@aws-sdk/client-kms 3.345.0 → 3.346.0

package/dist-cjs/models/models_0.js

@@ -8,6 +8,8 @@ exports.AlgorithmSpec = {
     RSAES_OAEP_SHA_1: "RSAES_OAEP_SHA_1",
     RSAES_OAEP_SHA_256: "RSAES_OAEP_SHA_256",
     RSAES_PKCS1_V1_5: "RSAES_PKCS1_V1_5",
+    RSA_AES_KEY_WRAP_SHA_1: "RSA_AES_KEY_WRAP_SHA_1",
+    RSA_AES_KEY_WRAP_SHA_256: "RSA_AES_KEY_WRAP_SHA_256",
 };
 class AlreadyExistsException extends KMSServiceException_1.KMSServiceException {
     constructor(opts) {
@@ -701,6 +703,8 @@ class ExpiredImportTokenException extends KMSServiceException_1.KMSServiceExcept
 exports.ExpiredImportTokenException = ExpiredImportTokenException;
 exports.WrappingKeySpec = {
     RSA_2048: "RSA_2048",
+    RSA_3072: "RSA_3072",
+    RSA_4096: "RSA_4096",
 };
 class IncorrectKeyMaterialException extends KMSServiceException_1.KMSServiceException {
     constructor(opts) {

package/dist-es/models/models_0.js

@@ -4,6 +4,8 @@ export const AlgorithmSpec = {
     RSAES_OAEP_SHA_1: "RSAES_OAEP_SHA_1",
     RSAES_OAEP_SHA_256: "RSAES_OAEP_SHA_256",
     RSAES_PKCS1_V1_5: "RSAES_PKCS1_V1_5",
+    RSA_AES_KEY_WRAP_SHA_1: "RSA_AES_KEY_WRAP_SHA_1",
+    RSA_AES_KEY_WRAP_SHA_256: "RSA_AES_KEY_WRAP_SHA_256",
 };
 export class AlreadyExistsException extends __BaseException {
     constructor(opts) {
@@ -656,6 +658,8 @@ export class ExpiredImportTokenException extends __BaseException {
 }
 export const WrappingKeySpec = {
     RSA_2048: "RSA_2048",
+    RSA_3072: "RSA_3072",
+    RSA_4096: "RSA_4096",
 };
 export class IncorrectKeyMaterialException extends __BaseException {
     constructor(opts) {

package/dist-types/commands/CreateKeyCommand.d.ts

@@ -79,12 +79,6 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
  *             You can't change these properties after the KMS key is created.</p>
  *                <p>HMAC KMS keys are symmetric keys that never leave KMS unencrypted. You can use
  *             HMAC keys to generate (<a>GenerateMac</a>) and verify (<a>VerifyMac</a>) HMAC codes for messages up to 4096 bytes.</p>
- *                <p>HMAC KMS keys are not supported in all Amazon Web Services Regions. If you try to create an HMAC
- *             KMS key in an Amazon Web Services Region in which HMAC keys are not supported, the
- *               <code>CreateKey</code> operation returns an
- *             <code>UnsupportedOperationException</code>. For a list of Regions in which HMAC KMS keys
- *             are supported, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in
- *               KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *                <p> </p>
  *             </dd>
  *             <dt>Multi-Region primary keys</dt>
@@ -107,17 +101,17 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
  *                <p> </p>
  *             </dd>
  *             <dd>
- *                <p>To import your own key material into a KMS key, begin by creating a symmetric
- *             encryption KMS key with no key material. To do this, use the <code>Origin</code>
- *             parameter of <code>CreateKey</code> with a value of <code>EXTERNAL</code>. Next, use
- *               <a>GetParametersForImport</a> operation to get a public key and import
- *             token, and use the public key to encrypt your key material. Then, use <a>ImportKeyMaterial</a> with your import token to import the key material. For
- *             step-by-step instructions, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the <i>
+ *                <p>To import your own key material into a KMS key, begin by creating a KMS key with no
+ *             key material. To do this, use the <code>Origin</code> parameter of
+ *               <code>CreateKey</code> with a value of <code>EXTERNAL</code>. Next, use <a>GetParametersForImport</a> operation to get a public key and import token. Use
+ *             the wrapping public key to encrypt your key material. Then, use <a>ImportKeyMaterial</a> with your import token to import the key material. For step-by-step instructions, see
+ *               <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the <i>
  *                      <i>Key Management Service Developer Guide</i>
  *                   </i>.</p>
- *                <p>This feature supports only symmetric encryption KMS keys, including multi-Region
- *             symmetric encryption KMS keys. You cannot import key material into any other type of KMS
- *             key.</p>
+ *                <p>You can import key material into KMS keys of all supported KMS key types: symmetric
+ *             encryption KMS keys, HMAC KMS keys, asymmetric encryption KMS keys, and asymmetric
+ *             signing KMS keys. You can also create multi-Region keys with imported key material.
+ *             However, you can't import key material into a KMS key in a custom key store.</p>
  *                <p>To create a multi-Region primary key with imported key material, use the
  *               <code>Origin</code> parameter of <code>CreateKey</code> with a value of
  *               <code>EXTERNAL</code> and the <code>MultiRegion</code> parameter with a value of

