@aws-sdk/client-kms 3.85.0 → 3.93.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/CHANGELOG.md +24 -0
  2. package/README.md +2 -1
  3. package/dist-types/KMS.d.ts +98 -38
  4. package/dist-types/KMSClient.d.ts +2 -1
  5. package/dist-types/commands/CreateKeyCommand.d.ts +3 -4
  6. package/dist-types/commands/DecryptCommand.d.ts +1 -1
  7. package/dist-types/commands/DisableKeyRotationCommand.d.ts +12 -2
  8. package/dist-types/commands/EnableKeyRotationCommand.d.ts +20 -2
  9. package/dist-types/commands/GenerateDataKeyCommand.d.ts +5 -6
  10. package/dist-types/commands/GenerateDataKeyPairCommand.d.ts +2 -1
  11. package/dist-types/commands/GenerateDataKeyPairWithoutPlaintextCommand.d.ts +2 -1
  12. package/dist-types/commands/GenerateDataKeyWithoutPlaintextCommand.d.ts +9 -7
  13. package/dist-types/commands/GenerateMacCommand.d.ts +7 -0
  14. package/dist-types/commands/GetKeyRotationStatusCommand.d.ts +20 -4
  15. package/dist-types/commands/GetParametersForImportCommand.d.ts +2 -2
  16. package/dist-types/commands/ImportKeyMaterialCommand.d.ts +6 -5
  17. package/dist-types/commands/SignCommand.d.ts +7 -2
  18. package/dist-types/models/models_0.d.ts +80 -36
  19. package/package.json +3 -3
package/CHANGELOG.md CHANGED
@@ -3,6 +3,30 @@
3
3
  All notable changes to this project will be documented in this file.
4
4
  See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
5
5
 
6
+ # [3.93.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.92.0...v3.93.0) (2022-05-17)
7
+
8
+ **Note:** Version bump only for package @aws-sdk/client-kms
9
+
10
+
11
+
12
+
13
+
14
+ # [3.92.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.91.0...v3.92.0) (2022-05-16)
15
+
16
+ **Note:** Version bump only for package @aws-sdk/client-kms
17
+
18
+
19
+
20
+
21
+
22
+ # [3.87.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.86.0...v3.87.0) (2022-05-09)
23
+
24
+ **Note:** Version bump only for package @aws-sdk/client-kms
25
+
26
+
27
+
28
+
29
+
6
30
  # [3.85.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.84.0...v3.85.0) (2022-05-05)
7
31
 
8
32
 
package/README.md CHANGED
@@ -30,7 +30,8 @@ Services</a>.</p>
30
30
  <p>If you need to use FIPS 140-2 validated cryptographic modules when communicating with
31
31
  Amazon Web Services, use the FIPS endpoint in your preferred Amazon Web Services Region. For more information about the
32
32
  available FIPS endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">Service endpoints</a> in the Key Management Service topic of the <i>Amazon Web Services General Reference</i>.</p>
33
- <p>Clients must support TLS (Transport Layer Security) 1.0. We recommend TLS 1.2. Clients
33
+ <p>All KMS API calls must be signed and be transmitted using Transport Layer Security (TLS).
34
+ KMS recommends you always use the latest supported TLS version. Clients
34
35
  must also support cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral
35
36
  Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems
36
37
  such as Java 7 and later support these modes.</p>
package/dist-types/KMS.d.ts CHANGED
@@ -71,7 +71,8 @@ import { KMSClient } from "./KMSClient";
71
71
  * <p>If you need to use FIPS 140-2 validated cryptographic modules when communicating with
72
72
  * Amazon Web Services, use the FIPS endpoint in your preferred Amazon Web Services Region. For more information about the
73
73
  * available FIPS endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">Service endpoints</a> in the Key Management Service topic of the <i>Amazon Web Services General Reference</i>.</p>
74
- * <p>Clients must support TLS (Transport Layer Security) 1.0. We recommend TLS 1.2. Clients
74
+ * <p>All KMS API calls must be signed and be transmitted using Transport Layer Security (TLS).
75
+ * KMS recommends you always use the latest supported TLS version. Clients
75
76
  * must also support cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral
76
77
  * Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems
77
78
  * such as Java 7 and later support these modes.</p>
@@ -420,13 +421,12 @@ export declare class KMS extends KMSClient {
420
421
  createGrant(args: CreateGrantCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: CreateGrantCommandOutput) => void): void;
421
422
  /**
422
423
  * <p>Creates a unique customer managed <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys">KMS key</a> in your Amazon Web Services account and
423
- * Region. </p>
424
+ * Region.</p>
424
425
  * <p>In addition to the required parameters, you can use the optional parameters to specify a key policy, description, tags, and other useful elements for any key type.</p>
425
426
  * <note>
426
427
  * <p>KMS is replacing the term <i>customer master key (CMK)</i> with <i>KMS key</i> and <i>KMS key</i>. The concept has not changed. To prevent breaking changes, KMS is keeping some variations of this term.</p>
427
428
  * </note>
428
429
  *
429
- *
430
430
  * <p>To create different types of KMS keys, use the following guidance:</p>
431
431
  *
432
432
  * <dl>
@@ -446,8 +446,8 @@ export declare class KMS extends KMSClient {
446
446
  * to determine whether the KMS key will be used to encrypt and decrypt or sign and verify.
447
447
  * You can't change these properties after the KMS key is created.</p>
448
448
  * <p>Asymmetric KMS keys contain an RSA key pair or an Elliptic Curve (ECC) key pair. The private key in an asymmetric
449
- * KMS key never leaves AWS KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to download the public key
450
- * so it can be used outside of AWS KMS. KMS keys with RSA key pairs can be used to encrypt or decrypt data or sign and verify messages (but not both).
449
+ * KMS key never leaves KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to download the public key
450
+ * so it can be used outside of KMS. KMS keys with RSA key pairs can be used to encrypt or decrypt data or sign and verify messages (but not both).
451
451
  * KMS keys with ECC key pairs can be used only to sign and verify messages.
