npm - @aws-sdk/client-kms - Versions diffs - 3.218.0 → 3.220.0 - Mend

@aws-sdk/client-kms 3.218.0 → 3.220.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (52) hide show

package/dist-types/commands/DescribeKeyCommand.d.ts CHANGED Viewed

@@ -13,9 +13,13 @@ export interface DescribeKeyCommandOutput extends DescribeKeyResponse, __Metadat
  *         key</a> or an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a>.</p>
  *          <p>This detailed information includes the key ARN, creation date (and deletion date, if
  *       applicable), the key state, and the origin and expiration date (if any) of the key material.
- *       It includes fields, like <code>KeySpec</code>, that help you distinguish different types of KMS keys. It also displays the key usage (encryption, signing, or generating and verifying MACs) and the algorithms that the KMS key supports. For KMS keys in custom key stores, it includes
- *       information about the custom key store, such as the key store ID and the CloudHSM cluster ID. For
- *       multi-Region keys, it displays the primary key and all related replica keys. </p>
+ *       It includes fields, like <code>KeySpec</code>, that help you distinguish different types of
+ *       KMS keys. It also displays the key usage (encryption, signing, or generating and verifying
+ *       MACs) and the algorithms that the KMS key supports. For <a href="kms/latest/developerguide/multi-region-keys-overview.html">multi-Region keys</a>, it displays
+ *       the primary key and all related replica keys. For KMS keys in <a href="kms/latest/developerguide/keystore-cloudhsm.html">CloudHSM key stores</a>, it includes information
+ *       about the custom key store, such as the key store ID and the CloudHSM cluster ID. For KMS key in
+ *         <a href="kms/latest/developerguide/keystore-external.html">external key stores</a>, it includes
+ *       the custom key store ID and the ID and status of the associated external key.</p>
  *          <p>
  *             <code>DescribeKey</code> does not return the following information:</p>
  *          <ul>

package/dist-types/commands/DisableKeyCommand.d.ts CHANGED Viewed

@@ -10,12 +10,13 @@ export interface DisableKeyCommandOutput extends __MetadataBearer {
 /**
  * <p>Sets the state of a KMS key to disabled. This change temporarily prevents use of the KMS
  *       key for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a>. </p>
- *          <p>For more information about how key state affects the use of a KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>
+ *          <p>For more information about how key state affects the use of a KMS key, see
+ *       <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>
  *                <i>Key Management Service Developer Guide</i>
  *             </i>.</p>
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
- *         <p>
+ *          <p>
  *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
  *
  *          <p>

package/dist-types/commands/DisableKeyRotationCommand.d.ts CHANGED Viewed

@@ -11,21 +11,19 @@ export interface DisableKeyRotationCommandOutput extends __MetadataBearer {
  * <p>Disables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic
  *         rotation of the key material</a> of the specified symmetric encryption KMS key.</p>
  *          <p>Automatic key rotation is supported only on symmetric encryption KMS keys.
- *       You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
- * To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
+ *       You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
  *          <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation of the
  *       key material in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>. Key material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
  *       configurable. KMS always rotates the key material for every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
  *         keys</a> varies.</p>
  *          <note>
- *             <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every
- *         three years to every year. For details, see <a>EnableKeyRotation</a>.</p>
+ *             <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
+ *         years to every year. For details, see <a>EnableKeyRotation</a>.</p>
  *          </note>
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
- *             <b>Cross-account
- *         use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
+ *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
  *
  *          <p>
  *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:DisableKeyRotation</a> (key policy)</p>