package/dist-types/commands/DeleteImportedKeyMaterialCommand.d.ts

@@ -23,14 +23,13 @@ export interface DeleteImportedKeyMaterialCommandOutput extends __MetadataBearer
 }
 /**
  * @public
- * <p>Deletes key material that you previously imported. This operation makes the specified KMS
- *       key unusable. For more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a>
- *       in the <i>Key Management Service Developer Guide</i>. </p>
+ * <p>Deletes key material that was previously imported. This operation makes the specified KMS
+ *       key temporarily unusable. To restore the usability of the KMS key, reimport the same key
+ *       material. For more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a>
+ *       in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>When the specified KMS key is in the <code>PendingDeletion</code> state, this operation
  *       does not change the KMS key's state. Otherwise, it changes the KMS key's state to
  *         <code>PendingImport</code>.</p>
- *          <p>After you delete key material, you can use <a>ImportKeyMaterial</a> to reimport
- *       the same key material into the KMS key.</p>
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>

package/dist-types/commands/GetParametersForImportCommand.d.ts

@@ -23,19 +23,58 @@ export interface GetParametersForImportCommandOutput extends GetParametersForImp
 }
 /**
  * @public
- * <p>Returns the items you need to import key material into a symmetric encryption KMS key. For
- *       more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a> in the
- *       <i>Key Management Service Developer Guide</i>.</p>
- *          <p>This operation returns a public key and an import token. Use the public key to encrypt the
- *       symmetric key material. Store the import token to send with a subsequent <a>ImportKeyMaterial</a> request.</p>
- *          <p>You must specify the key ID of the symmetric encryption KMS key into which you will import
- *       key material. The KMS key <code>Origin</code> must be <code>EXTERNAL</code>. You must also
- *       specify the wrapping algorithm and type of wrapping key (public key) that you will use to
- *       encrypt the key material. You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account.</p>
- *          <p>To import key material, you must use the public key and import token from the same
- *       response. These items are valid for 24 hours. The expiration date and time appear in the
- *         <code>GetParametersForImport</code> response. You cannot use an expired token in an <a>ImportKeyMaterial</a> request. If your key and token expire, send another
- *         <code>GetParametersForImport</code> request.</p>
+ * <p>Returns the public key and an import token you need to import or reimport key material for
+ *       a KMS key. </p>
+ *          <p>By default, KMS keys are created with key material that KMS generates. This operation
+ *       supports <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key
+ *         material</a>, an advanced feature that lets you generate and import the cryptographic
+ *       key material for a KMS key. For more information about importing key material into KMS, see
+ *         <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key
+ *         material</a> in the <i>Key Management Service Developer Guide</i>.</p>
+ *          <p>Before calling <code>GetParametersForImport</code>, use the <a>CreateKey</a>
+ *       operation with an <code>Origin</code> value of <code>EXTERNAL</code> to create a KMS key with
+ *       no key material. You can import key material for a symmetric encryption KMS key, HMAC KMS key,
+ *       asymmetric encryption KMS key, or asymmetric signing KMS key. You can also import key material
+ *       into a <a href="kms/latest/developerguide/multi-region-keys-overview.html">multi-Region key</a> of
+ *       any supported type. However, you can't import key material into a KMS key in a <a href="kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. You can also use
+ *       <code>GetParametersForImport</code> to get a public key and import token to <a href="kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport the original key material</a> into a KMS key whose key material expired or was
+ *       deleted.</p>
+ *          <p>
+ *             <code>GetParametersForImport</code> returns the items that you need to import your key
+ *       material.</p>
+ *          <ul>
+ *             <li>
+ *                <p>The public key (or "wrapping key") of an RSA key pair that KMS generates.</p>
+ *                <p>You will use this public key to encrypt ("wrap") your key material while it's in
+ *           transit to KMS. </p>
+ *             </li>
+ *             <li>
+ *                <p>A import token that ensures that KMS can decrypt your key material and associate it with the correct KMS key.</p>
+ *             </li>
+ *          </ul>
+ *          <p>The public key and its import token are permanently linked and must be used together. Each
+ *       public key and import token set is valid for 24 hours. The expiration date and time appear in
+ *       the <code>ParametersValidTo</code> field in the <code>GetParametersForImport</code> response.
+ *       You cannot use an expired public key or import token in an <a>ImportKeyMaterial</a>
+ *       request. If your key and token expire, send another <code>GetParametersForImport</code>
+ *       request.</p>
+ *          <p>
+ *             <code>GetParametersForImport</code> requires the following information:</p>
+ *          <ul>
+ *             <li>
+ *                <p>The key ID of the KMS key for which you are importing the key material.</p>
+ *             </li>
+ *             <li>
+ *                <p>The key spec of the public key ("wrapping key") that you will use to encrypt your key
+ *           material during import.</p>
+ *             </li>
+ *             <li>
+ *                <p>The wrapping algorithm that you will use with the public key to encrypt your key
+ *           material.</p>
+ *             </li>
+ *          </ul>
+ *          <p>You can use the same or a different public key spec and wrapping algorithm each time you
+ *       import or reimport the same key material. </p>
  *          <p>The KMS key that you use for this operation must be in a compatible key state. For
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
  *          <p>
@@ -65,8 +104,8 @@ export interface GetParametersForImportCommandOutput extends GetParametersForImp
  * const client = new KMSClient(config);
  * const input = { // GetParametersForImportRequest
  *   KeyId: "STRING_VALUE", // required
- *   WrappingAlgorithm: "RSAES_PKCS1_V1_5" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256", // required
- *   WrappingKeySpec: "RSA_2048", // required
+ *   WrappingAlgorithm: "RSAES_PKCS1_V1_5" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "RSA_AES_KEY_WRAP_SHA_1" || "RSA_AES_KEY_WRAP_SHA_256", // required
+ *   WrappingKeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096", // required
  * };
  * const command = new GetParametersForImportCommand(input);
  * const response = await client.send(command);

