@aws-sdk/client-kms 3.826.0 → 3.829.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. package/dist-cjs/index.js +5 -0
  2. package/dist-es/models/models_0.js +5 -0
  3. package/dist-types/commands/CreateKeyCommand.d.ts +16 -15
  4. package/dist-types/commands/DecryptCommand.d.ts +1 -0
  5. package/dist-types/commands/DeleteImportedKeyMaterialCommand.d.ts +2 -1
  6. package/dist-types/commands/DescribeKeyCommand.d.ts +3 -2
  7. package/dist-types/commands/GenerateDataKeyCommand.d.ts +1 -0
  8. package/dist-types/commands/GenerateDataKeyPairCommand.d.ts +1 -0
  9. package/dist-types/commands/GenerateDataKeyPairWithoutPlaintextCommand.d.ts +1 -0
  10. package/dist-types/commands/GenerateDataKeyWithoutPlaintextCommand.d.ts +2 -1
  11. package/dist-types/commands/GetPublicKeyCommand.d.ts +2 -2
  12. package/dist-types/commands/ImportKeyMaterialCommand.d.ts +4 -1
  13. package/dist-types/commands/ReEncryptCommand.d.ts +5 -1
  14. package/dist-types/commands/ReplicateKeyCommand.d.ts +2 -2
  15. package/dist-types/commands/RotateKeyOnDemandCommand.d.ts +2 -2
  16. package/dist-types/commands/SignCommand.d.ts +10 -10
  17. package/dist-types/commands/UpdatePrimaryRegionCommand.d.ts +2 -1
  18. package/dist-types/commands/VerifyCommand.d.ts +3 -3
  19. package/dist-types/models/models_0.d.ts +81 -33
  20. package/dist-types/ts3.4/models/models_0.d.ts +5 -0
  21. package/package.json +5 -5
package/dist-cjs/index.js CHANGED
@@ -979,6 +979,9 @@ var KeySpec = {
979
979
  HMAC_256: "HMAC_256",
980
980
  HMAC_384: "HMAC_384",
981
981
  HMAC_512: "HMAC_512",
982
+ ML_DSA_44: "ML_DSA_44",
983
+ ML_DSA_65: "ML_DSA_65",
984
+ ML_DSA_87: "ML_DSA_87",
982
985
  RSA_2048: "RSA_2048",
983
986
  RSA_3072: "RSA_3072",
984
987
  RSA_4096: "RSA_4096",
@@ -1038,6 +1041,7 @@ var SigningAlgorithmSpec = {
1038
1041
  ECDSA_SHA_256: "ECDSA_SHA_256",
1039
1042
  ECDSA_SHA_384: "ECDSA_SHA_384",
1040
1043
  ECDSA_SHA_512: "ECDSA_SHA_512",
1044
+ ML_DSA_SHAKE_256: "ML_DSA_SHAKE_256",
1041
1045
  RSASSA_PKCS1_V1_5_SHA_256: "RSASSA_PKCS1_V1_5_SHA_256",
1042
1046
  RSASSA_PKCS1_V1_5_SHA_384: "RSASSA_PKCS1_V1_5_SHA_384",
1043
1047
  RSASSA_PKCS1_V1_5_SHA_512: "RSASSA_PKCS1_V1_5_SHA_512",
@@ -1416,6 +1420,7 @@ var RotationType = {
1416
1420
  };
1417
1421
  var MessageType = {
1418
1422
  DIGEST: "DIGEST",
1423
+ EXTERNAL_MU: "EXTERNAL_MU",
1419
1424
  RAW: "RAW"
1420
1425
  };
1421
1426
  var XksProxyAuthenticationCredentialTypeFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
package/dist-es/models/models_0.js CHANGED
@@ -446,6 +446,9 @@ export const KeySpec = {
446
446
  HMAC_256: "HMAC_256",
447
447
  HMAC_384: "HMAC_384",
448
448
  HMAC_512: "HMAC_512",
449
+ ML_DSA_44: "ML_DSA_44",
450
+ ML_DSA_65: "ML_DSA_65",
451
+ ML_DSA_87: "ML_DSA_87",
449
452
  RSA_2048: "RSA_2048",
450
453
  RSA_3072: "RSA_3072",
451
454
  RSA_4096: "RSA_4096",
@@ -505,6 +508,7 @@ export const SigningAlgorithmSpec = {
505
508
  ECDSA_SHA_256: "ECDSA_SHA_256",
506
509
  ECDSA_SHA_384: "ECDSA_SHA_384",
507
510
  ECDSA_SHA_512: "ECDSA_SHA_512",
511
+ ML_DSA_SHAKE_256: "ML_DSA_SHAKE_256",
508
512
  RSASSA_PKCS1_V1_5_SHA_256: "RSASSA_PKCS1_V1_5_SHA_256",
509
513
  RSASSA_PKCS1_V1_5_SHA_384: "RSASSA_PKCS1_V1_5_SHA_384",
510
514
  RSASSA_PKCS1_V1_5_SHA_512: "RSASSA_PKCS1_V1_5_SHA_512",
@@ -775,6 +779,7 @@ export const RotationType = {
775
779
  };
776
780
  export const MessageType = {
777
781
  DIGEST: "DIGEST",
782
+ EXTERNAL_MU: "EXTERNAL_MU",
778
783
  RAW: "RAW",
779
784
  };
780
785
  export const XksProxyAuthenticationCredentialTypeFilterSensitiveLog = (obj) => ({
package/dist-types/commands/CreateKeyCommand.d.ts CHANGED
@@ -65,18 +65,19 @@ declare const CreateKeyCommand_base: {
65
65
  * the type of key material in the KMS key. Then, use the <code>KeyUsage</code> parameter
66
66
  * to determine whether the KMS key will be used to encrypt and decrypt or sign and verify.
