerifyMac",
+ * //     Timestamp: new Date("TIMESTAMP"),
+ * //     CloudTrailEventId: "STRING_VALUE",
+ * //     KmsRequestId: "STRING_VALUE",
+ * //   },
+ * //   TrackingStartDate: new Date("TIMESTAMP"),
+ * //   KeyCreationDate: new Date("TIMESTAMP"),
+ * // };
+ *
+ * ```
+ *
+ * @param GetKeyLastUsageCommandInput - {@link GetKeyLastUsageCommandInput}
+ * @returns {@link GetKeyLastUsageCommandOutput}
+ * @see {@link GetKeyLastUsageCommandInput} for command's `input` shape.
+ * @see {@link GetKeyLastUsageCommandOutput} for command's `response` shape.
+ * @see {@link KMSClientResolvedConfig | config} for KMSClient's `config` shape.
+ *
+ * @throws {@link DependencyTimeoutException} (server fault)
+ *  <p>The system timed out while trying to fulfill the request. You can retry the
+ *       request.</p>
+ *
+ * @throws {@link InvalidArnException} (client fault)
+ *  <p>The request was rejected because a specified ARN, or an ARN in a key policy, is not
+ *       valid.</p>
+ *
+ * @throws {@link KMSInternalException} (server fault)
+ *  <p>The request was rejected because an internal exception occurred. The request can be
+ *       retried.</p>
+ *
+ * @throws {@link NotFoundException} (client fault)
+ *  <p>The request was rejected because the specified entity or resource could not be
+ *       found.</p>
+ *
+ * @throws {@link KMSServiceException}
+ * <p>Base exception class for all service exceptions from KMS service.</p>
+ *
+ *
+ * @example To retrieve the last usage for a KMS key
+ * ```javascript
+ * // The following example retrieves usage information about the last successful cryptographic operation performed with the specified KMS key, including the operation type, timestamp, and associated AWS CloudTrail event ID.
+ * const input = {
+ *   KeyId: "1234abcd-12ab-34cd-56ef-1234567890ab"
+ * };
+ * const command = new GetKeyLastUsageCommand(input);
+ * const response = await client.send(command);
+ * /* response is
+ * {
+ *   KeyCreationDate: 1.77325342556E9,
+ *   KeyId: "1234abcd-12ab-34cd-56ef-1234567890ab",
+ *   KeyLastUsage: {
+ *     CloudTrailEventId: "2cfd5892-ea8c-4342-ad49-4b9594b06a8b",
+ *     KmsRequestId: "040cce3e-9ef3-4651-b8cf-e47c9bafdc9b",
+ *     Operation: "Encrypt",
+ *     Timestamp: 1.773253497E9
+ *   },
+ *   TrackingStartDate: 1.77325342556E9
+ * }
+ * *\/
+ * ```
+ *
+ * @public
+ */
+export declare class GetKeyLastUsageCommand extends GetKeyLastUsageCommand_base {
+    /** @internal type navigation helper, not in runtime. */
+    protected static __types: {
+        api: {
+            input: GetKeyLastUsageRequest;
+            output: GetKeyLastUsageResponse;
+        };
+        sdk: {
+            input: GetKeyLastUsageCommandInput;
+            output: GetKeyLastUsageCommandOutput;
+        };
+    };
+}

package/node_modules/@aws-sdk/client-kms/dist-types/commands/ReEncryptCommand.d.ts

