@aws-sdk/client-kms 3.218.0 → 3.220.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -11
- package/dist-cjs/endpoint/ruleset.js +1 -1
- package/dist-cjs/models/models_0.js +206 -3
- package/dist-cjs/protocols/Aws_json1_1.js +284 -0
- package/dist-es/endpoint/ruleset.js +1 -1
- package/dist-es/models/models_0.js +187 -0
- package/dist-es/protocols/Aws_json1_1.js +285 -1
- package/dist-types/KMS.d.ts +457 -312
- package/dist-types/KMSClient.d.ts +12 -11
- package/dist-types/commands/CancelKeyDeletionCommand.d.ts +1 -2
- package/dist-types/commands/ConnectCustomKeyStoreCommand.d.ts +43 -17
- package/dist-types/commands/CreateAliasCommand.d.ts +1 -1
- package/dist-types/commands/CreateCustomKeyStoreCommand.d.ts +51 -13
- package/dist-types/commands/CreateGrantCommand.d.ts +1 -2
- package/dist-types/commands/CreateKeyCommand.d.ts +76 -35
- package/dist-types/commands/DecryptCommand.d.ts +16 -17
- package/dist-types/commands/DeleteAliasCommand.d.ts +1 -1
- package/dist-types/commands/DeleteCustomKeyStoreCommand.d.ts +21 -16
- package/dist-types/commands/DescribeCustomKeyStoresCommand.d.ts +22 -17
- package/dist-types/commands/DescribeKeyCommand.d.ts +7 -3
- package/dist-types/commands/DisableKeyCommand.d.ts +3 -2
- package/dist-types/commands/DisableKeyRotationCommand.d.ts +4 -6
- package/dist-types/commands/DisconnectCustomKeyStoreCommand.d.ts +12 -12
- package/dist-types/commands/EnableKeyCommand.d.ts +1 -2
- package/dist-types/commands/EnableKeyRotationCommand.d.ts +6 -8
- package/dist-types/commands/EncryptCommand.d.ts +11 -9
- package/dist-types/commands/GenerateDataKeyCommand.d.ts +1 -2
- package/dist-types/commands/GenerateDataKeyPairCommand.d.ts +8 -10
- package/dist-types/commands/GenerateDataKeyPairWithoutPlaintextCommand.d.ts +4 -6
- package/dist-types/commands/GenerateDataKeyWithoutPlaintextCommand.d.ts +9 -2
- package/dist-types/commands/GenerateMacCommand.d.ts +14 -14
- package/dist-types/commands/GenerateRandomCommand.d.ts +6 -3
- package/dist-types/commands/GetKeyRotationStatusCommand.d.ts +3 -3
- package/dist-types/commands/GetParametersForImportCommand.d.ts +3 -3
- package/dist-types/commands/GetPublicKeyCommand.d.ts +5 -4
- package/dist-types/commands/ImportKeyMaterialCommand.d.ts +8 -8
- package/dist-types/commands/ReEncryptCommand.d.ts +5 -5
- package/dist-types/commands/ReplicateKeyCommand.d.ts +5 -4
- package/dist-types/commands/ScheduleKeyDeletionCommand.d.ts +11 -8
- package/dist-types/commands/SignCommand.d.ts +8 -6
- package/dist-types/commands/TagResourceCommand.d.ts +1 -1
- package/dist-types/commands/UntagResourceCommand.d.ts +1 -1
- package/dist-types/commands/UpdateAliasCommand.d.ts +6 -6
- package/dist-types/commands/UpdateCustomKeyStoreCommand.d.ts +58 -38
- package/dist-types/commands/UpdateKeyDescriptionCommand.d.ts +1 -2
- package/dist-types/commands/VerifyCommand.d.ts +5 -6
- package/dist-types/commands/VerifyMacCommand.d.ts +6 -6
- package/dist-types/endpoint/EndpointParameters.d.ts +1 -1
- package/dist-types/models/models_0.d.ts +925 -224
- package/dist-types/ts3.4/endpoint/EndpointParameters.d.ts +1 -1
- package/dist-types/ts3.4/models/models_0.d.ts +166 -0
- package/package.json +1 -1
package/dist-types/KMS.d.ts
CHANGED
|
@@ -58,7 +58,7 @@ import { KMSClient } from "./KMSClient";
|
|
|
58
58
|
* <i>Key Management Service Developer Guide</i>
|
|
59
59
|
* </a>.</p>
|
|
60
60
|
* <note>
|
|
61
|
-
* <p>KMS
|
|
61
|
+
* <p>KMS has replaced the term <i>customer master key (CMK)</i> with <i>KMS key</i> and <i>KMS key</i>. The concept has not changed. To prevent breaking changes, KMS is keeping some variations of this term.</p>
|
|
62
62
|
* <p>Amazon Web Services provides SDKs that consist of libraries and sample code for various programming
|
|
63
63
|
* languages and platforms (Java, Ruby, .Net, macOS, Android, etc.). The SDKs provide a
|
|
64
64
|
* convenient way to create programmatic access to KMS and other Amazon Web Services services. For example,
|
|
@@ -67,23 +67,24 @@ import { KMSClient } from "./KMSClient";
|
|
|
67
67
|
* download and install them, see <a href="http://aws.amazon.com/tools/">Tools for Amazon Web
|
|
68
68
|
* Services</a>.</p>
|
|
69
69
|
* </note>
|
|
70
|
-
* <p>We recommend that you use the Amazon Web Services SDKs to make programmatic API calls to KMS
|
|
70
|
+
* <p>We recommend that you use the Amazon Web Services SDKs to make programmatic API calls to KMS.</p>
|
|
71
71
|
* <p>If you need to use FIPS 140-2 validated cryptographic modules when communicating with
|
|
72
72
|
* Amazon Web Services, use the FIPS endpoint in your preferred Amazon Web Services Region. For more information about the
|
|
73
|
-
* available FIPS endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">Service endpoints</a> in the Key Management Service topic of
|
|
74
|
-
*
|
|
75
|
-
*
|
|
76
|
-
*
|
|
77
|
-
*
|
|
78
|
-
*
|
|
73
|
+
* available FIPS endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">Service endpoints</a> in the Key Management Service topic of
|
|
74
|
+
* the <i>Amazon Web Services General Reference</i>.</p>
|
|
75
|
+
* <p>All KMS API calls must be signed and be transmitted using Transport Layer Security
|
|
76
|
+
* (TLS). KMS recommends you always use the latest supported TLS version. Clients must also
|
|
77
|
+
* support cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral Diffie-Hellman
|
|
78
|
+
* (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems such as Java 7
|
|
79
|
+
* and later support these modes.</p>
|
|
79
80
|
* <p>
|
|
80
81
|
* <b>Signing Requests</b>
|
|
81
82
|
* </p>
|
|
82
83
|
* <p>Requests must be signed by using an access key ID and a secret access key. We strongly
|
|
83
84
|
* recommend that you <i>do not</i> use your Amazon Web Services account (root) access key ID and
|
|
84
|
-
* secret key for everyday work with KMS. Instead, use the access key ID and secret
|
|
85
|
-
* for an IAM user. You can also use the Amazon Web Services Security Token Service to generate
|
|
86
|
-
* security credentials that you can use to sign requests.</p>
|
|
85
|
+
* secret access key for everyday work with KMS. Instead, use the access key ID and secret
|
|
86
|
+
* access key for an IAM user. You can also use the Amazon Web Services Security Token Service to generate
|
|
87
|
+
* temporary security credentials that you can use to sign requests.</p>
|
|
87
88
|
* <p>All KMS operations require <a href="https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html">Signature Version 4</a>.</p>
|
|
88
89
|
* <p>
|
|
89
90
|
* <b>Logging API Requests</b>
|
|
@@ -155,8 +156,7 @@ export declare class KMS extends KMSClient {
|
|
|
155
156
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
156
157
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
157
158
|
* <p>
|
|
158
|
-
* <b>Cross-account
|
|
159
|
-
* use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
159
|
+
* <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
160
160
|
* <p>
|
|
161
161
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:CancelKeyDeletion</a> (key policy)</p>
|
|
162
162
|
* <p>
|
|
@@ -167,24 +167,21 @@ export declare class KMS extends KMSClient {
|
|
|
167
167
|
cancelKeyDeletion(args: CancelKeyDeletionCommandInput, cb: (err: any, data?: CancelKeyDeletionCommandOutput) => void): void;
|
|
168
168
|
cancelKeyDeletion(args: CancelKeyDeletionCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: CancelKeyDeletionCommandOutput) => void): void;
|
|
169
169
|
/**
|
|
170
|
-
* <p>Connects or reconnects a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a> to its
|
|
170
|
+
* <p>Connects or reconnects a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a> to its backing key store. For an CloudHSM key
|
|
171
|
+
* store, <code>ConnectCustomKeyStore</code> connects the key store to its associated CloudHSM
|
|
172
|
+
* cluster. For an external key store, <code>ConnectCustomKeyStore</code> connects the key store
|
|
173
|
+
* to the external key store proxy that communicates with your external key manager.</p>
|
|
171
174
|
* <p>The custom key store must be connected before you can create KMS keys in the key store or
|
|
172
175
|
* use the KMS keys it contains. You can disconnect and reconnect a custom key store at any
|
|
173
176
|
* time.</p>
|
|
174
|
-
* <p>
|
|
175
|
-
*
|
|
176
|
-
*
|
|
177
|
-
*
|
|
178
|
-
*
|
|
179
|
-
*
|
|
180
|
-
*
|
|
181
|
-
*
|
|
182
|
-
* succeeds, this operation quickly returns an HTTP 200 response and a JSON object with no
|
|
183
|
-
* properties. However, this response does not indicate that the custom key store is connected.