package/dist-types/commands/DisconnectCustomKeyStoreCommand.d.ts CHANGED Viewed

@@ -8,26 +8,26 @@ export interface DisconnectCustomKeyStoreCommandInput extends DisconnectCustomKe
 export interface DisconnectCustomKeyStoreCommandOutput extends DisconnectCustomKeyStoreResponse, __MetadataBearer {
 }
 /**
- * <p>Disconnects the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a> from its associated CloudHSM cluster. While a custom key
- *       store is disconnected, you can manage the custom key store and its KMS keys, but you cannot
- *       create or use KMS keys in the custom key store. You can reconnect the custom key store at any
+ * <p>Disconnects the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a> from its backing key store. This operation disconnects an
+ *       CloudHSM key store from its associated CloudHSM cluster or disconnects an external key store from
+ *       the external key store proxy that communicates with your external key manager.</p>
+ *          <p> This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key stores</a> feature in KMS, which
+ * combines the convenience and extensive integration of KMS with the isolation and control of a
+ * key store that you own and manage.</p>
+ *          <p>While a custom key store is disconnected, you can manage the custom key store and its KMS
+ *       keys, but you cannot create or use its KMS keys. You can reconnect the custom key store at any
  *       time.</p>
  *          <note>
  *             <p>While a custom key store is disconnected, all attempts to create KMS keys in the custom key store or to use existing KMS keys in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> will
  *         fail. This action can prevent users from storing and accessing sensitive data.</p>
  *          </note>
- *          <p></p>
- *          <p>To find the connection state of a custom key store, use the <a>DescribeCustomKeyStores</a> operation. To reconnect a custom key store, use the
+ *          <p>When you disconnect a custom key store, its <code>ConnectionState</code> changes to
+ *         <code>Disconnected</code>. To find the connection state of a custom key store, use the <a>DescribeCustomKeyStores</a> operation. To reconnect a custom key store, use the
  *         <a>ConnectCustomKeyStore</a> operation.</p>
  *          <p>If the operation succeeds, it returns a JSON object with no
  * properties.</p>
- *          <p>This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store feature</a> feature in KMS, which
- * combines the convenience and extensive integration of KMS with the isolation and control of a
- * single-tenant key store.</p>
- *
- *         <p>
- *             <b>Cross-account use</b>: No.
- *       You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
+ *          <p>
+ *             <b>Cross-account use</b>: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
  *
  *          <p>
  *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:DisconnectCustomKeyStore</a> (IAM policy)</p>

package/dist-types/commands/EnableKeyCommand.d.ts CHANGED Viewed

@@ -13,8 +13,7 @@ export interface EnableKeyCommandOutput extends __MetadataBearer {
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
- *             <b>Cross-account
- *       use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
+ *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
  *
  *          <p>
  *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:EnableKey</a> (key policy)</p>

package/dist-types/commands/EnableKeyRotationCommand.d.ts CHANGED Viewed

@@ -16,24 +16,22 @@ export interface EnableKeyRotationCommandOutput extends __MetadataBearer {
  *       CloudTrail and Amazon CloudWatch. To disable rotation of the key material in a customer
  *       managed KMS key, use the <a>DisableKeyRotation</a> operation.</p>
  *          <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
- *       You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
- * To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
+ *       You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
  *          <p>You cannot enable or disable automatic rotation <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a>. KMS
  *       always rotates the key material of Amazon Web Services managed keys every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
  *         keys</a> varies.</p>
  *          <note>
  *             <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
  *         years (approximately 1,095 days) to every year (approximately 365 days).</p>
- *             <p>New Amazon Web Services managed keys are automatically rotated one year after they
- *         are created, and approximately every year thereafter. </p>
- *             <p>Existing Amazon Web Services managed keys are automatically rotated one year after
- *         their most recent rotation, and every year thereafter.</p>
+ *             <p>New Amazon Web Services managed keys are automatically rotated one year after they are created, and
+ *         approximately every year thereafter. </p>
+ *             <p>Existing Amazon Web Services managed keys are automatically rotated one year after their most recent
+ *         rotation, and every year thereafter.</p>
  *          </note>
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
- *             <b>Cross-account
- *         use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
+ *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
  *
  *          <p>
  *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:EnableKeyRotation</a> (key policy)</p>

