@aws-sdk/client-kms 3.72.0 → 3.75.0

package/dist-types/KMS.d.ts

@@ -21,6 +21,7 @@ import { GenerateDataKeyCommandInput, GenerateDataKeyCommandOutput } from "./com
 import { GenerateDataKeyPairCommandInput, GenerateDataKeyPairCommandOutput } from "./commands/GenerateDataKeyPairCommand";
 import { GenerateDataKeyPairWithoutPlaintextCommandInput, GenerateDataKeyPairWithoutPlaintextCommandOutput } from "./commands/GenerateDataKeyPairWithoutPlaintextCommand";
 import { GenerateDataKeyWithoutPlaintextCommandInput, GenerateDataKeyWithoutPlaintextCommandOutput } from "./commands/GenerateDataKeyWithoutPlaintextCommand";
+import { GenerateMacCommandInput, GenerateMacCommandOutput } from "./commands/GenerateMacCommand";
 import { GenerateRandomCommandInput, GenerateRandomCommandOutput } from "./commands/GenerateRandomCommand";
 import { GetKeyPolicyCommandInput, GetKeyPolicyCommandOutput } from "./commands/GetKeyPolicyCommand";
 import { GetKeyRotationStatusCommandInput, GetKeyRotationStatusCommandOutput } from "./commands/GetKeyRotationStatusCommand";
@@ -47,6 +48,7 @@ import { UpdateCustomKeyStoreCommandInput, UpdateCustomKeyStoreCommandOutput } f
 import { UpdateKeyDescriptionCommandInput, UpdateKeyDescriptionCommandOutput } from "./commands/UpdateKeyDescriptionCommand";
 import { UpdatePrimaryRegionCommandInput, UpdatePrimaryRegionCommandOutput } from "./commands/UpdatePrimaryRegionCommand";
 import { VerifyCommandInput, VerifyCommandOutput } from "./commands/VerifyCommand";
+import { VerifyMacCommandInput, VerifyMacCommandOutput } from "./commands/VerifyMacCommand";
 import { KMSClient } from "./KMSClient";
 /**
  * <fullname>Key Management Service</fullname>
@@ -65,7 +67,10 @@ import { KMSClient } from "./KMSClient";
  *         download and install them, see <a href="http://aws.amazon.com/tools/">Tools for Amazon Web
  *           Services</a>.</p>
  *          </note>
- *          <p>We recommend that you use the Amazon Web Services SDKs to make programmatic API calls to KMS.</p>
+ *          <p>We recommend that you use the Amazon Web Services SDKs to make programmatic API calls to KMS. </p>
+ *          <p>If you need to use FIPS 140-2 validated cryptographic modules when communicating with
+ *       Amazon Web Services, use the FIPS endpoint in your preferred Amazon Web Services Region. For more information about the
+ *       available FIPS endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">Service endpoints</a> in the Key Management Service topic of the <i>Amazon Web Services General Reference</i>.</p>
  *          <p>Clients must support TLS (Transport Layer Security) 1.0. We recommend TLS 1.2. Clients
  *       must also support cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral
  *       Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems
@@ -147,7 +152,7 @@ export declare class KMS extends KMSClient {
      *          <p>For more information about scheduling and canceling deletion of a KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html">Deleting KMS keys</a> in the
      *       <i>Key Management Service Developer Guide</i>.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account
      *         use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
@@ -230,7 +235,7 @@ export declare class KMS extends KMSClient {
     /**
      * <p>Creates a friendly name for a KMS key. </p>
      *          <note>
-     *             <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">Using ABAC in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *             <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          </note>
      *          <p>You can use an alias to identify a KMS key in the KMS console, in the <a>DescribeKey</a> operation and in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a>, such as <a>Encrypt</a> and
      *         <a>GenerateDataKey</a>. You can also change the KMS key that's associated with
@@ -245,7 +250,7 @@ export declare class KMS extends KMSClient {
      *          <p>This operation does not return a response. To get the alias that you created, use the
      *         <a>ListAliases</a> operation.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>: No. You cannot perform this operation on an alias in a different Amazon Web Services account.</p>
      *
@@ -352,7 +357,7 @@ export declare class KMS extends KMSClient {
      *       grants are considered along with key policies and IAM policies. Grants are often used for
      *       temporary permissions because you can create one, use its permissions, and delete it without
      *       changing your key policies or IAM policies. </p>
-     *          <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Using grants</a> in the
+     *          <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Grants in KMS</a> in the
      *         <i>
      *                <i>Key Management Service Developer Guide</i>
      *             </i>. For examples of working with grants in several
@@ -377,7 +382,7 @@ export declare class KMS extends KMSClient {
      *             </li>
      *          </ul>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>: Yes.
      *       To perform this operation on a KMS key in a different Amazon Web Services account, specify the key
@@ -415,53 +420,53 @@ export declare class KMS extends KMSClient {
     createGrant(args: CreateGrantCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: CreateGrantCommandOutput) => void): void;
     /**
      * <p>Creates a unique customer managed <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys">KMS key</a> in your Amazon Web Services account and
-     *       Region.</p>
+     *       Region. </p>
+     *          <p>In addition to the required parameters, you can use the optional parameters to specify a key policy, description, tags, and other useful elements for any key type.</p>
      *          <note>
      *             <p>KMS is replacing the term <i>customer master key (CMK)</i> with <i>KMS key</i> and <i>KMS key</i>. The concept has not changed. To prevent breaking changes, KMS is keeping some variations of this term.</p>
      *          </note>
      *
-     *          <p>You can use the <code>CreateKey</code> operation to create symmetric or asymmetric KMS
-     *       keys.</p>
-     *          <ul>
-     *             <li>
-     *                <p>
-     *                   <b>Symmetric KMS keys</b> contain a 256-bit symmetric key
-     *           that never leaves KMS unencrypted. To use the KMS key, you must call KMS. You can use
-     *           a symmetric KMS key to encrypt and decrypt small amounts of data, but they are typically
-     *           used to generate <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-keys">data keys</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-key-pairs">data keys pairs</a>. For details,
-     *           see <a>GenerateDataKey</a> and <a>GenerateDataKeyPair</a>.</p>
-     *             </li>
-     *             <li>
-     *                <p>
-     *                   <b>Asymmetric KMS keys</b> can contain an RSA key pair or an
-     *           Elliptic Curve (ECC) key pair. The private key in an asymmetric KMS key never leaves KMS
-     *           unencrypted. However, you can use the <a>GetPublicKey</a> operation to download
-     *           the public key so it can be used outside of KMS. KMS keys with RSA key pairs can be used
-     *           to encrypt or decrypt data or sign and verify messages (but not both). KMS keys with ECC
-     *           key pairs can be used only to sign and verify messages.</p>
-     *             </li>
-     *          </ul>
-     *          <p>For information about symmetric and asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Using Symmetric and Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
-     *
      *
      *          <p>To create different types of KMS keys, use the following guidance:</p>
      *
      *          <dl>
+     *             <dt>Symmetric encryption KMS key</dt>
+     *             <dd>
+     *                <p>To create a symmetric encryption KMS key, you aren't required to specify any parameters. The default value for
+     *             <code>KeySpec</code>, <code>SYMMETRIC_DEFAULT</code>, and the default value for
+     *             <code>KeyUsage</code>, <code>ENCRYPT_DECRYPT</code>, create a symmetric encryption KMS key.</p>
+     *                <p>If you need a key for basic encryption and decryption or you
+     *             are creating a KMS key to protect your resources in an Amazon Web Services service, create a symmetric encryption KMS key. The key material in a symmetric encryption key never leaves KMS unencrypted. You can use a symmetric encryption KMS key to encrypt and decrypt data up to 4,096 bytes, but they are typically used to generate data keys and data keys pairs. For details, see <a>GenerateDataKey</a> and <a>GenerateDataKeyPair</a>.</p>
+     *                <p> </p>
+     *             </dd>
      *             <dt>Asymmetric KMS keys</dt>
      *             <dd>
      *                <p>To create an asymmetric KMS key, use the <code>KeySpec</code> parameter to specify
      *             the type of key material in the KMS key. Then, use the <code>KeyUsage</code> parameter
      *             to determine whether the KMS key will be used to encrypt and decrypt or sign and verify.