452
452
  * For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
453
453
  * <p> </p>
@@ -586,7 +586,7 @@ export declare class KMS extends KMSClient {
586
586
  * asymmetric encryption KMS key. When the KMS key is asymmetric, you must specify the KMS key and the
587
587
  * encryption algorithm that was used to encrypt the ciphertext. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
588
588
  * <p>The <code>Decrypt</code> operation also decrypts ciphertext that was encrypted outside of KMS by the
589
- * public key in an KMS asymmetric KMS key. However, it cannot decrypt symmetric ciphertext produced by
589
+ * public key in an KMS asymmetric KMS key. However, it cannot decrypt ciphertext produced by
590
590
  * other libraries, such as the <a href="https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/">Amazon Web Services
591
591
  * Encryption SDK</a> or <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html">Amazon S3 client-side encryption</a>.
592
592
  * These libraries return a ciphertext format that is incompatible with KMS.</p>
@@ -958,8 +958,18 @@ export declare class KMS extends KMSClient {
958
958
  disableKey(args: DisableKeyCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DisableKeyCommandOutput) => void): void;
959
959
  /**
960
960
  * <p>Disables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic
961
- * rotation of the key material</a> for the specified symmetric encryption KMS key.</p>
962
- * <p> You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
961
+ * rotation of the key material</a> of the specified symmetric encryption KMS key.</p>
962
+ * <p>Automatic key rotation is supported only on symmetric encryption KMS keys.
963
+ * You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
964
+ * To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
965
+ * <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation of the
966
+ * key material in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>. Key material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
967
+ * configurable. KMS always rotates the key material for every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
968
+ * keys</a> varies.</p>
969
+ * <note>
970
+ * <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every
971
+ * three years to every year. For details, see <a>EnableKeyRotation</a>.</p>
972
+ * </note>
963
973
  * <p>The KMS key that you use for this operation must be in a compatible key state. For
964
974
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
965
975
  * <p>
@@ -1065,8 +1075,26 @@ export declare class KMS extends KMSClient {
1065
1075
  enableKey(args: EnableKeyCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: EnableKeyCommandOutput) => void): void;
1066
1076
  /**
1067
1077
  * <p>Enables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation
1068
- * of the key material</a> for the specified symmetric encryption KMS key.</p>
1069
- * <p>You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
1078
+ * of the key material</a> of the specified symmetric encryption KMS key. </p>
1079
+ * <p>When you enable automatic rotation of a<a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS key</a>, KMS
1080
+ * rotates the key material of the KMS key one year (approximately 365 days) from the enable date
1081
+ * and every year thereafter. You can monitor rotation of the key material for your KMS keys in
1082
+ * CloudTrail and Amazon CloudWatch. To disable rotation of the key material in a customer
1083
+ * managed KMS key, use the <a>DisableKeyRotation</a> operation.</p>
1084
+ * <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
1085
+ * You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
1086
+ * To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
1087
+ * <p>You cannot enable or disable automatic rotation <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a>. KMS
1088
+ * always rotates the key material of Amazon Web Services managed keys every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
1089
+ * keys</a> varies.</p>
1090
+ * <note>
1091
+ * <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
1092
+ * years (approximately 1,095 days) to every year (approximately 365 days).</p>
1093
+ * <p>New Amazon Web Services managed keys are automatically rotated one year after they
1094
+ * are created, and approximately every year thereafter. </p>
1095
+ * <p>Existing Amazon Web Services managed keys are automatically rotated one year after
1096
+ * their most recent rotation, and every year thereafter.</p>
1097
+ * </note>
1070
1098
  * <p>The KMS key that you use for this operation must be in a compatible key state. For
1071
1099
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
1072
1100
  * <p>
@@ -1210,15 +1238,14 @@ export declare class KMS extends KMSClient {
1210
1238
  * <p>Returns a unique symmetric data key for use outside of KMS. This operation returns a
1211
1239
  * plaintext copy of the data key and a copy that is encrypted under a symmetric encryption KMS
1212
1240
  * key that you specify. The bytes in the plaintext key are random; they are not related to the caller or the KMS
1213
- * key. You can use the plaintext key to encrypt your data outside of KMS and store the
1214
- * encrypted data key with the encrypted data.</p>
1241
+ * key. You can use the plaintext key to encrypt your data outside of KMS and store the encrypted
1242
+ * data key with the encrypted data.</p>
1215
1243
  *
1216
1244
  * <p>To generate a data key, specify the symmetric encryption KMS key that will be used to
1217
1245
  * encrypt the data key. You cannot use an asymmetric KMS key to encrypt data keys. To get the
1218
- * type of your KMS key, use the <a>DescribeKey</a> operation. You must also specify
1219
- * the length of the data key. Use either the <code>KeySpec</code> or <code>NumberOfBytes</code>
1220
- * parameters (but not both). For 128-bit and 256-bit data keys, use the <code>KeySpec</code>
1221
- * parameter. </p>
1246
+ * type of your KMS key, use the <a>DescribeKey</a> operation. You must also specify the length of
1247
+ * the data key. Use either the <code>KeySpec</code> or <code>NumberOfBytes</code> parameters
1248
+ * (but not both). For 128-bit and 256-bit data keys, use the <code>KeySpec</code> parameter. </p>
1222
1249
  *
1223
1250
  * <p>To get only an encrypted copy of the data key, use <a>GenerateDataKeyWithoutPlaintext</a>. To generate an asymmetric data key pair, use
1224
1251
  * the <a>GenerateDataKeyPair</a> or <a>GenerateDataKeyPairWithoutPlaintext</a> operation. To get a cryptographically secure
@@ -1321,7 +1348,8 @@ export declare class KMS extends KMSClient {
1321
1348
  *
1322
1349
  * <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
1323
1350
  * the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
1324
- * custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
1351
+ * custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
1352
+ * operation. </p>
1325
1353
  * <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
1326
1354
  * key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for