@@ -74,8 +74,10 @@ declare const ReEncryptCommand_base: {
  *          <p>
  *             <b>Cross-account use</b>: Yes. The source KMS key and
  *       destination KMS key can be in different Amazon Web Services accounts. Either or both KMS keys can be in a
- *       different account than the caller. To specify a KMS key in a different account, you must use
- *       its key ARN or alias ARN.</p>
+ *       different account than the caller. To specify a KMS key in a different account, use the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN">key ARN</a>
+ *       or <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-alias-ARN">alias ARN</a>. A short <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id">key ID</a>
+ *       is also acceptable for the source key when decrypting symmetric ciphertexts, though
+ *       using a full key ARN is recommended to be more explicit about the intended KMS key.</p>
  *          <p>
  *             <b>Required permissions</b>:</p>
  *          <ul>
@@ -131,7 +133,7 @@ declare const ReEncryptCommand_base: {
  * const config = {}; // type is KMSClientConfig
  * const client = new KMSClient(config);
  * const input = { // ReEncryptRequest
- *   CiphertextBlob: new Uint8Array(), // e.g. Buffer.from("") or new TextEncoder().encode("")   // required
+ *   CiphertextBlob: new Uint8Array(), // e.g. Buffer.from("") or new TextEncoder().encode("")
  *   SourceEncryptionContext: { // EncryptionContextType
  *     "<keys>": "STRING_VALUE",
  *   },
@@ -146,6 +148,9 @@ declare const ReEncryptCommand_base: {
  *     "STRING_VALUE",
  *   ],
  *   DryRun: true || false,
+ *   DryRunModifiers: [ // DryRunModifierList
+ *     "IGNORE_CIPHERTEXT",
+ *   ],
  * };
  * const command = new ReEncryptCommand(input);
  * const response = await client.send(command);

package/node_modules/@aws-sdk/client-kms/dist-types/commands/RotateKeyOnDemandCommand.d.ts

@@ -37,7 +37,7 @@ declare const RotateKeyOnDemandCommand_base: {
  *       2024, and you perform an on-demand rotation on April 10, 2024, the key will automatically
  *       rotate, as scheduled, on April 14, 2024 and every 730 days thereafter.</p>
  *          <note>
- *             <p>You can perform on-demand key rotation a <b>maximum of 10
+ *             <p>You can perform on-demand key rotation a <b>maximum of 25
  *           times</b> per KMS key. You can use the KMS console to view the number of
  *         remaining on-demand rotations available for a KMS key.</p>
  *          </note>

package/node_modules/@aws-sdk/client-kms/dist-types/commands/UpdateCustomKeyStoreCommand.d.ts

@@ -58,8 +58,10 @@ declare const UpdateCustomKeyStoreCommand_base: {
  *       name (<code>NewCustomKeyStoreName</code>), to tell KMS about a change to the
  *         <code>kmsuser</code> crypto user password (<code>KeyStorePassword</code>), or to associate
  *       the custom key store with a different, but related, CloudHSM cluster
- *         (<code>CloudHsmClusterId</code>). To update any property of an CloudHSM key store, the
- *         <code>ConnectionState</code> of the CloudHSM key store must be <code>DISCONNECTED</code>. </p>
+ *         (<code>CloudHsmClusterId</code>). To update most properties of an CloudHSM key store, the
+ *         <code>ConnectionState</code> of the CloudHSM key store must be <code>DISCONNECTED</code>.
+ *         However, you can update the <code>CustomKeyStoreName</code> of an AWS CloudHSM key store
+ *         when it is in the <code>CONNECTED</code> or <code>DISCONNECTED</code> state.</p>
  *          <p>For an external key store, you can use this operation to change the custom key store
  *       friendly name (<code>NewCustomKeyStoreName</code>), or to tell KMS about a change to the
  *       external key store proxy authentication credentials
@@ -238,8 +240,10 @@ declare const UpdateCustomKeyStoreCommand_base: {
  *             </li>
  *             <li>
  *                <p>You requested the <a>UpdateCustomKeyStore</a> or <a>DeleteCustomKeyStore</a> operation on a custom key store that is not
- *           disconnected. This operation is valid only when the custom key store
- *             <code>ConnectionState</code> is <code>DISCONNECTED</code>.</p>
+ *           disconnected. <code>UpdateCustomKeyStore</code> can be called on a custom key store in the
+ *             <code>CONNECTED</code> state only to update <code>NewCustomKeyStoreName</code>.
+ *             For all other properties, the custom key store
+ *             <code>ConnectionState</code> must be <code>DISCONNECTED</code>.</p>
  *             </li>
  *             <li>
  *                <p>You requested the <a>GenerateRandom</a> operation in an CloudHSM key store