      *             You can't change these properties after the KMS key is created.</p>
+     *                <p>Asymmetric KMS keys contain an RSA key pair or an Elliptic Curve (ECC) key pair. The private key in an asymmetric
+     *             KMS key never leaves AWS KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to download the public key
+     *             so it can be used outside of AWS KMS. KMS keys with RSA key pairs can be used to encrypt or decrypt data or sign and verify messages (but not both).
+     *             KMS keys with ECC key pairs can be used only to sign and verify messages.
+     *             For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *                <p> </p>
      *             </dd>
-     *             <dt>Symmetric KMS keys</dt>
+     *             <dt>HMAC KMS key</dt>
      *             <dd>
-     *                <p>When creating a symmetric KMS key, you don't need to specify the
-     *               <code>KeySpec</code> or <code>KeyUsage</code> parameters. The default value for
-     *               <code>KeySpec</code>, <code>SYMMETRIC_DEFAULT</code>, and the default value for
-     *               <code>KeyUsage</code>, <code>ENCRYPT_DECRYPT</code>, are the only valid values for
-     *             symmetric KMS keys. </p>
+     *                <p>To create an HMAC KMS key, set the <code>KeySpec</code> parameter to a
+     *           key spec value for HMAC KMS keys. Then set the <code>KeyUsage</code> parameter to
+     *           <code>GENERATE_VERIFY_MAC</code>. You must set the key usage even though
+     *           <code>GENERATE_VERIFY_MAC</code> is the only valid key usage value for HMAC KMS keys.
+     *           You can't change these properties after the KMS key is created.</p>
+     *                <p>HMAC KMS keys are symmetric keys that never leave KMS unencrypted. You can use
+     *             HMAC keys to generate (<a>GenerateMac</a>) and verify (<a>VerifyMac</a>) HMAC codes for messages up to 4096 bytes.</p>
+     *                <p>HMAC KMS keys are not supported in all Amazon Web Services Regions. If you try to create an HMAC
+     *             KMS key in an Amazon Web Services Region in which HMAC keys are not supported, the
+     *               <code>CreateKey</code> operation returns an
+     *             <code>UnsupportedOperationException</code>. For a list of Regions in which HMAC KMS keys
+     *             are supported, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in
+     *               KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *                <p> </p>
      *             </dd>
      *             <dt>Multi-Region primary keys</dt>
@@ -473,38 +478,42 @@ export declare class KMS extends KMSClient {
      *             and key material as a primary key, but in a different Amazon Web Services Region, use the <a>ReplicateKey</a> operation. To change a replica key to a primary key, and its
      *             primary key to a replica key, use the <a>UpdatePrimaryRegion</a>
      *             operation.</p>
+     *                <p>You can create multi-Region KMS keys for all supported KMS key types: symmetric
+     *             encryption KMS keys, HMAC KMS keys, asymmetric encryption KMS keys, and asymmetric
+     *             signing KMS keys. You can also create multi-Region keys with imported key material.
+     *             However, you can't create multi-Region keys in a custom key store.</p>
      *                <p>This operation supports <i>multi-Region keys</i>, an KMS feature that lets you create multiple
      *       interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key
      *       material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt
-     *       it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Using multi-Region keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
-     *                <p>You can create symmetric and asymmetric multi-Region keys and multi-Region keys with
-     *             imported key material. You cannot create multi-Region keys in a custom key store.</p>
+     *       it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *                <p> </p>
      *             </dd>
      *             <dd>
-     *                <p>To import your own key material, begin by creating a symmetric KMS key with no key
+     *                <p>To import your own key material, begin by creating a symmetric encryption KMS key with no key
      *             material. To do this, use the <code>Origin</code> parameter of <code>CreateKey</code>
      *             with a value of <code>EXTERNAL</code>. Next, use <a>GetParametersForImport</a> operation to get a public key and import token, and use the public key to encrypt
      *             your key material. Then, use <a>ImportKeyMaterial</a> with your import token
      *             to import the key material. For step-by-step instructions, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the <i>
      *                      <i>Key Management Service Developer Guide</i>
-     *                   </i>. You
-     *             cannot import the key material into an asymmetric KMS key.</p>
+     *                   </i>.</p>
+     *                <p>This feature supports only symmetric encryption KMS keys, including multi-Region symmetric encryption KMS keys. You cannot import key
+     *             material into any other type of KMS key.</p>
      *                <p>To create a multi-Region primary key with imported key material, use the
      *               <code>Origin</code> parameter of <code>CreateKey</code> with a value of
      *               <code>EXTERNAL</code> and the <code>MultiRegion</code> parameter with a value of
-     *               <code>True</code>. To create replicas of the multi-Region primary key, use the <a>ReplicateKey</a> operation. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Using multi-Region keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *               <code>True</code>. To create replicas of the multi-Region primary key, use the <a>ReplicateKey</a> operation. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *                <p> </p>
      *             </dd>
      *             <dt>Custom key store</dt>
      *             <dd>
-     *                <p>To create a symmetric KMS key in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>, use the
+     *                <p>To create a symmetric encryption KMS key in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>, use the
      *               <code>CustomKeyStoreId</code> parameter to specify the custom key store. You must also
      *             use the <code>Origin</code> parameter with a value of <code>AWS_CLOUDHSM</code>. The
      *             CloudHSM cluster that is associated with the custom key store must have at least two active
      *             HSMs in different Availability Zones in the Amazon Web Services Region. </p>
-     *                <p>You cannot create an asymmetric KMS key in a custom key store. For information about
-     *             custom key stores in KMS see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">Using Custom Key Stores</a> in
+     *                <p>Custom key stores support only symmetric encryption KMS keys. You cannot create an
+     *             HMAC KMS key or an asymmetric KMS key in a custom key store. For information about
+     *             custom key stores in KMS see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">Custom key stores in KMS</a> in
      *             the <i>
      *                      <i>Key Management Service Developer Guide</i>
      *                   </i>.</p>
@@ -573,15 +582,15 @@ export declare class KMS extends KMSClient {
      *                </p>
      *             </li>
      *          </ul>
-     *          <p>You can use this operation to decrypt ciphertext that was encrypted under a symmetric or
-     *       asymmetric KMS key. When the KMS key is asymmetric, you must specify the KMS key and the
-     *       encryption algorithm that was used to encrypt the ciphertext. For information about symmetric and asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Using Symmetric and Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
-     *          <p>The Decrypt operation also decrypts ciphertext that was encrypted outside of KMS by the
-     *       public key in an KMS asymmetric KMS key. However, it cannot decrypt ciphertext produced by
+     *          <p>You can use this operation to decrypt ciphertext that was encrypted under a symmetric encryption KMS key or an
+     *       asymmetric encryption KMS key. When the KMS key is asymmetric, you must specify the KMS key and the
+     *       encryption algorithm that was used to encrypt the ciphertext. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *          <p>The <code>Decrypt</code> operation also decrypts ciphertext that was encrypted outside of KMS by the
+     *       public key in an KMS asymmetric KMS key. However, it cannot decrypt symmetric ciphertext produced by
      *       other libraries, such as the <a href="https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/">Amazon Web Services
      *         Encryption SDK</a> or <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html">Amazon S3 client-side encryption</a>.