|
|
184
|
-
* To get the connection state of the custom key store, use the <a>DescribeCustomKeyStores</a> operation.</p>
|
|
185
|
-
* <p>During the connection process, KMS finds the CloudHSM cluster that is associated with the
|
|
186
|
-
* custom key store, creates the connection infrastructure, connects to the cluster, logs into
|
|
187
|
-
* the CloudHSM client as the <code>kmsuser</code> CU, and rotates its password.</p>
|
|
177
|
+
* <p>The connection process for a custom key store can take an extended amount of time to
|
|
178
|
+
* complete. This operation starts the connection process, but it does not wait for it to
|
|
179
|
+
* complete. When it succeeds, this operation quickly returns an HTTP 200 response and a JSON
|
|
180
|
+
* object with no properties. However, this response does not indicate that the custom key store
|
|
181
|
+
* is connected. To get the connection state of the custom key store, use the <a>DescribeCustomKeyStores</a> operation.</p>
|
|
182
|
+
* <p> This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key stores</a> feature in KMS, which
|
|
183
|
+
* combines the convenience and extensive integration of KMS with the isolation and control of a
|
|
184
|
+
* key store that you own and manage.</p>
|
|
188
185
|
* <p>The <code>ConnectCustomKeyStore</code> operation might fail for various reasons. To find
|
|
189
186
|
* the reason, use the <a>DescribeCustomKeyStores</a> operation and see the
|
|
190
187
|
* <code>ConnectionErrorCode</code> in the response. For help interpreting the
|
|
@@ -192,8 +189,37 @@ export declare class KMS extends KMSClient {
|
|
|
192
189
|
* <p>To fix the failure, use the <a>DisconnectCustomKeyStore</a> operation to
|
|
193
190
|
* disconnect the custom key store, correct the error, use the <a>UpdateCustomKeyStore</a> operation if necessary, and then use
|
|
194
191
|
* <code>ConnectCustomKeyStore</code> again.</p>
|
|
195
|
-
* <p>
|
|
196
|
-
*
|
|
192
|
+
* <p>
|
|
193
|
+
* <b>CloudHSM key store</b>
|
|
194
|
+
* </p>
|
|
195
|
+
* <p>During the connection process for an CloudHSM key store, KMS finds the CloudHSM cluster that
|
|
196
|
+
* is associated with the custom key store, creates the connection infrastructure, connects to
|
|
197
|
+
* the cluster, logs into the CloudHSM client as the <code>kmsuser</code> CU, and rotates its
|
|
198
|
+
* password.</p>
|
|
199
|
+
* <p>To connect an CloudHSM key store, its associated CloudHSM cluster must have at least one active
|
|
200
|
+
* HSM. To get the number of active HSMs in a cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation. To add HSMs
|
|
201
|
+
* to the cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html">CreateHsm</a> operation. Also, the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser">
|
|
202
|
+
* <code>kmsuser</code> crypto
|
|
203
|
+
* user</a> (CU) must not be logged into the cluster. This prevents KMS from using this
|
|
204
|
+
* account to log in.</p>
|
|
205
|
+
* <p>If you are having trouble connecting or disconnecting a CloudHSM key store, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html">Troubleshooting an CloudHSM key
|
|
206
|
+
* store</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
207
|
+
* <p>
|
|
208
|
+
* <b>External key store</b>
|
|
209
|
+
* </p>
|
|
210
|
+
* <p>When you connect an external key store that uses public endpoint connectivity, KMS tests
|
|
211
|
+
* its ability to communicate with your external key manager by sending a request via the
|
|
212
|
+
* external key store proxy.</p>
|
|
213
|
+
* <p>When you connect to an external key store that uses VPC endpoint service connectivity,
|
|
214
|
+
* KMS establishes the networking elements that it needs to communicate with your external key
|
|
215
|
+
* manager via the external key store proxy. This includes creating an interface endpoint to the
|
|
216
|
+
* VPC endpoint service and a private hosted zone for traffic between KMS and the VPC endpoint
|
|
217
|
+
* service.</p>
|
|
218
|
+
* <p>To connect an external key store, KMS must be able to connect to the external key store
|
|
219
|
+
* proxy, the external key store proxy must be able to communicate with your external key
|
|
220
|
+
* manager, and the external key manager must be available for cryptographic operations.</p>
|
|
221
|
+
* <p>If you are having trouble connecting or disconnecting an external key store, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html">Troubleshooting an external
|
|
222
|
+
* key store</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
197
223
|
* <p>
|
|
198
224
|
* <b>Cross-account use</b>: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
|
|
199
225
|
*
|
|
@@ -236,7 +262,7 @@ export declare class KMS extends KMSClient {
|
|
|
236
262
|
/**
|
|
237
263
|
* <p>Creates a friendly name for a KMS key. </p>
|
|
238
264
|
* <note>
|
|
239
|
-
* <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC
|
|
265
|
+
* <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
240
266
|
* </note>
|
|
241
267
|
* <p>You can use an alias to identify a KMS key in the KMS console, in the <a>DescribeKey</a> operation and in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a>, such as <a>Encrypt</a> and
|
|
242
268
|
* <a>GenerateDataKey</a>. You can also change the KMS key that's associated with
|
|
@@ -297,21 +323,59 @@ export declare class KMS extends KMSClient {
|
|
|
297
323
|
createAlias(args: CreateAliasCommandInput, cb: (err: any, data?: CreateAliasCommandOutput) => void): void;
|
|
298
324
|
createAlias(args: CreateAliasCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: CreateAliasCommandOutput) => void): void;
|
|
299
325
|
/**
|
|
300
|
-
* <p>Creates a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>
|
|
301
|
-
*
|
|
302
|
-
*
|
|
326
|
+
* <p>Creates a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a> backed by a key store that you own and manage. When you use a
|
|
327
|
+
* KMS key in a custom key store for a cryptographic operation, the cryptographic operation is
|
|
328
|
+
* actually performed in your key store using your keys. KMS supports <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html">CloudHSM key stores</a>
|
|
329
|
+
* backed by an <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/clusters.html">CloudHSM cluster</a>
|
|
330
|
+
* and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html">external key stores</a> backed by an external key store proxy and
|
|
331
|
+
* external key manager outside of Amazon Web Services.</p>
|
|
332
|
+
* <p> This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key stores</a> feature in KMS, which
|
|
303
333
|
* combines the convenience and extensive integration of KMS with the isolation and control of a
|
|
304
|
-
*
|
|
305
|
-
* <p>Before you create the custom key store,
|
|
306
|
-
*
|
|
307
|
-
* key store. For details about the required elements
|
|
308
|
-
*
|
|
334
|
+
* key store that you own and manage.</p>
|
|
335
|
+
* <p>Before you create the custom key store, the required elements must be in place and
|
|
336
|
+
* operational. We recommend that you use the test tools that KMS provides to verify the
|
|
337
|
+
* configuration your external key store proxy. For details about the required elements and
|
|
338
|
+
* verification tests, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore">Assemble the prerequisites (for
|
|
339
|
+
* CloudHSM key stores)</a> or <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keystore.html#xks-requirements">Assemble the prerequisites (for
|
|
340
|
+
* external key stores)</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
341
|
+
* <p>To create a custom key store, use the following parameters.</p>
|
|
342
|
+
* <ul>
|
|
343
|
+
* <li>
|
|
344
|
+
* <p>To create an CloudHSM key store, specify the <code>CustomKeyStoreName</code>,
|
|
345
|
+
* <code>CloudHsmClusterId</code>, <code>KeyStorePassword</code>, and
|
|
346
|
+
* <code>TrustAnchorCertificate</code>. The <code>CustomKeyStoreType</code> parameter is
|
|
347
|
+
* optional for CloudHSM key stores. If you include it, set it to the default value,
|
|
348
|
+
* <code>AWS_CLOUDHSM</code>. For help with failures, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html">Troubleshooting an CloudHSM key store</a> in the
|
|
349
|
+
* <i>Key Management Service Developer Guide</i>.</p>
|
|
350
|
+
* </li>
|
|
351
|
+
* <li>
|
|
352
|
+
* <p>To create an external key store, specify the <code>CustomKeyStoreName</code> and a
|
|
353
|
+
* <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>. Also, specify values
|
|
354
|
+
* for <code>XksProxyConnectivity</code>, <code>XksProxyAuthenticationCredential</code>,
|
|
355
|
+
* <code>XksProxyUriEndpoint</code>, and <code>XksProxyUriPath</code>. If your
|
|
356
|
+
* <code>XksProxyConnectivity</code> value is <code>VPC_ENDPOINT_SERVICE</code>, specify
|
|
357
|
+
* the <code>XksProxyVpcEndpointServiceName</code> parameter. For help with failures, see
|
|
358
|
+
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html">Troubleshooting
|
|
359
|
+
* an external key store</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
360
|
+
* </li>
|
|
361
|
+
* </ul>
|
|
362
|
+
* <note>
|
|
363
|
+
* <p>For external key stores:</p>
|
|
364
|
+
* <p>Some external key managers provide a simpler method for creating an external key store.
|
|
365
|
+
* For details, see your external key manager documentation.</p>
|
|
366
|
+
* <p>When creating an external key store in the KMS console, you can upload a JSON-based
|
|
367
|
+
* proxy configuration file with the desired values. You cannot use a proxy configuration
|
|
368
|
+
* with the <code>CreateCustomKeyStore</code> operation. However, you can use the values in
|
|
369
|
+
* the file to help you determine the correct values for the <code>CreateCustomKeyStore</code>
|
|
370
|
+
* parameters.</p>
|
|
371
|
+
* </note>
|
|
309
372
|
* <p>When the operation completes successfully, it returns the ID of the new custom key store.
|
|
310
|
-
* Before you can use your new custom key store, you need to use the <a>ConnectCustomKeyStore</a> operation to connect
|
|
311
|
-
* cluster
|
|
312
|
-
*
|
|
313
|
-
* to
|
|
314
|
-
*
|
|
373
|
+
* Before you can use your new custom key store, you need to use the <a>ConnectCustomKeyStore</a> operation to connect a new CloudHSM key store to its CloudHSM
|
|
374
|
+
* cluster, or to connect a new external key store to the external key store proxy for your
|
|
375
|
+
* external key manager. Even if you are not going to use your custom key store immediately, you
|
|
376
|
+
* might want to connect it to verify that all settings are correct and then disconnect it until
|
|
377
|
+
* you are ready to use it.</p>
|
|
378
|
+
* <p>For help with failures, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html">Troubleshooting a custom key store</a> in the
|
|
315
379
|
* <i>Key Management Service Developer Guide</i>.</p>
|
|
316
380
|
* <p>
|
|
317
381
|
* <b>Cross-account use</b>: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
|
|
@@ -385,8 +449,7 @@ export declare class KMS extends KMSClient {
|
|
|
385
449
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
386
450
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
387
451
|
* <p>
|
|
388
|
-
* <b>Cross-account use</b>: Yes.
|
|
389
|
-
* To perform this operation on a KMS key in a different Amazon Web Services account, specify the key
|
|
452
|
+
* <b>Cross-account use</b>: Yes. To perform this operation on a KMS key in a different Amazon Web Services account, specify the key
|
|
390
453
|
* ARN in the value of the <code>KeyId</code> parameter. </p>
|
|
391
454
|
* <p>
|
|
392
455
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:CreateGrant</a> (key policy)</p>
|
|
@@ -420,25 +483,41 @@ export declare class KMS extends KMSClient {
|
|
|
420
483
|
createGrant(args: CreateGrantCommandInput, cb: (err: any, data?: CreateGrantCommandOutput) => void): void;
|
|
421
484
|
createGrant(args: CreateGrantCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: CreateGrantCommandOutput) => void): void;
|
|
422
485
|
/**
|
|
423
|
-
* <p>Creates a unique customer managed <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys">KMS key</a> in your Amazon Web Services account and
|
|
424
|
-
*
|
|
425
|
-
*
|
|
486
|
+
* <p>Creates a unique customer managed <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys">KMS key</a> in your Amazon Web Services account and Region.
|
|
487
|
+
* You can use a KMS key in cryptographic operations, such as encryption and signing. Some Amazon Web Services
|
|
488
|
+
* services let you use KMS keys that you create and manage to protect your service
|
|
489
|
+
* resources.</p>
|
|
490
|
+
* <p>A KMS key is a logical representation of a cryptographic key. In addition to the key
|
|
491
|
+
* material used in cryptographic operations, a KMS key includes metadata, such as the key ID,
|
|
492
|
+
* key policy, creation date, description, and key state. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html">Managing keys</a> in the
|
|
493
|
+
* <i>Key Management Service Developer Guide</i>
|
|
494
|
+
* </p>
|
|
495
|
+
* <p>Use the parameters of <code>CreateKey</code> to specify the type of KMS key, the source of
|
|
496
|
+
* its key material, its key policy, description, tags, and other properties.</p>
|
|
426
497
|
* <note>
|
|
427
|
-
* <p>KMS
|
|
498
|
+
* <p>KMS has replaced the term <i>customer master key (CMK)</i> with <i>KMS key</i> and <i>KMS key</i>. The concept has not changed. To prevent breaking changes, KMS is keeping some variations of this term.</p>
|
|
428
499
|
* </note>
|
|
429
500
|
*
|
|
501
|
+
*
|
|
430
502
|
* <p>To create different types of KMS keys, use the following guidance:</p>
|
|
431
503
|
*
|
|
432
504
|
* <dl>
|
|
433
505
|
* <dt>Symmetric encryption KMS key</dt>
|
|
434
506
|
* <dd>
|
|
435
|
-
* <p>
|
|
436
|
-
*
|
|
437
|
-
*
|
|
438
|
-
*
|
|
439
|
-
*
|
|
440
|
-
*
|
|
441
|
-
*
|
|
507
|
+
* <p>By default, <code>CreateKey</code> creates a symmetric encryption KMS key with key
|
|
508
|
+
* material that KMS generates. This is the basic and most widely used type of KMS key, and
|
|
509
|
+
* provides the best performance.</p>
|
|
510
|
+
* <p>To create a symmetric encryption KMS key, you don't need to specify any parameters.
|
|
511
|
+
* The default value for <code>KeySpec</code>, <code>SYMMETRIC_DEFAULT</code>, the default
|
|
512
|
+
* value for <code>KeyUsage</code>, <code>ENCRYPT_DECRYPT</code>, and the default value for
|
|
513
|
+
* <code>Origin</code>, <code>AWS_KMS</code>, create a symmetric encryption KMS key with
|
|
514
|
+
* KMS key material.</p>
|
|
515
|
+
* <p>If you need a key for basic encryption and decryption or you are creating a KMS key
|
|
516
|
+
* to protect your resources in an Amazon Web Services service, create a symmetric encryption KMS key.