67
67
  * You can't change these properties after the KMS key is created.</p>
68
- * <p>Asymmetric KMS keys contain an RSA key pair, Elliptic Curve (ECC) key pair, or an
69
- * SM2 key pair (China Regions only). The private key in an asymmetric KMS key never leaves
70
- * KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to
71
- * download the public key so it can be used outside of KMS. Each KMS key can have only
72
- * one key usage. KMS keys with RSA key pairs can be used to encrypt and decrypt data or
73
- * sign and verify messages (but not both). KMS keys with NIST-recommended ECC key pairs
74
- * can be used to sign and verify messages or derive shared secrets (but not both). KMS
75
- * keys with <code>ECC_SECG_P256K1</code> can be used only to sign and verify messages. KMS
76
- * keys with SM2 key pairs (China Regions only) can be used to either encrypt and decrypt
77
- * data, sign and verify messages, or derive shared secrets (you must choose one key usage
78
- * type). For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the
79
- * <i>Key Management Service Developer Guide</i>.</p>
68
+ * <p>Asymmetric KMS keys contain an RSA key pair, Elliptic Curve (ECC) key pair, ML-DSA
69
+ * key pair or an SM2 key pair (China Regions only). The private key in an asymmetric KMS
70
+ * key never leaves KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to download the public key so it can be used
71
+ * outside of KMS. Each KMS key can have only one key usage. KMS keys with RSA key pairs
72
+ * can be used to encrypt and decrypt data or sign and verify messages (but not both). KMS
73
+ * keys with NIST-recommended ECC key pairs can be used to sign and verify messages or
74
+ * derive shared secrets (but not both). KMS keys with <code>ECC_SECG_P256K1</code> can be
75
+ * used only to sign and verify messages. KMS keys with ML-DSA key pairs can be used to
76
+ * sign and verify messages. KMS keys with SM2 key pairs (China Regions only) can be used
77
+ * to either encrypt and decrypt data, sign and verify messages, or derive shared secrets
78
+ * (you must choose one key usage type). For information about asymmetric KMS keys, see
79
+ * <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric
80
+ * KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
80
81
  * <p> </p>
81
82
  * </dd>
82
83
  * <dt>HMAC KMS key</dt>
@@ -207,7 +208,7 @@ declare const CreateKeyCommand_base: {
207
208
  * Description: "STRING_VALUE",
208
209
  * KeyUsage: "SIGN_VERIFY" || "ENCRYPT_DECRYPT" || "GENERATE_VERIFY_MAC" || "KEY_AGREEMENT",
209
210
  * CustomerMasterKeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
210
- * KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
211
+ * KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87",
211
212
  * Origin: "AWS_KMS" || "EXTERNAL" || "AWS_CLOUDHSM" || "EXTERNAL_KEY_STORE",
212
213
  * CustomKeyStoreId: "STRING_VALUE",
213
214
  * BypassPolicyLockoutSafetyCheck: true || false,
@@ -240,12 +241,12 @@ declare const CreateKeyCommand_base: {
240
241
  * // ExpirationModel: "KEY_MATERIAL_EXPIRES" || "KEY_MATERIAL_DOES_NOT_EXPIRE",
241
242
  * // KeyManager: "AWS" || "CUSTOMER",
242
243
  * // CustomerMasterKeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
243
- * // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
244
+ * // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87",
244
245
  * // EncryptionAlgorithms: [ // EncryptionAlgorithmSpecList
245
246
  * // "SYMMETRIC_DEFAULT" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "SM2PKE",
246
247
  * // ],
247
248
  * // SigningAlgorithms: [ // SigningAlgorithmSpecList
248
- * // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA",
249
+ * // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256",
249
250
  * // ],
250
251
  * // KeyAgreementAlgorithms: [ // KeyAgreementAlgorithmSpecList
251
252
  * // "ECDH",
package/dist-types/commands/DecryptCommand.d.ts CHANGED
@@ -281,6 +281,7 @@ declare const DecryptCommand_base: {
281
281
  * {
282
282
  * EncryptionAlgorithm: "SYMMETRIC_DEFAULT",
283
283
  * KeyId: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
284
+ * KeyMaterialId: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
284
285
  * Plaintext: "<binary data>"
285
286
  * }
286
287
  * *\/
package/dist-types/commands/DeleteImportedKeyMaterialCommand.d.ts CHANGED
@@ -136,7 +136,8 @@ declare const DeleteImportedKeyMaterialCommand_base: {
136
136
  * ```javascript
137
137
  * // The following example deletes the imported key material from the specified KMS key.
