@aws-sdk/client-kms 3.32.0 → 3.36.0

package/dist/es/commands/GenerateDataKeyCommand.js

@@ -1,159 +0,0 @@
-import { __extends } from "tslib";
-import { GenerateDataKeyRequest, GenerateDataKeyResponse } from "../models/models_0";
-import { deserializeAws_json1_1GenerateDataKeyCommand, serializeAws_json1_1GenerateDataKeyCommand, } from "../protocols/Aws_json1_1";
-import { getSerdePlugin } from "@aws-sdk/middleware-serde";
-import { Command as $Command } from "@aws-sdk/smithy-client";
-/**
- * <p>Generates a unique symmetric data key for client-side encryption. This operation returns a
- *       plaintext copy of the data key and a copy that is encrypted under a KMS key
- *       that you specify. You can use the plaintext key to encrypt your data outside of KMS and
- *       store the encrypted data key with the encrypted data.</p>
- *
- *          <p>
- *             <code>GenerateDataKey</code> returns a unique data key for each request. The bytes in the
- *       plaintext key are not related to the caller or the KMS key.</p>
- *
- *          <p>To generate a data key, specify the symmetric KMS key that will be used to encrypt the data
- *       key. You cannot use an asymmetric KMS key to generate data keys. To get the type of your KMS key, use
- *       the <a>DescribeKey</a> operation. You must also specify the length of the data key.
- *       Use either the <code>KeySpec</code> or <code>NumberOfBytes</code> parameters (but not both).
- *       For 128-bit and 256-bit data keys, use the <code>KeySpec</code> parameter. </p>
- *
- *          <p>To get only an encrypted copy of the data key, use <a>GenerateDataKeyWithoutPlaintext</a>. To generate an asymmetric data key pair, use
- *       the <a>GenerateDataKeyPair</a> or <a>GenerateDataKeyPairWithoutPlaintext</a> operation. To get a cryptographically secure
- *       random byte string, use <a>GenerateRandom</a>.</p>
- *
- *          <p>You can use the optional encryption context to add additional security to the encryption
- *       operation. If you specify an <code>EncryptionContext</code>, you must specify the same
- *       encryption context (a case-sensitive exact match) when decrypting the encrypted data key.
- *       Otherwise, the request to decrypt fails with an <code>InvalidCiphertextException</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption Context</a> in the
- *       <i>Key Management Service Developer Guide</i>.</p>
- *          <p>Applications in Amazon Web Services Nitro Enclaves can call this operation by using the <a href="https://github.com/aws/aws-nitro-enclaves-sdk-c">Amazon Web Services Nitro Enclaves Development Kit</a>. For information about the supporting parameters, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves use KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
- *          <p>The KMS key that you use for this operation must be in a compatible key state. For
- * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
- *          <p>
- *             <b>How to use your data key</b>
- *          </p>
- *          <p>We recommend that you use the following pattern to encrypt data locally in your application.
- *       You can write your own code or use a client-side encryption library, such as the <a href="https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/">Amazon Web Services Encryption SDK</a>, the <a href="https://docs.aws.amazon.com/dynamodb-encryption-client/latest/devguide/">Amazon DynamoDB Encryption Client</a>, or
- *         <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html">Amazon S3
- *         client-side encryption</a> to do these tasks for you.</p>
- *          <p>To encrypt data outside of KMS:</p>
- *          <ol>
- *             <li>
- *                <p>Use the <code>GenerateDataKey</code> operation to get a data key.</p>
- *             </li>
- *             <li>
- *                <p>Use the plaintext data key (in the <code>Plaintext</code> field of the response) to
- *           encrypt your data outside of KMS. Then erase the plaintext data key from memory.</p>
- *             </li>
- *             <li>
- *                <p>Store the encrypted data key (in the <code>CiphertextBlob</code> field of the
- *           response) with the encrypted data.</p>
- *             </li>
- *          </ol>
- *          <p>To decrypt data outside of KMS:</p>
- *          <ol>
- *             <li>
- *                <p>Use the <a>Decrypt</a> operation to decrypt the encrypted data key. The
- *           operation returns a plaintext copy of the data key.</p>
- *             </li>
- *             <li>
- *                <p>Use the plaintext data key to decrypt data outside of KMS, then erase the plaintext
- *           data key from memory.</p>
- *             </li>
- *          </ol>
- *          <p>
- *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
- *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
- *
- *          <p>
- *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GenerateDataKey</a> (key policy)</p>
- *          <p>
- *             <b>Related operations:</b>
- *          </p>
- *          <ul>
- *             <li>
- *                <p>
- *                   <a>Decrypt</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>Encrypt</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKeyPair</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKeyPairWithoutPlaintext</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKeyWithoutPlaintext</a>
- *                </p>
- *             </li>
- *          </ul>
- * @example
- * Use a bare-bones client and the command you need to make an API call.