|
|
517
|
+
* The key material in a symmetric encryption key never leaves KMS unencrypted. You can
|
|
518
|
+
* use a symmetric encryption KMS key to encrypt and decrypt data up to 4,096 bytes, but
|
|
519
|
+
* they are typically used to generate data keys and data keys pairs. For details, see
|
|
520
|
+
* <a>GenerateDataKey</a> and <a>GenerateDataKeyPair</a>.</p>
|
|
442
521
|
* <p> </p>
|
|
443
522
|
* </dd>
|
|
444
523
|
* <dt>Asymmetric KMS keys</dt>
|
|
@@ -456,11 +535,11 @@ export declare class KMS extends KMSClient {
|
|
|
456
535
|
* </dd>
|
|
457
536
|
* <dt>HMAC KMS key</dt>
|
|
458
537
|
* <dd>
|
|
459
|
-
* <p>To create an HMAC KMS key, set the <code>KeySpec</code> parameter to a
|
|
460
|
-
*
|
|
461
|
-
*
|
|
462
|
-
*
|
|
463
|
-
*
|
|
538
|
+
* <p>To create an HMAC KMS key, set the <code>KeySpec</code> parameter to a key spec
|
|
539
|
+
* value for HMAC KMS keys. Then set the <code>KeyUsage</code> parameter to
|
|
540
|
+
* <code>GENERATE_VERIFY_MAC</code>. You must set the key usage even though
|
|
541
|
+
* <code>GENERATE_VERIFY_MAC</code> is the only valid key usage value for HMAC KMS keys.
|
|
542
|
+
* You can't change these properties after the KMS key is created.</p>
|
|
464
543
|
* <p>HMAC KMS keys are symmetric keys that never leave KMS unencrypted. You can use
|
|
465
544
|
* HMAC keys to generate (<a>GenerateMac</a>) and verify (<a>VerifyMac</a>) HMAC codes for messages up to 4096 bytes.</p>
|
|
466
545
|
* <p>HMAC KMS keys are not supported in all Amazon Web Services Regions. If you try to create an HMAC
|
|
@@ -491,34 +570,59 @@ export declare class KMS extends KMSClient {
|
|
|
491
570
|
* <p> </p>
|
|
492
571
|
* </dd>
|
|
493
572
|
* <dd>
|
|
494
|
-
* <p>To import your own key material, begin by creating a symmetric
|
|
495
|
-
* material. To do this, use the <code>Origin</code>
|
|
496
|
-
* with a value of <code>EXTERNAL</code>. Next, use
|
|
497
|
-
*
|
|
498
|
-
*
|
|
573
|
+
* <p>To import your own key material into a KMS key, begin by creating a symmetric
|
|
574
|
+
* encryption KMS key with no key material. To do this, use the <code>Origin</code>
|
|
575
|
+
* parameter of <code>CreateKey</code> with a value of <code>EXTERNAL</code>. Next, use
|
|
576
|
+
* <a>GetParametersForImport</a> operation to get a public key and import
|
|
577
|
+
* token, and use the public key to encrypt your key material. Then, use <a>ImportKeyMaterial</a> with your import token to import the key material. For
|
|
578
|
+
* step-by-step instructions, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the <i>
|
|
499
579
|
* <i>Key Management Service Developer Guide</i>
|
|
500
580
|
* </i>.</p>
|
|
501
|
-
* <p>This feature supports only symmetric encryption KMS keys, including multi-Region
|
|
502
|
-
* material into any other type of KMS
|
|
581
|
+
* <p>This feature supports only symmetric encryption KMS keys, including multi-Region
|
|
582
|
+
* symmetric encryption KMS keys. You cannot import key material into any other type of KMS
|
|
583
|
+
* key.</p>
|
|
503
584
|
* <p>To create a multi-Region primary key with imported key material, use the
|
|
504
585
|
* <code>Origin</code> parameter of <code>CreateKey</code> with a value of
|
|
505
586
|
* <code>EXTERNAL</code> and the <code>MultiRegion</code> parameter with a value of
|
|
506
|
-
* <code>True</code>. To create replicas of the multi-Region primary key, use the <a>ReplicateKey</a> operation. For
|
|
587
|
+
* <code>True</code>. To create replicas of the multi-Region primary key, use the <a>ReplicateKey</a> operation. For instructions, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html ">Importing key material into
|
|
588
|
+
* multi-Region keys</a>. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
507
589
|
* <p> </p>
|
|
508
590
|
* </dd>
|
|
509
591
|
* <dt>Custom key store</dt>
|
|
510
592
|
* <dd>
|
|
511
|
-
* <p>
|
|
512
|
-
*
|
|
513
|
-
*
|
|
514
|
-
*
|
|
515
|
-
*
|
|
516
|
-
*
|
|
517
|
-
*
|
|
518
|
-
*
|
|
519
|
-
* the
|
|
520
|
-
*
|
|
521
|
-
*
|
|
593
|
+
* <p>A <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a> lets you protect your Amazon Web Services resources using keys in a backing key
|
|
594
|
+
* store that you own and manage. When you request a cryptographic operation with a KMS key
|
|
595
|
+
* in a custom key store, the operation is performed in the backing key store using its
|
|
596
|
+
* cryptographic keys.</p>
|
|
597
|
+
* <p>KMS supports <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html">CloudHSM key stores</a> backed by an CloudHSM cluster and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html">external key stores</a> backed by an
|
|
598
|
+
* external key manager outside of Amazon Web Services. When you create a KMS key in an CloudHSM key store,
|
|
599
|
+
* KMS generates an encryption key in the CloudHSM cluster and associates it with the KMS
|
|
600
|
+
* key. When you create a KMS key in an external key store, you specify an existing
|
|
601
|
+
* encryption key in the external key manager.</p>
|
|
602
|
+
* <note>
|
|
603
|
+
* <p>Some external key managers provide a simpler method for creating a KMS key in an
|
|
604
|
+
* external key store. For details, see your external key manager documentation.</p>
|
|
605
|
+
* </note>
|
|
606
|
+
* <p>Before you create a KMS key in a custom key store, the <code>ConnectionState</code>
|
|
607
|
+
* of the key store must be <code>CONNECTED</code>. To connect the custom key store, use
|
|
608
|
+
* the <a>ConnectCustomKeyStore</a> operation. To find the
|
|
609
|
+
* <code>ConnectionState</code>, use the <a>DescribeCustomKeyStores</a>
|
|
610
|
+
* operation.</p>
|
|
611
|
+
* <p>To create a KMS key in a custom key store, use the <code>CustomKeyStoreId</code>.
|
|
612
|
+
* Use the default <code>KeySpec</code> value, <code>SYMMETRIC_DEFAULT</code>, and the
|
|
613
|
+
* default <code>KeyUsage</code> value, <code>ENCRYPT_DECRYPT</code> to create a symmetric
|
|
614
|
+
* encryption key. No other key type is supported in a custom key store.</p>
|
|
615
|
+
* <p>To create a KMS key in an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html">CloudHSM key store</a>, use the
|
|
616
|
+
* <code>Origin</code> parameter with a value of <code>AWS_CLOUDHSM</code>. The CloudHSM
|
|
617
|
+
* cluster that is associated with the custom key store must have at least two active HSMs
|
|
618
|
+
* in different Availability Zones in the Amazon Web Services Region.</p>
|
|
619
|
+
* <p>To create a KMS key in an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html">external key store</a>, use the <code>Origin</code> parameter
|
|
620
|
+
* with a value of <code>EXTERNAL_KEY_STORE</code> and an <code>XksKeyId</code> parameter
|
|
621
|
+
* that identifies an existing external key.</p>
|
|
622
|
+
* <note>
|
|
623
|
+
* <p>Some external key managers provide a simpler method for creating a KMS key in an
|
|
624
|
+
* external key store. For details, see your external key manager documentation.</p>
|
|
625
|
+
* </note>
|
|
522
626
|
* </dd>
|
|
523
627
|
* </dl>
|
|
524
628
|
* <p>
|
|
@@ -584,22 +688,22 @@ export declare class KMS extends KMSClient {
|
|
|
584
688
|
* </p>
|
|
585
689
|
* </li>
|
|
586
690
|
* </ul>
|
|
587
|
-
* <p>You can use this operation to decrypt ciphertext that was encrypted under a symmetric
|
|
588
|
-
* asymmetric encryption KMS key. When the KMS key is asymmetric, you
|
|
589
|
-
* encryption algorithm that was used to encrypt the ciphertext.
|
|
590
|
-
*
|
|
591
|
-
*
|
|
592
|
-
*
|
|
593
|
-
*
|
|
691
|
+
* <p>You can use this operation to decrypt ciphertext that was encrypted under a symmetric
|
|
692
|
+
* encryption KMS key or an asymmetric encryption KMS key. When the KMS key is asymmetric, you
|
|
693
|
+
* must specify the KMS key and the encryption algorithm that was used to encrypt the ciphertext.
|
|
694
|
+
* For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
695
|
+
* <p>The <code>Decrypt</code> operation also decrypts ciphertext that was encrypted outside of
|
|
696
|
+
* KMS by the public key in an KMS asymmetric KMS key. However, it cannot decrypt symmetric
|
|
697
|
+
* ciphertext produced by other libraries, such as the <a href="https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/">Amazon Web Services Encryption SDK</a> or <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html">Amazon S3 client-side encryption</a>.
|
|
594
698
|
* These libraries return a ciphertext format that is incompatible with KMS.</p>
|
|
595
|
-
* <p>If the ciphertext was encrypted under a symmetric encryption KMS key, the
|
|
596
|
-
*
|
|
597
|
-
* symmetric ciphertext blob. This feature adds durability to your implementation
|
|
598
|
-
* that authorized users can decrypt ciphertext decades after it was encrypted, even
|
|
599
|
-
* lost track of the key ID. However, specifying the KMS key is always recommended as
|
|
600
|
-
* practice. When you use the <code>KeyId</code> parameter to specify a KMS key, KMS
|
|
601
|
-
* the KMS key you specify. If the ciphertext was encrypted under a different KMS key,
|
|
602
|
-
*
|
|
699
|
+
* <p>If the ciphertext was encrypted under a symmetric encryption KMS key, the
|
|
700
|
+
* <code>KeyId</code> parameter is optional. KMS can get this information from metadata that
|
|
701
|
+
* it adds to the symmetric ciphertext blob. This feature adds durability to your implementation
|
|
702
|
+
* by ensuring that authorized users can decrypt ciphertext decades after it was encrypted, even
|
|
703
|
+
* if they've lost track of the key ID. However, specifying the KMS key is always recommended as
|
|
704
|
+
* a best practice. When you use the <code>KeyId</code> parameter to specify a KMS key, KMS
|
|
705
|
+
* only uses the KMS key you specify. If the ciphertext was encrypted under a different KMS key,
|
|
706
|
+
* the <code>Decrypt</code> operation fails. This practice ensures that you use the KMS key that
|
|
603
707
|
* you intend.</p>
|
|
604
708
|
* <p>Whenever possible, use key policies to give users permission to call the
|
|
605
709
|
* <code>Decrypt</code> operation on a particular KMS key, instead of using IAM policies.