      *       These libraries return a ciphertext format that is incompatible with KMS.</p>
-     *          <p>If the ciphertext was encrypted under a symmetric KMS key, the <code>KeyId</code>
+     *          <p>If the ciphertext was encrypted under a symmetric encryption KMS key, the <code>KeyId</code>
      *       parameter is optional. KMS can get this information from metadata that it adds to the
      *       symmetric ciphertext blob. This feature adds durability to your implementation by ensuring
      *       that authorized users can decrypt ciphertext decades after it was encrypted, even if they've
@@ -600,7 +609,7 @@ export declare class KMS extends KMSClient {
      *         policies</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>Applications in Amazon Web Services Nitro Enclaves can call this operation by using the <a href="https://github.com/aws/aws-nitro-enclaves-sdk-c">Amazon Web Services Nitro Enclaves Development Kit</a>. For information about the supporting parameters, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves use KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account
      *         use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
@@ -640,7 +649,7 @@ export declare class KMS extends KMSClient {
     /**
      * <p>Deletes the specified alias. </p>
      *          <note>
-     *             <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">Using ABAC in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *             <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          </note>
      *          <p>Because an alias is not a property of a KMS key, you can delete and change the aliases of
      *       a KMS key without affecting the KMS key. Also, aliases do not appear in the response from the
@@ -760,7 +769,7 @@ export declare class KMS extends KMSClient {
      *          <p>After you delete key material, you can use <a>ImportKeyMaterial</a> to reimport
      *       the same key material into the KMS key.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
      *
@@ -850,10 +859,7 @@ export declare class KMS extends KMSClient {
      *         key</a> or an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a>.</p>
      *          <p>This detailed information includes the key ARN, creation date (and deletion date, if
      *       applicable), the key state, and the origin and expiration date (if any) of the key material.
-     *       It includes fields, like <code>KeySpec</code>, that help you distinguish symmetric from
-     *       asymmetric KMS keys. It also provides information that is particularly important to asymmetric
-     *       keys, such as the key usage (encryption or signing) and the encryption algorithms or signing
-     *       algorithms that the KMS key supports. For KMS keys in custom key stores, it includes
+     *       It includes fields, like <code>KeySpec</code>, that help you distinguish different types of KMS keys. It also displays the key usage (encryption, signing, or generating and verifying MACs) and the algorithms that the KMS key supports. For KMS keys in custom key stores, it includes
      *       information about the custom key store, such as the key store ID and the CloudHSM cluster ID. For
      *       multi-Region keys, it displays the primary key and all related replica keys. </p>
      *          <p>
@@ -875,10 +881,11 @@ export declare class KMS extends KMSClient {
      *                <p>Key policies and grants on the KMS key. To get this information, use <a>GetKeyPolicy</a> and <a>ListGrants</a>.</p>
      *             </li>
      *          </ul>
-     *          <p>If you call the <code>DescribeKey</code> operation on a <i>predefined Amazon Web Services
-     *         alias</i>, that is, an Amazon Web Services alias with no key ID, KMS creates an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed
-     *         key</a>. Then, it associates the alias with the new KMS key, and returns the
-     *         <code>KeyId</code> and <code>Arn</code> of the new KMS key in the response.</p>
+     *          <p>In general, <code>DescribeKey</code> is a non-mutating operation. It returns data about
+     *       KMS keys, but doesn't change them. However, Amazon Web Services services use <code>DescribeKey</code> to
+     *       create <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services
+     *         managed keys</a> from a <i>predefined Amazon Web Services alias</i> with no key
+     *       ID.</p>
      *          <p>
      *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
      *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
@@ -932,12 +939,11 @@ export declare class KMS extends KMSClient {
     /**
      * <p>Sets the state of a KMS key to disabled. This change temporarily prevents use of the KMS
      *       key for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a>. </p>
-     *          <p>For more information about how key state affects the use of a KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS
-     *         key</a> in the <i>
+     *          <p>For more information about how key state affects the use of a KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>
      *                <i>Key Management Service Developer Guide</i>
      *             </i>.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *         <p>
      *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
      *
@@ -952,10 +958,10 @@ export declare class KMS extends KMSClient {
     disableKey(args: DisableKeyCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DisableKeyCommandOutput) => void): void;
     /**
      * <p>Disables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic
-     *         rotation of the key material</a> for the specified symmetric KMS key.</p>
-     *          <p> You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#asymmetric-cmks">asymmetric KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-replica-key">multi-Region keys</a>, set the property on the primary key. </p>
+     *         rotation of the key material</a> for the specified symmetric encryption KMS key.</p>
+     *          <p> You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account
      *         use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
@@ -1043,7 +1049,7 @@ export declare class KMS extends KMSClient {
      * <p>Sets the key state of a KMS key to enabled. This allows you to use the KMS key for
      *       <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a>. </p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account
      *       use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
@@ -1059,10 +1065,10 @@ export declare class KMS extends KMSClient {
     enableKey(args: EnableKeyCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: EnableKeyCommandOutput) => void): void;
     /**
      * <p>Enables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation
-     *         of the key material</a> for the specified symmetric KMS key.</p>
-     *          <p>You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#asymmetric-cmks">asymmetric KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-replica-key">multi-Region keys</a>, set the property on the primary key.</p>
+     *         of the key material</a> for the specified symmetric encryption KMS key.</p>
+     *          <p>You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account
      *         use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
@@ -1089,31 +1095,13 @@ export declare class KMS extends KMSClient {
     enableKeyRotation(args: EnableKeyRotationCommandInput, cb: (err: any, data?: EnableKeyRotationCommandOutput) => void): void;
     enableKeyRotation(args: EnableKeyRotationCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: EnableKeyRotationCommandOutput) => void): void;
     /**
-     * <p>Encrypts plaintext into ciphertext by using a KMS key. The <code>Encrypt</code> operation
-     *       has two primary use cases:</p>
-     *          <ul>
-     *             <li>
-     *                <p>You can encrypt small amounts of arbitrary data, such as a personal identifier or
-     *           database password, or other sensitive information. </p>
-     *             </li>
-     *             <li>
-     *                <p>You can use the <code>Encrypt</code> operation to move encrypted data from one Amazon Web Services
-     *           Region to another. For example, in Region A, generate a data key and use the plaintext key
-     *           to encrypt your data. Then, in Region A, use the <code>Encrypt</code> operation to encrypt
-     *           the plaintext data key under a KMS key in Region B. Now, you can move the encrypted data
-     *           and the encrypted data key to Region B. When necessary, you can decrypt the encrypted data
-     *           key and the encrypted data entirely within in Region B.</p>
-     *             </li>
-     *          </ul>
-     *
-     *          <p>You don't need to use the <code>Encrypt</code> operation to encrypt a data key. The <a>GenerateDataKey</a> and <a>GenerateDataKeyPair</a> operations return a
+     * <p>Encrypts plaintext of up to 4,096 bytes using a KMS key. You can use a symmetric or
+     *       asymmetric KMS key with a <code>KeyUsage</code> of <code>ENCRYPT_DECRYPT</code>.</p>
+     *          <p>You can use this operation to encrypt small amounts of arbitrary data, such as a personal identifier or
+     *           database password, or other sensitive information. You don't need to use the <code>Encrypt</code> operation to encrypt a data key. The <a>GenerateDataKey</a> and <a>GenerateDataKeyPair</a> operations return a
      *       plaintext data key and an encrypted copy of that data key.</p>
      *
-     *          <p>When you encrypt data, you must specify a symmetric or asymmetric KMS key to use in the
-     *       encryption operation. The KMS key must have a <code>KeyUsage</code> value of
-     *         <code>ENCRYPT_DECRYPT.</code> To find the <code>KeyUsage</code> of a KMS key, use the <a>DescribeKey</a> operation. </p>
-     *
-     *          <p>If you use a symmetric KMS key, you can use an encryption context to add additional
+     *          <p>If you use a symmetric encryption KMS key, you can use an encryption context to add additional
      *       security to your encryption operation. If you specify an <code>EncryptionContext</code> when
      *       encrypting data, you must specify the same encryption context (a case-sensitive exact match)
      *       when decrypting the data. Otherwise, the request to decrypt fails with an
@@ -1123,7 +1111,7 @@ export declare class KMS extends KMSClient {
      *       algorithm must be compatible with the KMS key type.</p>
      *          <important>
      *             <p>When you use an asymmetric KMS key to encrypt or reencrypt data, be sure to record the KMS key and encryption algorithm that you choose. You will be required to provide the same KMS key and encryption algorithm when you decrypt the data. If the KMS key and algorithm do not match the values used to encrypt the data, the decrypt operation fails.</p>
-     *             <p>You are not required to supply the key ID and encryption algorithm when you decrypt with symmetric KMS keys because KMS stores this information in the ciphertext blob. KMS cannot store metadata in ciphertext generated with asymmetric keys. The standard format for asymmetric key ciphertext does not include configurable fields.</p>
+     *             <p>You are not required to supply the key ID and encryption algorithm when you decrypt with symmetric encryption KMS keys because KMS stores this information in the ciphertext blob. KMS cannot store metadata in ciphertext generated with asymmetric keys. The standard format for asymmetric key ciphertext does not include configurable fields.</p>
      *          </important>
      *
      *
@@ -1131,7 +1119,7 @@ export declare class KMS extends KMSClient {
      *       encryption algorithm that you choose.</p>
      *          <ul>
      *             <li>
-     *                <p>Symmetric KMS keys</p>
+     *                <p>Symmetric encryption KMS keys</p>
      *                <ul>
      *                   <li>
      *                      <p>
@@ -1186,7 +1174,7 @@ export declare class KMS extends KMSClient {
      *             </li>
      *          </ul>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>: Yes.