- * ```javascript
- * import { KMSClient, GenerateDataKeyCommand } from "@aws-sdk/client-kms"; // ES Modules import
- * // const { KMSClient, GenerateDataKeyCommand } = require("@aws-sdk/client-kms"); // CommonJS import
- * const client = new KMSClient(config);
- * const command = new GenerateDataKeyCommand(input);
- * const response = await client.send(command);
- * ```
- *
- * @see {@link GenerateDataKeyCommandInput} for command's `input` shape.
- * @see {@link GenerateDataKeyCommandOutput} for command's `response` shape.
- * @see {@link KMSClientResolvedConfig | config} for command's `input` shape.
- *
- */
-var GenerateDataKeyCommand = /** @class */ (function (_super) {
-    __extends(GenerateDataKeyCommand, _super);
-    // Start section: command_properties
-    // End section: command_properties
-    function GenerateDataKeyCommand(input) {
-        var _this = 
-        // Start section: command_constructor
-        _super.call(this) || this;
-        _this.input = input;
-        return _this;
-        // End section: command_constructor
-    }
-    /**
-     * @internal
-     */
-    GenerateDataKeyCommand.prototype.resolveMiddleware = function (clientStack, configuration, options) {
-        this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
-        var stack = clientStack.concat(this.middlewareStack);
-        var logger = configuration.logger;
-        var clientName = "KMSClient";
-        var commandName = "GenerateDataKeyCommand";
-        var handlerExecutionContext = {
-            logger: logger,
-            clientName: clientName,
-            commandName: commandName,
-            inputFilterSensitiveLog: GenerateDataKeyRequest.filterSensitiveLog,
-            outputFilterSensitiveLog: GenerateDataKeyResponse.filterSensitiveLog,
-        };
-        var requestHandler = configuration.requestHandler;
-        return stack.resolve(function (request) {
-            return requestHandler.handle(request.request, options || {});
-        }, handlerExecutionContext);
-    };
-    GenerateDataKeyCommand.prototype.serialize = function (input, context) {
-        return serializeAws_json1_1GenerateDataKeyCommand(input, context);
-    };
-    GenerateDataKeyCommand.prototype.deserialize = function (output, context) {
-        return deserializeAws_json1_1GenerateDataKeyCommand(output, context);
-    };
-    return GenerateDataKeyCommand;
-}($Command));
-export { GenerateDataKeyCommand };
-//# sourceMappingURL=GenerateDataKeyCommand.js.map

package/dist/es/commands/GenerateDataKeyCommand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"GenerateDataKeyCommand.js","sourceRoot":"","sources":["../../../commands/GenerateDataKeyCommand.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EACL,4CAA4C,EAC5C,0CAA0C,GAC3C,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAc7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8GG;AACH;IAA4C,0CAI3C;IACC,oCAAoC;IACpC,kCAAkC;IAElC,gCAAqB,KAAkC;QAAvD;QACE,qCAAqC;QACrC,iBAAO,SAER;QAJoB,WAAK,GAAL,KAAK,CAA6B;;QAGrD,mCAAmC;IACrC,CAAC;IAED;;OAEG;IACH,kDAAiB,GAAjB,UACE,WAAmE,EACnE,aAAsC,EACtC,OAA8B;QAE9B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAE1F,IAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAE/C,IAAA,MAAM,GAAK,aAAa,OAAlB,CAAmB;QACjC,IAAM,UAAU,GAAG,WAAW,CAAC;QAC/B,IAAM,WAAW,GAAG,wBAAwB,CAAC;QAC7C,IAAM,uBAAuB,GAA4B;YACvD,MAAM,QAAA;YACN,UAAU,YAAA;YACV,WAAW,aAAA;YACX,uBAAuB,EAAE,sBAAsB,CAAC,kBAAkB;YAClE,wBAAwB,EAAE,uBAAuB,CAAC,kBAAkB;SACrE,CAAC;QACM,IAAA,cAAc,GAAK,aAAa,eAAlB,CAAmB;QACzC,OAAO,KAAK,CAAC,OAAO,CAClB,UAAC,OAAsC;YACrC,OAAA,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,OAAwB,EAAE,OAAO,IAAI,EAAE,CAAC;QAAtE,CAAsE,EACxE,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAEO,0CAAS,GAAjB,UAAkB,KAAkC,EAAE,OAAuB;QAC3E,OAAO,0CAA0C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAEO,4CAAW,GAAnB,UAAoB,MAAsB,EAAE,OAAuB;QACjE,OAAO,4CAA4C,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAIH,6BAAC;AAAD,CAAC,AAtDD,CAA4C,QAAQ,GAsDnD"}

package/dist/es/commands/GenerateDataKeyPairCommand.js

@@ -1,139 +0,0 @@
-import { __extends } from "tslib";
-import { GenerateDataKeyPairRequest, GenerateDataKeyPairResponse } from "../models/models_0";