package/node_modules/@aws-sdk/client-kms/dist-types/commands/index.d.ts

@@ -23,6 +23,7 @@ export * from "./GenerateDataKeyPairWithoutPlaintextCommand";
 export * from "./GenerateDataKeyWithoutPlaintextCommand";
 export * from "./GenerateMacCommand";
 export * from "./GenerateRandomCommand";
+export * from "./GetKeyLastUsageCommand";
 export * from "./GetKeyPolicyCommand";
 export * from "./GetKeyRotationStatusCommand";
 export * from "./GetParametersForImportCommand";

package/node_modules/@aws-sdk/client-kms/dist-types/endpoint/bdd.d.ts

@@ -0,0 +1,2 @@
+import { BinaryDecisionDiagram } from "@smithy/util-endpoints";
+export declare const bdd: BinaryDecisionDiagram;

package/node_modules/@aws-sdk/client-kms/dist-types/index.d.ts

@@ -102,7 +102,7 @@
  */
 export * from "./KMSClient";
 export * from "./KMS";
-export { ClientInputEndpointParameters } from "./endpoint/EndpointParameters";
+export type { ClientInputEndpointParameters } from "./endpoint/EndpointParameters";
 export type { RuntimeExtension } from "./runtimeExtensions";
 export type { KMSExtensionConfiguration } from "./extensionConfiguration";
 export * from "./commands";

package/node_modules/@aws-sdk/client-kms/dist-types/models/enums.d.ts

@@ -333,6 +333,17 @@ export declare const DataKeySpec: {
  * @public
  */
 export type DataKeySpec = (typeof DataKeySpec)[keyof typeof DataKeySpec];
+/**
+ * @public
+ * @enum
+ */
+export declare const DryRunModifierType: {
+    readonly IGNORE_CIPHERTEXT: "IGNORE_CIPHERTEXT";
+};
+/**
+ * @public
+ */
+export type DryRunModifierType = (typeof DryRunModifierType)[keyof typeof DryRunModifierType];
 /**
  * @public
  * @enum
@@ -344,6 +355,28 @@ export declare const KeyEncryptionMechanism: {
  * @public
  */
 export type KeyEncryptionMechanism = (typeof KeyEncryptionMechanism)[keyof typeof KeyEncryptionMechanism];
+/**
+ * @public
+ * @enum
+ */
+export declare const KeyLastUsageTrackingOperation: {
+    readonly Decrypt: "Decrypt";
+    readonly DeriveSharedSecret: "DeriveSharedSecret";
+    readonly Encrypt: "Encrypt";
+    readonly GenerateDataKey: "GenerateDataKey";
+    readonly GenerateDataKeyPair: "GenerateDataKeyPair";
+    readonly GenerateDataKeyPairWithoutPlaintext: "GenerateDataKeyPairWithoutPlaintext";
+    readonly GenerateDataKeyWithoutPlaintext: "GenerateDataKeyWithoutPlaintext";
+    readonly GenerateMac: "GenerateMac";
+    readonly ReEncrypt: "ReEncrypt";
+    readonly Sign: "Sign";
+    readonly Verify: "Verify";
+    readonly VerifyMac: "VerifyMac";
+};
+/**
+ * @public
+ */
+export type KeyLastUsageTrackingOperation = (typeof KeyLastUsageTrackingOperation)[keyof typeof KeyLastUsageTrackingOperation];
 /**
  * @public
  * @enum