      *       To perform this operation with a KMS key in a different Amazon Web Services account, specify
@@ -1219,33 +1207,31 @@ export declare class KMS extends KMSClient {
     encrypt(args: EncryptCommandInput, cb: (err: any, data?: EncryptCommandOutput) => void): void;
     encrypt(args: EncryptCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: EncryptCommandOutput) => void): void;
     /**
-     * <p>Generates a unique symmetric data key for client-side encryption. This operation returns a
-     *       plaintext copy of the data key and a copy that is encrypted under a KMS key that you specify.
-     *       You can use the plaintext key to encrypt your data outside of KMS and store the encrypted
-     *       data key with the encrypted data.</p>
-     *
-     *          <p>
-     *             <code>GenerateDataKey</code> returns a unique data key for each request. The bytes in the
-     *       plaintext key are not related to the caller or the KMS key.</p>
-     *
-     *          <p>To generate a data key, specify the symmetric KMS key that will be used to encrypt the
-     *       data key. You cannot use an asymmetric KMS key to generate data keys. To get the type of your
-     *       KMS key, use the <a>DescribeKey</a> operation. You must also specify the length of
-     *       the data key. Use either the <code>KeySpec</code> or <code>NumberOfBytes</code> parameters
-     *       (but not both). For 128-bit and 256-bit data keys, use the <code>KeySpec</code> parameter. </p>
+     * <p>Returns a unique symmetric data key for use outside of KMS. This operation returns a
+     *       plaintext copy of the data key and a copy that is encrypted under a symmetric encryption KMS
+     *       key that you specify. The bytes in the plaintext key are random; they are not related to the caller or the KMS
+     *       key. You can use the plaintext key to encrypt your data outside of KMS and store the
+     *       encrypted data key with the encrypted data.</p>
+     *
+     *          <p>To generate a data key, specify the symmetric encryption KMS key that will be used to
+     *       encrypt the data key. You cannot use an asymmetric KMS key to encrypt data keys. To get the
+     *       type of your KMS key, use the <a>DescribeKey</a> operation. You must also specify
+     *       the length of the data key. Use either the <code>KeySpec</code> or <code>NumberOfBytes</code>
+     *       parameters (but not both). For 128-bit and 256-bit data keys, use the <code>KeySpec</code>
+     *       parameter. </p>
      *
      *          <p>To get only an encrypted copy of the data key, use <a>GenerateDataKeyWithoutPlaintext</a>. To generate an asymmetric data key pair, use
      *       the <a>GenerateDataKeyPair</a> or <a>GenerateDataKeyPairWithoutPlaintext</a> operation. To get a cryptographically secure
      *       random byte string, use <a>GenerateRandom</a>.</p>
      *
-     *          <p>You can use the optional encryption context to add additional security to the encryption
+     *          <p>You can use an optional encryption context to add additional security to the encryption
      *       operation. If you specify an <code>EncryptionContext</code>, you must specify the same
      *       encryption context (a case-sensitive exact match) when decrypting the encrypted data key.
      *       Otherwise, the request to decrypt fails with an <code>InvalidCiphertextException</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption Context</a> in the
      *       <i>Key Management Service Developer Guide</i>.</p>
      *          <p>Applications in Amazon Web Services Nitro Enclaves can call this operation by using the <a href="https://github.com/aws/aws-nitro-enclaves-sdk-c">Amazon Web Services Nitro Enclaves Development Kit</a>. For information about the supporting parameters, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html">How Amazon Web Services Nitro Enclaves use KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>How to use your data
      *         key</b>
@@ -1322,19 +1308,20 @@ export declare class KMS extends KMSClient {
     generateDataKey(args: GenerateDataKeyCommandInput, cb: (err: any, data?: GenerateDataKeyCommandOutput) => void): void;
     generateDataKey(args: GenerateDataKeyCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GenerateDataKeyCommandOutput) => void): void;
     /**
-     * <p>Generates a unique asymmetric data key pair. The <code>GenerateDataKeyPair</code>
-     *       operation returns a plaintext public key, a plaintext private key, and a copy of the private
-     *       key that is encrypted under the symmetric KMS key you specify. You can use the data key pair
-     *       to perform asymmetric cryptography and implement digital signatures outside of KMS.</p>
+     * <p>Returns a unique asymmetric data key pair for use outside of KMS. This operation returns
+     *       a plaintext public key, a plaintext private key, and a copy of the private key that is
+     *       encrypted under the symmetric encryption KMS key you specify. You can use the data key pair to
+     *       perform asymmetric cryptography and implement digital signatures outside of KMS. The bytes
+     *       in the keys are random; they not related to the caller or to the KMS key that is used to encrypt the
+     *       private key. </p>
      *
      *          <p>You can use the public key that <code>GenerateDataKeyPair</code> returns to encrypt data
      *       or verify a signature outside of KMS. Then, store the encrypted private key with the data.
      *       When you are ready to decrypt data or sign a message, you can use the <a>Decrypt</a> operation to decrypt the encrypted private key.</p>
      *
-     *          <p>To generate a data key pair, you must specify a symmetric KMS key to encrypt the private
-     *       key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a custom key
-     *       store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
-     *       operation. </p>
+     *          <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
+     *       the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
+     *       custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
      *          <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
      *       key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for
      *       either encryption or signing, but not both. However, KMS cannot enforce any restrictions on
@@ -1350,18 +1337,18 @@ export declare class KMS extends KMSClient {
      *
      *          <p>
      *             <code>GenerateDataKeyPair</code> returns a unique data key pair for each request. The
-     *       bytes in the keys are not related to the caller or the KMS key that is used to encrypt the
+     *       bytes in the keys are random; they are not related to the caller or the KMS key that is used to encrypt the
      *       private key. The public key is a DER-encoded X.509 SubjectPublicKeyInfo, as specified in
      *         <a href="https://tools.ietf.org/html/rfc5280">RFC 5280</a>. The private key is a
      *       DER-encoded PKCS8 PrivateKeyInfo, as specified in <a href="https://tools.ietf.org/html/rfc5958">RFC 5958</a>.</p>
      *
-     *          <p>You can use the optional encryption context to add additional security to the encryption
+     *          <p>You can use an optional encryption context to add additional security to the encryption
      *       operation. If you specify an <code>EncryptionContext</code>, you must specify the same
      *       encryption context (a case-sensitive exact match) when decrypting the encrypted data key.