-import { deserializeAws_json1_1GenerateDataKeyPairCommand, serializeAws_json1_1GenerateDataKeyPairCommand, } from "../protocols/Aws_json1_1";
-import { getSerdePlugin } from "@aws-sdk/middleware-serde";
-import { Command as $Command } from "@aws-sdk/smithy-client";
-/**
- * <p>Generates a unique asymmetric data key pair. The <code>GenerateDataKeyPair</code>
- *       operation returns a plaintext public key, a plaintext private key, and a copy of the private
- *       key that is encrypted under the symmetric KMS key you specify. You can use the data key pair to
- *       perform asymmetric cryptography and implement digital signatures outside of KMS.</p>
- *
- *          <p>You can use the public key that <code>GenerateDataKeyPair</code> returns to encrypt data
- *       or verify a signature outside of KMS. Then, store the encrypted private key with the data.
- *       When you are ready to decrypt data or sign a message, you can use the <a>Decrypt</a> operation to decrypt the encrypted private key.</p>
- *
- *          <p>To generate a data key pair, you must specify a symmetric KMS key to
- *       encrypt the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
- *       custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
- *          <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
- *       key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs
- *       for either encryption or signing, but not both. However, KMS cannot enforce any restrictions
- *       on the use of data key pairs outside of KMS.</p>
- *
- *          <p>If you are using the data key pair to encrypt data, or for any operation where you don't
- *       immediately need a private key, consider using the <a>GenerateDataKeyPairWithoutPlaintext</a> operation.
- *         <code>GenerateDataKeyPairWithoutPlaintext</code> returns a plaintext public key and an
- *       encrypted private key, but omits the plaintext private key that you need only to decrypt
- *       ciphertext or sign a message. Later, when you need to decrypt the data or sign a message, use
- *       the <a>Decrypt</a> operation to decrypt the encrypted private key in the data key
- *       pair.</p>
- *
- *          <p>
- *             <code>GenerateDataKeyPair</code> returns a unique data key pair for each request. The
- *       bytes in the keys are not related to the caller or the KMS key that is used to encrypt the private
- *       key. The public key is a DER-encoded X.509 SubjectPublicKeyInfo, as specified in <a href="https://tools.ietf.org/html/rfc5280">RFC 5280</a>. The
- *       private key is a DER-encoded PKCS8 PrivateKeyInfo, as specified in <a href="https://tools.ietf.org/html/rfc5958">RFC
- *         5958</a>.</p>
- *
- *          <p>You can use the optional encryption context to add additional security to the encryption
- *       operation. If you specify an <code>EncryptionContext</code>, you must specify the same
- *       encryption context (a case-sensitive exact match) when decrypting the encrypted data key.
- *       Otherwise, the request to decrypt fails with an <code>InvalidCiphertextException</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption Context</a> in the
- *       <i>Key Management Service Developer Guide</i>.</p>
- *          <p>The KMS key that you use for this operation must be in a compatible key state. For
- * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
- *          <p>
- *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
- *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
- *
- *          <p>
- *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GenerateDataKeyPair</a> (key policy)</p>
- *          <p>
- *             <b>Related operations:</b>
- *          </p>
- *          <ul>
- *             <li>
- *                <p>
- *                   <a>Decrypt</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>Encrypt</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKey</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKeyPairWithoutPlaintext</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKeyWithoutPlaintext</a>
- *                </p>
- *             </li>
- *          </ul>
- * @example
- * Use a bare-bones client and the command you need to make an API call.