|
|
@@ -613,8 +717,7 @@ export declare class KMS extends KMSClient {
|
|
|
613
717
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
614
718
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
615
719
|
* <p>
|
|
616
|
-
* <b>Cross-account
|
|
617
|
-
* use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
720
|
+
* <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
618
721
|
* the key ARN or alias ARN in the value of the <code>KeyId</code> parameter. </p>
|
|
619
722
|
*
|
|
620
723
|
* <p>
|
|
@@ -651,7 +754,7 @@ export declare class KMS extends KMSClient {
|
|
|
651
754
|
/**
|
|
652
755
|
* <p>Deletes the specified alias. </p>
|
|
653
756
|
* <note>
|
|
654
|
-
* <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC
|
|
757
|
+
* <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
655
758
|
* </note>
|
|
656
759
|
* <p>Because an alias is not a property of a KMS key, you can delete and change the aliases of
|
|
657
760
|
* a KMS key without affecting the KMS key. Also, aliases do not appear in the response from the
|
|
@@ -702,28 +805,33 @@ export declare class KMS extends KMSClient {
|
|
|
702
805
|
deleteAlias(args: DeleteAliasCommandInput, cb: (err: any, data?: DeleteAliasCommandOutput) => void): void;
|
|
703
806
|
deleteAlias(args: DeleteAliasCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DeleteAliasCommandOutput) => void): void;
|
|
704
807
|
/**
|
|
705
|
-
* <p>Deletes a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. This operation does not
|
|
706
|
-
*
|
|
808
|
+
* <p>Deletes a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. This operation does not affect any backing elements of the
|
|
809
|
+
* custom key store. It does not delete the CloudHSM cluster that is associated with an CloudHSM key
|
|
810
|
+
* store, or affect any users or keys in the cluster. For an external key store, it does not
|
|
811
|
+
* affect the external key store proxy, external key manager, or any external keys.</p>
|
|
812
|
+
* <p> This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key stores</a> feature in KMS, which
|
|
813
|
+
* combines the convenience and extensive integration of KMS with the isolation and control of a
|
|
814
|
+
* key store that you own and manage.</p>
|
|
707
815
|
* <p>The custom key store that you delete cannot contain any <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys">KMS keys</a>. Before deleting the key store,
|
|
708
816
|
* verify that you will never need to use any of the KMS keys in the key store for any
|
|
709
817
|
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a>. Then, use <a>ScheduleKeyDeletion</a> to delete the KMS keys from the
|
|
710
|
-
* key store.
|
|
711
|
-
*
|
|
712
|
-
*
|
|
713
|
-
*
|
|
714
|
-
*
|
|
715
|
-
*
|
|
716
|
-
*
|
|
717
|
-
*
|
|
718
|
-
*
|
|
818
|
+
* key store. After the required waiting period expires and all KMS keys are deleted from the
|
|
819
|
+
* custom key store, use <a>DisconnectCustomKeyStore</a> to disconnect the key store
|
|
820
|
+
* from KMS. Then, you can delete the custom key store.</p>
|
|
821
|
+
* <p>For keys in an CloudHSM key store, the <code>ScheduleKeyDeletion</code> operation makes a
|
|
822
|
+
* best effort to delete the key material from the associated cluster. However, you might need to
|
|
823
|
+
* manually <a href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key">delete the orphaned key
|
|
824
|
+
* material</a> from the cluster and its backups. KMS never creates, manages, or deletes
|
|
825
|
+
* cryptographic keys in the external key manager associated with an external key store. You must
|
|
826
|
+
* manage them using your external key manager tools.</p>
|
|
827
|
+
* <p>Instead of deleting the custom key store, consider using the <a>DisconnectCustomKeyStore</a> operation to disconnect the custom key store from its
|
|
828
|
+
* backing key store. While the key store is disconnected, you cannot create or use the KMS keys
|
|
829
|
+
* in the key store. But, you do not need to delete KMS keys and you can reconnect a disconnected
|
|
830
|
+
* custom key store at any time.</p>
|
|
719
831
|
* <p>If the operation succeeds, it returns a JSON object with no
|
|
720
832
|
* properties.</p>
|
|
721
|
-
* <p>This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store feature</a> feature in KMS, which
|
|
722
|
-
* combines the convenience and extensive integration of KMS with the isolation and control of a
|
|
723
|
-
* single-tenant key store.</p>
|
|
724
833
|
* <p>
|
|
725
|
-
* <b>Cross-account use</b>: No.
|
|
726
|
-
* You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
|
|
834
|
+
* <b>Cross-account use</b>: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
|
|
727
835
|
*
|
|
728
836
|
* <p>
|
|
729
837
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:DeleteCustomKeyStore</a> (IAM policy)</p>
|
|
@@ -798,25 +906,30 @@ export declare class KMS extends KMSClient {
|
|
|
798
906
|
deleteImportedKeyMaterial(args: DeleteImportedKeyMaterialCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DeleteImportedKeyMaterialCommandOutput) => void): void;
|
|
799
907
|
/**
|
|
800
908
|
* <p>Gets information about <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key stores</a> in the account and Region.</p>
|
|
801
|
-
* <p>This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key
|
|
909
|
+
* <p> This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key stores</a> feature in KMS, which
|
|
802
910
|
* combines the convenience and extensive integration of KMS with the isolation and control of a
|
|
803
|
-
*
|
|
804
|
-
* <p>By default, this operation returns information about all custom key
|
|
805
|
-
*
|
|
806
|
-
*
|
|
807
|
-
*
|
|
808
|
-
* <p>To determine whether the custom key store is connected to its CloudHSM cluster
|
|
809
|
-
*
|
|
810
|
-
* key store failed, the <code>ConnectionState</code> value is
|
|
811
|
-
* <code>ConnectionErrorCode</code> element in the response
|
|
812
|
-
* For help interpreting the
|
|
911
|
+
* key store that you own and manage.</p>
|
|
912
|
+
* <p>By default, this operation returns information about all custom key stores in the account
|
|
913
|
+
* and Region. To get only information about a particular custom key store, use either the
|
|
914
|
+
* <code>CustomKeyStoreName</code> or <code>CustomKeyStoreId</code> parameter (but not
|
|
915
|
+
* both).</p>
|
|
916
|
+
* <p>To determine whether the custom key store is connected to its CloudHSM cluster or external
|
|
917
|
+
* key store proxy, use the <code>ConnectionState</code> element in the response. If an attempt
|
|
918
|
+
* to connect the custom key store failed, the <code>ConnectionState</code> value is
|
|
919
|
+
* <code>FAILED</code> and the <code>ConnectionErrorCode</code> element in the response
|
|
920
|
+
* indicates the cause of the failure. For help interpreting the
|
|
921
|
+
* <code>ConnectionErrorCode</code>, see <a>CustomKeyStoresListEntry</a>.</p>
|
|
813
922
|
* <p>Custom key stores have a <code>DISCONNECTED</code> connection state if the key store has
|
|
814
|
-
* never been connected or you
|
|
815
|
-
* disconnect it.
|
|
816
|
-
*
|
|
817
|
-
*
|
|
818
|
-
*
|
|
819
|
-
*
|
|
923
|
+
* never been connected or you used the <a>DisconnectCustomKeyStore</a> operation to
|
|
924
|
+
* disconnect it. Otherwise, the connection state is CONNECTED. If your custom key store
|
|
925
|
+
* connection state is <code>CONNECTED</code> but you are having trouble using it, verify that
|
|
926
|
+
* the backing store is active and available. For an CloudHSM key store, verify that the associated
|
|
927
|
+
* CloudHSM cluster is active and contains the minimum number of HSMs required for the operation, if
|
|
928
|
+
* any. For an external key store, verify that the external key store proxy and its associated
|
|
929
|
+
* external key manager are reachable and enabled.</p>
|
|
930
|
+
* <p> For help repairing your CloudHSM key store, see the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html">Troubleshooting CloudHSM key stores</a>. For help
|
|
931
|
+
* repairing your external key store, see the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/xks-troubleshooting.html">Troubleshooting external key stores</a>. Both
|
|
932
|
+
* topics are in the <i>Key Management Service Developer Guide</i>.</p>
|
|
820
933
|
* <p>
|
|
821
934
|
* <b>Cross-account use</b>: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
|
|
822
935
|
* <p>
|
|
@@ -861,9 +974,13 @@ export declare class KMS extends KMSClient {
|
|
|
861
974
|
* key</a> or an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a>.</p>
|
|
862
975
|
* <p>This detailed information includes the key ARN, creation date (and deletion date, if
|
|
863
976
|
* applicable), the key state, and the origin and expiration date (if any) of the key material.
|
|
864
|
-
* It includes fields, like <code>KeySpec</code>, that help you distinguish different types of
|
|
865
|
-
*
|
|
866
|
-
*
|
|
977
|
+
* It includes fields, like <code>KeySpec</code>, that help you distinguish different types of
|
|
978
|
+
* KMS keys. It also displays the key usage (encryption, signing, or generating and verifying
|
|
979
|
+
* MACs) and the algorithms that the KMS key supports. For <a href="kms/latest/developerguide/multi-region-keys-overview.html">multi-Region keys</a>, it displays
|
|
980
|
+
* the primary key and all related replica keys. For KMS keys in <a href="kms/latest/developerguide/keystore-cloudhsm.html">CloudHSM key stores</a>, it includes information
|
|
981
|
+
* about the custom key store, such as the key store ID and the CloudHSM cluster ID. For KMS key in
|
|
982
|
+
* <a href="kms/latest/developerguide/keystore-external.html">external key stores</a>, it includes
|
|
983
|
+
* the custom key store ID and the ID and status of the associated external key.</p>
|
|
867
984
|
* <p>
|
|
868
985
|
* <code>DescribeKey</code> does not return the following information:</p>
|
|
869
986
|
* <ul>
|
|
@@ -941,12 +1058,13 @@ export declare class KMS extends KMSClient {
|
|
|
941
1058
|
/**
|
|
942
1059
|
* <p>Sets the state of a KMS key to disabled. This change temporarily prevents use of the KMS
|
|
943
1060
|
* key for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a>. </p>
|
|
944
|
-
* <p>For more information about how key state affects the use of a KMS key, see
|
|
1061
|
+
* <p>For more information about how key state affects the use of a KMS key, see
|
|
1062
|
+
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>
|
|
945
1063
|
* <i>Key Management Service Developer Guide</i>
|
|
946
1064
|
* </i>.</p>
|
|
947
1065
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
948
1066
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
949
|
-
*
|
|
1067
|
+
* <p>
|
|
950
1068
|
* <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
951
1069
|
*
|
|
952
1070
|
* <p>
|
|
@@ -962,21 +1080,19 @@ export declare class KMS extends KMSClient {
|
|
|
962
1080
|
* <p>Disables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic
|
|
963
1081
|
* rotation of the key material</a> of the specified symmetric encryption KMS key.</p>
|
|
964
1082
|
* <p>Automatic key rotation is supported only on symmetric encryption KMS keys.
|
|
965
|
-
* You cannot enable
|
|
966
|
-
* To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
|
|
1083
|
+
* You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
|
|
967
1084
|
* <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation of the
|
|
968
1085
|
* key material in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>. Key material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
|
|
969
1086
|
* configurable. KMS always rotates the key material for every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
|
|
970
1087
|
* keys</a> varies.</p>
|
|
971
1088
|
* <note>
|
|
972
|
-
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every
|
|
973
|
-
*
|
|
1089
|
+
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
|
|
1090
|
+
* years to every year. For details, see <a>EnableKeyRotation</a>.</p>
|
|
974
1091
|
* </note>
|
|
975
1092
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
976
1093
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
977
1094
|
* <p>
|
|
978
|
-
* <b>Cross-account
|
|
979
|
-
* use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
1095
|
+
* <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
980
1096
|
*
|
|
981
1097
|
* <p>
|
|
982
1098
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:DisableKeyRotation</a> (key policy)</p>
|
|
@@ -1000,26 +1116,26 @@ export declare class KMS extends KMSClient {
|
|
|
1000
1116
|
disableKeyRotation(args: DisableKeyRotationCommandInput, cb: (err: any, data?: DisableKeyRotationCommandOutput) => void): void;
|
|
1001
1117
|
disableKeyRotation(args: DisableKeyRotationCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DisableKeyRotationCommandOutput) => void): void;
|
|
1002
1118
|
/**
|
|
1003
|
-
* <p>Disconnects the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a> from its
|
|
1004
|
-
*
|
|
1005
|
-
*
|
|
1119
|
+
* <p>Disconnects the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a> from its backing key store. This operation disconnects an
|
|
1120
|
+
* CloudHSM key store from its associated CloudHSM cluster or disconnects an external key store from
|
|
1121
|
+
* the external key store proxy that communicates with your external key manager.</p>
|
|
1122
|
+
* <p> This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key stores</a> feature in KMS, which
|
|
1123
|
+
* combines the convenience and extensive integration of KMS with the isolation and control of a
|
|
1124
|
+
* key store that you own and manage.</p>
|
|
1125
|
+
* <p>While a custom key store is disconnected, you can manage the custom key store and its KMS
|
|
1126
|
+
* keys, but you cannot create or use its KMS keys. You can reconnect the custom key store at any
|
|
1006
1127
|
* time.</p>
|
|
1007
1128
|
* <note>
|
|
1008
1129
|
* <p>While a custom key store is disconnected, all attempts to create KMS keys in the custom key store or to use existing KMS keys in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> will
|
|
1009
1130
|
* fail. This action can prevent users from storing and accessing sensitive data.</p>
|
|
1010
1131
|
* </note>
|
|
1011
|
-
* <p
|
|
1012
|
-
*
|
|
1132
|
+
* <p>When you disconnect a custom key store, its <code>ConnectionState</code> changes to
|
|
1133
|
+
* <code>Disconnected</code>. To find the connection state of a custom key store, use the <a>DescribeCustomKeyStores</a> operation. To reconnect a custom key store, use the
|
|
1013
1134
|
* <a>ConnectCustomKeyStore</a> operation.</p>
|
|
1014
1135
|
* <p>If the operation succeeds, it returns a JSON object with no
|
|
1015
1136
|
* properties.</p>
|
|
1016
|
-
* <p>
|
|
1017
|
-
*
|
|
1018
|
-
* single-tenant key store.</p>
|
|
1019
|
-
*
|
|
1020
|
-
* <p>
|
|
1021
|
-
* <b>Cross-account use</b>: No.