138
138
  * const input = {
139
- * KeyId: "1234abcd-12ab-34cd-56ef-1234567890ab"
139
+ * KeyId: "1234abcd-12ab-34cd-56ef-1234567890ab",
140
+ * KeyMaterialId: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6"
140
141
  * };
141
142
  * const command = new DeleteImportedKeyMaterialCommand(input);
142
143
  * const response = await client.send(command);
package/dist-types/commands/DescribeKeyCommand.d.ts CHANGED
@@ -143,12 +143,12 @@ declare const DescribeKeyCommand_base: {
143
143
  * // ExpirationModel: "KEY_MATERIAL_EXPIRES" || "KEY_MATERIAL_DOES_NOT_EXPIRE",
144
144
  * // KeyManager: "AWS" || "CUSTOMER",
145
145
  * // CustomerMasterKeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
146
- * // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
146
+ * // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87",
147
147
  * // EncryptionAlgorithms: [ // EncryptionAlgorithmSpecList
148
148
  * // "SYMMETRIC_DEFAULT" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "SM2PKE",
149
149
  * // ],
150
150
  * // SigningAlgorithms: [ // SigningAlgorithmSpecList
151
- * // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA",
151
+ * // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256",
152
152
  * // ],
153
153
  * // KeyAgreementAlgorithms: [ // KeyAgreementAlgorithmSpecList
154
154
  * // "ECDH",
@@ -290,6 +290,7 @@ declare const DescribeKeyCommand_base: {
290
290
  * AWSAccountId: "111122223333",
291
291
  * Arn: "arn:aws:kms:ap-northeast-1:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab",
292
292
  * CreationDate: 1.586329200918E9,
293
+ * CurrentKeyMaterialId: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
293
294
  * CustomerMasterKeySpec: "SYMMETRIC_DEFAULT",
294
295
  * Description: "",
295
296
  * Enabled: true,
package/dist-types/commands/GenerateDataKeyCommand.d.ts CHANGED
@@ -257,6 +257,7 @@ declare const GenerateDataKeyCommand_base: {
257
257
  * {
258
258
  * CiphertextBlob: "<binary data>",
259
259
  * KeyId: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
260
+ * KeyMaterialId: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
260
261
  * Plaintext: "<binary data>"
261
262
  * }
262
263
  * *\/
package/dist-types/commands/GenerateDataKeyPairCommand.d.ts CHANGED
@@ -240,6 +240,7 @@ declare const GenerateDataKeyPairCommand_base: {
240
240
  * /* response is
241
241
  * {
242
242
  * KeyId: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
243
+ * KeyMaterialId: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
243
244
  * KeyPairSpec: "RSA_3072",
244
245
  * PrivateKeyCiphertextBlob: "<binary data>",
245
246
  * PrivateKeyPlaintext: "<binary data>",
package/dist-types/commands/GenerateDataKeyPairWithoutPlaintextCommand.d.ts CHANGED
@@ -216,6 +216,7 @@ declare const GenerateDataKeyPairWithoutPlaintextCommand_base: {
216
216
  * /* response is
217
217
  * {
218
218
  * KeyId: "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
219
+ * KeyMaterialId: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
219
220
  * KeyPairSpec: "ECC_NIST_P521",
220
221
  * PrivateKeyCiphertextBlob: "<binary data>",
221
222
  * PublicKey: "<binary data>"
package/dist-types/commands/GenerateDataKeyWithoutPlaintextCommand.d.ts CHANGED
@@ -220,7 +220,8 @@ declare const GenerateDataKeyWithoutPlaintextCommand_base: {
220
220
  * /* response is
221
221
  * {
222
222
  * CiphertextBlob: "<binary data>",
223
- * KeyId: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
223
+ * KeyId: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
224
+ * KeyMaterialId: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6"
224
225
  * }
225
226
  * *\/
226
227
  * ```
package/dist-types/commands/GetPublicKeyCommand.d.ts CHANGED
@@ -97,13 +97,13 @@ declare const GetPublicKeyCommand_base: {
97
97
  * // KeyId: "STRING_VALUE",
98
98
  * // PublicKey: new Uint8Array(),
99
99
  * // CustomerMasterKeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
100
- * // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
100
+ * // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87",
101
101
  * // KeyUsage: "SIGN_VERIFY" || "ENCRYPT_DECRYPT" || "GENERATE_VERIFY_MAC" || "KEY_AGREEMENT",
102
102
  * // EncryptionAlgorithms: [ // EncryptionAlgorithmSpecList
103
103
  * // "SYMMETRIC_DEFAULT" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "SM2PKE",
104
104
  * // ],
105
105
  * // SigningAlgorithms: [ // SigningAlgorithmSpecList
106
- * // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA",
106
+ * // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256",
107
107
  * // ],
108
108
  * // KeyAgreementAlgorithms: [ // KeyAgreementAlgorithmSpecList
109
109
  * // "ECDH",
package/dist-types/commands/ImportKeyMaterialCommand.d.ts CHANGED
@@ -249,7 +249,10 @@ declare const ImportKeyMaterialCommand_base: {
249
249
  * const command = new ImportKeyMaterialCommand(input);
250
250
  * const response = await client.send(command);
251
251
  * /* response is
252
- * { /* metadata only *\/ }
252
+ * {
253
+ * KeyId: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
254
+ * KeyMaterialId: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6"
255
+ * }
253
256
  * *\/
254
257
  * ```
255
258
  *
package/dist-types/commands/ReEncryptCommand.d.ts CHANGED
@@ -262,8 +262,12 @@ declare const ReEncryptCommand_base: {
262
262
  * /* response is
263
263