package/dist-types/commands/EncryptCommand.d.ts CHANGED Viewed

@@ -10,15 +10,17 @@ export interface EncryptCommandOutput extends EncryptResponse, __MetadataBearer
 /**
  * <p>Encrypts plaintext of up to 4,096 bytes using a KMS key. You can use a symmetric or
  *       asymmetric KMS key with a <code>KeyUsage</code> of <code>ENCRYPT_DECRYPT</code>.</p>
- *          <p>You can use this operation to encrypt small amounts of arbitrary data, such as a personal identifier or
- *           database password, or other sensitive information. You don't need to use the <code>Encrypt</code> operation to encrypt a data key. The <a>GenerateDataKey</a> and <a>GenerateDataKeyPair</a> operations return a
- *       plaintext data key and an encrypted copy of that data key.</p>
- *
- *          <p>If you use a symmetric encryption KMS key, you can use an encryption context to add additional
- *       security to your encryption operation. If you specify an <code>EncryptionContext</code> when
- *       encrypting data, you must specify the same encryption context (a case-sensitive exact match)
- *       when decrypting the data. Otherwise, the request to decrypt fails with an
- *         <code>InvalidCiphertextException</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption
+ *          <p>You can use this operation to encrypt small amounts of arbitrary data, such as a personal
+ *       identifier or database password, or other sensitive information. You don't need to use the
+ *         <code>Encrypt</code> operation to encrypt a data key. The <a>GenerateDataKey</a>
+ *       and <a>GenerateDataKeyPair</a> operations return a plaintext data key and an
+ *       encrypted copy of that data key.</p>
+ *          <p>If you use a symmetric encryption KMS key, you can use an encryption context to add
+ *       additional security to your encryption operation. If you specify an
+ *         <code>EncryptionContext</code> when encrypting data, you must specify the same encryption
+ *       context (a case-sensitive exact match) when decrypting the data. Otherwise, the request to
+ *       decrypt fails with an <code>InvalidCiphertextException</code>. For more information, see
+ *         <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption
  *         Context</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>If you specify an asymmetric KMS key, you must also specify the encryption algorithm. The
  *       algorithm must be compatible with the KMS key spec.</p>

package/dist-types/commands/GenerateDataKeyCommand.d.ts CHANGED Viewed

@@ -39,8 +39,7 @@ export interface GenerateDataKeyCommandOutput extends GenerateDataKeyResponse, _
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
- *             <b>How to use your data
- *         key</b>
+ *             <b>How to use your data key</b>
  *          </p>
  *          <p>We recommend that you use the following pattern to encrypt data locally in your
  *       application. You can write your own code or use a client-side encryption library, such as the

package/dist-types/commands/GenerateDataKeyPairCommand.d.ts CHANGED Viewed

@@ -12,8 +12,8 @@ export interface GenerateDataKeyPairCommandOutput extends GenerateDataKeyPairRes
  *       a plaintext public key, a plaintext private key, and a copy of the private key that is
  *       encrypted under the symmetric encryption KMS key you specify. You can use the data key pair to
  *       perform asymmetric cryptography and implement digital signatures outside of KMS. The bytes
- *       in the keys are random; they not related to the caller or to the KMS key that is used to encrypt the
- *       private key. </p>
+ *       in the keys are random; they not related to the caller or to the KMS key that is used to
+ *       encrypt the private key. </p>
  *
  *          <p>You can use the public key that <code>GenerateDataKeyPair</code> returns to encrypt data
  *       or verify a signature outside of KMS. Then, store the encrypted private key with the data.
@@ -21,8 +21,7 @@ export interface GenerateDataKeyPairCommandOutput extends GenerateDataKeyPairRes
  *
  *          <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
  *       the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
- *       custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
- *       operation. </p>
+ *       custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
  *          <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
  *       key pair. In China Regions, you can also choose an SM2 data key pair. KMS recommends that you use
  *       ECC key pairs for signing, and use RSA and SM2 key pairs for either encryption or signing, but not both.
@@ -38,10 +37,10 @@ export interface GenerateDataKeyPairCommandOutput extends GenerateDataKeyPairRes
  *
  *          <p>
  *             <code>GenerateDataKeyPair</code> returns a unique data key pair for each request. The
- *       bytes in the keys are random; they are not related to the caller or the KMS key that is used to encrypt the
- *       private key. The public key is a DER-encoded X.509 SubjectPublicKeyInfo, as specified in
- *         <a href="https://tools.ietf.org/html/rfc5280">RFC 5280</a>. The private key is a
- *       DER-encoded PKCS8 PrivateKeyInfo, as specified in <a href="https://tools.ietf.org/html/rfc5958">RFC 5958</a>.</p>
+ *       bytes in the keys are random; they are not related to the caller or the KMS key that is used
+ *       to encrypt the private key. The public key is a DER-encoded X.509 SubjectPublicKeyInfo, as
+ *       specified in <a href="https://tools.ietf.org/html/rfc5280">RFC 5280</a>. The private
+ *       key is a DER-encoded PKCS8 PrivateKeyInfo, as specified in <a href="https://tools.ietf.org/html/rfc5958">RFC 5958</a>.</p>
  *
  *          <p>You can use an optional encryption context to add additional security to the encryption
  *       operation. If you specify an <code>EncryptionContext</code>, you must specify the same
@@ -51,8 +50,7 @@ export interface GenerateDataKeyPairCommandOutput extends GenerateDataKeyPairRes
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
- *             <b>Cross-account
- *         use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
+ *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
  *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
  *
  *          <p>