- * ```javascript
- * import { KMSClient, GenerateDataKeyPairCommand } from "@aws-sdk/client-kms"; // ES Modules import
- * // const { KMSClient, GenerateDataKeyPairCommand } = require("@aws-sdk/client-kms"); // CommonJS import
- * const client = new KMSClient(config);
- * const command = new GenerateDataKeyPairCommand(input);
- * const response = await client.send(command);
- * ```
- *
- * @see {@link GenerateDataKeyPairCommandInput} for command's `input` shape.
- * @see {@link GenerateDataKeyPairCommandOutput} for command's `response` shape.
- * @see {@link KMSClientResolvedConfig | config} for command's `input` shape.
- *
- */
-var GenerateDataKeyPairCommand = /** @class */ (function (_super) {
-    __extends(GenerateDataKeyPairCommand, _super);
-    // Start section: command_properties
-    // End section: command_properties
-    function GenerateDataKeyPairCommand(input) {
-        var _this = 
-        // Start section: command_constructor
-        _super.call(this) || this;
-        _this.input = input;
-        return _this;
-        // End section: command_constructor
-    }
-    /**
-     * @internal
-     */
-    GenerateDataKeyPairCommand.prototype.resolveMiddleware = function (clientStack, configuration, options) {
-        this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
-        var stack = clientStack.concat(this.middlewareStack);
-        var logger = configuration.logger;
-        var clientName = "KMSClient";
-        var commandName = "GenerateDataKeyPairCommand";
-        var handlerExecutionContext = {
-            logger: logger,
-            clientName: clientName,
-            commandName: commandName,
-            inputFilterSensitiveLog: GenerateDataKeyPairRequest.filterSensitiveLog,
-            outputFilterSensitiveLog: GenerateDataKeyPairResponse.filterSensitiveLog,
-        };
-        var requestHandler = configuration.requestHandler;
-        return stack.resolve(function (request) {
-            return requestHandler.handle(request.request, options || {});
-        }, handlerExecutionContext);
-    };
-    GenerateDataKeyPairCommand.prototype.serialize = function (input, context) {
-        return serializeAws_json1_1GenerateDataKeyPairCommand(input, context);
-    };
-    GenerateDataKeyPairCommand.prototype.deserialize = function (output, context) {
-        return deserializeAws_json1_1GenerateDataKeyPairCommand(output, context);
-    };
-    return GenerateDataKeyPairCommand;
-}($Command));
-export { GenerateDataKeyPairCommand };
-//# sourceMappingURL=GenerateDataKeyPairCommand.js.map

package/dist/es/commands/GenerateDataKeyPairCommand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"GenerateDataKeyPairCommand.js","sourceRoot":"","sources":["../../../commands/GenerateDataKeyPairCommand.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EACL,gDAAgD,EAChD,8CAA8C,GAC/C,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAc7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AACH;IAAgD,8CAI/C;IACC,oCAAoC;IACpC,kCAAkC;IAElC,oCAAqB,KAAsC;QAA3D;QACE,qCAAqC;QACrC,iBAAO,SAER;QAJoB,WAAK,GAAL,KAAK,CAAiC;;QAGzD,mCAAmC;IACrC,CAAC;IAED;;OAEG;IACH,sDAAiB,GAAjB,UACE,WAAmE,EACnE,aAAsC,EACtC,OAA8B;QAE9B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAE1F,IAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAE/C,IAAA,MAAM,GAAK,aAAa,OAAlB,CAAmB;QACjC,IAAM,UAAU,GAAG,WAAW,CAAC;QAC/B,IAAM,WAAW,GAAG,4BAA4B,CAAC;QACjD,IAAM,uBAAuB,GAA4B;YACvD,MAAM,QAAA;YACN,UAAU,YAAA;YACV,WAAW,aAAA;YACX,uBAAuB,EAAE,0BAA0B,CAAC,kBAAkB;YACtE,wBAAwB,EAAE,2BAA2B,CAAC,kBAAkB;SACzE,CAAC;QACM,IAAA,cAAc,GAAK,aAAa,eAAlB,CAAmB;QACzC,OAAO,KAAK,CAAC,OAAO,CAClB,UAAC,OAAsC;YACrC,OAAA,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,OAAwB,EAAE,OAAO,IAAI,EAAE,CAAC;QAAtE,CAAsE,EACxE,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAEO,8CAAS,GAAjB,UAAkB,KAAsC,EAAE,OAAuB;QAC/E,OAAO,8CAA8C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAEO,gDAAW,GAAnB,UAAoB,MAAsB,EAAE,OAAuB;QACjE,OAAO,gDAAgD,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAIH,iCAAC;AAAD,CAAC,AAtDD,CAAgD,QAAQ,GAsDvD"}

package/dist/es/commands/GenerateDataKeyPairWithoutPlaintextCommand.js

@@ -1,128 +0,0 @@
-import { __extends } from "tslib";
-import { GenerateDataKeyPairWithoutPlaintextRequest, GenerateDataKeyPairWithoutPlaintextResponse, } from "../models/models_0";