  * {
264
264
  * CiphertextBlob: "<binary data>",
265
+ * DestinationEncryptionAlgorithm: "SYMMETRIC_DEFAULT",
266
+ * DestinationKeyMaterialId: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
265
267
  * KeyId: "arn:aws:kms:us-east-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321",
266
- * SourceKeyId: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
268
+ * SourceEncryptionAlgorithm: "SYMMETRIC_DEFAULT",
269
+ * SourceKeyId: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
270
+ * SourceKeyMaterialId: "1c6be7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6"
267
271
  * }
268
272
  * *\/
269
273
  * ```
package/dist-types/commands/ReplicateKeyCommand.d.ts CHANGED
@@ -148,12 +148,12 @@ declare const ReplicateKeyCommand_base: {
148
148
  * // ExpirationModel: "KEY_MATERIAL_EXPIRES" || "KEY_MATERIAL_DOES_NOT_EXPIRE",
149
149
  * // KeyManager: "AWS" || "CUSTOMER",
150
150
  * // CustomerMasterKeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
151
- * // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2",
151
+ * // KeySpec: "RSA_2048" || "RSA_3072" || "RSA_4096" || "ECC_NIST_P256" || "ECC_NIST_P384" || "ECC_NIST_P521" || "ECC_SECG_P256K1" || "SYMMETRIC_DEFAULT" || "HMAC_224" || "HMAC_256" || "HMAC_384" || "HMAC_512" || "SM2" || "ML_DSA_44" || "ML_DSA_65" || "ML_DSA_87",
152
152
  * // EncryptionAlgorithms: [ // EncryptionAlgorithmSpecList
153
153
  * // "SYMMETRIC_DEFAULT" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "SM2PKE",
154
154
  * // ],
155
155
  * // SigningAlgorithms: [ // SigningAlgorithmSpecList
156
- * // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA",
156
+ * // "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256",
157
157
  * // ],
158
158
  * // KeyAgreementAlgorithms: [ // KeyAgreementAlgorithmSpecList
159
159
  * // "ECDH",
package/dist-types/commands/RotateKeyOnDemandCommand.d.ts CHANGED
@@ -29,8 +29,8 @@ declare const RotateKeyOnDemandCommand_base: {
29
29
  /**
30
30
  * <p>Immediately initiates rotation of the key material of the specified symmetric encryption
31
31
  * KMS key.</p>
32
- * <p>You can perform <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html">on-demand rotation</a> of
33
- * the key material in customer managed KMS keys, regardless of whether or not <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html">automatic key
32
+ * <p>You can perform <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-on-demand.html">on-demand rotation</a> of the key
33
+ * material in customer managed KMS keys, regardless of whether or not <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotating-keys-enable-disable.html">automatic key
34
34
  * rotation</a> is enabled. On-demand rotations do not change existing automatic rotation
35
35
  * schedules. For example, consider a KMS key that has automatic key rotation enabled with a
36
36
  * rotation period of 730 days. If the key is scheduled to automatically rotate on April 14,
package/dist-types/commands/SignCommand.d.ts CHANGED
@@ -31,11 +31,11 @@ declare const SignCommand_base: {
31
31
  * signature</a> for a message or message digest by using the private key in an asymmetric
32
32
  * signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use
33
33
  * the public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
34
- * <p>Digital signatures are generated and verified by using asymmetric key pair, such as an RSA
35
- * or ECC pair that is represented by an asymmetric KMS key. The key owner (or an authorized
36
- * user) uses their private key to sign a message. Anyone with the public key can verify that the
37
- * message was signed with that particular private key and that the message hasn't changed since
38
- * it was signed. </p>
34
+ * <p>Digital signatures are generated and verified by using asymmetric key pair, such as an
35
+ * RSA, ECC, or ML-DSA pair that is represented by an asymmetric KMS key. The key owner (or an
36
+ * authorized user) uses their private key to sign a message. Anyone with the public key can
37
+ * verify that the message was signed with that particular private key and that the message
38
+ * hasn't changed since it was signed. </p>
39
39
  * <p>To use the <code>Sign</code> operation, provide the following information:</p>
40
40
  * <ul>
41
41
  * <li>
@@ -48,8 +48,8 @@ declare const SignCommand_base: {
48
48
  * <p>Use the <code>Message</code> parameter to specify the message or message digest to
49
49
  * sign. You can submit messages of up to 4096 bytes. To sign a larger message, generate a
50
50
  * hash digest of the message, and then provide the hash digest in the <code>Message</code>
51
- * parameter. To indicate whether the message is a full message or a digest, use the
52
- * <code>MessageType</code> parameter.</p>
51
+ * parameter. To indicate whether the message is a full message, a digest, or an ML-DSA
52
+ * EXTERNAL_MU, use the <code>MessageType</code> parameter.</p>
53
53
  * </li>
54
54
  * <li>
55
55
  * <p>Choose a signing algorithm that is compatible with the KMS key. </p>
@@ -91,11 +91,11 @@ declare const SignCommand_base: {
91
91
  * const input = { // SignRequest
92
92
  * KeyId: "STRING_VALUE", // required
93
93
  * Message: new Uint8Array(), // e.g. Buffer.from("") or new TextEncoder().encode("") // required
94
- * MessageType: "RAW" || "DIGEST",
94