|
|
1022
|
-
* You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
|
|
1137
|
+
* <p>
|
|
1138
|
+
* <b>Cross-account use</b>: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
|
|
1023
1139
|
*
|
|
1024
1140
|
* <p>
|
|
1025
1141
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:DisconnectCustomKeyStore</a> (IAM policy)</p>
|
|
@@ -1063,8 +1179,7 @@ export declare class KMS extends KMSClient {
|
|
|
1063
1179
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1064
1180
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1065
1181
|
* <p>
|
|
1066
|
-
* <b>Cross-account
|
|
1067
|
-
* use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
1182
|
+
* <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
1068
1183
|
*
|
|
1069
1184
|
* <p>
|
|
1070
1185
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:EnableKey</a> (key policy)</p>
|
|
@@ -1084,24 +1199,22 @@ export declare class KMS extends KMSClient {
|
|
|
1084
1199
|
* CloudTrail and Amazon CloudWatch. To disable rotation of the key material in a customer
|
|
1085
1200
|
* managed KMS key, use the <a>DisableKeyRotation</a> operation.</p>
|
|
1086
1201
|
* <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
|
|
1087
|
-
* You cannot enable
|
|
1088
|
-
* To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
|
|
1202
|
+
* You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
|
|
1089
1203
|
* <p>You cannot enable or disable automatic rotation <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a>. KMS
|
|
1090
1204
|
* always rotates the key material of Amazon Web Services managed keys every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
|
|
1091
1205
|
* keys</a> varies.</p>
|
|
1092
1206
|
* <note>
|
|
1093
1207
|
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
|
|
1094
1208
|
* years (approximately 1,095 days) to every year (approximately 365 days).</p>
|
|
1095
|
-
* <p>New Amazon Web Services managed keys are automatically rotated one year after they
|
|
1096
|
-
*
|
|
1097
|
-
* <p>Existing Amazon Web Services managed keys are automatically rotated one year after
|
|
1098
|
-
*
|
|
1209
|
+
* <p>New Amazon Web Services managed keys are automatically rotated one year after they are created, and
|
|
1210
|
+
* approximately every year thereafter. </p>
|
|
1211
|
+
* <p>Existing Amazon Web Services managed keys are automatically rotated one year after their most recent
|
|
1212
|
+
* rotation, and every year thereafter.</p>
|
|
1099
1213
|
* </note>
|
|
1100
1214
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1101
1215
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1102
1216
|
* <p>
|
|
1103
|
-
* <b>Cross-account
|
|
1104
|
-
* use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
1217
|
+
* <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
1105
1218
|
*
|
|
1106
1219
|
* <p>
|
|
1107
1220
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:EnableKeyRotation</a> (key policy)</p>
|
|
@@ -1127,15 +1240,17 @@ export declare class KMS extends KMSClient {
|
|
|
1127
1240
|
/**
|
|
1128
1241
|
* <p>Encrypts plaintext of up to 4,096 bytes using a KMS key. You can use a symmetric or
|
|
1129
1242
|
* asymmetric KMS key with a <code>KeyUsage</code> of <code>ENCRYPT_DECRYPT</code>.</p>
|
|
1130
|
-
* <p>You can use this operation to encrypt small amounts of arbitrary data, such as a personal
|
|
1131
|
-
*
|
|
1132
|
-
*
|
|
1133
|
-
*
|
|
1134
|
-
*
|
|
1135
|
-
*
|
|
1136
|
-
*
|
|
1137
|
-
*
|
|
1138
|
-
*
|
|
1243
|
+
* <p>You can use this operation to encrypt small amounts of arbitrary data, such as a personal
|
|
1244
|
+
* identifier or database password, or other sensitive information. You don't need to use the
|
|
1245
|
+
* <code>Encrypt</code> operation to encrypt a data key. The <a>GenerateDataKey</a>
|
|
1246
|
+
* and <a>GenerateDataKeyPair</a> operations return a plaintext data key and an
|
|
1247
|
+
* encrypted copy of that data key.</p>
|
|
1248
|
+
* <p>If you use a symmetric encryption KMS key, you can use an encryption context to add
|
|
1249
|
+
* additional security to your encryption operation. If you specify an
|
|
1250
|
+
* <code>EncryptionContext</code> when encrypting data, you must specify the same encryption
|
|
1251
|
+
* context (a case-sensitive exact match) when decrypting the data. Otherwise, the request to
|
|
1252
|
+
* decrypt fails with an <code>InvalidCiphertextException</code>. For more information, see
|
|
1253
|
+
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption
|
|
1139
1254
|
* Context</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1140
1255
|
* <p>If you specify an asymmetric KMS key, you must also specify the encryption algorithm. The
|
|
1141
1256
|
* algorithm must be compatible with the KMS key spec.</p>
|
|
@@ -1272,8 +1387,7 @@ export declare class KMS extends KMSClient {
|
|
|
1272
1387
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1273
1388
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1274
1389
|
* <p>
|
|
1275
|
-
* <b>How to use your data
|
|
1276
|
-
* key</b>
|
|
1390
|
+
* <b>How to use your data key</b>
|
|
1277
1391
|
* </p>
|
|
1278
1392
|
* <p>We recommend that you use the following pattern to encrypt data locally in your
|
|
1279
1393
|
* application. You can write your own code or use a client-side encryption library, such as the
|
|
@@ -1351,8 +1465,8 @@ export declare class KMS extends KMSClient {
|
|
|
1351
1465
|
* a plaintext public key, a plaintext private key, and a copy of the private key that is
|
|
1352
1466
|
* encrypted under the symmetric encryption KMS key you specify. You can use the data key pair to
|
|
1353
1467
|
* perform asymmetric cryptography and implement digital signatures outside of KMS. The bytes
|
|
1354
|
-
* in the keys are random; they not related to the caller or to the KMS key that is used to
|
|
1355
|
-
* private key. </p>
|
|
1468
|
+
* in the keys are random; they not related to the caller or to the KMS key that is used to
|
|
1469
|
+
* encrypt the private key. </p>
|
|
1356
1470
|
*
|
|
1357
1471
|
* <p>You can use the public key that <code>GenerateDataKeyPair</code> returns to encrypt data
|
|
1358
1472
|
* or verify a signature outside of KMS. Then, store the encrypted private key with the data.
|
|
@@ -1360,8 +1474,7 @@ export declare class KMS extends KMSClient {
|
|
|
1360
1474
|
*
|
|
1361
1475
|
* <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
|
|
1362
1476
|
* the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
|
|
1363
|
-
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
|
|
1364
|
-
* operation. </p>
|
|
1477
|
+
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
|
|
1365
1478
|
* <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
|
|
1366
1479
|
* key pair. In China Regions, you can also choose an SM2 data key pair. KMS recommends that you use
|
|
1367
1480
|
* ECC key pairs for signing, and use RSA and SM2 key pairs for either encryption or signing, but not both.
|
|
@@ -1377,10 +1490,10 @@ export declare class KMS extends KMSClient {
|
|
|
1377
1490
|
*
|
|
1378
1491
|
* <p>
|
|
1379
1492
|
* <code>GenerateDataKeyPair</code> returns a unique data key pair for each request. The
|
|
1380
|
-
* bytes in the keys are random; they are not related to the caller or the KMS key that is used
|
|
1381
|
-
* private key. The public key is a DER-encoded X.509 SubjectPublicKeyInfo, as
|
|
1382
|
-
*
|
|
1383
|
-
* DER-encoded PKCS8 PrivateKeyInfo, as specified in <a href="https://tools.ietf.org/html/rfc5958">RFC 5958</a>.</p>
|
|
1493
|
+
* bytes in the keys are random; they are not related to the caller or the KMS key that is used
|
|
1494
|
+
* to encrypt the private key. The public key is a DER-encoded X.509 SubjectPublicKeyInfo, as
|
|
1495
|
+
* specified in <a href="https://tools.ietf.org/html/rfc5280">RFC 5280</a>. The private
|
|
1496
|
+
* key is a DER-encoded PKCS8 PrivateKeyInfo, as specified in <a href="https://tools.ietf.org/html/rfc5958">RFC 5958</a>.</p>
|
|
1384
1497
|
*
|
|
1385
1498
|
* <p>You can use an optional encryption context to add additional security to the encryption
|
|
1386
1499
|
* operation. If you specify an <code>EncryptionContext</code>, you must specify the same
|
|
@@ -1390,8 +1503,7 @@ export declare class KMS extends KMSClient {
|
|
|
1390
1503
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1391
1504
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1392
1505
|
* <p>
|
|
1393
|
-
* <b>Cross-account
|
|
1394
|
-
* use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
1506
|
+
* <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
1395
1507
|
* the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
|
|
1396
1508
|
*
|
|
1397
1509
|
* <p>
|
|
@@ -1434,15 +1546,14 @@ export declare class KMS extends KMSClient {
|
|
|
1434
1546
|
* <p>Returns a unique asymmetric data key pair for use outside of KMS. This operation returns
|
|
1435
1547
|
* a plaintext public key and a copy of the private key that is encrypted under the symmetric
|
|
1436
1548
|
* encryption KMS key you specify. Unlike <a>GenerateDataKeyPair</a>, this operation
|
|
1437
|
-
* does not return a plaintext private key. The bytes in the keys are random; they are not
|
|
1438
|
-
* or to the KMS key that is used to encrypt the private key. </p>
|
|
1549
|
+
* does not return a plaintext private key. The bytes in the keys are random; they are not
|
|
1550
|
+
* related to the caller or to the KMS key that is used to encrypt the private key. </p>
|
|
1439
1551
|
* <p>You can use the public key that <code>GenerateDataKeyPairWithoutPlaintext</code> returns
|
|
1440
1552
|
* to encrypt data or verify a signature outside of KMS. Then, store the encrypted private key
|
|
1441
1553
|
* with the data. When you are ready to decrypt data or sign a message, you can use the <a>Decrypt</a> operation to decrypt the encrypted private key.</p>
|
|
1442
1554
|
* <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
|
|
1443
1555
|
* the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
|
|
1444
|
-
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
|
|
1445
|
-
* operation. </p>
|
|
1556
|
+
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
|
|
1446
1557
|
* <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
|
|
1447
1558
|
* key pair. In China Regions, you can also choose an SM2 data key pair. KMS recommends that you
|
|
1448
1559
|
* use ECC key pairs for signing, and use RSA and SM2 key pairs for either encryption or signing, but not
|
|
@@ -1461,8 +1572,7 @@ export declare class KMS extends KMSClient {
|
|
|
1461
1572
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1462
1573
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1463
1574
|
* <p>
|
|
1464
|
-
* <b>Cross-account
|
|
1465
|
-
* use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
1575
|
+
* <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
1466
1576
|
* the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
|
|
1467
1577
|
*
|
|
1468
1578
|
* <p>
|
|
@@ -1526,6 +1636,14 @@ export declare class KMS extends KMSClient {
|
|
|
1526
1636
|
* encrypt the data key. You cannot use an asymmetric KMS key or a key in a custom key store to generate a data key. To get the
|
|
1527
1637
|
* type of your KMS key, use the <a>DescribeKey</a> operation.</p>
|
|
1528
1638
|
*
|
|
1639
|
+
* <p>You must also specify the length of the data key. Use either the <code>KeySpec</code> or
|
|
1640
|
+
* <code>NumberOfBytes</code> parameters (but not both). For 128-bit and 256-bit data keys, use
|
|
1641
|
+
* the <code>KeySpec</code> parameter.</p>
|
|
1642
|
+
*
|
|
1643
|
+
* <p>To generate an SM4 data key (China Regions only), specify a <code>KeySpec</code> value of
|
|
1644
|
+
* <code>AES_128</code> or <code>NumberOfBytes</code> value of <code>128</code>. The symmetric
|
|
1645
|
+
* encryption key used in China Regions to encrypt your data key is an SM4 encryption key.</p>
|
|
1646
|
+
*
|
|
1529
1647
|
* <p>If the operation succeeds, you will find the encrypted copy of the data key in the
|
|
1530
1648
|
* <code>CiphertextBlob</code> field.</p>
|
|
1531
1649
|
*
|
|
@@ -1537,8 +1655,7 @@ export declare class KMS extends KMSClient {
|
|
|
1537
1655
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1538
1656
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1539
1657
|
* <p>
|
|
1540
|
-
* <b>Cross-account
|
|
1541
|
-
* use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
1658
|
+
* <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
1542
1659
|
* the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
|
|
1543
1660
|
*
|
|
1544
1661
|
* <p>
|
|
@@ -1579,28 +1696,28 @@ export declare class KMS extends KMSClient {
|
|
|
1579
1696
|
generateDataKeyWithoutPlaintext(args: GenerateDataKeyWithoutPlaintextCommandInput, cb: (err: any, data?: GenerateDataKeyWithoutPlaintextCommandOutput) => void): void;
|
|
1580
1697
|
generateDataKeyWithoutPlaintext(args: GenerateDataKeyWithoutPlaintextCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GenerateDataKeyWithoutPlaintextCommandOutput) => void): void;
|
|
1581
1698
|
/**
|
|
1582
|
-
* <p>Generates a hash-based message authentication code (HMAC) for a message using an HMAC KMS
|
|
1583
|
-
*
|
|
1584
|
-
*
|
|
1585
|
-
*
|
|
1586
|
-
*
|
|
1587
|
-
*
|
|
1588
|
-
*
|
|
1589
|
-
*
|
|
1699
|
+
* <p>Generates a hash-based message authentication code (HMAC) for a message using an HMAC KMS key and a MAC algorithm that the key supports.