      *       Otherwise, the request to decrypt fails with an <code>InvalidCiphertextException</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption Context</a> in the
      *       <i>Key Management Service Developer Guide</i>.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account
      *         use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
@@ -1404,18 +1391,17 @@ export declare class KMS extends KMSClient {
     generateDataKeyPair(args: GenerateDataKeyPairCommandInput, cb: (err: any, data?: GenerateDataKeyPairCommandOutput) => void): void;
     generateDataKeyPair(args: GenerateDataKeyPairCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GenerateDataKeyPairCommandOutput) => void): void;
     /**
-     * <p>Generates a unique asymmetric data key pair. The
-     *         <code>GenerateDataKeyPairWithoutPlaintext</code> operation returns a plaintext public key
-     *       and a copy of the private key that is encrypted under the symmetric KMS key you specify.
-     *       Unlike <a>GenerateDataKeyPair</a>, this operation does not return a plaintext
-     *       private key. </p>
+     * <p>Returns a unique asymmetric data key pair for use outside of KMS. This operation returns
+     *       a plaintext public key and a copy of the private key that is encrypted under the symmetric
+     *       encryption KMS key you specify. Unlike <a>GenerateDataKeyPair</a>, this operation
+     *       does not return a plaintext private key. The bytes in the keys are random; they are not related to the caller
+     *       or to the KMS key that is used to encrypt the private key. </p>
      *          <p>You can use the public key that <code>GenerateDataKeyPairWithoutPlaintext</code> returns
      *       to encrypt data or verify a signature outside of KMS. Then, store the encrypted private key
      *       with the data. When you are ready to decrypt data or sign a message, you can use the <a>Decrypt</a> operation to decrypt the encrypted private key.</p>
-     *          <p>To generate a data key pair, you must specify a symmetric KMS key to encrypt the private
-     *       key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a custom key
-     *       store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
-     *       operation. </p>
+     *          <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
+     *       the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
+     *       custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
      *          <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
      *       key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for
      *       either encryption or signing, but not both. However, KMS cannot enforce any restrictions on
@@ -1426,13 +1412,13 @@ export declare class KMS extends KMSClient {
      *       the private key. The public key is a DER-encoded X.509 SubjectPublicKeyInfo, as specified in
      *         <a href="https://tools.ietf.org/html/rfc5280">RFC 5280</a>.</p>
      *
-     *          <p>You can use the optional encryption context to add additional security to the encryption
+     *          <p>You can use an optional encryption context to add additional security to the encryption
      *       operation. If you specify an <code>EncryptionContext</code>, you must specify the same
      *       encryption context (a case-sensitive exact match) when decrypting the encrypted data key.
      *       Otherwise, the request to decrypt fails with an <code>InvalidCiphertextException</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption Context</a> in the
      *       <i>Key Management Service Developer Guide</i>.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account
      *         use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
@@ -1476,40 +1462,37 @@ export declare class KMS extends KMSClient {
     generateDataKeyPairWithoutPlaintext(args: GenerateDataKeyPairWithoutPlaintextCommandInput, cb: (err: any, data?: GenerateDataKeyPairWithoutPlaintextCommandOutput) => void): void;
     generateDataKeyPairWithoutPlaintext(args: GenerateDataKeyPairWithoutPlaintextCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GenerateDataKeyPairWithoutPlaintextCommandOutput) => void): void;
     /**
-     * <p>Generates a unique symmetric data key. This operation returns a data key that is encrypted
-     *       under a KMS key that you specify. To request an asymmetric data key pair, use the <a>GenerateDataKeyPair</a> or <a>GenerateDataKeyPairWithoutPlaintext</a>
-     *       operations.</p>
-     *          <p>
-     *             <code>GenerateDataKeyWithoutPlaintext</code> is identical to the <a>GenerateDataKey</a> operation except that returns only the encrypted copy of the
-     *       data key. This operation is useful for systems that need to encrypt data at some point, but
-     *       not immediately. When you need to encrypt the data, you call the <a>Decrypt</a>
-     *       operation on the encrypted copy of the key. </p>
-     *          <p>It's also useful in distributed systems with different levels of trust. For example, you
-     *       might store encrypted data in containers. One component of your system creates new containers
-     *       and stores an encrypted data key with each container. Then, a different component puts the
-     *       data into the containers. That component first decrypts the data key, uses the plaintext data
-     *       key to encrypt data, puts the encrypted data into the container, and then destroys the
-     *       plaintext data key. In this system, the component that creates the containers never sees the
-     *       plaintext data key.</p>
-     *          <p>
-     *             <code>GenerateDataKeyWithoutPlaintext</code> returns a unique data key for each request.
-     *       The bytes in the keys are not related to the caller or KMS key that is used to encrypt the
-     *       private key.</p>
-     *
-     *          <p>To generate a data key, you must specify the symmetric KMS key that is used to encrypt the
-     *       data key. You cannot use an asymmetric KMS key to generate a data key. To get the type of your
-     *       KMS key, use the <a>DescribeKey</a> operation.</p>
-     *
+     * <p>Returns a unique symmetric data key for use outside of KMS. This operation returns a
+     *       data key that is encrypted under a symmetric encryption KMS key that you specify. The bytes in
+     *       the key are random; they are not related to the caller or to the KMS key.</p>
+     *          <p>
+     *             <code>GenerateDataKeyWithoutPlaintext</code> is identical to the <a>GenerateDataKey</a> operation except that it does not return a plaintext copy of the
+     *       data key. </p>
+     *          <p>This operation is useful for systems that need to encrypt data at some point, but not
+     *       immediately. When you need to encrypt the data, you call the <a>Decrypt</a>
+     *       operation on the encrypted copy of the key. It's also useful in distributed systems with
+     *       different levels of trust. For example, you might store encrypted data in containers. One
+     *       component of your system creates new containers and stores an encrypted data key with each
+     *       container. Then, a different component puts the data into the containers. That component first
+     *       decrypts the data key, uses the plaintext data key to encrypt data, puts the encrypted data
+     *       into the container, and then destroys the plaintext data key. In this system, the component
+     *       that creates the containers never sees the plaintext data key.</p>
+     *          <p>To request an asymmetric data key pair, use the <a>GenerateDataKeyPair</a> or
+     *         <a>GenerateDataKeyPairWithoutPlaintext</a> operations.</p>
+     *
+     *          <p>To generate a data key, you must specify the symmetric encryption KMS key that is used to
+     *       encrypt the data key. You cannot use an asymmetric KMS key or a key in a custom key store to generate a data key. To get the
+     *       type of your KMS key, use the <a>DescribeKey</a> operation.</p>
      *          <p>If the operation succeeds, you will find the encrypted copy of the data key in the
      *         <code>CiphertextBlob</code> field.</p>
      *
-     *          <p>You can use the optional encryption context to add additional security to the encryption
+     *          <p>You can use an optional encryption context to add additional security to the encryption
      *       operation. If you specify an <code>EncryptionContext</code>, you must specify the same
      *       encryption context (a case-sensitive exact match) when decrypting the encrypted data key.