+ * MessageType: "RAW" || "DIGEST" || "EXTERNAL_MU",
95
95
  * GrantTokens: [ // GrantTokenList
96
96
  * "STRING_VALUE",
97
97
  * ],
98
- * SigningAlgorithm: "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA", // required
98
+ * SigningAlgorithm: "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256", // required
99
99
  * DryRun: true || false,
100
100
  * };
101
101
  * const command = new SignCommand(input);
@@ -103,7 +103,7 @@ declare const SignCommand_base: {
103
103
  * // { // SignResponse
104
104
  * // KeyId: "STRING_VALUE",
105
105
  * // Signature: new Uint8Array(),
106
- * // SigningAlgorithm: "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA",
106
+ * // SigningAlgorithm: "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256",
107
107
  * // };
108
108
  *
109
109
  * ```
package/dist-types/commands/UpdatePrimaryRegionCommand.d.ts CHANGED
@@ -33,7 +33,8 @@ declare const UpdatePrimaryRegionCommand_base: {
33
33
  * in <code>us-east-1</code> and a replica key in <code>eu-west-2</code>. If you run
34
34
  * <code>UpdatePrimaryRegion</code> with a <code>PrimaryRegion</code> value of
35
35
  * <code>eu-west-2</code>, the primary key is now the key in <code>eu-west-2</code>, and the
36
- * key in <code>us-east-1</code> becomes a replica key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-update.html">Change the primary key in a set of multi-Region keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
36
+ * key in <code>us-east-1</code> becomes a replica key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-update.html">Change the primary key in a
37
+ * set of multi-Region keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
37
38
  * <p>This operation supports <i>multi-Region keys</i>, an KMS feature that lets you create multiple
38
39
  * interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key
39
40
  * material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt
package/dist-types/commands/VerifyCommand.d.ts CHANGED
@@ -74,9 +74,9 @@ declare const VerifyCommand_base: {
74
74
  * const input = { // VerifyRequest
75
75
  * KeyId: "STRING_VALUE", // required
76
76
  * Message: new Uint8Array(), // e.g. Buffer.from("") or new TextEncoder().encode("") // required
77
- * MessageType: "RAW" || "DIGEST",
77
+ * MessageType: "RAW" || "DIGEST" || "EXTERNAL_MU",
78
78
  * Signature: new Uint8Array(), // e.g. Buffer.from("") or new TextEncoder().encode("") // required
79
- * SigningAlgorithm: "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA", // required
79
+ * SigningAlgorithm: "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256", // required
80
80
  * GrantTokens: [ // GrantTokenList
81
81
  * "STRING_VALUE",
82
82
  * ],
@@ -87,7 +87,7 @@ declare const VerifyCommand_base: {
87
87
  * // { // VerifyResponse
88
88
  * // KeyId: "STRING_VALUE",
89
89
  * // SignatureValid: true || false,
90
- * // SigningAlgorithm: "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA",
90
+ * // SigningAlgorithm: "RSASSA_PSS_SHA_256" || "RSASSA_PSS_SHA_384" || "RSASSA_PSS_SHA_512" || "RSASSA_PKCS1_V1_5_SHA_256" || "RSASSA_PKCS1_V1_5_SHA_384" || "RSASSA_PKCS1_V1_5_SHA_512" || "ECDSA_SHA_256" || "ECDSA_SHA_384" || "ECDSA_SHA_512" || "SM2DSA" || "ML_DSA_SHAKE_256",
91
91
  * // };
92
92
  *
93
93
  * ```
package/dist-types/models/models_0.d.ts CHANGED
@@ -1152,6 +1152,9 @@ export declare const KeySpec: {
1152
1152
  readonly HMAC_256: "HMAC_256";
1153
1153
  readonly HMAC_384: "HMAC_384";
1154
1154
  readonly HMAC_512: "HMAC_512";
1155
+ readonly ML_DSA_44: "ML_DSA_44";
1156
+ readonly ML_DSA_65: "ML_DSA_65";
1157
+ readonly ML_DSA_87: "ML_DSA_87";
1155
1158
  readonly RSA_2048: "RSA_2048";
1156
1159
  readonly RSA_3072: "RSA_3072";
1157
1160
  readonly RSA_4096: "RSA_4096";
@@ -1236,13 +1239,13 @@ export interface CreateKeyRequest {
1236
1239
  * </li>
1237
1240
  * </ul>
1238
1241
  * <note>
1239
- * <p>If either of the required <code>Resource</code> or <code>Action</code>
1240
- * elements are missing from a key policy statement, the policy statement has
1241
- * no effect. When a key policy statement is missing one of these elements,
1242
- * the KMS console correctly reports an error, but the
1243
- * <code>CreateKey</code> and <code>PutKeyPolicy</code> API requests succeed, even though the policy
1244
- * statement is ineffective.</p>
1245
- * <p>For more information on required key policy elements, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements">Elements in a key policy</a> in the <i>Key Management Service Developer Guide</i>.</p>
1242
+ * <p>If either of the required <code>Resource</code> or <code>Action</code> elements are
1243
+ * missing from a key policy statement, the policy statement has no effect. When a key policy
1244
+ * statement is missing one of these elements, the KMS console correctly reports an error,
1245
+ * but the <code>CreateKey</code> and <code>PutKeyPolicy</code> API requests succeed, even
1246
+ * though the policy statement is ineffective.</p>
1247
+ * <p>For more information on required key policy elements, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements">Elements in a key
1248
+ * policy</a> in the <i>Key Management Service Developer Guide</i>.</p>
1246
1249
  * </note>
1247
1250
  * <p>If you do not provide a key policy, KMS attaches a default key policy to the KMS key.