|
|
1700
|
+
* HMAC KMS keys and the HMAC algorithms that KMS uses conform to industry standards defined in <a href="https://datatracker.ietf.org/doc/html/rfc2104">RFC 2104</a>.</p>
|
|
1701
|
+
* <p>You can use value that GenerateMac returns in the <a>VerifyMac</a> operation to
|
|
1702
|
+
* demonstrate that the original message has not changed. Also, because a secret key is used to
|
|
1703
|
+
* create the hash, you can verify that the party that generated the hash has the required secret
|
|
1704
|
+
* key. You can also use the raw result to implement HMAC-based algorithms such as key derivation
|
|
1705
|
+
* functions. This operation is part of KMS support for HMAC KMS keys. For
|
|
1706
|
+
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in
|
|
1707
|
+
* KMS</a> in the <i>
|
|
1590
1708
|
* <i>Key Management Service Developer Guide</i>
|
|
1591
1709
|
* </i>.</p>
|
|
1592
1710
|
* <note>
|
|
1593
1711
|
* <p>Best practices recommend that you limit the time during which any signing mechanism,
|
|
1594
|
-
* including an HMAC, is effective. This deters an attack where the actor uses a signed
|
|
1595
|
-
*
|
|
1596
|
-
*
|
|
1597
|
-
*
|
|
1712
|
+
* including an HMAC, is effective. This deters an attack where the actor uses a signed message
|
|
1713
|
+
* to establish validity repeatedly or long after the message is superseded. HMAC tags do not
|
|
1714
|
+
* include a timestamp, but you can include a timestamp in the token or message to help you
|
|
1715
|
+
* detect when its time to refresh the HMAC. </p>
|
|
1598
1716
|
* </note>
|
|
1599
1717
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1600
1718
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1601
1719
|
* <p>
|
|
1602
|
-
* <b>Cross-account
|
|
1603
|
-
* use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
1720
|
+
* <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
1604
1721
|
* the key ARN or alias ARN in the value of the <code>KeyId</code> parameter. </p>
|
|
1605
1722
|
* <p>
|
|
1606
1723
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GenerateMac</a> (key policy)</p>
|
|
@@ -1616,13 +1733,16 @@ export declare class KMS extends KMSClient {
|
|
|
1616
1733
|
* <p>You must use the <code>NumberOfBytes</code> parameter to specify the length of the random
|
|
1617
1734
|
* byte string. There is no default value for string length.</p>
|
|
1618
1735
|
* <p>By default, the random byte string is generated in KMS. To generate the byte string in
|
|
1619
|
-
* the CloudHSM cluster
|
|
1620
|
-
*
|
|
1736
|
+
* the CloudHSM cluster associated with an CloudHSM key store, use the <code>CustomKeyStoreId</code>
|
|
1737
|
+
* parameter.</p>
|
|
1621
1738
|
* <p>Applications in Amazon Web Services Nitro Enclaves can call this operation by using the <a href="https://github.com/aws/aws-nitro-enclaves-sdk-c">Amazon Web Services Nitro Enclaves Development Kit</a>. For information about the supporting parameters, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves use KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1622
1739
|
* <p>For more information about entropy and random number generation, see
|
|
1623
1740
|
* <a href="https://docs.aws.amazon.com/kms/latest/cryptographic-details/">Key Management Service Cryptographic Details</a>.</p>
|
|
1741
|
+
*
|
|
1624
1742
|
* <p>
|
|
1625
|
-
* <b>Cross-account use</b>: Not applicable.
|
|
1743
|
+
* <b>Cross-account use</b>: Not applicable.
|
|
1744
|
+
* <code>GenerateRandom</code> does not use any account-specific resources, such as KMS
|
|
1745
|
+
* keys.</p>
|
|
1626
1746
|
* <p>
|
|
1627
1747
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GenerateRandom</a> (IAM policy)</p>
|
|
1628
1748
|
*/
|
|
@@ -1651,14 +1771,14 @@ export declare class KMS extends KMSClient {
|
|
|
1651
1771
|
* and every year thereafter. You can monitor rotation of the key material for your KMS keys in
|
|
1652
1772
|
* CloudTrail and Amazon CloudWatch.</p>
|
|
1653
1773
|
* <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
|
|
1654
|
-
* You cannot enable
|
|
1655
|
-
* To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key..</p>
|
|
1774
|
+
* You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key..</p>
|
|
1656
1775
|
* <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation (<a>DisableKeyRotation</a>) of the key material in customer managed KMS keys. Key
|
|
1657
1776
|
* material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
|
|
1658
1777
|
* configurable. KMS always rotates the key material in Amazon Web Services managed KMS keys every year. The
|
|
1659
1778
|
* key rotation status for Amazon Web Services managed KMS keys is always <code>true</code>.</p>
|
|
1660
1779
|
* <note>
|
|
1661
|
-
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
|
|
1780
|
+
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
|
|
1781
|
+
* years to every year. For details, see <a>EnableKeyRotation</a>.</p>
|
|
1662
1782
|
* </note>
|
|
1663
1783
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1664
1784
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
@@ -1704,12 +1824,12 @@ export declare class KMS extends KMSClient {
|
|
|
1704
1824
|
getKeyRotationStatus(args: GetKeyRotationStatusCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GetKeyRotationStatusCommandOutput) => void): void;
|
|
1705
1825
|
/**
|
|
1706
1826
|
* <p>Returns the items you need to import key material into a symmetric encryption KMS key. For
|
|
1707
|
-
* more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a>
|
|
1708
|
-
*
|
|
1827
|
+
* more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a> in the
|
|
1828
|
+
* <i>Key Management Service Developer Guide</i>.</p>
|
|
1709
1829
|
* <p>This operation returns a public key and an import token. Use the public key to encrypt the
|
|
1710
1830
|
* symmetric key material. Store the import token to send with a subsequent <a>ImportKeyMaterial</a> request.</p>
|
|
1711
1831
|
* <p>You must specify the key ID of the symmetric encryption KMS key into which you will import
|
|
1712
|
-
* key material.
|
|
1832
|
+
* key material. The KMS key <code>Origin</code> must be <code>EXTERNAL</code>. You must also
|
|
1713
1833
|
* specify the wrapping algorithm and type of wrapping key (public key) that you will use to
|
|
1714
1834
|
* encrypt the key material. You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account.</p>
|
|
1715
1835
|
* <p>To import key material, you must use the public key and import token from the same
|
|
@@ -1753,10 +1873,7 @@ export declare class KMS extends KMSClient {
|
|
|
1753
1873
|
* public key within KMS, you benefit from the authentication, authorization, and logging that
|
|
1754
1874
|
* are part of every KMS operation. You also reduce of risk of encrypting data that cannot be
|
|
1755
1875
|
* decrypted. These features are not effective outside of KMS.</p>
|
|
1756
|
-
*
|
|
1757
|
-
* specify the distinguishing ID. By default, KMS uses <code>1234567812345678</code> as the
|
|
1758
|
-
* distinguishing ID. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification">Offline verification
|
|
1759
|
-
* with SM2 key pairs</a>.</p>
|
|
1876
|
+
*
|
|
1760
1877
|
* <p>To help you use the public key safely outside of KMS, <code>GetPublicKey</code> returns
|
|
1761
1878
|
* important information about the public key in the response, including:</p>
|
|
1762
1879
|
* <ul>
|
|
@@ -1781,6 +1898,10 @@ export declare class KMS extends KMSClient {
|
|
|
1781
1898
|
* public key from being used with an encryption algorithm that is not supported by KMS. You
|
|
1782
1899
|
* can also avoid errors, such as using the wrong signing algorithm in a verification
|
|
1783
1900
|
* operation.</p>
|
|
1901
|
+
* <p>To verify a signature outside of KMS with an SM2 public key (China Regions only), you must
|
|
1902
|
+
* specify the distinguishing ID. By default, KMS uses <code>1234567812345678</code> as the
|
|
1903
|
+
* distinguishing ID. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification">Offline verification
|
|
1904
|
+
* with SM2 key pairs</a>.</p>
|
|
1784
1905
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1785
1906
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1786
1907
|
* <p>
|
|
@@ -1800,9 +1921,8 @@ export declare class KMS extends KMSClient {
|
|
|
1800
1921
|
/**
|
|
1801
1922
|
* <p>Imports key material into an existing symmetric encryption KMS key that was created
|
|
1802
1923
|
* without key material. After you successfully import key material into a KMS key, you can
|
|
1803
|
-
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport
|
|
1804
|
-
*
|
|
1805
|
-
* material. </p>
|
|
1924
|
+
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport the same key material</a> into that KMS key, but you cannot import different
|
|
1925
|
+
* key material. </p>
|
|
1806
1926
|
* <p>You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account. For more information about creating KMS keys with no key material
|
|
1807
1927
|
* and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the
|
|
1808
1928
|
* <i>Key Management Service Developer Guide</i>.</p>
|
|
@@ -1828,11 +1948,12 @@ export declare class KMS extends KMSClient {
|
|
|
1828
1948
|
* a public key and token from the same <code>GetParametersForImport</code> response.</p>
|
|
1829
1949
|
* </li>
|
|
1830
1950
|
* <li>
|
|
1831
|
-
* <p>Whether the key material expires and if so, when
|
|
1832
|
-
*
|
|
1833
|
-
*
|
|
1834
|
-
*
|
|
1835
|
-
* expiration date
|
|
1951
|
+
* <p>Whether the key material expires (<code>ExpirationModel</code>) and, if so, when
|
|
1952
|
+
* (<code>ValidTo</code>). If you set an expiration date, on the specified date, KMS
|
|
1953
|
+
* deletes the key material from the KMS key, making the KMS key unusable. To use the KMS key
|
|
1954
|
+
* in cryptographic operations again, you must reimport the same key material. The only way
|
|
1955
|
+
* to change the expiration model or expiration date is by reimporting the same key material
|
|
1956
|
+
* and specifying a new expiration date. </p>
|
|
1836
1957
|
* </li>
|
|
1837
1958
|
* </ul>
|
|
1838
1959
|
* <p>When this operation is successful, the key state of the KMS key changes from
|
|
@@ -2174,7 +2295,7 @@ export declare class KMS extends KMSClient {
|
|
|
2174
2295
|
* that you intend.</p>
|
|
2175
2296
|
* </li>
|
|
2176
2297
|
* <li>
|
|
2177
|
-
* <p>To reencrypt the data, you must use the <code>DestinationKeyId</code> parameter
|
|
2298
|
+
* <p>To reencrypt the data, you must use the <code>DestinationKeyId</code> parameter to
|
|
2178
2299
|
* specify the KMS key that re-encrypts the data after it is decrypted. If the destination
|
|
2179
2300
|
* KMS key is an asymmetric KMS key, you must also provide the encryption algorithm. The
|
|
2180
2301
|
* algorithm that you choose must be compatible with the KMS key.</p>
|
|
@@ -2188,10 +2309,10 @@ export declare class KMS extends KMSClient {
|
|
|
2188
2309
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
2189
2310
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2190
2311
|
* <p>
|
|
2191
|
-
* <b>Cross-account use</b>: Yes.