package/node_modules/@aws-sdk/client-kms/dist-types/models/errors.d.ts

@@ -240,8 +240,10 @@ export declare class ConflictException extends __BaseException {
  *             </li>
  *             <li>
  *                <p>You requested the <a>UpdateCustomKeyStore</a> or <a>DeleteCustomKeyStore</a> operation on a custom key store that is not
- *           disconnected. This operation is valid only when the custom key store
- *             <code>ConnectionState</code> is <code>DISCONNECTED</code>.</p>
+ *           disconnected. <code>UpdateCustomKeyStore</code> can be called on a custom key store in the
+ *             <code>CONNECTED</code> state only to update <code>NewCustomKeyStoreName</code>.
+ *             For all other properties, the custom key store
+ *             <code>ConnectionState</code> must be <code>DISCONNECTED</code>.</p>
  *             </li>
  *             <li>
  *                <p>You requested the <a>GenerateRandom</a> operation in an CloudHSM key store

package/node_modules/@aws-sdk/client-kms/dist-types/models/models_0.d.ts

@@ -1,4 +1,4 @@
-import { AlgorithmSpec, ConnectionErrorCodeType, ConnectionStateType, CustomerMasterKeySpec, CustomKeyStoreType, DataKeyPairSpec, DataKeySpec, EncryptionAlgorithmSpec, ExpirationModelType, GrantOperation, ImportState, ImportType, IncludeKeyMaterial, KeyAgreementAlgorithmSpec, KeyEncryptionMechanism, KeyManagerType, KeyMaterialState, KeySpec, KeyState, KeyUsageType, MacAlgorithmSpec, MessageType, MultiRegionKeyType, OriginType, RotationType, SigningAlgorithmSpec, WrappingKeySpec, XksProxyConnectivityType } from "./enums";
+import type { AlgorithmSpec, ConnectionErrorCodeType, ConnectionStateType, CustomerMasterKeySpec, CustomKeyStoreType, DataKeyPairSpec, DataKeySpec, DryRunModifierType, EncryptionAlgorithmSpec, ExpirationModelType, GrantOperation, ImportState, ImportType, IncludeKeyMaterial, KeyAgreementAlgorithmSpec, KeyEncryptionMechanism, KeyLastUsageTrackingOperation, KeyManagerType, KeyMaterialState, KeySpec, KeyState, KeyUsageType, MacAlgorithmSpec, MessageType, MultiRegionKeyType, OriginType, RotationType, SigningAlgorithmSpec, WrappingKeySpec, XksProxyConnectivityType } from "./enums";
 /**
  * <p>Contains information about an alias.</p>
  * @public
@@ -1539,9 +1539,10 @@ export interface RecipientInfo {
 export interface DecryptRequest {
     /**
      * <p>Ciphertext to be decrypted. The blob includes metadata.</p>
+     *          <p>This parameter is required in all cases except when <code>DryRun</code> is <code>true</code> and <code>DryRunModifiers</code> is set to <code>IGNORE_CIPHERTEXT</code>.</p>
      * @public
      */
-    CiphertextBlob: Uint8Array | undefined;
+    CiphertextBlob?: Uint8Array | undefined;
     /**
      * <p>Specifies the encryption context to use when decrypting the data.
      *       An encryption context is valid only for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations">cryptographic operations</a> with a symmetric encryption KMS key. The standard asymmetric encryption algorithms and HMAC algorithms that KMS uses do not support an encryption context.</p>
@@ -1566,10 +1567,10 @@ export interface DecryptRequest {
      *       different KMS key, the <code>Decrypt</code> operation throws an
      *         <code>IncorrectKeyException</code>.</p>
      *          <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS
-     *       key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that
+     *       key or when <code>DryRun</code> is <code>true</code> and <code>DryRunModifiers</code> is set to <code>IGNORE_CIPHERTEXT</code>. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that
      *       it adds to the symmetric ciphertext blob. However, it is always recommended as a best
      *       practice. This practice ensures that you use the KMS key that you intend.</p>
-     *          <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
+     *          <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you should use the key ARN or alias ARN.</p>
      *          <p>For example:</p>
      *          <ul>
      *             <li>
@@ -1625,6 +1626,16 @@ export interface DecryptRequest {
      * @public
      */
     DryRun?: boolean | undefined;
+    /**
+     * <p>Specifies the modifiers to apply to the dry run operation. <code>DryRunModifiers</code> is an optional parameter that only applies when <code>DryRun</code> is