1248
1251
  * For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html">Default key policy</a> in the
@@ -1290,10 +1293,14 @@ export interface CreateKeyRequest {
1290
1293
  * <code>SIGN_VERIFY</code> or <code>KEY_AGREEMENT</code>.</p>
1291
1294
  * </li>
1292
1295
  * <li>
1293
- * <p>For asymmetric KMS keys with <code>ECC_SECG_P256K1</code> key pairs specify
1296
+ * <p>For asymmetric KMS keys with <code>ECC_SECG_P256K1</code> key pairs, specify
1294
1297
  * <code>SIGN_VERIFY</code>.</p>
1295
1298
  * </li>
1296
1299
  * <li>
1300
+ * <p>For asymmetric KMS keys with ML-DSA key pairs, specify
1301
+ * <code>SIGN_VERIFY</code>.</p>
1302
+ * </li>
1303
+ * <li>
1297
1304
  * <p>For asymmetric KMS keys with SM2 key pairs (China Regions only), specify
1298
1305
  * <code>ENCRYPT_DECRYPT</code>, <code>SIGN_VERIFY</code>, or
1299
1306
  * <code>KEY_AGREEMENT</code>.</p>
@@ -1420,6 +1427,26 @@ export interface CreateKeyRequest {
1420
1427
  * </ul>
1421
1428
  * </li>
1422
1429
  * <li>
1430
+ * <p>Asymmetric ML-DSA key pairs (signing and verification)</p>
1431
+ * <ul>
1432
+ * <li>
1433
+ * <p>
1434
+ * <code>ML_DSA_44</code>
1435
+ * </p>
1436
+ * </li>
1437
+ * <li>
1438
+ * <p>
1439
+ * <code>ML_DSA_65</code>
1440
+ * </p>
1441
+ * </li>
1442
+ * <li>
1443
+ * <p>
1444
+ * <code>ML_DSA_87</code>
1445
+ * </p>
1446
+ * </li>
1447
+ * </ul>
1448
+ * </li>
1449
+ * <li>
1423
1450
  * <p>SM2 key pairs (encryption and decryption -or- signing and verification -or- deriving
1424
1451
  * shared secrets)</p>
1425
1452
  * <ul>
@@ -1689,6 +1716,7 @@ export declare const SigningAlgorithmSpec: {
1689
1716
  readonly ECDSA_SHA_256: "ECDSA_SHA_256";
1690
1717
  readonly ECDSA_SHA_384: "ECDSA_SHA_384";
1691
1718
  readonly ECDSA_SHA_512: "ECDSA_SHA_512";
1719
+ readonly ML_DSA_SHAKE_256: "ML_DSA_SHAKE_256";
1692
1720
  readonly RSASSA_PKCS1_V1_5_SHA_256: "RSASSA_PKCS1_V1_5_SHA_256";
1693
1721
  readonly RSASSA_PKCS1_V1_5_SHA_384: "RSASSA_PKCS1_V1_5_SHA_384";
1694
1722
  readonly RSASSA_PKCS1_V1_5_SHA_512: "RSASSA_PKCS1_V1_5_SHA_512";
@@ -3364,7 +3392,7 @@ export interface GenerateDataKeyPairRequest {
3364
3392
  KeyId: string | undefined;
3365
3393
  /**
3366
3394
  * <p>Determines the type of data key pair that is generated. </p>
3367
- * <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), and the rule that permits you to use ECC KMS keys only to sign and verify, are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
3395
+ * <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), the rule that permits you to use ECC KMS keys only to sign and verify, and the rule that permits you to use ML-DSA key pairs to sign and verify only are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
3368
3396
  * @public
3369
3397
  */
3370
3398
  KeyPairSpec: DataKeyPairSpec | undefined;
@@ -3442,8 +3470,7 @@ export interface GenerateDataKeyPairResponse {
3442
3470
  */
3443
3471
  CiphertextForRecipient?: Uint8Array | undefined;
3444
3472
  /**
3445
- * <p>The identifier of the key material used to encrypt the private key. This field is omitted if the request
3446
- * includes the <code>Recipient</code> parameter.</p>
3473
+ * <p>The identifier of the key material used to encrypt the private key.</p>
3447
3474
  * @public
3448
3475
  */
3449
3476
  KeyMaterialId?: string | undefined;
@@ -3496,7 +3523,7 @@ export interface GenerateDataKeyPairWithoutPlaintextRequest {
3496
3523
  KeyId: string | undefined;
3497
3524
  /**
3498
3525
  * <p>Determines the type of data key pair that is generated.</p>
3499
- * <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), and the rule that permits you to use ECC KMS keys only to sign and verify, are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
3526
+ * <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), the rule that permits you to use ECC KMS keys only to sign and verify, and the rule that permits you to use ML-DSA key pairs to sign and verify only are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
3500
3527
  * @public
3501
3528
  */
3502
3529
  KeyPairSpec: DataKeyPairSpec | undefined;
@@ -4913,6 +4940,7 @@ export interface ListRetirableGrantsRequest {
4913
4940
  */
4914
4941
  export declare const MessageType: {
4915
4942
  readonly DIGEST: "DIGEST";
4943
+ readonly EXTERNAL_MU: "EXTERNAL_MU";
4916
4944
  readonly RAW: "RAW";
4917
4945
  };
4918
4946
  /**
@@ -4967,13 +4995,13 @@ export interface PutKeyPolicyRequest {
4967
4995
  * </li>
4968
4996
  * </ul>
4969
4997
  * <note>
4970
- * <p>If either of the required <code>Resource</code> or <code>Action</code>
4971
- * elements are missing from a key policy statement, the policy statement has
4972
- * no effect. When a key policy statement is missing one of these elements,
4973
- * the KMS console correctly reports an error, but the
4974
- * <code>PutKeyPolicy</code> API request succeeds, even though the policy
4975
- * statement is ineffective.</p>
4976
- * <p>For more information on required key policy elements, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements">Elements in a key policy</a> in the <i>Key Management Service Developer Guide</i>.</p>