1327
1355
  * either encryption or signing, but not both. However, KMS cannot enforce any restrictions on
@@ -1401,7 +1429,8 @@ export declare class KMS extends KMSClient {
1401
1429
  * with the data. When you are ready to decrypt data or sign a message, you can use the <a>Decrypt</a> operation to decrypt the encrypted private key.</p>
1402
1430
  * <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
1403
1431
  * the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
1404
- * custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
1432
+ * custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
1433
+ * operation. </p>
1405
1434
  * <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
1406
1435
  * key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for
1407
1436
  * either encryption or signing, but not both. However, KMS cannot enforce any restrictions on
@@ -1470,19 +1499,21 @@ export declare class KMS extends KMSClient {
1470
1499
  * data key. </p>
1471
1500
  * <p>This operation is useful for systems that need to encrypt data at some point, but not
1472
1501
  * immediately. When you need to encrypt the data, you call the <a>Decrypt</a>
1473
- * operation on the encrypted copy of the key. It's also useful in distributed systems with
1474
- * different levels of trust. For example, you might store encrypted data in containers. One
1475
- * component of your system creates new containers and stores an encrypted data key with each
1476
- * container. Then, a different component puts the data into the containers. That component first
1477
- * decrypts the data key, uses the plaintext data key to encrypt data, puts the encrypted data
1478
- * into the container, and then destroys the plaintext data key. In this system, the component
1479
- * that creates the containers never sees the plaintext data key.</p>
1502
+ * operation on the encrypted copy of the key.</p>
1503
+ * <p>It's also useful in distributed systems with different levels of trust. For example, you
1504
+ * might store encrypted data in containers. One component of your system creates new containers
1505
+ * and stores an encrypted data key with each container. Then, a different component puts the
1506
+ * data into the containers. That component first decrypts the data key, uses the plaintext data
1507
+ * key to encrypt data, puts the encrypted data into the container, and then destroys the
1508
+ * plaintext data key. In this system, the component that creates the containers never sees the
1509
+ * plaintext data key.</p>
1480
1510
  * <p>To request an asymmetric data key pair, use the <a>GenerateDataKeyPair</a> or
1481
1511
  * <a>GenerateDataKeyPairWithoutPlaintext</a> operations.</p>
1482
1512
  *
1483
1513
  * <p>To generate a data key, you must specify the symmetric encryption KMS key that is used to
1484
1514
  * encrypt the data key. You cannot use an asymmetric KMS key or a key in a custom key store to generate a data key. To get the
1485
1515
  * type of your KMS key, use the <a>DescribeKey</a> operation.</p>
1516
+ *
1486
1517
  * <p>If the operation succeeds, you will find the encrypted copy of the data key in the
1487
1518
  * <code>CiphertextBlob</code> field.</p>
1488
1519
  *
@@ -1546,6 +1577,13 @@ export declare class KMS extends KMSClient {
1546
1577
  * For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>
1547
1578
  * <i>Key Management Service Developer Guide</i>
1548
1579
  * </i>.</p>
1580
+ * <note>
1581
+ * <p>Best practices recommend that you limit the time during which any signing mechanism,
1582
+ * including an HMAC, is effective. This deters an attack where the actor uses a signed
1583
+ * message to establish validity repeatedly or long after the message is superseded. HMAC
1584
+ * tags do not include a timestamp, but you can include a timestamp in the token or message
1585
+ * to help you detect when its time to refresh the HMAC. </p>
1586
+ * </note>
1549
1587
  * <p>The KMS key that you use for this operation must be in a compatible key state. For
1550
1588
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
1551
1589
  * <p>
@@ -1593,19 +1631,35 @@ export declare class KMS extends KMSClient {
1593
1631
  /**
1594
1632
  * <p>Gets a Boolean value that indicates whether <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation of the key material</a> is
1595
1633
  * enabled for the specified KMS key.</p>
1596
- * <p>You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. The key rotation status for these KMS keys is always
1597
- * <code>false</code>.</p>
1634
+ * <p>When you enable automatic rotation for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>, KMS
1635
+ * rotates the key material of the KMS key one year (approximately 365 days) from the enable date
1636
+ * and every year thereafter. You can monitor rotation of the key material for your KMS keys in
1637
+ * CloudTrail and Amazon CloudWatch.</p>
1638
+ * <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
1639
+ * You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
1640
+ * To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key..</p>
1641
+ * <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation (<a>DisableKeyRotation</a>) of the key material in customer managed KMS keys. Key
1642
+ * material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
1643
+ * configurable. KMS always rotates the key material in Amazon Web Services managed KMS keys every year. The
1644
+ * key rotation status for Amazon Web Services managed KMS keys is always <code>true</code>.</p>
1645
+ * <note>
1646
+ * <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three years to every year. For details, see <a>EnableKeyRotation</a>.</p>
1647
+ * </note>
1598
1648
  * <p>The KMS key that you use for this operation must be in a compatible key state. For
1599
1649
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
1600
1650
  * <ul>
1601
1651
  * <li>
1602
1652
  * <p>Disabled: The key rotation status does not change when you disable a KMS key. However,
1603
- * while the KMS key is disabled, KMS does not rotate the key material.</p>
1653
+ * while the KMS key is disabled, KMS does not rotate the key material. When you re-enable
1654
+ * the KMS key, rotation resumes. If the key material in the re-enabled KMS key hasn't been
1655
+ * rotated in one year, KMS rotates it immediately, and every year thereafter. If it's been
1656
+ * less than a year since the key material in the re-enabled KMS key was rotated, the KMS key
1657
+ * resumes its prior rotation schedule.</p>
1604
1658
  * </li>
1605
1659
  * <li>
1606
1660
  * <p>Pending deletion: While a KMS key is pending deletion, its key rotation status is
1607
1661
  * <code>false</code> and KMS does not rotate the key material. If you cancel the
1608
- * deletion, the original key rotation status is restored.</p>
1662
+ * deletion, the original key rotation status returns to <code>true</code>.</p>
1609
1663
  * </li>
1610
1664
  * </ul>
1611
1665
  * <p>
@@ -1635,8 +1689,8 @@ export declare class KMS extends KMSClient {
1635
1689