package/dist-types/commands/ImportKeyMaterialCommand.d.ts

@@ -23,29 +23,66 @@ export interface ImportKeyMaterialCommandOutput extends ImportKeyMaterialRespons
 }
 /**
  * @public
- * <p>Imports key material into an existing symmetric encryption KMS key that was created
- *       without key material. After you successfully import key material into a KMS key, you can
- *         <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport the same key material</a> into that KMS key, but you cannot import different
- *       key material. </p>
- *          <p>You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account. For more information about creating KMS keys with no key material
- *       and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the
- *       <i>Key Management Service Developer Guide</i>.</p>
- *          <p>Before using this operation, call <a>GetParametersForImport</a>. Its response
- *       includes a public key and an import token. Use the public key to encrypt the key material.
- *       Then, submit the import token from the same <code>GetParametersForImport</code>
- *       response.</p>
- *          <p>When calling this operation, you must specify the following values:</p>
+ * <p>Imports or reimports key material into an existing KMS key that was created without key
+ *       material. <code>ImportKeyMaterial</code> also sets the expiration model and expiration date of
+ *       the imported key material.</p>
+ *          <p>By default, KMS keys are created with key material that KMS generates. This operation
+ *       supports <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key
+ *         material</a>, an advanced feature that lets you generate and import the cryptographic
+ *       key material for a KMS key. For more information about importing key material into KMS, see
+ *         <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key
+ *         material</a> in the <i>Key Management Service Developer Guide</i>.</p>
+ *          <p>After you successfully import key material into a KMS key, you can <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport
+ *         the same key material</a> into that KMS key, but you cannot import different key
+ *       material. You might reimport key material to replace key material that expired or key material
+ *       that you deleted. You might also reimport key material to change the expiration model or
+ *       expiration date of the key material. Before reimporting key material, if necessary, call <a>DeleteImportedKeyMaterial</a> to delete the current imported key material. </p>
+ *          <p>Each time you import key material into KMS, you can determine whether
+ *         (<code>ExpirationModel</code>) and when (<code>ValidTo</code>) the key material expires. To
+ *       change the expiration of your key material, you must import it again, either by calling
+ *       <code>ImportKeyMaterial</code> or using the <a href="kms/latest/developerguide/importing-keys-import-key-material.html#importing-keys-import-key-material-console">import features</a> of the
+ *       KMS console.</p>
+ *          <p>Before calling <code>ImportKeyMaterial</code>:</p>
  *          <ul>
  *             <li>
- *                <p>The key ID or key ARN of a KMS key with no key material. Its <code>Origin</code> must
- *           be <code>EXTERNAL</code>.</p>
- *                <p>To create a KMS key with no key material, call <a>CreateKey</a> and set the
- *           value of its <code>Origin</code> parameter to <code>EXTERNAL</code>. To get the
- *             <code>Origin</code> of a KMS key, call <a>DescribeKey</a>.)</p>
+ *                <p>Create or identify a KMS key with no key material. The KMS key must have an
+ *             <code>Origin</code> value of <code>EXTERNAL</code>, which indicates that the KMS key is
+ *           designed for imported key material. </p>
+ *                <p>To create an new KMS key for imported key material, call the <a>CreateKey</a> operation with an <code>Origin</code> value of <code>EXTERNAL</code>. You can create a
+ *           symmetric encryption KMS key, HMAC KMS key, asymmetric encryption KMS key, or asymmetric
+ *           signing KMS key. You can also import key material into a <a href="kms/latest/developerguide/multi-region-keys-overview.html">multi-Region key</a> of any