-import { deserializeAws_json1_1GenerateDataKeyPairWithoutPlaintextCommand, serializeAws_json1_1GenerateDataKeyPairWithoutPlaintextCommand, } from "../protocols/Aws_json1_1";
-import { getSerdePlugin } from "@aws-sdk/middleware-serde";
-import { Command as $Command } from "@aws-sdk/smithy-client";
-/**
- * <p>Generates a unique asymmetric data key pair. The
- *         <code>GenerateDataKeyPairWithoutPlaintext</code> operation returns a plaintext public key
- *       and a copy of the private key that is encrypted under the symmetric KMS key you specify. Unlike
- *         <a>GenerateDataKeyPair</a>, this operation does not return a plaintext private
- *       key. </p>
- *          <p>You can use the public key that <code>GenerateDataKeyPairWithoutPlaintext</code> returns
- *       to encrypt data or verify a signature outside of KMS. Then, store the encrypted private key
- *       with the data. When you are ready to decrypt data or sign a message, you can use the <a>Decrypt</a> operation to decrypt the encrypted private key.</p>
- *          <p>To generate a data key pair, you must specify a symmetric KMS key to
- *       encrypt the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
- *       custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
- *          <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
- *       key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs
- *       for either encryption or signing, but not both. However, KMS cannot enforce any restrictions
- *       on the use of data key pairs outside of KMS.</p>
- *          <p>
- *             <code>GenerateDataKeyPairWithoutPlaintext</code> returns a unique data key pair for each
- *       request. The bytes in the key are not related to the caller or KMS key that is used to encrypt the
- *       private key. The public key is a DER-encoded X.509 SubjectPublicKeyInfo, as specified in
- *         <a href="https://tools.ietf.org/html/rfc5280">RFC 5280</a>.</p>
- *
- *          <p>You can use the optional encryption context to add additional security to the encryption
- *       operation. If you specify an <code>EncryptionContext</code>, you must specify the same
- *       encryption context (a case-sensitive exact match) when decrypting the encrypted data key.
- *       Otherwise, the request to decrypt fails with an <code>InvalidCiphertextException</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption Context</a> in the
- *       <i>Key Management Service Developer Guide</i>.</p>
- *          <p>The KMS key that you use for this operation must be in a compatible key state. For
- * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
- *          <p>
- *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
- *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
- *
- *          <p>
- *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GenerateDataKeyPairWithoutPlaintext</a> (key policy)</p>
- *          <p>
- *             <b>Related operations:</b>
- *          </p>
- *          <ul>
- *             <li>
- *                <p>
- *                   <a>Decrypt</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>Encrypt</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKey</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKeyPair</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKeyWithoutPlaintext</a>
- *                </p>
- *             </li>
- *          </ul>
- * @example
- * Use a bare-bones client and the command you need to make an API call.
- * ```javascript
- * import { KMSClient, GenerateDataKeyPairWithoutPlaintextCommand } from "@aws-sdk/client-kms"; // ES Modules import
- * // const { KMSClient, GenerateDataKeyPairWithoutPlaintextCommand } = require("@aws-sdk/client-kms"); // CommonJS import
- * const client = new KMSClient(config);
- * const command = new GenerateDataKeyPairWithoutPlaintextCommand(input);
- * const response = await client.send(command);
- * ```
- *
- * @see {@link GenerateDataKeyPairWithoutPlaintextCommandInput} for command's `input` shape.
- * @see {@link GenerateDataKeyPairWithoutPlaintextCommandOutput} for command's `response` shape.
- * @see {@link KMSClientResolvedConfig | config} for command's `input` shape.