  getKeyRotationStatus(args: GetKeyRotationStatusCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GetKeyRotationStatusCommandOutput) => void): void;
1636
1690
  /**
1637
1691
  * <p>Returns the items you need to import key material into a symmetric encryption KMS key. For
1638
- * more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a> in the
1639
- * <i>Key Management Service Developer Guide</i>.</p>
1692
+ * more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a>
1693
+ * in the <i>Key Management Service Developer Guide</i>.</p>
1640
1694
  * <p>This operation returns a public key and an import token. Use the public key to encrypt the
1641
1695
  * symmetric key material. Store the import token to send with a subsequent <a>ImportKeyMaterial</a> request.</p>
1642
1696
  * <p>You must specify the key ID of the symmetric encryption KMS key into which you will import
@@ -1728,11 +1782,12 @@ export declare class KMS extends KMSClient {
1728
1782
  /**
1729
1783
  * <p>Imports key material into an existing symmetric encryption KMS key that was created
1730
1784
  * without key material. After you successfully import key material into a KMS key, you can
1731
- * <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport the same key material</a> into that KMS key, but you cannot import different
1732
- * key material. </p>
1733
- * <p>You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account. For more information about
1734
- * creating KMS keys with no key material and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a>
1735
- * in the <i>Key Management Service Developer Guide</i>.</p>
1785
+ * <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport
1786
+ * the same key material</a> into that KMS key, but you cannot import different key
1787
+ * material. </p>
1788
+ * <p>You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account. For more information about creating KMS keys with no key material
1789
+ * and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the
1790
+ * <i>Key Management Service Developer Guide</i>.</p>
1736
1791
  * <p>Before using this operation, call <a>GetParametersForImport</a>. Its response
1737
1792
  * includes a public key and an import token. Use the public key to encrypt the key material.
1738
1793
  * Then, submit the import token from the same <code>GetParametersForImport</code>
@@ -2418,8 +2473,8 @@ export declare class KMS extends KMSClient {
2418
2473
  /**
2419
2474
  * <p>Creates a <a href="https://en.wikipedia.org/wiki/Digital_signature">digital
2420
2475
  * signature</a> for a message or message digest by using the private key in an asymmetric
2421
- * signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use
2422
- * the public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
2476
+ * signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use the
2477
+ * public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
2423
2478
  * <p>Digital signatures are generated and verified by using asymmetric key pair, such as an RSA
2424
2479
  * or ECC pair that is represented by an asymmetric KMS key. The key owner (or an authorized
2425
2480
  * user) uses their private key to sign a message. Anyone with the public key can verify that the
@@ -2448,6 +2503,11 @@ export declare class KMS extends KMSClient {
2448
2503
  * <p>When signing a message, be sure to record the KMS key and the signing algorithm. This
2449
2504
  * information is required to verify the signature.</p>
2450
2505
  * </important>
2506
+ * <note>
2507
+ * <p>Best practices recommend that you limit the time during which any signature is effective. This deters an attack where the actor uses a signed
2508
+ * message to establish validity repeatedly or long after the message is superseded. Signatures do not include a timestamp, but you can include a timestamp in the signed message
2509
+ * to help you detect when its time to refresh the signature. </p>
2510
+ * </note>
2451
2511
  * <p>To verify the signature that this operation generates, use the <a>Verify</a>
2452
2512
  * operation. Or use the <a>GetPublicKey</a> operation to download the public key and
2453
2513
  * then use the public key to verify the signature outside of KMS. </p>
package/dist-types/KMSClient.d.ts CHANGED
@@ -196,7 +196,8 @@ export interface KMSClientResolvedConfig extends KMSClientResolvedConfigType {
196
196
  * <p>If you need to use FIPS 140-2 validated cryptographic modules when communicating with
197
197
  * Amazon Web Services, use the FIPS endpoint in your preferred Amazon Web Services Region. For more information about the
198
198
  * available FIPS endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">Service endpoints</a> in the Key Management Service topic of the <i>Amazon Web Services General Reference</i>.</p>
199
- * <p>Clients must support TLS (Transport Layer Security) 1.0. We recommend TLS 1.2. Clients
199
+ * <p>All KMS API calls must be signed and be transmitted using Transport Layer Security (TLS).
200
+ * KMS recommends you always use the latest supported TLS version. Clients
200
201
  * must also support cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral
201
202
  * Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems
202
203
  * such as Java 7 and later support these modes.</p>
package/dist-types/commands/CreateKeyCommand.d.ts CHANGED
@@ -8,13 +8,12 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
8
8
  }
9
9
  /**
10
10
  * <p>Creates a unique customer managed <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys">KMS key</a> in your Amazon Web Services account and
11
- * Region. </p>
11
+ * Region.</p>
12
12
  * <p>In addition to the required parameters, you can use the optional parameters to specify a key policy, description, tags, and other useful elements for any key type.</p>
13
13
  * <note>
14
14
  * <p>KMS is replacing the term <i>customer master key (CMK)</i> with <i>KMS key</i> and <i>KMS key</i>. The concept has not changed. To prevent breaking changes, KMS is keeping some variations of this term.</p>
15
15
  * </note>
16
16
  *
17
- *
18
17
  * <p>To create different types of KMS keys, use the following guidance:</p>
19
18
  *
20
19
  * <dl>
@@ -34,8 +33,8 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
34
33
  * to determine whether the KMS key will be used to encrypt and decrypt or sign and verify.
35
34
  * You can't change these properties after the KMS key is created.</p>
36
35
  * <p>Asymmetric KMS keys contain an RSA key pair or an Elliptic Curve (ECC) key pair. The private key in an asymmetric
37
- * KMS key never leaves AWS KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to download the public key
38
- * so it can be used outside of AWS KMS. KMS keys with RSA key pairs can be used to encrypt or decrypt data or sign and verify messages (but not both).
36
+ * KMS key never leaves KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to download the public key
37
+ * so it can be used outside of KMS. KMS keys with RSA key pairs can be used to encrypt or decrypt data or sign and verify messages (but not both).