+ *           supported type. However, you can't import key material into a KMS key in a <a href="kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>.</p>
  *             </li>
  *             <li>
- *                <p>The encrypted key material. To get the public key to encrypt the key material, call
- *             <a>GetParametersForImport</a>.</p>
+ *                <p>Use the <a>DescribeKey</a> operation to verify that the
+ *             <code>KeyState</code> of the KMS key is <code>PendingImport</code>, which indicates that
+ *           the KMS key has no key material. </p>
+ *                <p>If you are reimporting the same key material into an existing KMS key, you might need
+ *           to call the <a>DeleteImportedKeyMaterial</a> to delete its existing key
+ *           material.</p>
+ *             </li>
+ *             <li>
+ *                <p>Call the <a>GetParametersForImport</a> operation to get a public key and
+ *           import token set for importing key material. </p>
+ *             </li>
+ *             <li>
+ *                <p>Use the public key in the <a>GetParametersForImport</a> response to encrypt
+ *           your key material.</p>
+ *             </li>
+ *          </ul>
+ *          <p> Then, in an <code>ImportKeyMaterial</code> request, you submit your encrypted key
+ *       material and import token. When calling this operation, you must specify the following
+ *       values:</p>
+ *          <ul>
+ *             <li>
+ *                <p>The key ID or key ARN of the KMS key to associate with the imported key material. Its
+ *             <code>Origin</code> must be <code>EXTERNAL</code> and its <code>KeyState</code> must be
+ *             <code>PendingImport</code>. You cannot perform this operation on a KMS key in a <a href="kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>, or on a KMS
+ *           key in a different Amazon Web Services account. To get the <code>Origin</code> and <code>KeyState</code>
+ *           of a KMS key, call <a>DescribeKey</a>.</p>
+ *             </li>
+ *             <li>
+ *                <p>The encrypted key material. </p>
  *             </li>
  *             <li>
  *                <p>The import token that <a>GetParametersForImport</a> returned. You must use
@@ -53,15 +90,17 @@ export interface ImportKeyMaterialCommandOutput extends ImportKeyMaterialRespons
  *             </li>
  *             <li>
  *                <p>Whether the key material expires (<code>ExpirationModel</code>) and, if so, when
- *             (<code>ValidTo</code>). If you set an expiration date, on the specified date, KMS
- *           deletes the key material from the KMS key, making the KMS key unusable. To use the KMS key
- *           in cryptographic operations again, you must reimport the same key material. The only way
- *           to change the expiration model or expiration date is by reimporting the same key material
- *           and specifying a new expiration date. </p>
+ *             (<code>ValidTo</code>). For help with this choice, see <a href="https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration">Setting an expiration time</a> in the <i>Key Management Service Developer Guide</i>.</p>
+ *                <p>If you set an expiration date, KMS deletes the key material from the KMS key on the
+ *           specified date, making the KMS key unusable. To use the KMS key in cryptographic
+ *           operations again, you must reimport the same key material. However, you can delete and
+ *           reimport the key material at any time, including before the key material expires. Each
+ *           time you reimport, you can eliminate or reset the expiration time.</p>
  *             </li>
  *          </ul>
  *          <p>When this operation is successful, the key state of the KMS key changes from
- *         <code>PendingImport</code> to <code>Enabled</code>, and you can use the KMS key.</p>
+ *         <code>PendingImport</code> to <code>Enabled</code>, and you can use the KMS key in
+ *       cryptographic operations.</p>
  *          <p>If this operation fails, use the exception to help determine the problem. If the error is
  *       related to the key material, the import token, or wrapping key, use <a>GetParametersForImport</a> to get a new public key and import token for the KMS key
  *       and repeat the import procedure. For help, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#importing-keys-overview">How To Import Key