+     *         set to <code>true</code>.</p>
+     *          <p>When set to <code>IGNORE_CIPHERTEXT</code>, KMS performs only authorization validation without ciphertext validation. This allows you to test permissions
+     *         without requiring a valid ciphertext blob.</p>
+     *          <p>To learn more about how to use this parameter, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html">Testing your
+     *         permissions</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * @public
+     */
+    DryRunModifiers?: DryRunModifierType[] | undefined;
 }
 /**
  * @public
@@ -2782,6 +2793,89 @@ export interface GenerateRandomResponse {
      */
     CiphertextForRecipient?: Uint8Array | undefined;
 }
+/**
+ * @public
+ */
+export interface GetKeyLastUsageRequest {
+    /**
+     * <p>Identifies the KMS key to get usage information for. To specify a KMS key, use its key ID
+     *       or key ARN. Alias names are not supported.</p>
+     *          <p>Specify the key ID or key ARN of the KMS key.</p>
+     *          <p>For example:</p>
+     *          <ul>
+     *             <li>
+     *                <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code>
+     *                </p>
+     *             </li>
+     *             <li>
+     *                <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code>
+     *                </p>
+     *             </li>
+     *          </ul>
+     *          <p>To get the key ID and key ARN for a KMS key, use <a>ListKeys</a> or <a>DescribeKey</a>.</p>
+     * @public
+     */
+    KeyId: string | undefined;
+}
+/**
+ * <p>Contains usage information about the last time the KMS key was used for a successful cryptographic
+ *       operation.</p>
+ * @public
+ */
+export interface KeyLastUsageData {
+    /**
+     * <p>The last successful cryptographic operation the KMS key was used for. Absent if the key has not been
+     *       used since KMS began tracking.</p>
+     * @public
+     */
+    Operation?: KeyLastUsageTrackingOperation | undefined;
+    /**
+     * <p>The date and time when the KMS key was most recently used for a successful cryptographic
+     *       operation. Absent if the key has not been used since KMS began tracking.</p>
+     * @public
+     */
+    Timestamp?: Date | undefined;
+    /**
+     * <p>The CloudTrail <code>eventId</code> associated with the last successful cryptographic operation.
+     *       Absent if the key has not been used since KMS began tracking.</p>
+     * @public
+     */
+    CloudTrailEventId?: string | undefined;
+    /**
+     * <p>The KMS request ID associated with the last successful cryptographic operation. Absent if the key
+     *       has not been used since KMS began tracking.</p>
+     * @public
+     */
+    KmsRequestId?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface GetKeyLastUsageResponse {
+    /**
+     * <p>The globally unique identifier for the KMS key.</p>
+     * @public
+     */
+    KeyId?: string | undefined;
+    /**
+     * <p>Contains usage information about the last time the KMS key was used for a successful cryptographic
+     *       operation. If the key has not been used since tracking began, this response element is
+     *       empty.</p>
+     * @public
+     */
+    KeyLastUsage?: KeyLastUsageData | undefined;
+    /**
+     * <p>The date from which KMS began recording cryptographic activity for this key, or the date
+     *       the KMS key was created, whichever is later.</p>
+     * @public
+     */
+    TrackingStartDate?: Date | undefined;
+    /**
+     * <p>The date and time when the KMS key was created.</p>
+     * @public
+     */
+    KeyCreationDate?: Date | undefined;
+}
 /**
  * @public
  */
@@ -3906,9 +4000,10 @@ export interface PutKeyPolicyRequest {
 export interface ReEncryptRequest {
     /**
      * <p>Ciphertext of the data to reencrypt.</p>
+     *          <p>This parameter is required in all cases except when <code>DryRun</code> is <code>true</code> and <code>DryRunModifiers</code> is set to <code>IGNORE_CIPHERTEXT</code>.</p>
      * @public
      */
-    CiphertextBlob: Uint8Array | undefined;
+    CiphertextBlob?: Uint8Array | undefined;
     /**
      * <p>Specifies the encryption context to use to decrypt the ciphertext. Enter the same