39
38
  * KMS keys with ECC key pairs can be used only to sign and verify messages.
40
39
  * For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
41
40
  * <p> </p>
package/dist-types/commands/DecryptCommand.d.ts CHANGED
@@ -40,7 +40,7 @@ export interface DecryptCommandOutput extends DecryptResponse, __MetadataBearer
40
40
  * asymmetric encryption KMS key. When the KMS key is asymmetric, you must specify the KMS key and the
41
41
  * encryption algorithm that was used to encrypt the ciphertext. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
42
42
  * <p>The <code>Decrypt</code> operation also decrypts ciphertext that was encrypted outside of KMS by the
43
- * public key in an KMS asymmetric KMS key. However, it cannot decrypt symmetric ciphertext produced by
43
+ * public key in an KMS asymmetric KMS key. However, it cannot decrypt ciphertext produced by
44
44
  * other libraries, such as the <a href="https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/">Amazon Web Services
45
45
  * Encryption SDK</a> or <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html">Amazon S3 client-side encryption</a>.
46
46
  * These libraries return a ciphertext format that is incompatible with KMS.</p>
package/dist-types/commands/DisableKeyRotationCommand.d.ts CHANGED
@@ -8,8 +8,18 @@ export interface DisableKeyRotationCommandOutput extends __MetadataBearer {
8
8
  }
9
9
  /**
10
10
  * <p>Disables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic
11
- * rotation of the key material</a> for the specified symmetric encryption KMS key.</p>
12
- * <p> You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
11
+ * rotation of the key material</a> of the specified symmetric encryption KMS key.</p>
12
+ * <p>Automatic key rotation is supported only on symmetric encryption KMS keys.
13
+ * You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
14
+ * To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
15
+ * <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation of the
16
+ * key material in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>. Key material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
17
+ * configurable. KMS always rotates the key material for every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
18
+ * keys</a> varies.</p>
19
+ * <note>
20
+ * <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every
21
+ * three years to every year. For details, see <a>EnableKeyRotation</a>.</p>
22
+ * </note>
13
23
  * <p>The KMS key that you use for this operation must be in a compatible key state. For
14
24
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
15
25
  * <p>
package/dist-types/commands/EnableKeyRotationCommand.d.ts CHANGED
@@ -8,8 +8,26 @@ export interface EnableKeyRotationCommandOutput extends __MetadataBearer {
8
8
  }
9
9
  /**
10
10
  * <p>Enables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation
11
- * of the key material</a> for the specified symmetric encryption KMS key.</p>
12
- * <p>You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
11
+ * of the key material</a> of the specified symmetric encryption KMS key. </p>
12
+ * <p>When you enable automatic rotation of a<a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS key</a>, KMS
13
+ * rotates the key material of the KMS key one year (approximately 365 days) from the enable date
14
+ * and every year thereafter. You can monitor rotation of the key material for your KMS keys in
15
+ * CloudTrail and Amazon CloudWatch. To disable rotation of the key material in a customer
16
+ * managed KMS key, use the <a>DisableKeyRotation</a> operation.</p>
17
+ * <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
18
+ * You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
19
+ * To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
20
+ * <p>You cannot enable or disable automatic rotation <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a>. KMS
21
+ * always rotates the key material of Amazon Web Services managed keys every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
22
+ * keys</a> varies.</p>
23
+ * <note>
24
+ * <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
25
+ * years (approximately 1,095 days) to every year (approximately 365 days).</p>
26
+ * <p>New Amazon Web Services managed keys are automatically rotated one year after they
27
+ * are created, and approximately every year thereafter. </p>
28
+ * <p>Existing Amazon Web Services managed keys are automatically rotated one year after
29
+ * their most recent rotation, and every year thereafter.</p>
30
+ * </note>
13
31
  * <p>The KMS key that you use for this operation must be in a compatible key state. For
14
32
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
15
33
  * <p>
package/dist-types/commands/GenerateDataKeyCommand.d.ts CHANGED
@@ -10,15 +10,14 @@ export interface GenerateDataKeyCommandOutput extends GenerateDataKeyResponse, _
10
10
  * <p>Returns a unique symmetric data key for use outside of KMS. This operation returns a
11
11
  * plaintext copy of the data key and a copy that is encrypted under a symmetric encryption KMS
12
12
  * key that you specify. The bytes in the plaintext key are random; they are not related to the caller or the KMS
13
- * key. You can use the plaintext key to encrypt your data outside of KMS and store the
14
- * encrypted data key with the encrypted data.</p>
13
+ * key. You can use the plaintext key to encrypt your data outside of KMS and store the encrypted
14
+ * data key with the encrypted data.</p>
15
15
  *
16
16
  * <p>To generate a data key, specify the symmetric encryption KMS key that will be used to
17
17
  * encrypt the data key. You cannot use an asymmetric KMS key to encrypt data keys. To get the
18
- * type of your KMS key, use the <a>DescribeKey</a> operation. You must also specify
19
- * the length of the data key. Use either the <code>KeySpec</code> or <code>NumberOfBytes</code>
20
- * parameters (but not both). For 128-bit and 256-bit data keys, use the <code>KeySpec</code>
21
- * parameter. </p>
18
+ * type of your KMS key, use the <a>DescribeKey</a> operation. You must also specify the length of
19
+ * the data key. Use either the <code>KeySpec</code> or <code>NumberOfBytes</code> parameters
20
+ * (but not both). For 128-bit and 256-bit data keys, use the <code>KeySpec</code> parameter. </p>
22
21
  *
23
22
  * <p>To get only an encrypted copy of the data key, use <a>GenerateDataKeyWithoutPlaintext</a>. To generate an asymmetric data key pair, use
24
23
  * the <a>GenerateDataKeyPair</a> or <a>GenerateDataKeyPairWithoutPlaintext</a> operation. To get a cryptographically secure
package/dist-types/commands/GenerateDataKeyPairCommand.d.ts CHANGED
@@ -20,7 +20,8 @@ export interface GenerateDataKeyPairCommandOutput extends GenerateDataKeyPairRes