package/dist-types/commands/ScheduleKeyDeletionCommand.d.ts

@@ -34,8 +34,10 @@ export interface ScheduleKeyDeletionCommandOutput extends ScheduleKeyDeletionRes
  *          <important>
  *             <p>Deleting a KMS key is a destructive and potentially dangerous operation. When a KMS key
  *         is deleted, all data that was encrypted under the KMS key is unrecoverable. (The only
- *         exception is a multi-Region replica key.) To prevent the use of a KMS key without deleting
- *         it, use <a>DisableKey</a>. </p>
+ *         exception is a <a href="kms/latest/developerguide/multi-region-keys-delete.html">multi-Region replica
+ *           key</a>, or an asymmetric or HMAC KMS key with imported key material[BUGBUG-link to
+ *         importing-keys-managing.html#import-delete-key.) To prevent the use of a KMS key without
+ *         deleting it, use <a>DisableKey</a>. </p>
  *          </important>
  *          <p>You can schedule the deletion of a multi-Region primary key and its replica keys at any
  *       time. However, KMS will not delete a multi-Region primary key with existing replica keys. If

package/dist-types/models/models_0.d.ts

@@ -8,6 +8,8 @@ export declare const AlgorithmSpec: {
     readonly RSAES_OAEP_SHA_1: "RSAES_OAEP_SHA_1";
     readonly RSAES_OAEP_SHA_256: "RSAES_OAEP_SHA_256";
     readonly RSAES_PKCS1_V1_5: "RSAES_PKCS1_V1_5";
+    readonly RSA_AES_KEY_WRAP_SHA_1: "RSA_AES_KEY_WRAP_SHA_1";
+    readonly RSA_AES_KEY_WRAP_SHA_256: "RSA_AES_KEY_WRAP_SHA_256";
 };
 /**
  * @public
@@ -3313,6 +3315,8 @@ export interface GetKeyRotationStatusResponse {
  */
 export declare const WrappingKeySpec: {
     readonly RSA_2048: "RSA_2048";
+    readonly RSA_3072: "RSA_3072";
+    readonly RSA_4096: "RSA_4096";
 };
 /**
  * @public
@@ -3323,8 +3327,10 @@ export type WrappingKeySpec = (typeof WrappingKeySpec)[keyof typeof WrappingKeyS
  */
 export interface GetParametersForImportRequest {
     /**
-     * <p>The identifier of the symmetric encryption KMS key into which you will import key
-     *       material. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>.</p>
+     * <p>The identifier of the KMS key that will be associated with the imported key material. The
+     *         <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>.</p>
+     *          <p>All KMS key types are supported, including multi-Region keys. However, you cannot import
+     *       key material into a KMS key in a custom key store.</p>
      *          <p>Specify the key ID or key ARN of the KMS key.</p>
      *          <p>For example:</p>
      *          <ul>
@@ -3341,19 +3347,50 @@ export interface GetParametersForImportRequest {
      */
     KeyId: string | undefined;
     /**
-     * <p>The algorithm you will use to encrypt the key material before using the <a>ImportKeyMaterial</a> operation to import it. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-encrypt-key-material.html">Encrypt the
-     *         key material</a> in the <i>Key Management Service Developer Guide</i>.</p>
-     *          <important>
-     *             <p>The <code>RSAES_PKCS1_V1_5</code> wrapping algorithm is deprecated. We recommend that
-     *         you begin using a different wrapping algorithm immediately. KMS will end support for
-     *           <code>RSAES_PKCS1_V1_5</code> by October 1, 2023 pursuant to <a href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf">cryptographic key management guidance</a> from the National Institute of Standards
-     *         and Technology (NIST).</p>
-     *          </important>
+     * <p>The algorithm you will use with the RSA public key (<code>PublicKey</code>) in the