package/dist-types/commands/GenerateDataKeyPairWithoutPlaintextCommand.d.ts CHANGED Viewed

@@ -11,15 +11,14 @@ export interface GenerateDataKeyPairWithoutPlaintextCommandOutput extends Genera
  * <p>Returns a unique asymmetric data key pair for use outside of KMS. This operation returns
  *       a plaintext public key and a copy of the private key that is encrypted under the symmetric
  *       encryption KMS key you specify. Unlike <a>GenerateDataKeyPair</a>, this operation
- *       does not return a plaintext private key. The bytes in the keys are random; they are not related to the caller
- *       or to the KMS key that is used to encrypt the private key. </p>
+ *       does not return a plaintext private key. The bytes in the keys are random; they are not
+ *       related to the caller or to the KMS key that is used to encrypt the private key. </p>
  *          <p>You can use the public key that <code>GenerateDataKeyPairWithoutPlaintext</code> returns
  *       to encrypt data or verify a signature outside of KMS. Then, store the encrypted private key
  *       with the data. When you are ready to decrypt data or sign a message, you can use the <a>Decrypt</a> operation to decrypt the encrypted private key.</p>
  *          <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
  *       the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
- *       custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
- *       operation. </p>
+ *       custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
  *          <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
  *       key pair. In China Regions, you can also choose an SM2 data key pair. KMS recommends that you
  *       use ECC key pairs for signing, and use RSA and SM2 key pairs for either encryption or signing, but not
@@ -38,8 +37,7 @@ export interface GenerateDataKeyPairWithoutPlaintextCommandOutput extends Genera
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
- *             <b>Cross-account
- *         use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
+ *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
  *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
  *
  *          <p>

package/dist-types/commands/GenerateDataKeyWithoutPlaintextCommand.d.ts CHANGED Viewed

@@ -31,6 +31,14 @@ export interface GenerateDataKeyWithoutPlaintextCommandOutput extends GenerateDa
  *       encrypt the data key. You cannot use an asymmetric KMS key or a key in a custom key store to generate a data key. To get the
  *       type of your KMS key, use the <a>DescribeKey</a> operation.</p>
  *
+ *          <p>You must also specify the length of the data key. Use either the <code>KeySpec</code> or
+ *       <code>NumberOfBytes</code> parameters (but not both). For 128-bit and 256-bit data keys, use
+ *       the <code>KeySpec</code> parameter.</p>
+ *
+ *          <p>To generate an SM4 data key (China Regions only), specify a <code>KeySpec</code> value of
+ *       <code>AES_128</code> or <code>NumberOfBytes</code> value of <code>128</code>. The symmetric
+ *       encryption key used in China Regions to encrypt your data key is an SM4 encryption key.</p>
+ *
  *          <p>If the operation succeeds, you will find the encrypted copy of the data key in the
  *         <code>CiphertextBlob</code> field.</p>
  *
@@ -42,8 +50,7 @@ export interface GenerateDataKeyWithoutPlaintextCommandOutput extends GenerateDa
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
- *             <b>Cross-account
- *         use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
+ *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
  *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
  *
  *          <p>