20
20
  *
21
21
  * <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
22
22
  * the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
23
- * custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
23
+ * custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
24
+ * operation. </p>
24
25
  * <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
25
26
  * key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for
26
27
  * either encryption or signing, but not both. However, KMS cannot enforce any restrictions on
package/dist-types/commands/GenerateDataKeyPairWithoutPlaintextCommand.d.ts CHANGED
@@ -17,7 +17,8 @@ export interface GenerateDataKeyPairWithoutPlaintextCommandOutput extends Genera
17
17
  * with the data. When you are ready to decrypt data or sign a message, you can use the <a>Decrypt</a> operation to decrypt the encrypted private key.</p>
18
18
  * <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
19
19
  * the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
20
- * custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a> operation. </p>
20
+ * custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
21
+ * operation. </p>
21
22
  * <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
22
23
  * key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for
23
24
  * either encryption or signing, but not both. However, KMS cannot enforce any restrictions on
package/dist-types/commands/GenerateDataKeyWithoutPlaintextCommand.d.ts CHANGED
@@ -15,19 +15,21 @@ export interface GenerateDataKeyWithoutPlaintextCommandOutput extends GenerateDa
15
15
  * data key. </p>
16
16
  * <p>This operation is useful for systems that need to encrypt data at some point, but not
17
17
  * immediately. When you need to encrypt the data, you call the <a>Decrypt</a>
18
- * operation on the encrypted copy of the key. It's also useful in distributed systems with
19
- * different levels of trust. For example, you might store encrypted data in containers. One
20
- * component of your system creates new containers and stores an encrypted data key with each
21
- * container. Then, a different component puts the data into the containers. That component first
22
- * decrypts the data key, uses the plaintext data key to encrypt data, puts the encrypted data
23
- * into the container, and then destroys the plaintext data key. In this system, the component
24
- * that creates the containers never sees the plaintext data key.</p>
18
+ * operation on the encrypted copy of the key.</p>
19
+ * <p>It's also useful in distributed systems with different levels of trust. For example, you
20
+ * might store encrypted data in containers. One component of your system creates new containers
21
+ * and stores an encrypted data key with each container. Then, a different component puts the
22
+ * data into the containers. That component first decrypts the data key, uses the plaintext data
23
+ * key to encrypt data, puts the encrypted data into the container, and then destroys the
24
+ * plaintext data key. In this system, the component that creates the containers never sees the
25
+ * plaintext data key.</p>
25
26
  * <p>To request an asymmetric data key pair, use the <a>GenerateDataKeyPair</a> or
26
27
  * <a>GenerateDataKeyPairWithoutPlaintext</a> operations.</p>
27
28
  *
28
29
  * <p>To generate a data key, you must specify the symmetric encryption KMS key that is used to
29
30
  * encrypt the data key. You cannot use an asymmetric KMS key or a key in a custom key store to generate a data key. To get the
30
31
  * type of your KMS key, use the <a>DescribeKey</a> operation.</p>
32
+ *
31
33
  * <p>If the operation succeeds, you will find the encrypted copy of the data key in the
32
34
  * <code>CiphertextBlob</code> field.</p>
33
35
  *
package/dist-types/commands/GenerateMacCommand.d.ts CHANGED
@@ -17,6 +17,13 @@ export interface GenerateMacCommandOutput extends GenerateMacResponse, __Metadat
17
17
  * For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>
18
18
  * <i>Key Management Service Developer Guide</i>
19
19
  * </i>.</p>
20
+ * <note>
21
+ * <p>Best practices recommend that you limit the time during which any signing mechanism,
22
+ * including an HMAC, is effective. This deters an attack where the actor uses a signed
23
+ * message to establish validity repeatedly or long after the message is superseded. HMAC
24
+ * tags do not include a timestamp, but you can include a timestamp in the token or message
25
+ * to help you detect when its time to refresh the HMAC. </p>
26
+ * </note>
20
27
  * <p>The KMS key that you use for this operation must be in a compatible key state. For
21
28
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
22
29
  * <p>
package/dist-types/commands/GetKeyRotationStatusCommand.d.ts CHANGED
@@ -9,19 +9,35 @@ export interface GetKeyRotationStatusCommandOutput extends GetKeyRotationStatusR
9
9
  /**
10
10
  * <p>Gets a Boolean value that indicates whether <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation of the key material</a> is
11
11
  * enabled for the specified KMS key.</p>
12
- * <p>You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. The key rotation status for these KMS keys is always
13
- * <code>false</code>.</p>
12
+ * <p>When you enable automatic rotation for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>, KMS
13
+ * rotates the key material of the KMS key one year (approximately 365 days) from the enable date
14
+ * and every year thereafter. You can monitor rotation of the key material for your KMS keys in
15
+ * CloudTrail and Amazon CloudWatch.</p>
16
+ * <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
17
+ * You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
18
+ * To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key..</p>
19
+ * <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation (<a>DisableKeyRotation</a>) of the key material in customer managed KMS keys. Key
20
+ * material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
21
+ * configurable. KMS always rotates the key material in Amazon Web Services managed KMS keys every year. The
22
+ * key rotation status for Amazon Web Services managed KMS keys is always <code>true</code>.</p>
23
+ * <note>
24
+ * <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three years to every year. For details, see <a>EnableKeyRotation</a>.</p>
25
+ * </note>
14
26
  * <p>The KMS key that you use for this operation must be in a compatible key state. For
15
27
  * details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
16
28
  * <ul>
17
29
  * <li>
18
30
  * <p>Disabled: The key rotation status does not change when you disable a KMS key. However,
19
- * while the KMS key is disabled, KMS does not rotate the key material.</p>