+     *       response to protect your key material during import. For more information, see <a href="kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm">Select a wrapping algorithm</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *          <p>For RSA_AES wrapping algorithms, you encrypt your key material with an AES key that you
+     *       generate, then encrypt your AES key with the RSA public key from KMS. For RSAES wrapping
+     *       algorithms, you encrypt your key material directly with the RSA public key from KMS.</p>
+     *          <p>The wrapping algorithms that you can use depend on the type of key material that you are
+     *       importing. To import an RSA private key, you must use an RSA_AES wrapping algorithm.</p>
+     *          <ul>
+     *             <li>
+     *                <p>
+     *                   <b>RSA_AES_KEY_WRAP_SHA_256</b> — Supported for wrapping RSA and ECC key
+     *           material.</p>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <b>RSA_AES_KEY_WRAP_SHA_1</b> — Supported for wrapping RSA and ECC key material.</p>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <b>RSAES_OAEP_SHA_256</b> — Supported for all types of key material, except RSA key material (private key).</p>
+     *                <p>You cannot use the RSAES_OAEP_SHA_256 wrapping algorithm with the RSA_2048 wrapping key spec to wrap
+     *           ECC_NIST_P521 key material.</p>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <b>RSAES_OAEP_SHA_1</b> — Supported for all types of key material, except RSA key material (private
+     *           key).</p>
+     *                <p>You cannot use the RSAES_OAEP_SHA_1 wrapping algorithm with the RSA_2048 wrapping key spec to wrap
+     *           ECC_NIST_P521 key material.</p>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <b>RSAES_PKCS1_V1_5</b> (Deprecated) — Supported only for symmetric encryption key
+     *           material (and only in legacy mode).</p>
+     *             </li>
+     *          </ul>
      */
     WrappingAlgorithm: AlgorithmSpec | string | undefined;
     /**
-     * <p>The type of wrapping key (public key) to return in the response. Only 2048-bit RSA public
-     *       keys are supported.</p>
+     * <p>The type of RSA public key to return in the response. You will use this wrapping key with
+     *       the specified wrapping algorithm to protect your key material during import. </p>
+     *          <p>Use the longest RSA wrapping key that is practical. </p>
+     *          <p>You cannot use an RSA_2048 public key to directly wrap an ECC_NIST_P521 private key.
+     *       Instead, use an RSA_AES wrapping algorithm or choose a longer RSA public key.</p>
      */
     WrappingKeySpec: WrappingKeySpec | string | undefined;
 }
@@ -3523,12 +3560,15 @@ export interface GrantListEntry {
  */
 export interface ImportKeyMaterialRequest {
     /**
-     * <p>The identifier of the symmetric encryption KMS key that receives the imported key
-     *       material. This must be the same KMS key specified in the <code>KeyID</code> parameter of the
-     *       corresponding <a>GetParametersForImport</a> request. The <code>Origin</code> of the
-     *       KMS key must be <code>EXTERNAL</code>. You cannot perform this operation on an asymmetric KMS
-     *       key, an HMAC KMS key, a KMS key in a custom key store, or on a KMS key in a different
-     *       Amazon Web Services account</p>
+     * <p>The identifier of the KMS key that will be associated with the imported key material. This
+     *       must be the same KMS key specified in the <code>KeyID</code> parameter of the corresponding
+     *         <a>GetParametersForImport</a> request. The <code>Origin</code> of the KMS key
+     *       must be <code>EXTERNAL</code> and its <code>KeyState</code> must be
+     *       <code>PendingImport</code>. </p>
+     *          <p>The KMS key can be a symmetric encryption KMS key, HMAC KMS key, asymmetric encryption KMS