- *
- */
-var GenerateDataKeyPairWithoutPlaintextCommand = /** @class */ (function (_super) {
-    __extends(GenerateDataKeyPairWithoutPlaintextCommand, _super);
-    // Start section: command_properties
-    // End section: command_properties
-    function GenerateDataKeyPairWithoutPlaintextCommand(input) {
-        var _this = 
-        // Start section: command_constructor
-        _super.call(this) || this;
-        _this.input = input;
-        return _this;
-        // End section: command_constructor
-    }
-    /**
-     * @internal
-     */
-    GenerateDataKeyPairWithoutPlaintextCommand.prototype.resolveMiddleware = function (clientStack, configuration, options) {
-        this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
-        var stack = clientStack.concat(this.middlewareStack);
-        var logger = configuration.logger;
-        var clientName = "KMSClient";
-        var commandName = "GenerateDataKeyPairWithoutPlaintextCommand";
-        var handlerExecutionContext = {
-            logger: logger,
-            clientName: clientName,
-            commandName: commandName,
-            inputFilterSensitiveLog: GenerateDataKeyPairWithoutPlaintextRequest.filterSensitiveLog,
-            outputFilterSensitiveLog: GenerateDataKeyPairWithoutPlaintextResponse.filterSensitiveLog,
-        };
-        var requestHandler = configuration.requestHandler;
-        return stack.resolve(function (request) {
-            return requestHandler.handle(request.request, options || {});
-        }, handlerExecutionContext);
-    };
-    GenerateDataKeyPairWithoutPlaintextCommand.prototype.serialize = function (input, context) {
-        return serializeAws_json1_1GenerateDataKeyPairWithoutPlaintextCommand(input, context);
-    };
-    GenerateDataKeyPairWithoutPlaintextCommand.prototype.deserialize = function (output, context) {
-        return deserializeAws_json1_1GenerateDataKeyPairWithoutPlaintextCommand(output, context);
-    };
-    return GenerateDataKeyPairWithoutPlaintextCommand;
-}($Command));
-export { GenerateDataKeyPairWithoutPlaintextCommand };
-//# sourceMappingURL=GenerateDataKeyPairWithoutPlaintextCommand.js.map

package/dist/es/commands/GenerateDataKeyPairWithoutPlaintextCommand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"GenerateDataKeyPairWithoutPlaintextCommand.js","sourceRoot":"","sources":["../../../commands/GenerateDataKeyPairWithoutPlaintextCommand.ts"],"names":[],"mappings":";AACA,OAAO,EACL,0CAA0C,EAC1C,2CAA2C,GAC5C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gEAAgE,EAChE,8DAA8D,GAC/D,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAgB7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH;IAAgE,8DAI/D;IACC,oCAAoC;IACpC,kCAAkC;IAElC,oDAAqB,KAAsD;QAA3E;QACE,qCAAqC;QACrC,iBAAO,SAER;QAJoB,WAAK,GAAL,KAAK,CAAiD;;QAGzE,mCAAmC;IACrC,CAAC;IAED;;OAEG;IACH,sEAAiB,GAAjB,UACE,WAAmE,EACnE,aAAsC,EACtC,OAA8B;QAE9B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAE1F,IAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAE/C,IAAA,MAAM,GAAK,aAAa,OAAlB,CAAmB;QACjC,IAAM,UAAU,GAAG,WAAW,CAAC;QAC/B,IAAM,WAAW,GAAG,4CAA4C,CAAC;QACjE,IAAM,uBAAuB,GAA4B;YACvD,MAAM,QAAA;YACN,UAAU,YAAA;YACV,WAAW,aAAA;YACX,uBAAuB,EAAE,0CAA0C,CAAC,kBAAkB;YACtF,wBAAwB,EAAE,2CAA2C,CAAC,kBAAkB;SACzF,CAAC;QACM,IAAA,cAAc,GAAK,aAAa,eAAlB,CAAmB;QACzC,OAAO,KAAK,CAAC,OAAO,CAClB,UAAC,OAAsC;YACrC,OAAA,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,OAAwB,EAAE,OAAO,IAAI,EAAE,CAAC;QAAtE,CAAsE,EACxE,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAEO,8DAAS,GAAjB,UACE,KAAsD,EACtD,OAAuB;QAEvB,OAAO,8DAA8D,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IAEO,gEAAW,GAAnB,UACE,MAAsB,EACtB,OAAuB;QAEvB,OAAO,gEAAgE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3F,CAAC;IAIH,iDAAC;AAAD,CAAC,AA5DD,CAAgE,QAAQ,GA4DvE"}

package/dist/es/commands/GenerateDataKeyWithoutPlaintextCommand.js

@@ -1,134 +0,0 @@
-import { __extends } from "tslib";
-import { GenerateDataKeyWithoutPlaintextRequest, GenerateDataKeyWithoutPlaintextResponse } from "../models/models_0";
-import { deserializeAws_json1_1GenerateDataKeyWithoutPlaintextCommand, serializeAws_json1_1GenerateDataKeyWithoutPlaintextCommand, } from "../protocols/Aws_json1_1";
-import { getSerdePlugin } from "@aws-sdk/middleware-serde";
-import { Command as $Command } from "@aws-sdk/smithy-client";
-/**