31
+ * while the KMS key is disabled, KMS does not rotate the key material. When you re-enable
32
+ * the KMS key, rotation resumes. If the key material in the re-enabled KMS key hasn't been
33
+ * rotated in one year, KMS rotates it immediately, and every year thereafter. If it's been
34
+ * less than a year since the key material in the re-enabled KMS key was rotated, the KMS key
35
+ * resumes its prior rotation schedule.</p>
20
36
  * </li>
21
37
  * <li>
22
38
  * <p>Pending deletion: While a KMS key is pending deletion, its key rotation status is
23
39
  * <code>false</code> and KMS does not rotate the key material. If you cancel the
24
- * deletion, the original key rotation status is restored.</p>
40
+ * deletion, the original key rotation status returns to <code>true</code>.</p>
25
41
  * </li>
26
42
  * </ul>
27
43
  * <p>
package/dist-types/commands/GetParametersForImportCommand.d.ts CHANGED
@@ -8,8 +8,8 @@ export interface GetParametersForImportCommandOutput extends GetParametersForImp
8
8
  }
9
9
  /**
10
10
  * <p>Returns the items you need to import key material into a symmetric encryption KMS key. For
11
- * more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a> in the
12
- * <i>Key Management Service Developer Guide</i>.</p>
11
+ * more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a>
12
+ * in the <i>Key Management Service Developer Guide</i>.</p>
13
13
  * <p>This operation returns a public key and an import token. Use the public key to encrypt the
14
14
  * symmetric key material. Store the import token to send with a subsequent <a>ImportKeyMaterial</a> request.</p>
15
15
  * <p>You must specify the key ID of the symmetric encryption KMS key into which you will import
package/dist-types/commands/ImportKeyMaterialCommand.d.ts CHANGED
@@ -9,11 +9,12 @@ export interface ImportKeyMaterialCommandOutput extends ImportKeyMaterialRespons
9
9
  /**
10
10
  * <p>Imports key material into an existing symmetric encryption KMS key that was created
11
11
  * without key material. After you successfully import key material into a KMS key, you can
12
- * <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport the same key material</a> into that KMS key, but you cannot import different
13
- * key material. </p>
14
- * <p>You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account. For more information about
15
- * creating KMS keys with no key material and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a>
16
- * in the <i>Key Management Service Developer Guide</i>.</p>
12
+ * <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport
13
+ * the same key material</a> into that KMS key, but you cannot import different key
14
+ * material. </p>
15
+ * <p>You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account. For more information about creating KMS keys with no key material
16
+ * and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the
17
+ * <i>Key Management Service Developer Guide</i>.</p>
17
18
  * <p>Before using this operation, call <a>GetParametersForImport</a>. Its response
18
19
  * includes a public key and an import token. Use the public key to encrypt the key material.
19
20
  * Then, submit the import token from the same <code>GetParametersForImport</code>
package/dist-types/commands/SignCommand.d.ts CHANGED
@@ -9,8 +9,8 @@ export interface SignCommandOutput extends SignResponse, __MetadataBearer {
9
9
  /**
10
10
  * <p>Creates a <a href="https://en.wikipedia.org/wiki/Digital_signature">digital
11
11
  * signature</a> for a message or message digest by using the private key in an asymmetric
12
- * signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use
13
- * the public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
12
+ * signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use the
13
+ * public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
14
14
  * <p>Digital signatures are generated and verified by using asymmetric key pair, such as an RSA
15
15
  * or ECC pair that is represented by an asymmetric KMS key. The key owner (or an authorized
16
16
  * user) uses their private key to sign a message. Anyone with the public key can verify that the
@@ -39,6 +39,11 @@ export interface SignCommandOutput extends SignResponse, __MetadataBearer {
39
39
  * <p>When signing a message, be sure to record the KMS key and the signing algorithm. This
40
40
  * information is required to verify the signature.</p>
41
41
  * </important>
42
+ * <note>
43
+ * <p>Best practices recommend that you limit the time during which any signature is effective. This deters an attack where the actor uses a signed
44
+ * message to establish validity repeatedly or long after the message is superseded. Signatures do not include a timestamp, but you can include a timestamp in the signed message
45
+ * to help you detect when its time to refresh the signature. </p>
46
+ * </note>
42
47
  * <p>To verify the signature that this operation generates, use the <a>Verify</a>
43
48
  * operation. Or use the <a>GetPublicKey</a> operation to download the public key and
44
49
  * then use the public key to verify the signature outside of KMS. </p>
package/dist-types/models/models_0.d.ts CHANGED
@@ -584,10 +584,10 @@ export interface CreateGrantRequest {
584
584
  /**
585
585
  * <p>A list of operations that the grant permits. </p>
586
586
  * <p>This list must include only operations that are permitted in a grant. Also, the operation
587
- * must be supported on the KMS key. For example, you cannot create a grant for a symmetric encryption KMS key that allows the <a>Sign</a> operation, or a grant for an asymmetric KMS key
588
- * that allows the <a>GenerateDataKey</a> operation. If you try, KMS returns a
589
- * <code>ValidationError</code> exception. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">Grant operations</a> in the
590
- * <i>Key Management Service Developer Guide</i>.</p>
587
+ * must be supported on the KMS key. For example, you cannot create a grant for a symmetric encryption KMS key that allows the <a>Sign</a> operation, or a grant for an
588
+ * asymmetric KMS key that allows the <a>GenerateDataKey</a> operation. If you try,
589
+ * KMS returns a <code>ValidationError</code> exception. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">Grant
590
+ * operations</a> in the <i>Key Management Service Developer Guide</i>.</p>
591
591
  */
592
592
  Operations: (GrantOperation | string)[] | undefined;
593
593
  /**
@@ -745,11 +745,13 @@ export declare namespace Tag {
745
745
  }
746
746
  export interface CreateKeyRequest {
747
747
  /**
748
- * <p>The key policy to attach to the KMS key.</p>
748
+ * <p>The key policy to attach to the KMS key. If you do not specify a key policy, KMS attaches a default key policy to the KMS key.