      *       Otherwise, the request to decrypt fails with an <code>InvalidCiphertextException</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption Context</a> in the
      *       <i>Key Management Service Developer Guide</i>.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account
      *         use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
@@ -1552,6 +1535,32 @@ export declare class KMS extends KMSClient {
     generateDataKeyWithoutPlaintext(args: GenerateDataKeyWithoutPlaintextCommandInput, options?: __HttpHandlerOptions): Promise<GenerateDataKeyWithoutPlaintextCommandOutput>;
     generateDataKeyWithoutPlaintext(args: GenerateDataKeyWithoutPlaintextCommandInput, cb: (err: any, data?: GenerateDataKeyWithoutPlaintextCommandOutput) => void): void;
     generateDataKeyWithoutPlaintext(args: GenerateDataKeyWithoutPlaintextCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GenerateDataKeyWithoutPlaintextCommandOutput) => void): void;
+    /**
+     * <p>Generates a hash-based message authentication code (HMAC) for a message using an HMAC KMS
+     *       key and a MAC algorithm that the key supports. The MAC algorithm computes the HMAC for the
+     *       message and the key as described in <a href="https://datatracker.ietf.org/doc/html/rfc2104">RFC 2104</a>.</p>
+     *          <p>You can use the HMAC that this operation generates with the <a>VerifyMac</a>
+     *       operation to demonstrate that the original message has not changed. Also, because a secret key
+     *       is used to create the hash, you can verify that the party that generated the hash has the
+     *       required secret key. This operation is part of KMS support for HMAC KMS keys.
+     *       For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>
+     *                <i>Key Management Service Developer Guide</i>
+     *             </i>.</p>
+     *          <p>The KMS key that you use for this operation must be in a compatible key state. For
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *          <p>
+     *             <b>Cross-account
+     *         use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
+     *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter. </p>
+     *          <p>
+     *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GenerateMac</a> (key policy)</p>
+     *          <p>
+     *             <b>Related operations</b>: <a>VerifyMac</a>
+     *          </p>
+     */
+    generateMac(args: GenerateMacCommandInput, options?: __HttpHandlerOptions): Promise<GenerateMacCommandOutput>;
+    generateMac(args: GenerateMacCommandInput, cb: (err: any, data?: GenerateMacCommandOutput) => void): void;
+    generateMac(args: GenerateMacCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GenerateMacCommandOutput) => void): void;
     /**
      * <p>Returns a random byte string that is cryptographically secure.</p>
      *          <p>By default, the random byte string is generated in KMS. To generate the byte string in
@@ -1584,10 +1593,10 @@ export declare class KMS extends KMSClient {
     /**
      * <p>Gets a Boolean value that indicates whether <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation of the key material</a> is
      *       enabled for the specified KMS key.</p>
-     *          <p>You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#asymmetric-cmks">asymmetric KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-replica-key">multi-Region keys</a>, set the property on the primary key. The key rotation status for these KMS keys is always
+     *          <p>You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. The key rotation status for these KMS keys is always
      *       <code>false</code>.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <ul>
      *             <li>
      *                <p>Disabled: The key rotation status does not change when you disable a KMS key. However,
@@ -1625,21 +1634,21 @@ export declare class KMS extends KMSClient {
     getKeyRotationStatus(args: GetKeyRotationStatusCommandInput, cb: (err: any, data?: GetKeyRotationStatusCommandOutput) => void): void;
     getKeyRotationStatus(args: GetKeyRotationStatusCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GetKeyRotationStatusCommandOutput) => void): void;
     /**
-     * <p>Returns the items you need to import key material into a symmetric, customer managed KMS
-     *       key. For more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a>
-     *       in the <i>Key Management Service Developer Guide</i>.</p>
+     * <p>Returns the items you need to import key material into a symmetric encryption KMS key. For
+     *       more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a> in the
+     *       <i>Key Management Service Developer Guide</i>.</p>
      *          <p>This operation returns a public key and an import token. Use the public key to encrypt the
      *       symmetric key material. Store the import token to send with a subsequent <a>ImportKeyMaterial</a> request.</p>
-     *          <p>You must specify the key ID of the symmetric KMS key into which you will import key
-     *       material. This KMS key's <code>Origin</code> must be <code>EXTERNAL</code>. You must also
+     *          <p>You must specify the key ID of the symmetric encryption KMS key into which you will import
+     *       key material. This KMS key's <code>Origin</code> must be <code>EXTERNAL</code>. You must also
      *       specify the wrapping algorithm and type of wrapping key (public key) that you will use to
-     *       encrypt the key material. You cannot perform this operation on an asymmetric KMS key or on any KMS key in a different Amazon Web Services account.</p>
+     *       encrypt the key material. You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account.</p>
      *          <p>To import key material, you must use the public key and import token from the same
      *       response. These items are valid for 24 hours. The expiration date and time appear in the
      *         <code>GetParametersForImport</code> response. You cannot use an expired token in an <a>ImportKeyMaterial</a> request. If your key and token expire, send another
      *         <code>GetParametersForImport</code> request.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
      *
@@ -1669,7 +1678,7 @@ export declare class KMS extends KMSClient {
      *       KMS key, which never leaves KMS unencrypted, callers with <code>kms:GetPublicKey</code>
      *       permission can download the public key of an asymmetric KMS key. You can share the public key
      *       to allow others to encrypt messages and verify signatures outside of KMS.
-     *       For information about symmetric and asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Using Symmetric and Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>You do not need to download the public key. Instead, you can use the public key within
      *       KMS by calling the <a>Encrypt</a>, <a>ReEncrypt</a>, or <a>Verify</a> operations with the identifier of an asymmetric KMS key. When you use the
      *       public key within KMS, you benefit from the authentication, authorization, and logging that
@@ -1701,7 +1710,7 @@ export declare class KMS extends KMSClient {
      *       can also avoid errors, such as using the wrong signing algorithm in a verification
      *       operation.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>:
      *       Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
@@ -1717,13 +1726,13 @@ export declare class KMS extends KMSClient {
     getPublicKey(args: GetPublicKeyCommandInput, cb: (err: any, data?: GetPublicKeyCommandOutput) => void): void;
     getPublicKey(args: GetPublicKeyCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GetPublicKeyCommandOutput) => void): void;
     /**
-     * <p>Imports key material into an existing symmetric KMS KMS key that was created without key
-     *       material. After you successfully import key material into a KMS key, you can <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport
-     *         the same key material</a> into that KMS key, but you cannot import different key
-     *       material. </p>
-     *          <p>You cannot perform this operation on an asymmetric KMS key or on any KMS key in a different Amazon Web Services account. For more information about creating KMS keys with no key material
-     *       and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the
-     *       <i>Key Management Service Developer Guide</i>.</p>
+     * <p>Imports key material into an existing symmetric encryption KMS key that was created
+     *       without key material. After you successfully import key material into a KMS key, you can
+     *         <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport the same key material</a> into that KMS key, but you cannot import different
+     *       key material. </p>
+     *          <p>You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account. For more information about
+     *       creating KMS keys with no key material and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a>
+     *       in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>Before using this operation, call <a>GetParametersForImport</a>. Its response
      *       includes a public key and an import token. Use the public key to encrypt the key material.