- * <p>Generates a unique symmetric data key. This operation returns a data key that is encrypted
- *       under a KMS key that you specify. To request an asymmetric data key pair,
- *       use the <a>GenerateDataKeyPair</a> or <a>GenerateDataKeyPairWithoutPlaintext</a> operations.</p>
- *          <p>
- *             <code>GenerateDataKeyWithoutPlaintext</code> is identical to the <a>GenerateDataKey</a> operation except that returns only the encrypted copy of the
- *       data key. This operation is useful for systems that need to encrypt data at some point, but
- *       not immediately. When you need to encrypt the data, you call the <a>Decrypt</a>
- *       operation on the encrypted copy of the key. </p>
- *          <p>It's also useful in distributed systems with different levels of trust. For example, you
- *       might store encrypted data in containers. One component of your system creates new containers
- *       and stores an encrypted data key with each container. Then, a different component puts the
- *       data into the containers. That component first decrypts the data key, uses the plaintext data
- *       key to encrypt data, puts the encrypted data into the container, and then destroys the
- *       plaintext data key. In this system, the component that creates the containers never sees the
- *       plaintext data key.</p>
- *          <p>
- *             <code>GenerateDataKeyWithoutPlaintext</code> returns a unique data key for each request.
- *       The bytes in the keys are not related to the caller or KMS key that is used to encrypt the private
- *       key.</p>
- *
- *          <p>To generate a data key, you must specify the symmetric KMS key that is
- *       used to encrypt the data key. You cannot use an asymmetric KMS key to generate a data key. To get
- *       the type of your KMS key, use the <a>DescribeKey</a> operation.</p>
- *
- *          <p>If the operation succeeds, you will find the encrypted copy of the data key in the
- *         <code>CiphertextBlob</code> field.</p>
- *
- *          <p>You can use the optional encryption context to add additional security to the encryption
- *       operation. If you specify an <code>EncryptionContext</code>, you must specify the same
- *       encryption context (a case-sensitive exact match) when decrypting the encrypted data key.
- *       Otherwise, the request to decrypt fails with an <code>InvalidCiphertextException</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption Context</a> in the
- *       <i>Key Management Service Developer Guide</i>.</p>
- *          <p>The KMS key that you use for this operation must be in a compatible key state. For
- * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
- *          <p>
- *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
- *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
- *
- *          <p>
- *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GenerateDataKeyWithoutPlaintext</a> (key policy)</p>
- *          <p>
- *             <b>Related operations:</b>
- *          </p>
- *          <ul>
- *             <li>
- *                <p>
- *                   <a>Decrypt</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>Encrypt</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKey</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKeyPair</a>
- *                </p>
- *             </li>
- *             <li>
- *                <p>
- *                   <a>GenerateDataKeyPairWithoutPlaintext</a>
- *                </p>
- *             </li>
- *          </ul>
- * @example
- * Use a bare-bones client and the command you need to make an API call.
- * ```javascript
- * import { KMSClient, GenerateDataKeyWithoutPlaintextCommand } from "@aws-sdk/client-kms"; // ES Modules import
- * // const { KMSClient, GenerateDataKeyWithoutPlaintextCommand } = require("@aws-sdk/client-kms"); // CommonJS import
- * const client = new KMSClient(config);
- * const command = new GenerateDataKeyWithoutPlaintextCommand(input);
- * const response = await client.send(command);
- * ```
- *
- * @see {@link GenerateDataKeyWithoutPlaintextCommandInput} for command's `input` shape.
- * @see {@link GenerateDataKeyWithoutPlaintextCommandOutput} for command's `response` shape.
- * @see {@link KMSClientResolvedConfig | config} for command's `input` shape.