      *       encryption context that was used to encrypt the ciphertext.</p>
@@ -3927,10 +4022,11 @@ export interface ReEncryptRequest {
      *       different KMS key, the <code>ReEncrypt</code> operation throws an
      *         <code>IncorrectKeyException</code>.</p>
      *          <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS
-     *       key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that
-     *       it adds to the symmetric ciphertext blob. However, it is always recommended as a best
+     *       key or when <code>DryRun</code> is <code>true</code> and <code>DryRunModifiers</code> is set to
+     *       <code>IGNORE_CIPHERTEXT</code>. If you used a symmetric encryption KMS key, KMS can get the KMS key
+     *       from metadata that it adds to the symmetric ciphertext blob. However, it is always recommended as a best
      *       practice. This practice ensures that you use the KMS key that you intend.</p>
-     *          <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
+     *          <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you should use the key ARN or alias ARN.</p>
      *          <p>For example:</p>
      *          <ul>
      *             <li>
@@ -4032,6 +4128,16 @@ export interface ReEncryptRequest {
      * @public
      */
     DryRun?: boolean | undefined;
+    /**
+     * <p>Specifies the modifiers to apply to the dry run operation. <code>DryRunModifiers</code> is an optional parameter that only applies when <code>DryRun</code> is
+     *         set to <code>true</code>.</p>
+     *          <p>When set to <code>IGNORE_CIPHERTEXT</code>, KMS performs only authorization validation without ciphertext validation. This allows you to test permissions
+     *         without requiring a valid ciphertext blob.</p>
+     *          <p>To learn more about how to use this parameter, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html">Testing your
+     *         permissions</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * @public
+     */
+    DryRunModifiers?: DryRunModifierType[] | undefined;
 }
 /**
  * @public
@@ -4484,6 +4590,12 @@ export interface SignRequest {
      *                </p>
      *             </li>
      *          </ul>
+     *          <important>
+     *             <p>When you specify the ED25519_PH_SHA_512 signing algorithm with <code>MessageType:DIGEST</code>, KMS
+     *       still performs the SHA-512 prehash described in <a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf#page=39">Step 1
+     *       of Section 7.8.1 in FIPS 186-5</a>. This means the input is hashed twice: once by you and once by KMS.
+     *       </p>
+     *          </important>
      *          <p>When the value of <code>MessageType</code> is <code>DIGEST</code>, the length of the
      *         <code>Message</code> value must match the length of hashed messages for the specified
      *       signing algorithm.</p>
@@ -4690,8 +4802,7 @@ export interface UpdateCustomKeyStoreRequest {
      *          <important>
      *             <p>Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.</p>
      *          </important>
-     *          <p>To change this value, an CloudHSM key store must be disconnected. An external key store can
-     *       be connected or disconnected.</p>
+     *          <p>To change this value, the custom key store can be connected or disconnected.</p>
      * @public
      */
     NewCustomKeyStoreName?: string | undefined;
@@ -4935,6 +5046,12 @@ export interface VerifyRequest {
      *                </p>
      *             </li>
      *          </ul>
+     *          <important>
+     *             <p>When you specify the ED25519_PH_SHA_512 signing algorithm with <code>MessageType:DIGEST</code>, KMS
+     *       still performs the SHA-512 prehash described in <a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf#page=39">Step 1
+     *       of Section 7.8.1 in FIPS 186-5</a>. This means the input is hashed twice: once by you and once by KMS.
+     *       </p>
+     *          </important>
      *          <p>When the value of <code>MessageType</code> is <code>DIGEST</code>, the length of the
      *         <code>Message</code> value must match the length of hashed messages for the specified
      *       signing algorithm.</p>