4998
+ * <p>If either of the required <code>Resource</code> or <code>Action</code> elements are
4999
+ * missing from a key policy statement, the policy statement has no effect. When a key policy
5000
+ * statement is missing one of these elements, the KMS console correctly reports an error,
5001
+ * but the <code>PutKeyPolicy</code> API request succeeds, even though the policy statement is
5002
+ * ineffective.</p>
5003
+ * <p>For more information on required key policy elements, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements">Elements in a key
5004
+ * policy</a> in the <i>Key Management Service Developer Guide</i>.</p>
4977
5005
  * </note>
4978
5006
  * <p>A key policy document can include only the following characters:</p>
4979
5007
  * <ul>
@@ -5571,22 +5599,29 @@ export interface SignRequest {
5571
5599
  /**
5572
5600
  * <p>Tells KMS whether the value of the <code>Message</code> parameter should be hashed as
5573
5601
  * part of the signing algorithm. Use <code>RAW</code> for unhashed messages; use
5574
- * <code>DIGEST</code> for message digests, which are already hashed.</p>
5602
+ * <code>DIGEST</code> for message digests, which are already hashed; use
5603
+ * <code>EXTERNAL_MU</code> for 64-byte representative μ used in ML-DSA signing as defined
5604
+ * in NIST FIPS 204 Section 6.2.</p>
5575
5605
  * <p>When the value of <code>MessageType</code> is <code>RAW</code>, KMS uses the standard
5576
5606
  * signing algorithm, which begins with a hash function. When the value is <code>DIGEST</code>,
5577
- * KMS skips the hashing step in the signing algorithm.</p>
5607
+ * KMS skips the hashing step in the signing algorithm. When the value is
5608
+ * <code>EXTERNAL_MU</code> KMS skips the concatenated hashing of the public key hash and the
5609
+ * message done in the ML-DSA signing algorithm.</p>
5578
5610
  * <important>
5579
- * <p>Use the <code>DIGEST</code> value only when the value of the <code>Message</code>
5580
- * parameter is a message digest. If you use the <code>DIGEST</code> value with an unhashed
5581
- * message, the security of the signing operation can be compromised.</p>
5611
+ * <p>Use the <code>DIGEST</code> or <code>EXTERNAL_MU</code> value only when the value of the
5612
+ * <code>Message</code> parameter is a message digest. If you use the <code>DIGEST</code>
5613
+ * value with an unhashed message, the security of the signing operation can be
5614
+ * compromised.</p>
5582
5615
  * </important>
5583
- * <p>When the value of <code>MessageType</code>is <code>DIGEST</code>, the length of the
5616
+ * <p>When the value of <code>MessageType</code> is <code>DIGEST</code>, the length of the
5584
5617
  * <code>Message</code> value must match the length of hashed messages for the specified
5585
5618
  * signing algorithm.</p>
5619
+ * <p>When the value of <code>MessageType</code> is <code>EXTERNAL_MU</code> the length of the
5620
+ * <code>Message</code> value must be 64 bytes.</p>
5586
5621
  * <p>You can submit a message digest and omit the <code>MessageType</code> or specify
5587
5622
  * <code>RAW</code> so the digest is hashed again while signing. However, this can cause
5588
5623
  * verification failures when verifying with a system that assumes a single hash.</p>
5589
- * <p>The hashing algorithm in that <code>Sign</code> uses is based on the
5624
+ * <p>The hashing algorithm that <code>Sign</code> uses is based on the
5590
5625
  * <code>SigningAlgorithm</code> value.</p>
5591
5626
  * <ul>
5592
5627
  * <li>
@@ -5599,6 +5634,9 @@ export interface SignRequest {
5599
5634
  * <p>Signing algorithms that end in SHA_512 use the SHA_512 hashing algorithm.</p>
5600
5635
  * </li>
5601
5636
  * <li>
5637
+ * <p>Signing algorithms that end in SHAKE_256 use the SHAKE_256 hashing algorithm.</p>
5638
+ * </li>
5639
+ * <li>
5602
5640
  * <p>SM2DSA uses the SM3 hashing algorithm. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification">Offline
5603
5641
  * verification with SM2 key pairs</a>.</p>
5604
5642
  * </li>
@@ -5992,23 +6030,30 @@ export interface VerifyRequest {
5992
6030
  /**
5993
6031
  * <p>Tells KMS whether the value of the <code>Message</code> parameter should be hashed as
5994
6032
  * part of the signing algorithm. Use <code>RAW</code> for unhashed messages; use
5995
- * <code>DIGEST</code> for message digests, which are already hashed.</p>
6033
+ * <code>DIGEST</code> for message digests, which are already hashed; use
6034
+ * <code>EXTERNAL_MU</code> for 64-byte representative μ used in ML-DSA signing as defined
6035
+ * in NIST FIPS 204 Section 6.2.</p>
5996
6036
  * <p>When the value of <code>MessageType</code> is <code>RAW</code>, KMS uses the standard
5997
6037
  * signing algorithm, which begins with a hash function. When the value is <code>DIGEST</code>,
5998
- * KMS skips the hashing step in the signing algorithm.</p>
6038
+ * KMS skips the hashing step in the signing algorithm. When the value is
6039