- *
- */
-var GenerateDataKeyWithoutPlaintextCommand = /** @class */ (function (_super) {
-    __extends(GenerateDataKeyWithoutPlaintextCommand, _super);
-    // Start section: command_properties
-    // End section: command_properties
-    function GenerateDataKeyWithoutPlaintextCommand(input) {
-        var _this = 
-        // Start section: command_constructor
-        _super.call(this) || this;
-        _this.input = input;
-        return _this;
-        // End section: command_constructor
-    }
-    /**
-     * @internal
-     */
-    GenerateDataKeyWithoutPlaintextCommand.prototype.resolveMiddleware = function (clientStack, configuration, options) {
-        this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
-        var stack = clientStack.concat(this.middlewareStack);
-        var logger = configuration.logger;
-        var clientName = "KMSClient";
-        var commandName = "GenerateDataKeyWithoutPlaintextCommand";
-        var handlerExecutionContext = {
-            logger: logger,
-            clientName: clientName,
-            commandName: commandName,
-            inputFilterSensitiveLog: GenerateDataKeyWithoutPlaintextRequest.filterSensitiveLog,
-            outputFilterSensitiveLog: GenerateDataKeyWithoutPlaintextResponse.filterSensitiveLog,
-        };
-        var requestHandler = configuration.requestHandler;
-        return stack.resolve(function (request) {
-            return requestHandler.handle(request.request, options || {});
-        }, handlerExecutionContext);
-    };
-    GenerateDataKeyWithoutPlaintextCommand.prototype.serialize = function (input, context) {
-        return serializeAws_json1_1GenerateDataKeyWithoutPlaintextCommand(input, context);
-    };
-    GenerateDataKeyWithoutPlaintextCommand.prototype.deserialize = function (output, context) {
-        return deserializeAws_json1_1GenerateDataKeyWithoutPlaintextCommand(output, context);
-    };
-    return GenerateDataKeyWithoutPlaintextCommand;
-}($Command));
-export { GenerateDataKeyWithoutPlaintextCommand };
-//# sourceMappingURL=GenerateDataKeyWithoutPlaintextCommand.js.map

package/dist/es/commands/GenerateDataKeyWithoutPlaintextCommand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"GenerateDataKeyWithoutPlaintextCommand.js","sourceRoot":"","sources":["../../../commands/GenerateDataKeyWithoutPlaintextCommand.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,sCAAsC,EAAE,uCAAuC,EAAE,MAAM,oBAAoB,CAAC;AACrH,OAAO,EACL,4DAA4D,EAC5D,0DAA0D,GAC3D,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAgB7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH;IAA4D,0DAI3D;IACC,oCAAoC;IACpC,kCAAkC;IAElC,gDAAqB,KAAkD;QAAvE;QACE,qCAAqC;QACrC,iBAAO,SAER;QAJoB,WAAK,GAAL,KAAK,CAA6C;;QAGrE,mCAAmC;IACrC,CAAC;IAED;;OAEG;IACH,kEAAiB,GAAjB,UACE,WAAmE,EACnE,aAAsC,EACtC,OAA8B;QAE9B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAE1F,IAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAE/C,IAAA,MAAM,GAAK,aAAa,OAAlB,CAAmB;QACjC,IAAM,UAAU,GAAG,WAAW,CAAC;QAC/B,IAAM,WAAW,GAAG,wCAAwC,CAAC;QAC7D,IAAM,uBAAuB,GAA4B;YACvD,MAAM,QAAA;YACN,UAAU,YAAA;YACV,WAAW,aAAA;YACX,uBAAuB,EAAE,sCAAsC,CAAC,kBAAkB;YAClF,wBAAwB,EAAE,uCAAuC,CAAC,kBAAkB;SACrF,CAAC;QACM,IAAA,cAAc,GAAK,aAAa,eAAlB,CAAmB;QACzC,OAAO,KAAK,CAAC,OAAO,CAClB,UAAC,OAAsC;YACrC,OAAA,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,OAAwB,EAAE,OAAO,IAAI,EAAE,CAAC;QAAtE,CAAsE,EACxE,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAEO,0DAAS,GAAjB,UACE,KAAkD,EAClD,OAAuB;QAEvB,OAAO,0DAA0D,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;IAEO,4DAAW,GAAnB,UACE,MAAsB,EACtB,OAAuB;QAEvB,OAAO,4DAA4D,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvF,CAAC;IAIH,6CAAC;AAAD,CAAC,AA5DD,CAA4D,QAAQ,GA4DnE"}