package/dist-types/commands/GenerateMacCommand.d.ts CHANGED Viewed

@@ -8,28 +8,28 @@ export interface GenerateMacCommandInput extends GenerateMacRequest {
 export interface GenerateMacCommandOutput extends GenerateMacResponse, __MetadataBearer {
 }
 /**
- * <p>Generates a hash-based message authentication code (HMAC) for a message using an HMAC KMS
- *       key and a MAC algorithm that the key supports. The MAC algorithm computes the HMAC for the
- *       message and the key as described in <a href="https://datatracker.ietf.org/doc/html/rfc2104">RFC 2104</a>.</p>
- *          <p>You can use the HMAC that this operation generates with the <a>VerifyMac</a>
- *       operation to demonstrate that the original message has not changed. Also, because a secret key
- *       is used to create the hash, you can verify that the party that generated the hash has the
- *       required secret key. This operation is part of KMS support for HMAC KMS keys.
- *       For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>
+ * <p>Generates a hash-based message authentication code (HMAC) for a message using an HMAC KMS key and a MAC algorithm that the key supports.
+ *       HMAC KMS keys and the HMAC algorithms that KMS uses conform to industry standards defined in <a href="https://datatracker.ietf.org/doc/html/rfc2104">RFC 2104</a>.</p>
+ *          <p>You can use value that GenerateMac returns in the <a>VerifyMac</a> operation to
+ *       demonstrate that the original message has not changed. Also, because a secret key is used to
+ *       create the hash, you can verify that the party that generated the hash has the required secret
+ *       key. You can also use the raw result to implement HMAC-based algorithms such as key derivation
+ *       functions. This operation is part of KMS support for HMAC KMS keys. For
+ *       details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in
+ *         KMS</a> in the <i>
  *                <i>Key Management Service Developer Guide</i>
  *             </i>.</p>
  *          <note>
  *             <p>Best practices recommend that you limit the time during which any signing mechanism,
- *         including an HMAC, is effective. This deters an attack where the actor uses a signed
- *         message to establish validity repeatedly or long after the message is superseded. HMAC
- *         tags do not include a timestamp, but you can include a timestamp in the token or message
- *         to help you detect when its time to refresh the HMAC. </p>
+ *         including an HMAC, is effective. This deters an attack where the actor uses a signed message
+ *         to establish validity repeatedly or long after the message is superseded. HMAC tags do not
+ *         include a timestamp, but you can include a timestamp in the token or message to help you
+ *         detect when its time to refresh the HMAC. </p>
  *          </note>
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
- *             <b>Cross-account
- *         use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
+ *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
  *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter. </p>
  *          <p>
  *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GenerateMac</a> (key policy)</p>

package/dist-types/commands/GenerateRandomCommand.d.ts CHANGED Viewed

@@ -12,13 +12,16 @@ export interface GenerateRandomCommandOutput extends GenerateRandomResponse, __M
  *          <p>You must use the <code>NumberOfBytes</code> parameter to specify the length of the random
  *       byte string. There is no default value for string length.</p>
  *          <p>By default, the random byte string is generated in KMS. To generate the byte string in
- *       the CloudHSM cluster that is associated with a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>, specify the custom key store
- *       ID.</p>
+ *       the CloudHSM cluster associated with an CloudHSM key store, use the <code>CustomKeyStoreId</code>
+ *       parameter.</p>
  *          <p>Applications in Amazon Web Services Nitro Enclaves can call this operation by using the <a href="https://github.com/aws/aws-nitro-enclaves-sdk-c">Amazon Web Services Nitro Enclaves Development Kit</a>. For information about the supporting parameters, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves use KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>For more information about entropy and random number generation, see
  *       <a href="https://docs.aws.amazon.com/kms/latest/cryptographic-details/">Key Management Service Cryptographic Details</a>.</p>
+ *
  *          <p>
- *             <b>Cross-account use</b>: Not applicable. <code>GenerateRandom</code> does not use any account-specific resources, such as KMS keys.</p>
+ *             <b>Cross-account use</b>: Not applicable.
+ *         <code>GenerateRandom</code> does not use any account-specific resources, such as KMS
+ *       keys.</p>
  *          <p>
  *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GenerateRandom</a> (IAM policy)</p>
  * @example