+     *       key, or asymmetric signing KMS key, including a <a href="kms/latest/developerguide/multi-region-keys-overview.html">multi-Region key</a> of any supported
+     *       type. You cannot perform this operation on a KMS key in a custom key store, or on a KMS key in
+     *       a different Amazon Web Services account.</p>
      *          <p>Specify the key ID or key ARN of the KMS key.</p>
      *          <p>For example:</p>
      *          <ul>
@@ -3550,7 +3590,7 @@ export interface ImportKeyMaterialRequest {
      */
     ImportToken: Uint8Array | undefined;
     /**
-     * <p>The encrypted key material to import. The key material must be encrypted with the public
+     * <p>The encrypted key material to import. The key material must be encrypted under the public
      *       wrapping key that <a>GetParametersForImport</a> returned, using the wrapping
      *       algorithm that you specified in the same <code>GetParametersForImport</code> request.</p>
      */
@@ -3570,13 +3610,14 @@ export interface ImportKeyMaterialRequest {
     ValidTo?: Date;
     /**
      * <p>Specifies whether the key material expires. The default is
-     *         <code>KEY_MATERIAL_EXPIRES</code>.</p>
+     *         <code>KEY_MATERIAL_EXPIRES</code>. For help with this choice, see <a href="https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration">Setting an expiration time</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>When the value of <code>ExpirationModel</code> is <code>KEY_MATERIAL_EXPIRES</code>, you
      *       must specify a value for the <code>ValidTo</code> parameter. When value is
      *         <code>KEY_MATERIAL_DOES_NOT_EXPIRE</code>, you must omit the <code>ValidTo</code>
      *       parameter.</p>
      *          <p>You cannot change the <code>ExpirationModel</code> or <code>ValidTo</code> values for the
-     *       current import after the request completes. To change either value, you must delete (<a>DeleteImportedKeyMaterial</a>) and reimport the key material.</p>
+     *       current import after the request completes. To change either value, you must reimport the key
+     *       material.</p>
      */
     ExpirationModel?: ExpirationModelType | string;
 }
@@ -4454,7 +4495,11 @@ export interface ScheduleKeyDeletionRequest {
      *       when the last of its replica keys is deleted. Otherwise, the waiting period begins
      *       immediately.</p>
      *          <p>This value is optional. If you include a value, it must be between 7 and 30, inclusive. If
-     *       you do not include a value, it defaults to 30.</p>
+     *       you do not include a value, it defaults to 30. You can use the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-pending-deletion-window">
+     *                <code>kms:ScheduleKeyDeletionPendingWindowInDays</code>
+     *             </a>
+     *       condition key to further constrain the values that principals can specify in the
+     *       <code>PendingWindowInDays</code> parameter.</p>
      */
     PendingWindowInDays?: number;
 }
@@ -4592,7 +4637,7 @@ export interface SignResponse {
      *             <li>
      *                <p>When used with the <code>ECDSA_SHA_256</code>, <code>ECDSA_SHA_384</code>, or
      *             <code>ECDSA_SHA_512</code> signing algorithms, this value is a DER-encoded object as
-     *           defined by ANS X9.62–2005 and <a href="https://tools.ietf.org/html/rfc3279#section-2.2.3">RFC 3279 Section 2.2.3</a>.
+     *           defined by ANSI X9.62–2005 and <a href="https://tools.ietf.org/html/rfc3279#section-2.2.3">RFC 3279 Section 2.2.3</a>.
      *           This is the most commonly used signature format and is appropriate for most uses.
      *           </p>
      *             </li>