+ * <code>EXTERNAL_MU</code> KMS skips the concatenated hashing of the public key hash and the
6040
+ * message done in the ML-DSA signing algorithm.</p>
5999
6041
  * <important>
6000
- * <p>Use the <code>DIGEST</code> value only when the value of the <code>Message</code>
6001
- * parameter is a message digest. If you use the <code>DIGEST</code> value with an unhashed
6002
- * message, the security of the verification operation can be compromised.</p>
6042
+ * <p>Use the <code>DIGEST</code> or <code>EXTERNAL_MU</code> value only when the value of the
6043
+ * <code>Message</code> parameter is a message digest. If you use the <code>DIGEST</code>
6044
+ * value with an unhashed message, the security of the signing operation can be
6045
+ * compromised.</p>
6003
6046
  * </important>
6004
- * <p>When the value of <code>MessageType</code>is <code>DIGEST</code>, the length of the
6047
+ * <p>When the value of <code>MessageType</code> is <code>DIGEST</code>, the length of the
6005
6048
  * <code>Message</code> value must match the length of hashed messages for the specified
6006
6049
  * signing algorithm.</p>
6050
+ * <p>When the value of <code>MessageType</code> is <code>EXTERNAL_MU</code> the length of the
6051
+ * <code>Message</code> value must be 64 bytes.</p>
6007
6052
  * <p>You can submit a message digest and omit the <code>MessageType</code> or specify
6008
6053
  * <code>RAW</code> so the digest is hashed again while signing. However, if the signed message
6009
6054
  * is hashed once while signing, but twice while verifying, verification fails, even when the
6010
6055
  * message hasn't changed.</p>
6011
- * <p>The hashing algorithm in that <code>Verify</code> uses is based on the
6056
+ * <p>The hashing algorithm that <code>Verify</code> uses is based on the
6012
6057
  * <code>SigningAlgorithm</code> value.</p>
6013
6058
  * <ul>
6014
6059
  * <li>
@@ -6021,6 +6066,9 @@ export interface VerifyRequest {
6021
6066
  * <p>Signing algorithms that end in SHA_512 use the SHA_512 hashing algorithm.</p>
6022
6067
  * </li>
6023
6068
  * <li>
6069
+ * <p>Signing algorithms that end in SHAKE_256 use the SHAKE_256 hashing algorithm.</p>
6070
+ * </li>
6071
+ * <li>
6024
6072
  * <p>SM2DSA uses the SM3 hashing algorithm. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/offline-operations.html#key-spec-sm-offline-verification">Offline
6025
6073
  * verification with SM2 key pairs</a>.</p>
6026
6074
  * </li>
package/dist-types/ts3.4/models/models_0.d.ts CHANGED
@@ -408,6 +408,9 @@ export declare const KeySpec: {
408
408
  readonly HMAC_256: "HMAC_256";
409
409
  readonly HMAC_384: "HMAC_384";
410
410
  readonly HMAC_512: "HMAC_512";
411
+ readonly ML_DSA_44: "ML_DSA_44";
412
+ readonly ML_DSA_65: "ML_DSA_65";
413
+ readonly ML_DSA_87: "ML_DSA_87";
411
414
  readonly RSA_2048: "RSA_2048";
412
415
  readonly RSA_3072: "RSA_3072";
413
416
  readonly RSA_4096: "RSA_4096";
@@ -509,6 +512,7 @@ export declare const SigningAlgorithmSpec: {
509
512
  readonly ECDSA_SHA_256: "ECDSA_SHA_256";
510
513
  readonly ECDSA_SHA_384: "ECDSA_SHA_384";
511
514
  readonly ECDSA_SHA_512: "ECDSA_SHA_512";
515
+ readonly ML_DSA_SHAKE_256: "ML_DSA_SHAKE_256";
512
516
  readonly RSASSA_PKCS1_V1_5_SHA_256: "RSASSA_PKCS1_V1_5_SHA_256";
513
517
  readonly RSASSA_PKCS1_V1_5_SHA_384: "RSASSA_PKCS1_V1_5_SHA_384";
514
518
  readonly RSASSA_PKCS1_V1_5_SHA_512: "RSASSA_PKCS1_V1_5_SHA_512";
@@ -1090,6 +1094,7 @@ export interface ListRetirableGrantsRequest {
1090
1094
  }
1091
1095
  export declare const MessageType: {
1092
1096
  readonly DIGEST: "DIGEST";
1097
+ readonly EXTERNAL_MU: "EXTERNAL_MU";
1093
1098
  readonly RAW: "RAW";
1094
1099
  };
1095
1100
  export type MessageType = (typeof MessageType)[keyof typeof MessageType];
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@aws-sdk/client-kms",
3
3
  "description": "AWS SDK for JavaScript Kms Client for Node.js, Browser and React Native",
4
- "version": "3.826.0",
4
+ "version": "3.829.0",
5
5
  "scripts": {
6
6
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
7
7
  "build:cjs": "node ../../scripts/compilation/inline client-kms",
@@ -21,16 +21,16 @@
21
21
  "@aws-crypto/sha256-browser": "5.2.0",
22
22
  "@aws-crypto/sha256-js": "5.2.0",
23
23
  "@aws-sdk/core": "3.826.0",
24
- "@aws-sdk/credential-provider-node": "3.826.0",
24
+ "@aws-sdk/credential-provider-node": "3.828.0",
25
25
  "@aws-sdk/middleware-host-header": "3.821.0",
26
26
  "@aws-sdk/middleware-logger": "3.821.0",
27
27
  "@aws-sdk/middleware-recursion-detection": "3.821.0",
28
- "@aws-sdk/middleware-user-agent": "3.826.0",
28
+ "@aws-sdk/middleware-user-agent": "3.828.0",
29
29
  "@aws-sdk/region-config-resolver": "3.821.0",
30
30
  "@aws-sdk/types": "3.821.0",
31
- "@aws-sdk/util-endpoints": "3.821.0",
31
+ "@aws-sdk/util-endpoints": "3.828.0",
32
32
  "@aws-sdk/util-user-agent-browser": "3.821.0",
33
- "@aws-sdk/util-user-agent-node": "3.826.0",
33
+ "@aws-sdk/util-user-agent-node": "3.828.0",
34
34
  "@smithy/config-resolver": "^4.1.4",
35
35
  "@smithy/core": "^3.5.3",
36
36
  "@smithy/fetch-http-handler": "^5.0.4",