package/dist-types/commands/GetKeyRotationStatusCommand.d.ts CHANGED Viewed

@@ -15,14 +15,14 @@ export interface GetKeyRotationStatusCommandOutput extends GetKeyRotationStatusR
  *       and every year thereafter. You can monitor rotation of the key material for your KMS keys in
  *       CloudTrail and Amazon CloudWatch.</p>
  *          <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
- *       You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
- * To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key..</p>
+ *       You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key..</p>
  *          <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation (<a>DisableKeyRotation</a>) of the key material in customer managed KMS keys. Key
  *       material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
  *       configurable. KMS always rotates the key material in Amazon Web Services managed KMS keys every year. The
  *       key rotation status for Amazon Web Services managed KMS keys is always <code>true</code>.</p>
  *          <note>
- *             <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three years to every year. For details, see <a>EnableKeyRotation</a>.</p>
+ *             <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
+ *         years to every year. For details, see <a>EnableKeyRotation</a>.</p>
  *          </note>
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>

package/dist-types/commands/GetParametersForImportCommand.d.ts CHANGED Viewed

@@ -9,12 +9,12 @@ export interface GetParametersForImportCommandOutput extends GetParametersForImp
 }
 /**
  * <p>Returns the items you need to import key material into a symmetric encryption KMS key. For
- *       more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a>
- *       in the <i>Key Management Service Developer Guide</i>.</p>
+ *       more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a> in the
+ *       <i>Key Management Service Developer Guide</i>.</p>
  *          <p>This operation returns a public key and an import token. Use the public key to encrypt the
  *       symmetric key material. Store the import token to send with a subsequent <a>ImportKeyMaterial</a> request.</p>
  *          <p>You must specify the key ID of the symmetric encryption KMS key into which you will import
- *       key material. This KMS key's <code>Origin</code> must be <code>EXTERNAL</code>. You must also
+ *       key material. The KMS key <code>Origin</code> must be <code>EXTERNAL</code>. You must also
  *       specify the wrapping algorithm and type of wrapping key (public key) that you will use to
  *       encrypt the key material. You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account.</p>
  *          <p>To import key material, you must use the public key and import token from the same

package/dist-types/commands/GetPublicKeyCommand.d.ts CHANGED Viewed

@@ -18,10 +18,7 @@ export interface GetPublicKeyCommandOutput extends GetPublicKeyResponse, __Metad
  *       public key within KMS, you benefit from the authentication, authorization, and logging that
  *       are part of every KMS operation. You also reduce of risk of encrypting data that cannot be
  *       decrypted. These features are not effective outside of KMS.</p>
- *          <p>To verify a signature outside of KMS with an SM2 public key (China Regions only), you must
- *       specify the distinguishing ID. By default, KMS uses <code>1234567812345678</code> as the
- *       distinguishing ID. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification">Offline verification
- *       with SM2 key pairs</a>.</p>
+ *
  *          <p>To help you use the public key safely outside of KMS, <code>GetPublicKey</code> returns
  *       important information about the public key in the response, including:</p>
  *          <ul>
@@ -46,6 +43,10 @@ export interface GetPublicKeyCommandOutput extends GetPublicKeyResponse, __Metad
  *       public key from being used with an encryption algorithm that is not supported by KMS. You
  *       can also avoid errors, such as using the wrong signing algorithm in a verification
  *       operation.</p>
+ *          <p>To verify a signature outside of KMS with an SM2 public key (China Regions only), you must
+ *       specify the distinguishing ID. By default, KMS uses <code>1234567812345678</code> as the
+ *       distinguishing ID. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/asymmetric-key-specs.html#key-spec-sm-offline-verification">Offline verification
+ *         with SM2 key pairs</a>.</p>
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>