      *       Then, submit the import token from the same <code>GetParametersForImport</code>
@@ -1760,7 +1769,7 @@ export declare class KMS extends KMSClient {
      *       and repeat the import procedure. For help, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#importing-keys-overview">How To Import Key
      *         Material</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
      *
@@ -1837,7 +1846,7 @@ export declare class KMS extends KMSClient {
      * <p>Gets a list of all grants for the specified KMS key. </p>
      *          <p>You must specify the KMS key in all requests. You can filter the grant list by grant ID or
      *       grantee principal.</p>
-     *          <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Using grants</a> in the
+     *          <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Grants in KMS</a> in the
      *         <i>
      *                <i>Key Management Service Developer Guide</i>
      *             </i>. For examples of working with grants in several
@@ -1994,7 +2003,7 @@ export declare class KMS extends KMSClient {
      *          <p>You can specify any principal in your Amazon Web Services account. The grants that are returned include
      *       grants for KMS keys in your Amazon Web Services account and other Amazon Web Services accounts. You might use this
      *       operation to determine which grants you may retire. To retire a grant, use the <a>RetireGrant</a> operation.</p>
-     *          <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Using grants</a> in the
+     *          <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Grants in KMS</a> in the
      *         <i>
      *                <i>Key Management Service Developer Guide</i>
      *             </i>. For examples of working with grants in several
@@ -2062,8 +2071,8 @@ export declare class KMS extends KMSClient {
      *         rotate</a> a KMS key or change the KMS key that protects a ciphertext. You can also use
      *       it to reencrypt ciphertext under the same KMS key, such as to change the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">encryption
      *         context</a> of a ciphertext.</p>
-     *          <p>The <code>ReEncrypt</code> operation can decrypt ciphertext that was encrypted by using an
-     *       KMS KMS key in an KMS operation, such as <a>Encrypt</a> or <a>GenerateDataKey</a>. It can also decrypt ciphertext that was encrypted by using the
+     *          <p>The <code>ReEncrypt</code> operation can decrypt ciphertext that was encrypted by using a
+     *       KMS key in an KMS operation, such as <a>Encrypt</a> or <a>GenerateDataKey</a>. It can also decrypt ciphertext that was encrypted by using the
      *       public key of an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#asymmetric-cmks">asymmetric KMS key</a>
      *       outside of KMS. However, it cannot decrypt ciphertext produced by other libraries, such as
      *       the <a href="https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/">Amazon Web Services Encryption SDK</a> or
@@ -2080,7 +2089,7 @@ export declare class KMS extends KMSClient {
      *           is required to decrypt the data.</p>
      *             </li>
      *             <li>
-     *                <p>If your ciphertext was encrypted under a symmetric KMS key, the
+     *                <p>If your ciphertext was encrypted under a symmetric encryption KMS key, the
      *             <code>SourceKeyId</code> parameter is optional. KMS can get this information from
      *           metadata that it adds to the symmetric ciphertext blob. This feature adds durability to
      *           your implementation by ensuring that authorized users can decrypt ciphertext decades after
@@ -2093,19 +2102,18 @@ export declare class KMS extends KMSClient {
      *             </li>
      *             <li>
      *                <p>To reencrypt the data, you must use the <code>DestinationKeyId</code> parameter
-     *           specify the KMS key that re-encrypts the data after it is decrypted. You can select a
-     *           symmetric or asymmetric KMS key. If the destination KMS key is an asymmetric KMS key, you
-     *           must also provide the encryption algorithm. The algorithm that you choose must be
-     *           compatible with the KMS key.</p>
+     *           specify the KMS key that re-encrypts the data after it is decrypted. If the destination
+     *           KMS key is an asymmetric KMS key, you must also provide the encryption algorithm. The
+     *           algorithm that you choose must be compatible with the KMS key.</p>
      *
      *                <important>
      *                   <p>When you use an asymmetric KMS key to encrypt or reencrypt data, be sure to record the KMS key and encryption algorithm that you choose. You will be required to provide the same KMS key and encryption algorithm when you decrypt the data. If the KMS key and algorithm do not match the values used to encrypt the data, the decrypt operation fails.</p>
-     *                   <p>You are not required to supply the key ID and encryption algorithm when you decrypt with symmetric KMS keys because KMS stores this information in the ciphertext blob. KMS cannot store metadata in ciphertext generated with asymmetric keys. The standard format for asymmetric key ciphertext does not include configurable fields.</p>
+     *                   <p>You are not required to supply the key ID and encryption algorithm when you decrypt with symmetric encryption KMS keys because KMS stores this information in the ciphertext blob. KMS cannot store metadata in ciphertext generated with asymmetric keys. The standard format for asymmetric key ciphertext does not include configurable fields.</p>
      *                </important>
      *             </li>
      *          </ul>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>: Yes.
      *       The source KMS key and destination KMS key can be in different Amazon Web Services accounts. Either or both
@@ -2169,7 +2177,7 @@ export declare class KMS extends KMSClient {
      *          <p>This operation supports <i>multi-Region keys</i>, an KMS feature that lets you create multiple
      *       interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key
      *       material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt
-     *       it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Using multi-Region keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>A <i>replica key</i> is a fully-functional KMS key that can be used
      *       independently of its primary and peer replica keys. A primary key and its replica keys share
      *       properties that make them interoperable. They have the same <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id">key ID</a> and key material. They also
@@ -2179,8 +2187,7 @@ export declare class KMS extends KMSClient {
      *         material origin</a>, and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic key rotation status</a>. KMS automatically synchronizes these shared
      *       properties among related multi-Region keys. All other properties of a replica key can differ,
      *       including its <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">key
-     *         policy</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">tags</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html">aliases</a>, and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">key
-     *         state</a>. KMS pricing and quotas for KMS keys apply to each primary key and replica
+     *         policy</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">tags</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html">aliases</a>, and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a>. KMS pricing and quotas for KMS keys apply to each primary key and replica
      *       key.</p>
      *          <p>When this operation completes, the new replica key has a transient key state of
      *         <code>Creating</code>. This key state changes to <code>Enabled</code> (or
@@ -2189,8 +2196,13 @@ export declare class KMS extends KMSClient {
      *       cannot yet use it in cryptographic operations. If you are creating and using the replica key
      *       programmatically, retry on <code>KMSInvalidStateException</code> or call
      *         <code>DescribeKey</code> to check its <code>KeyState</code> value before using it. For
-     *       details about the <code>Creating</code> key state, see <a href="kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the
+     *       details about the <code>Creating</code> key state, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the
      *       <i>Key Management Service Developer Guide</i>.</p>
+     *          <p>You cannot create more than one replica of a primary key in any Region. If the Region
+     *       already includes a replica of the key you're trying to replicate, <code>ReplicateKey</code>
+     *       returns an <code>AlreadyExistsException</code> error. If the key state of the existing replica
+     *       is <code>PendingDeletion</code>, you can cancel the scheduled key deletion (<a>CancelKeyDeletion</a>) or wait for the key to be deleted. The new replica key you create
+     *       will have the same <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#mrk-sync-properties">shared properties</a> as the original replica key.</p>
      *          <p>The CloudTrail log of a <code>ReplicateKey</code> operation records a
      *         <code>ReplicateKey</code> operation in the primary key's Region and a <a>CreateKey</a> operation in the replica key's Region.</p>
      *          <p>If you replicate a multi-Region primary key with imported key material, the replica key is
@@ -2250,11 +2262,10 @@ export declare class KMS extends KMSClient {
      *       returns both values.</p>
      *          <p>This operation can be called by the <i>retiring principal</i> for a grant,
      *       by the <i>grantee principal</i> if the grant allows the <code>RetireGrant</code>
-     *       operation, and by the Amazon Web Services account (root user) in which the grant is created. It can also be
-     *       called by principals to whom permission for retiring a grant is delegated. For details, see
-     *         <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete">Retiring and
-     *         revoking grants</a> in the <i>Key Management Service Developer Guide</i>.</p>
-     *          <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Using grants</a> in the
+     *       operation, and by the Amazon Web Services account in which the grant is created. It can also be called by
+     *       principals to whom permission for retiring a grant is delegated. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete">Retiring and revoking
+     *         grants</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *          <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Grants in KMS</a> in the
      *         <i>
      *                <i>Key Management Service Developer Guide</i>
      *             </i>. For examples of working with grants in several
@@ -2305,7 +2316,7 @@ export declare class KMS extends KMSClient {
      *       the <i>
      *                <i>Key Management Service Developer Guide</i>
      *             </i>. </p>
-     *          <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Using grants</a> in the
+     *          <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Grants in KMS</a> in the
      *         <i>
      *                <i>Key Management Service Developer Guide</i>
      *             </i>. For examples of working with grants in several
@@ -2376,7 +2387,7 @@ export declare class KMS extends KMSClient {
      *          <p>For more information about scheduling a KMS key for deletion, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html">Deleting KMS keys</a> in the
      *       <i>Key Management Service Developer Guide</i>.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account
      *         use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
@@ -2407,8 +2418,8 @@ export declare class KMS extends KMSClient {
     /**
      * <p>Creates a <a href="https://en.wikipedia.org/wiki/Digital_signature">digital
      *         signature</a> for a message or message digest by using the private key in an asymmetric
-     *       KMS key. To verify the signature, use the <a>Verify</a> operation, or use the
-     *       public key in the same asymmetric KMS key outside of KMS. For information about symmetric and asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Using Symmetric and Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use
+     *       the public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>Digital signatures are generated and verified by using asymmetric key pair, such as an RSA
      *       or ECC pair that is represented by an asymmetric KMS key. The key owner (or an authorized
      *       user) uses their private key to sign a message. Anyone with the public key can verify that the
@@ -2441,7 +2452,7 @@ export declare class KMS extends KMSClient {
      *       operation. Or use the <a>GetPublicKey</a> operation to download the public key and
      *       then use the public key to verify the signature outside of KMS. </p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *         <p>
      *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
      *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
@@ -2458,7 +2469,7 @@ export declare class KMS extends KMSClient {
     /**
      * <p>Adds or edits tags on a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>.</p>
      *          <note>
-     *             <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">Using ABAC in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *             <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          </note>
      *          <p>Each tag consists of a tag key and a tag value, both of which are case-sensitive strings.