package/dist-types/ts3.4/models/models_0.d.ts

@@ -4,6 +4,8 @@ export declare const AlgorithmSpec: {
   readonly RSAES_OAEP_SHA_1: "RSAES_OAEP_SHA_1";
   readonly RSAES_OAEP_SHA_256: "RSAES_OAEP_SHA_256";
   readonly RSAES_PKCS1_V1_5: "RSAES_PKCS1_V1_5";
+  readonly RSA_AES_KEY_WRAP_SHA_1: "RSA_AES_KEY_WRAP_SHA_1";
+  readonly RSA_AES_KEY_WRAP_SHA_256: "RSA_AES_KEY_WRAP_SHA_256";
 };
 export type AlgorithmSpec = (typeof AlgorithmSpec)[keyof typeof AlgorithmSpec];
 export interface AliasListEntry {
@@ -822,6 +824,8 @@ export interface GetKeyRotationStatusResponse {
 }
 export declare const WrappingKeySpec: {
   readonly RSA_2048: "RSA_2048";
+  readonly RSA_3072: "RSA_3072";
+  readonly RSA_4096: "RSA_4096";
 };
 export type WrappingKeySpec =
   (typeof WrappingKeySpec)[keyof typeof WrappingKeySpec];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aws-sdk/client-kms",
   "description": "AWS SDK for JavaScript Kms Client for Node.js, Browser and React Native",
-  "version": "3.345.0",
+  "version": "3.346.0",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
     "build:cjs": "tsc -p tsconfig.cjs.json",