package/dist-types/commands/ImportKeyMaterialCommand.d.ts CHANGED Viewed

@@ -10,9 +10,8 @@ export interface ImportKeyMaterialCommandOutput extends ImportKeyMaterialRespons
 /**
  * <p>Imports key material into an existing symmetric encryption KMS key that was created
  *       without key material. After you successfully import key material into a KMS key, you can
- *         <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport
- *         the same key material</a> into that KMS key, but you cannot import different key
- *       material. </p>
+ *         <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport the same key material</a> into that KMS key, but you cannot import different
+ *       key material. </p>
  *          <p>You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account. For more information about creating KMS keys with no key material
  *       and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the
  *       <i>Key Management Service Developer Guide</i>.</p>
@@ -38,11 +37,12 @@ export interface ImportKeyMaterialCommandOutput extends ImportKeyMaterialRespons
  *           a public key and token from the same <code>GetParametersForImport</code> response.</p>
  *             </li>
  *             <li>
- *                <p>Whether the key material expires and if so, when. If you set an expiration date, KMS
- *           deletes the key material from the KMS key on the specified date, and the KMS key becomes
- *           unusable. To use the KMS key again, you must reimport the same key material. The only way
- *           to change an expiration date is by reimporting the same key material and specifying a new
- *           expiration date. </p>
+ *                <p>Whether the key material expires (<code>ExpirationModel</code>) and, if so, when
+ *             (<code>ValidTo</code>). If you set an expiration date, on the specified date, KMS
+ *           deletes the key material from the KMS key, making the KMS key unusable. To use the KMS key
+ *           in cryptographic operations again, you must reimport the same key material. The only way
+ *           to change the expiration model or expiration date is by reimporting the same key material
+ *           and specifying a new expiration date. </p>
  *             </li>
  *          </ul>
  *          <p>When this operation is successful, the key state of the KMS key changes from

package/dist-types/commands/ReEncryptCommand.d.ts CHANGED Viewed

@@ -43,7 +43,7 @@ export interface ReEncryptCommandOutput extends ReEncryptResponse, __MetadataBea
  *           that you intend.</p>
  *             </li>
  *             <li>
- *                <p>To reencrypt the data, you must use the <code>DestinationKeyId</code> parameter
+ *                <p>To reencrypt the data, you must use the <code>DestinationKeyId</code> parameter to
  *           specify the KMS key that re-encrypts the data after it is decrypted. If the destination
  *           KMS key is an asymmetric KMS key, you must also provide the encryption algorithm. The
  *           algorithm that you choose must be compatible with the KMS key.</p>
@@ -57,10 +57,10 @@ export interface ReEncryptCommandOutput extends ReEncryptResponse, __MetadataBea
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
- *             <b>Cross-account use</b>: Yes.
- *       The source KMS key and destination KMS key can be in different Amazon Web Services accounts. Either or both
- *       KMS keys can be in a different account than the caller. To specify a KMS key in a different
- *       account, you must use its key ARN or alias ARN.</p>
+ *             <b>Cross-account use</b>: Yes. The source KMS key and
+ *       destination KMS key can be in different Amazon Web Services accounts. Either or both KMS keys can be in a
+ *       different account than the caller. To specify a KMS key in a different account, you must use
+ *       its key ARN or alias ARN.</p>
  *
  *          <p>
  *             <b>Required permissions</b>:</p>