      *       The tag value can be an empty (null) string. To add a tag, specify a new tag key and a tag
@@ -2473,7 +2484,7 @@ export declare class KMS extends KMSClient {
      *       tags, including the format and syntax, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html">Tagging Amazon Web Services resources</a> in the <i>Amazon
      *         Web Services General Reference</i>. </p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. </p>
      *
@@ -2512,7 +2523,7 @@ export declare class KMS extends KMSClient {
      * <p>Deletes tags from a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>. To delete a tag,
      *       specify the tag key and the KMS key.</p>
      *          <note>
-     *             <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">Using ABAC in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *             <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          </note>
      *          <p>When it succeeds, the <code>UntagResource</code> operation doesn't return any output.
      *       Also, if the specified tag key isn't found on the KMS key, it doesn't throw an exception or
@@ -2522,7 +2533,7 @@ export declare class KMS extends KMSClient {
      *       tags, including the format and syntax, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html">Tagging Amazon Web Services resources</a> in the <i>Amazon
      *         Web Services General Reference</i>. </p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p>
      *
@@ -2562,7 +2573,7 @@ export declare class KMS extends KMSClient {
      *       only one KMS key at a time, although a KMS key can have multiple aliases. The alias and the
      *       KMS key must be in the same Amazon Web Services account and Region.</p>
      *          <note>
-     *             <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">Using ABAC in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *             <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          </note>
      *          <p>The current and new KMS key must be the same type (both symmetric or both asymmetric), and
      *       they must have the same key usage (<code>ENCRYPT_DECRYPT</code> or <code>SIGN_VERIFY</code>).
@@ -2576,7 +2587,7 @@ export declare class KMS extends KMSClient {
      *       response from the <a>DescribeKey</a> operation. To get the aliases of all KMS keys
      *       in the account, use the <a>ListAliases</a> operation. </p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *         <p>
      *             <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. </p>
      *          <p>
@@ -2706,7 +2717,7 @@ export declare class KMS extends KMSClient {
     /**
      * <p>Updates the description of a KMS key. To see the description of a KMS key, use <a>DescribeKey</a>. </p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account
      *         use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. </p>
@@ -2743,7 +2754,7 @@ export declare class KMS extends KMSClient {
      *          <p>This operation supports <i>multi-Region keys</i>, an KMS feature that lets you create multiple
      *       interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key
      *       material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt
-     *       it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Using multi-Region keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>The <i>primary key</i> of a multi-Region key is the source for properties
      *       that are always shared by primary and replica keys, including the key material, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-id">key ID</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-spec">key spec</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-usage">key usage</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-origin">key material
      *       origin</a>, and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic
@@ -2763,8 +2774,7 @@ export declare class KMS extends KMSClient {
      *       update is complete. While the key state is <code>Updating</code>, you can use the keys in
      *       cryptographic operations, but you cannot replicate the new primary key or perform certain
      *       management operations, such as enabling or disabling these keys. For details about the
-     *         <code>Updating</code> key state, see <a href="kms/latest/developerguide/key-state.html">Key state:
-     *         Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *         <code>Updating</code> key state, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>This operation does not return any output. To verify that primary key is changed, use the
      *         <a>DescribeKey</a> operation.</p>
      *          <p>
@@ -2813,7 +2823,7 @@ export declare class KMS extends KMSClient {
      *       fails with an <code>KMSInvalidSignatureException</code> exception.</p>
      *          <p>A digital signature is generated by using the private key in an asymmetric KMS key. The
      *       signature is verified by using the public key in the same asymmetric KMS key.
-     *       For information about symmetric and asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Using Symmetric and Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *       For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>To verify a digital signature, you can use the <code>Verify</code> operation. Specify the
      *       same asymmetric KMS key, message, and signing algorithm that were used to produce the
      *       signature.</p>
@@ -2825,7 +2835,7 @@ export declare class KMS extends KMSClient {
      *       in CloudTrail, and you can use key policy and IAM policy to determine who is authorized to use
      *       the KMS key to verify signatures.</p>
      *          <p>The KMS key that you use for this operation must be in a compatible key state. For
-     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key state: Effect on your KMS key</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
      *          <p>
      *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
      *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter. </p>
@@ -2839,4 +2849,31 @@ export declare class KMS extends KMSClient {
     verify(args: VerifyCommandInput, options?: __HttpHandlerOptions): Promise<VerifyCommandOutput>;
     verify(args: VerifyCommandInput, cb: (err: any, data?: VerifyCommandOutput) => void): void;
     verify(args: VerifyCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: VerifyCommandOutput) => void): void;
+    /**
+     * <p>Verifies the hash-based message authentication code (HMAC) for a specified message, HMAC
+     *       KMS key, and MAC algorithm. To verify the HMAC, <code>VerifyMac</code> computes an HMAC using
+     *       the message, HMAC KMS key, and MAC algorithm that you specify, and compares the computed HMAC
+     *       to the HMAC that you specify. If the HMACs are identical, the verification succeeds;
+     *       otherwise, it fails.</p>
+     *
+     *          <p>Verification indicates that the message hasn't changed since the HMAC was calculated, and
+     *       the specified key was used to generate and verify the HMAC.</p>
+     *          <p>This operation is part of KMS support for HMAC KMS keys. For details, see
+     *       <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *
+     *          <p>The KMS key that you use for this operation must be in a compatible key state. For
+     * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
+     *          <p>
+     *             <b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify
+     *   the key ARN or alias ARN in the value of the <code>KeyId</code> parameter. </p>
+     *
+     *          <p>
+     *             <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:VerifyMac</a> (key policy)</p>
+     *          <p>
+     *             <b>Related operations</b>: <a>GenerateMac</a>
+     *          </p>
+     */
+    verifyMac(args: VerifyMacCommandInput, options?: __HttpHandlerOptions): Promise<VerifyMacCommandOutput>;
+    verifyMac(args: VerifyMacCommandInput, cb: (err: any, data?: VerifyMacCommandOutput) => void): void;
+    verifyMac(args: VerifyMacCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: VerifyMacCommandOutput) => void): void;
 }