package/node_modules/@aws-sdk/client-kms/dist-types/pagination/DescribeCustomKeyStoresPaginator.d.ts

@@ -1,6 +1,6 @@
 import type { Paginator } from "@smithy/types";
 import { DescribeCustomKeyStoresCommandInput, DescribeCustomKeyStoresCommandOutput } from "../commands/DescribeCustomKeyStoresCommand";
-import { KMSPaginationConfiguration } from "./Interfaces";
+import type { KMSPaginationConfiguration } from "./Interfaces";
 /**
  * @public
  */

package/node_modules/@aws-sdk/client-kms/dist-types/pagination/ListAliasesPaginator.d.ts

@@ -1,6 +1,6 @@
 import type { Paginator } from "@smithy/types";
 import { ListAliasesCommandInput, ListAliasesCommandOutput } from "../commands/ListAliasesCommand";
-import { KMSPaginationConfiguration } from "./Interfaces";
+import type { KMSPaginationConfiguration } from "./Interfaces";
 /**
  * @public
  */

package/node_modules/@aws-sdk/client-kms/dist-types/pagination/ListGrantsPaginator.d.ts

@@ -1,6 +1,6 @@
 import type { Paginator } from "@smithy/types";
 import { ListGrantsCommandInput, ListGrantsCommandOutput } from "../commands/ListGrantsCommand";
-import { KMSPaginationConfiguration } from "./Interfaces";
+import type { KMSPaginationConfiguration } from "./Interfaces";
 /**
  * @public
  */

package/node_modules/@aws-sdk/client-kms/dist-types/pagination/ListKeyPoliciesPaginator.d.ts

@@ -1,6 +1,6 @@
 import type { Paginator } from "@smithy/types";
 import { ListKeyPoliciesCommandInput, ListKeyPoliciesCommandOutput } from "../commands/ListKeyPoliciesCommand";
-import { KMSPaginationConfiguration } from "./Interfaces";
+import type { KMSPaginationConfiguration } from "./Interfaces";
 /**
  * @public
  */

package/node_modules/@aws-sdk/client-kms/dist-types/pagination/ListKeyRotationsPaginator.d.ts

@@ -1,6 +1,6 @@
 import type { Paginator } from "@smithy/types";
 import { ListKeyRotationsCommandInput, ListKeyRotationsCommandOutput } from "../commands/ListKeyRotationsCommand";
-import { KMSPaginationConfiguration } from "./Interfaces";
+import type { KMSPaginationConfiguration } from "./Interfaces";
 /**
  * @public
  */

package/node_modules/@aws-sdk/client-kms/dist-types/pagination/ListKeysPaginator.d.ts

@@ -1,6 +1,6 @@
 import type { Paginator } from "@smithy/types";
 import { ListKeysCommandInput, ListKeysCommandOutput } from "../commands/ListKeysCommand";
-import { KMSPaginationConfiguration } from "./Interfaces";
+import type { KMSPaginationConfiguration } from "./Interfaces";
 /**
  * @public
  */

package/node_modules/@aws-sdk/client-kms/dist-types/pagination/ListResourceTagsPaginator.d.ts

@@ -1,6 +1,6 @@
 import type { Paginator } from "@smithy/types";
 import { ListResourceTagsCommandInput, ListResourceTagsCommandOutput } from "../commands/ListResourceTagsCommand";
-import { KMSPaginationConfiguration } from "./Interfaces";
+import type { KMSPaginationConfiguration } from "./Interfaces";
 /**
  * @public
  */

package/node_modules/@aws-sdk/client-kms/dist-types/pagination/ListRetirableGrantsPaginator.d.ts

@@ -1,6 +1,6 @@
 import type { Paginator } from "@smithy/types";
 import { ListRetirableGrantsCommandInput, ListRetirableGrantsCommandOutput } from "../commands/ListRetirableGrantsCommand";
-import { KMSPaginationConfiguration } from "./Interfaces";
+import type { KMSPaginationConfiguration } from "./Interfaces";
 /**
  * @public
  */