package/dist-types/commands/ReplicateKeyCommand.d.ts CHANGED Viewed

@@ -26,8 +26,8 @@ export interface ReplicateKeyCommandOutput extends ReplicateKeyResponse, __Metad
  *         material origin</a>, and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic key rotation status</a>. KMS automatically synchronizes these shared
  *       properties among related multi-Region keys. All other properties of a replica key can differ,
  *       including its <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">key
- *         policy</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">tags</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html">aliases</a>, and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a>. KMS pricing and quotas for KMS keys apply to each primary key and replica
- *       key.</p>
+ *         policy</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">tags</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html">aliases</a>, and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a>. KMS pricing and quotas for KMS keys apply to each
+ *       primary key and replica key.</p>
  *          <p>When this operation completes, the new replica key has a transient key state of
  *         <code>Creating</code>. This key state changes to <code>Enabled</code> (or
  *         <code>PendingImport</code>) after a few seconds when the process of creating the new replica
@@ -40,8 +40,9 @@ export interface ReplicateKeyCommandOutput extends ReplicateKeyResponse, __Metad
  *          <p>You cannot create more than one replica of a primary key in any Region. If the Region
  *       already includes a replica of the key you're trying to replicate, <code>ReplicateKey</code>
  *       returns an <code>AlreadyExistsException</code> error. If the key state of the existing replica
- *       is <code>PendingDeletion</code>, you can cancel the scheduled key deletion (<a>CancelKeyDeletion</a>) or wait for the key to be deleted. The new replica key you create
- *       will have the same <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties">shared properties</a> as the original replica key.</p>
+ *       is <code>PendingDeletion</code>, you can cancel the scheduled key deletion (<a>CancelKeyDeletion</a>) or wait for the key to be deleted. The new replica key you
+ *       create will have the same <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties">shared
+ *         properties</a> as the original replica key.</p>
  *          <p>The CloudTrail log of a <code>ReplicateKey</code> operation records a
  *         <code>ReplicateKey</code> operation in the primary key's Region and a <a>CreateKey</a> operation in the replica key's Region.</p>
  *          <p>If you replicate a multi-Region primary key with imported key material, the replica key is

package/dist-types/commands/ScheduleKeyDeletionCommand.d.ts CHANGED Viewed

@@ -22,11 +22,6 @@ export interface ScheduleKeyDeletionCommandOutput extends ScheduleKeyDeletionRes
  *         exception is a multi-Region replica key.) To prevent the use of a KMS key without deleting
  *         it, use <a>DisableKey</a>. </p>
  *          </important>
- *          <p>If you schedule deletion of a KMS key from a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>, when the waiting period
- *       expires, <code>ScheduleKeyDeletion</code> deletes the KMS key from KMS. Then KMS makes a
- *       best effort to delete the key material from the associated CloudHSM cluster. However, you might
- *       need to manually <a href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key">delete the orphaned key
- *         material</a> from the cluster and its backups.</p>
  *          <p>You can schedule the deletion of a multi-Region primary key and its replica keys at any
  *       time. However, KMS will not delete a multi-Region primary key with existing replica keys. If
  *       you schedule the deletion of a primary key with replicas, its key state changes to
@@ -35,14 +30,22 @@ export interface ScheduleKeyDeletionCommandOutput extends ScheduleKeyDeletionRes
  *       deleted (not just scheduled), the key state of the primary key changes to
  *         <code>PendingDeletion</code> and its waiting period (<code>PendingWindowInDays</code>)
  *       begins. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-delete.html">Deleting multi-Region keys</a> in the
- *       <i>Key Management Service Developer Guide</i>. </p>
+ *       <i>Key Management Service Developer Guide</i>.</p>
+ *          <p>When KMS <a href="https://docs.aws.amazon.com/kms/latest/developerguide/delete-cmk-keystore.html">deletes
+ *         a KMS key from an CloudHSM key store</a>, it makes a best effort to delete the associated
+ *       key material from the associated CloudHSM cluster. However, you might need to manually <a href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-orphaned-key">delete
+ *         the orphaned key material</a> from the cluster and its backups. <a href="https://docs.aws.amazon.com/kms/latest/developerguide/delete-xks-key.html">Deleting a KMS key from an
+ *         external key store</a> has no effect on the associated external key. However, for both
+ *       types of custom key stores, deleting a KMS key is destructive and irreversible. You cannot
+ *       decrypt ciphertext encrypted under the KMS key by using only its associated external key or
+ *       CloudHSM key. Also, you cannot recreate a KMS key in an external key store by creating a new KMS
+ *       key with the same key material.</p>
  *          <p>For more information about scheduling a KMS key for deletion, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html">Deleting KMS keys</a> in the
  *       <i>Key Management Service Developer Guide</i>.</p>
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
- *             <b>Cross-account
- *         use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
+ *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
  *
  *
  *          <p>