|
|
2192
|
-
*
|
|
2193
|
-
*
|
|
2194
|
-
*
|
|
2312
|
+
* <b>Cross-account use</b>: Yes. The source KMS key and
|
|
2313
|
+
* destination KMS key can be in different Amazon Web Services accounts. Either or both KMS keys can be in a
|
|
2314
|
+
* different account than the caller. To specify a KMS key in a different account, you must use
|
|
2315
|
+
* its key ARN or alias ARN.</p>
|
|
2195
2316
|
*
|
|
2196
2317
|
* <p>
|
|
2197
2318
|
* <b>Required permissions</b>:</p>
|
|
@@ -2260,8 +2381,8 @@ export declare class KMS extends KMSClient {
|
|
|
2260
2381
|
* material origin</a>, and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic key rotation status</a>. KMS automatically synchronizes these shared
|
|
2261
2382
|
* properties among related multi-Region keys. All other properties of a replica key can differ,
|
|
2262
2383
|
* including its <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">key
|
|
2263
|
-
* policy</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">tags</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html">aliases</a>, and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a>. KMS pricing and quotas for KMS keys apply to each
|
|
2264
|
-
* key.</p>
|
|
2384
|
+
* policy</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">tags</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html">aliases</a>, and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a>. KMS pricing and quotas for KMS keys apply to each
|
|
2385
|
+
* primary key and replica key.</p>
|
|
2265
2386
|
* <p>When this operation completes, the new replica key has a transient key state of
|
|
2266
2387
|
* <code>Creating</code>. This key state changes to <code>Enabled</code> (or
|
|
2267
2388
|
* <code>PendingImport</code>) after a few seconds when the process of creating the new replica
|
|
@@ -2274,8 +2395,9 @@ export declare class KMS extends KMSClient {
|
|
|
2274
2395
|
* <p>You cannot create more than one replica of a primary key in any Region. If the Region
|
|
2275
2396
|
* already includes a replica of the key you're trying to replicate, <code>ReplicateKey</code>
|
|
2276
2397
|
* returns an <code>AlreadyExistsException</code> error. If the key state of the existing replica
|
|
2277
|
-
* is <code>PendingDeletion</code>, you can cancel the scheduled key deletion (<a>CancelKeyDeletion</a>) or wait for the key to be deleted. The new replica key you
|
|
2278
|
-
* will have the same <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties">shared
|
|
2398
|
+
* is <code>PendingDeletion</code>, you can cancel the scheduled key deletion (<a>CancelKeyDeletion</a>) or wait for the key to be deleted. The new replica key you
|
|
2399
|
+
* create will have the same <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties">shared
|
|
2400
|
+
* properties</a> as the original replica key.</p>
|
|
2279
2401
|
* <p>The CloudTrail log of a <code>ReplicateKey</code> operation records a
|
|
2280
2402
|
* <code>ReplicateKey</code> operation in the primary key's Region and a <a>CreateKey</a> operation in the replica key's Region.</p>
|
|
2281
2403
|
* <p>If you replicate a multi-Region primary key with imported key material, the replica key is
|
|
@@ -2443,11 +2565,6 @@ export declare class KMS extends KMSClient {
|
|
|
2443
2565
|
* exception is a multi-Region replica key.) To prevent the use of a KMS key without deleting
|
|
2444
2566
|
* it, use <a>DisableKey</a>. </p>
|
|
2445
2567
|
* </important>
|
|
2446
|
-
* <p>If you schedule deletion of a KMS key from a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>, when the waiting period
|
|
2447
|
-
* expires, <code>ScheduleKeyDeletion</code> deletes the KMS key from KMS. Then KMS makes a
|
|
2448
|
-
* best effort to delete the key material from the associated CloudHSM cluster. However, you might
|
|
2449
|
-
* need to manually <a href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key">delete the orphaned key
|
|
2450
|
-
* material</a> from the cluster and its backups.</p>
|
|
2451
2568
|
* <p>You can schedule the deletion of a multi-Region primary key and its replica keys at any
|
|
2452
2569
|
* time. However, KMS will not delete a multi-Region primary key with existing replica keys. If
|
|
2453
2570
|
* you schedule the deletion of a primary key with replicas, its key state changes to
|
|
@@ -2456,14 +2573,22 @@ export declare class KMS extends KMSClient {
|
|
|
2456
2573
|
* deleted (not just scheduled), the key state of the primary key changes to
|
|
2457
2574
|
* <code>PendingDeletion</code> and its waiting period (<code>PendingWindowInDays</code>)
|
|
2458
2575
|
* begins. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-delete.html">Deleting multi-Region keys</a> in the
|
|
2459
|
-
* <i>Key Management Service Developer Guide</i
|
|
2576
|
+
* <i>Key Management Service Developer Guide</i>.</p>
|
|
2577
|
+
* <p>When KMS <a href="https://docs.aws.amazon.com/kms/latest/developerguide/delete-cmk-keystore.html">deletes
|
|
2578
|
+
* a KMS key from an CloudHSM key store</a>, it makes a best effort to delete the associated
|
|
2579
|
+
* key material from the associated CloudHSM cluster. However, you might need to manually <a href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key">delete
|
|
2580
|
+
* the orphaned key material</a> from the cluster and its backups. <a href="https://docs.aws.amazon.com/kms/latest/developerguide/delete-xks-key.html">Deleting a KMS key from an
|
|
2581
|
+
* external key store</a> has no effect on the associated external key. However, for both
|
|
2582
|
+
* types of custom key stores, deleting a KMS key is destructive and irreversible. You cannot
|
|
2583
|
+
* decrypt ciphertext encrypted under the KMS key by using only its associated external key or
|
|
2584
|
+
* CloudHSM key. Also, you cannot recreate a KMS key in an external key store by creating a new KMS
|
|
2585
|
+
* key with the same key material.</p>
|
|
2460
2586
|
* <p>For more information about scheduling a KMS key for deletion, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html">Deleting KMS keys</a> in the
|
|
2461
2587
|
* <i>Key Management Service Developer Guide</i>.</p>
|
|
2462
2588
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
2463
2589
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2464
2590
|
* <p>
|
|
2465
|
-
* <b>Cross-account
|
|
2466
|
-
* use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
2591
|
+
* <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
|
|
2467
2592
|
*
|
|
2468
2593
|
*
|
|
2469
2594
|
* <p>
|
|
@@ -2491,8 +2616,8 @@ export declare class KMS extends KMSClient {
|
|
|
2491
2616
|
/**
|
|
2492
2617
|
* <p>Creates a <a href="https://en.wikipedia.org/wiki/Digital_signature">digital
|
|
2493
2618
|
* signature</a> for a message or message digest by using the private key in an asymmetric
|
|
2494
|
-
* signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use
|
|
2495
|
-
* public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2619
|
+
* signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use
|
|
2620
|
+
* the public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2496
2621
|
* <p>Digital signatures are generated and verified by using asymmetric key pair, such as an RSA
|
|
2497
2622
|
* or ECC pair that is represented by an asymmetric KMS key. The key owner (or an authorized
|
|
2498
2623
|
* user) uses their private key to sign a message. Anyone with the public key can verify that the
|
|
@@ -2522,16 +2647,18 @@ export declare class KMS extends KMSClient {
|
|
|
2522
2647
|
* information is required to verify the signature.</p>
|
|
2523
2648
|
* </important>
|
|
2524
2649
|
* <note>
|
|
2525
|
-
* <p>Best practices recommend that you limit the time during which any signature is
|
|
2526
|
-
*
|
|
2527
|
-
*
|
|
2650
|
+
* <p>Best practices recommend that you limit the time during which any signature is
|
|
2651
|
+
* effective. This deters an attack where the actor uses a signed message to establish validity
|
|
2652
|
+
* repeatedly or long after the message is superseded. Signatures do not include a timestamp,
|
|
2653
|
+
* but you can include a timestamp in the signed message to help you detect when its time to
|
|
2654
|
+
* refresh the signature. </p>
|
|
2528
2655
|
* </note>
|
|
2529
2656
|
* <p>To verify the signature that this operation generates, use the <a>Verify</a>
|
|
2530
2657
|
* operation. Or use the <a>GetPublicKey</a> operation to download the public key and
|
|
2531
2658
|
* then use the public key to verify the signature outside of KMS. </p>
|
|
2532
2659
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
2533
2660
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2534
|
-
*
|
|
2661
|
+
* <p>
|
|
2535
2662
|
* <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
2536
2663
|
* the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
|
|
2537
2664
|
*
|
|
@@ -2547,7 +2674,7 @@ export declare class KMS extends KMSClient {
|
|
|
2547
2674
|
/**
|
|
2548
2675
|
* <p>Adds or edits tags on a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>.</p>
|
|
2549
2676
|
* <note>
|
|
2550
|
-
* <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC
|
|
2677
|
+
* <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2551
2678
|
* </note>
|
|
2552
2679
|
* <p>Each tag consists of a tag key and a tag value, both of which are case-sensitive strings.
|
|
2553
2680
|
* The tag value can be an empty (null) string. To add a tag, specify a new tag key and a tag
|
|
@@ -2601,7 +2728,7 @@ export declare class KMS extends KMSClient {
|
|
|
2601
2728
|
* <p>Deletes tags from a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>. To delete a tag,
|
|
2602
2729
|
* specify the tag key and the KMS key.</p>
|
|
2603
2730
|
* <note>
|
|
2604
|
-
* <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC
|
|
2731
|
+
* <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2605
2732
|
* </note>
|
|
2606
2733
|
* <p>When it succeeds, the <code>UntagResource</code> operation doesn't return any output.
|
|
2607
2734
|
* Also, if the specified tag key isn't found on the KMS key, it doesn't throw an exception or
|
|
@@ -2651,12 +2778,12 @@ export declare class KMS extends KMSClient {
|
|
|
2651
2778
|
* only one KMS key at a time, although a KMS key can have multiple aliases. The alias and the
|
|
2652
2779
|
* KMS key must be in the same Amazon Web Services account and Region.</p>
|
|
2653
2780
|
* <note>
|
|
2654
|
-
* <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC
|
|
2781
|
+
* <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2655
2782
|
* </note>
|
|
2656
|
-
* <p>The current and new KMS key must be the same type (both symmetric or both asymmetric
|
|
2657
|
-
* they must have the same key usage
|
|
2658
|
-
*
|
|
2659
|
-
*
|
|
2783
|
+
* <p>The current and new KMS key must be the same type (both symmetric or both asymmetric or
|
|
2784
|
+
* both HMAC), and they must have the same key usage. This restriction prevents errors in code
|
|
2785
|
+
* that uses aliases. If you must assign an alias to a different type of KMS key, use <a>DeleteAlias</a> to delete the old alias and <a>CreateAlias</a> to create
|
|
2786
|
+
* a new alias.</p>
|
|
2660
2787
|
* <p>You cannot use <code>UpdateAlias</code> to change an alias name. To change an alias name,
|
|
2661
2788
|
* use <a>DeleteAlias</a> to delete the old alias and <a>CreateAlias</a> to
|
|
2662
2789
|
* create a new alias.</p>
|
|
@@ -2666,7 +2793,7 @@ export declare class KMS extends KMSClient {
|
|
|
2666
2793
|
* in the account, use the <a>ListAliases</a> operation. </p>
|
|
2667
2794
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
2668
2795
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2669
|
-
*
|
|
2796
|
+
* <p>
|
|
2670
2797
|
* <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. </p>
|
|
2671
2798
|
* <p>
|
|
2672
2799
|
* <b>Required permissions</b>
|
|
@@ -2715,47 +2842,67 @@ export declare class KMS extends KMSClient {
|
|
|
2715
2842
|
updateAlias(args: UpdateAliasCommandInput, cb: (err: any, data?: UpdateAliasCommandOutput) => void): void;
|
|
2716
2843
|
updateAlias(args: UpdateAliasCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: UpdateAliasCommandOutput) => void): void;
|
|
2717
2844
|
/**
|
|
2718
|
-
* <p>Changes the properties of a custom key store.
|
|
2719
|
-
*
|
|
2720
|
-
*
|
|
2721
|
-
*
|
|
2722
|
-
*
|
|
2723
|
-
*
|
|
2724
|
-
*
|
|
2725
|
-
*
|
|
2726
|
-
* <
|
|
2727
|
-
*
|
|
2728
|
-
*
|
|
2729
|
-
*
|
|
2730
|
-
*
|
|
2731
|
-
*
|
|
2732
|
-
*
|
|
2733
|
-
*
|
|
2734
|
-
*
|
|
2735
|
-
*
|
|
2736
|
-
* <
|
|
2737
|
-
*
|
|
2738
|
-
*
|
|
2739
|
-
*
|
|
2740
|
-
*
|
|
2741
|
-
*
|
|
2742
|
-
*
|
|
2743
|
-
*
|
|
2744
|
-
*
|
|
2745
|
-
*
|
|
2746
|
-
*
|
|
2747
|
-
*
|
|
2748
|
-
*
|
|
2749
|
-
*
|
|
2750
|
-
*
|
|
2845
|
+
* <p>Changes the properties of a custom key store. You can use this operation to change the
|
|
2846
|
+
* properties of an CloudHSM key store or an external key store.</p>
|
|
2847
|
+
* <p>Use the required <code>CustomKeyStoreId</code> parameter to identify the custom key store.
|
|
2848
|
+
* Use the remaining optional parameters to change its properties. This operation does not return
|
|
2849
|
+
* any property values. To verify the updated property values, use the <a>DescribeCustomKeyStores</a> operation.</p>
|
|
2850
|
+
* <p> This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key stores</a> feature in KMS, which
|
|
2851
|
+
* combines the convenience and extensive integration of KMS with the isolation and control of a
|
|
2852
|
+
* key store that you own and manage.</p>
|
|
2853
|
+
* <important>
|
|
2854
|
+
* <p>When updating the properties of an external key store, verify that the updated settings
|
|
2855
|
+
* connect your key store, via the external key store proxy, to the same external key manager
|
|
2856
|
+
* as the previous settings, or to a backup or snapshot of the external key manager with the
|
|
2857
|
+
* same cryptographic keys. If the updated connection settings fail, you can fix them and
|
|
2858
|
+
* retry, although an extended delay might disrupt Amazon Web Services services. However, if KMS
|
|
2859
|
+
* permanently loses its access to cryptographic keys, ciphertext encrypted under those keys is
|
|
2860
|
+
* unrecoverable.</p>
|
|
2861
|
+
* </important>
|
|
2862
|
+
* <note>
|
|
2863
|
+
* <p>For external key stores:</p>
|
|
2864
|
+
* <p>Some external key managers provide a simpler method for updating an external key store.
|
|
2865
|
+
* For details, see your external key manager documentation.</p>
|
|
2866
|
+
* <p>When updating an external key store in the KMS console, you can upload a JSON-based
|
|
2867
|
+
* proxy configuration file with the desired values. You cannot upload the proxy configuration
|
|
2868
|
+
* file to the <code>UpdateCustomKeyStore</code> operation. However, you can use the file to
|
|
2869
|
+
* help you determine the correct values for the <code>UpdateCustomKeyStore</code>
|
|
2870
|
+
* parameters.</p>
|
|
2871
|
+
* </note>
|
|
2872
|
+
* <p>For an CloudHSM key store, you can use this operation to change the custom key store friendly
|
|
2873
|
+
* name (<code>NewCustomKeyStoreName</code>), to tell KMS about a change to the
|
|
2874
|
+
* <code>kmsuser</code> crypto user password (<code>KeyStorePassword</code>), or to associate
|
|
2875
|
+
* the custom key store with a different, but related, CloudHSM cluster
|
|
2876
|
+
* (<code>CloudHsmClusterId</code>). To update any property of an CloudHSM key store, the
|
|
2877
|
+
* <code>ConnectionState</code> of the CloudHSM key store must be <code>DISCONNECTED</code>. </p>
|
|
2878
|
+
* <p>For an external key store, you can use this operation to change the custom key store
|
|
2879
|
+
* friendly name (<code>NewCustomKeyStoreName</code>), or to tell KMS about a change to the
|
|
2880
|
+
* external key store proxy authentication credentials
|
|
2881
|
+
* (<code>XksProxyAuthenticationCredential</code>), connection method
|
|
2882
|
+
* (<code>XksProxyConnectivity</code>), external proxy endpoint
|
|
2883
|
+
* (<code>XksProxyUriEndpoint</code>) and path (<code>XksProxyUriPath</code>). For external key
|
|
2884
|
+
* stores with an <code>XksProxyConnectivity</code> of <code>VPC_ENDPOINT_SERVICE</code>, you can
|
|
2885
|
+
* also update the Amazon VPC endpoint service name (<code>XksProxyVpcEndpointServiceName</code>). To
|
|
2886
|
+
* update most properties of an external key store, the <code>ConnectionState</code> of the
|
|
2887
|
+
* external key store must be <code>DISCONNECTED</code>. However, you can update the
|
|
2888
|
+
* <code>CustomKeyStoreName</code>, <code>XksProxyAuthenticationCredential</code>, and
|
|
2889
|
+
* <code>XksProxyUriPath</code> of an external key store when it is in the CONNECTED or
|
|
2890
|
+
* DISCONNECTED state. </p>
|
|
2891
|
+
* <p>If your update requires a <code>DISCONNECTED</code> state, before using
|
|
2892
|
+
* <code>UpdateCustomKeyStore</code>, use the <a>DisconnectCustomKeyStore</a>
|
|
2893
|
+
* operation to disconnect the custom key store. After the <code>UpdateCustomKeyStore</code>
|
|
2894
|
+
* operation completes, use the <a>ConnectCustomKeyStore</a> to reconnect the custom
|
|
2895
|
+
* key store. To find the <code>ConnectionState</code> of the custom key store, use the <a>DescribeCustomKeyStores</a> operation. </p>
|
|
2896
|
+
* <p>
|
|
2897
|
+
* </p>
|
|
2898
|
+
* <p>Before updating the custom key store, verify that the new values allow KMS to connect
|
|
2899
|
+
* the custom key store to its backing key store. For example, before you change the
|
|
2900
|
+
* <code>XksProxyUriPath</code> value, verify that the external key store proxy is reachable at
|
|
2901
|
+
* the new path.</p>
|
|
2751
2902
|
* <p>If the operation succeeds, it returns a JSON object with no
|
|
2752
2903
|
* properties.</p>
|
|
2753
|
-
* <p>This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store feature</a> feature in KMS, which
|
|
2754
|
-
* combines the convenience and extensive integration of KMS with the isolation and control of a
|
|
2755
|
-
* single-tenant key store.</p>
|
|
2756
2904
|
* <p>
|
|
2757
|
-
* <b>Cross-account
|
|
2758
|
-
* use</b>: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account. </p>
|
|
2905
|
+
* <b>Cross-account use</b>: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
|
|
2759
2906
|
* <p>
|
|
2760
2907
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:UpdateCustomKeyStore</a> (IAM policy)</p>
|
|
2761
2908
|
* <p>
|
|
@@ -2797,8 +2944,7 @@ export declare class KMS extends KMSClient {
|
|
|
2797
2944
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
2798
2945
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2799
2946
|
* <p>
|
|
2800
|
-
* <b>Cross-account
|
|
2801
|
-
* use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. </p>
|
|
2947
|
+
* <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. </p>
|
|
2802
2948
|
*
|
|
2803
2949
|
* <p>
|
|
2804
2950
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:UpdateKeyDescription</a> (key policy)</p>
|
|
@@ -2907,21 +3053,20 @@ export declare class KMS extends KMSClient {
|
|
|
2907
3053
|
* signature.</p>
|
|
2908
3054
|
* <p>You can also verify the digital signature by using the public key of the KMS key outside
|
|
2909
3055
|
* of KMS. Use the <a>GetPublicKey</a> operation to download the public key in the
|
|
2910
|
-
* asymmetric KMS key and then use the public key to verify the signature outside of KMS.
|
|
2911
|
-
* verify a signature outside of KMS with an SM2 public key, you must specify the distinguishing
|
|
2912
|
-
* ID. By default, KMS uses <code>1234567812345678</code> as the distinguishing ID. For more
|
|
2913
|
-
* information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification">Offline
|
|
2914
|
-
* verification with SM2 key pairs</a> in <i>Key Management Service Developer Guide</i>. The
|
|
3056
|
+
* asymmetric KMS key and then use the public key to verify the signature outside of KMS. The
|
|
2915
3057
|
* advantage of using the <code>Verify</code> operation is that it is performed within KMS. As
|
|
2916
3058
|
* a result, it's easy to call, the operation is performed within the FIPS boundary, it is logged
|
|
2917
3059
|
* in CloudTrail, and you can use key policy and IAM policy to determine who is authorized to use
|
|
2918
3060
|
* the KMS key to verify signatures.</p>
|
|
3061
|
+
* <p>To verify a signature outside of KMS with an SM2 public key (China Regions only), you must
|
|
3062
|
+
* specify the distinguishing ID. By default, KMS uses <code>1234567812345678</code> as the
|
|
3063
|
+
* distinguishing ID. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification">Offline verification
|
|
3064
|
+
* with SM2 key pairs</a>.</p>
|
|
2919
3065
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
2920
3066
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2921
3067
|
* <p>
|
|
2922
3068
|
* <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
|
|
2923
3069
|
* the key ARN or alias ARN in the value of the <code>KeyId</code> parameter. </p>
|
|
2924
|
-
*
|
|
2925
3070
|
* <p>
|
|
2926
3071
|
* <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:Verify</a> (key policy)</p>
|
|
2927
3072
|
* <p>
|
|
@@ -2936,13 +3081,13 @@ export declare class KMS extends KMSClient {
|
|
|
2936
3081
|
* KMS key, and MAC algorithm. To verify the HMAC, <code>VerifyMac</code> computes an HMAC using
|
|
2937
3082
|
* the message, HMAC KMS key, and MAC algorithm that you specify, and compares the computed HMAC
|
|
2938
3083
|
* to the HMAC that you specify. If the HMACs are identical, the verification succeeds;
|
|
2939
|
-
* otherwise, it fails
|
|
2940
|
-
*
|
|
2941
|
-
* <p>
|
|
2942
|
-
*
|
|
3084
|
+
* otherwise, it fails. Verification indicates that the message hasn't changed since the HMAC was
|
|
3085
|
+
* calculated, and the specified key was used to generate and verify the HMAC.</p>
|
|
3086
|
+
* <p>HMAC KMS keys and the HMAC algorithms that KMS uses conform to industry standards
|
|
3087
|
+
* defined in <a href="https://datatracker.ietf.org/doc/html/rfc2104">RFC 2104</a>.</p>
|
|
2943
3088
|
* <p>This operation is part of KMS support for HMAC KMS keys. For details, see
|
|
2944
|
-
*
|
|
2945
|
-
*
|
|
3089
|
+
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the
|
|
3090
|
+
* <i>Key Management Service Developer Guide</i>.</p>
|
|
2946
3091
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
2947
3092
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2948
3093
|
* <p>
|