749
+ * For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">Default key policy</a> in the
750
+ * <i>Key Management Service Developer Guide</i>.</p>
749
751
  * <p>If you provide a key policy, it must meet the following criteria:</p>
750
752
  * <ul>
751
753
  * <li>
752
- * <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy
754
+ * <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to <code>True</code>, the key policy
753
755
  * must allow the principal that is making the <code>CreateKey</code> request to make a
754
756
  * subsequent <a>PutKeyPolicy</a> request on the KMS key. This reduces the risk
755
757
  * that the KMS key becomes unmanageable. For more information, refer to the scenario in the
@@ -766,10 +768,23 @@ export interface CreateKeyRequest {
766
768
  * Identity and Access Management User Guide</i>.</p>
767
769
  * </li>
768
770
  * </ul>
769
- * <p>If you do not provide a key policy, KMS attaches a default key policy to the KMS key.
770
- * For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">Default Key Policy</a> in the
771
- * <i>Key Management Service Developer Guide</i>. </p>
772
- * <p>The key policy size quota is 32 kilobytes (32768 bytes).</p>
771
+ *
772
+ * <p>A key policy document must conform to the following rules.</p>
773
+ * <ul>
774
+ * <li>
775
+ * <p>Up to 32 kilobytes (32768 bytes)</p>
776
+ * </li>
777
+ * <li>
778
+ * <p>Must be UTF-8 encoded</p>
779
+ * </li>
780
+ * <li>
781
+ * <p>The only Unicode characters that are permitted in a key policy document are the horizontal tab (U+0009), linefeed (U+000A), carriage return (U+000D), and characters in the range U+0020 to U+00FF.</p>
782
+ * </li>
783
+ * <li>
784
+ * <p>The <code>Sid</code> element in a key policy statement can include spaces. (Spaces are
785
+ * prohibited in the <code>Sid</code> element of an IAM policy document.)</p>
786
+ * </li>
787
+ * </ul>
773
788
  * <p>For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i>
774
789
  * <i>Identity and Access Management User Guide</i>
775
790
  * </i>.</p>
@@ -784,7 +799,7 @@ export interface CreateKeyRequest {
784
799
  Description?: string;
785
800
  /**
786
801
  * <p>Determines the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> for which you can use the KMS key. The default value is
787
- * <code>ENCRYPT_DECRYPT</code>. This parameter is optional when you are creating a symmetric
802
+ * <code>ENCRYPT_DECRYPT</code>. This parameter is optional when you are creating a symmetric
788
803
  * encryption KMS key; otherwise, it is required. You
789
804
  * can't change the <code>KeyUsage</code> value after the KMS key is created.</p>
790
805
  * <p>Select only one valid value.</p>
@@ -819,15 +834,14 @@ export interface CreateKeyRequest {
819
834
  /**
820
835
  * <p>Specifies the type of KMS key to create. The default value,
821
836
  * <code>SYMMETRIC_DEFAULT</code>, creates a KMS key with a 256-bit symmetric key for encryption
822
- * and decryption. For help choosing a key spec for your KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose">Choosing a KMS key type</a> in
823
- * the <i>
837
+ * and decryption. For help choosing a key spec for your KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose">Choosing a KMS key type</a> in the <i>
824
838
  * <i>Key Management Service Developer Guide</i>
825
839
  * </i>.</p>
826
840
  * <p>The <code>KeySpec</code> determines whether the KMS key contains a symmetric key or an
827
- * asymmetric key pair. It also determines the algorithms that the KMS key supports. You can't
828
- * change the <code>KeySpec</code> after the KMS key is created. To further restrict the
829
- * algorithms that can be used with the KMS key, use a condition key in its key policy or IAM
830
- * policy. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm">kms:EncryptionAlgorithm</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm">kms:MacAlgorithm</a> or <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm">kms:Signing Algorithm</a> in the <i>
841
+ * asymmetric key pair. It also determines the cryptographic algorithms that the KMS key supports. You can't
842
+ * change the <code>KeySpec</code> after the KMS key is created.
843
+ * To further restrict the algorithms that can be used with the KMS key, use a condition key in
844
+ * its key policy or IAM policy. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm">kms:EncryptionAlgorithm</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm">kms:MacAlgorithm</a> or <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm">kms:Signing Algorithm</a> in the <i>
831
845
  * <i>Key Management Service Developer Guide</i>
832
846
  * </i>.</p>
833
847
  * <important>
@@ -993,8 +1007,8 @@ export interface CreateKeyRequest {
993
1007
  * it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
994
1008
  * <p>This value creates a <i>primary key</i>, not a replica. To create a
995
1009
  * <i>replica key</i>, use the <a>ReplicateKey</a> operation. </p>
996
- * <p>You can create a symmetric or asymmetric multi-Region key, and you can create a
997
- * multi-Region key with imported key material. However, you cannot create a multi-Region key in
1010
+ * <p>You can create a multi-Region version of a symmetric encryption KMS key, an HMAC KMS key, an asymmetric KMS key, or a
1011
+ * KMS key with imported key material. However, you cannot create a multi-Region key in
998
1012
  * a custom key store.</p>
999
1013
  */
1000
1014
  MultiRegion?: boolean;
@@ -1490,10 +1504,8 @@ export interface DecryptRequest {
1490
1504
  GrantTokens?: string[];
1491
1505
  /**
1492
1506
  * <p>Specifies the KMS key that KMS uses to decrypt the ciphertext.</p>
1493
- *
1494
1507
  * <p>Enter a key ID of the KMS
1495
1508
  * key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>Decrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
1496
- *
1497
1509
  * <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS
1498
1510
  * key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to
1499
1511
  * the symmetric ciphertext blob. However, it is always recommended as a best practice. This
@@ -1560,8 +1572,8 @@ export declare namespace DecryptResponse {
1560
1572
  }
1561
1573
  /**
1562
1574
  * <p>The request was rejected because the specified KMS key cannot decrypt the data. The
1563
- * <code>KeyId</code> in a <code>Decrypt</code> request and the <code>SourceKeyId</code>
1564
- * in a <code>ReEncrypt</code> request must identify the same KMS key that was used to
1575
+ * <code>KeyId</code> in a <a>Decrypt</a> request and the <code>SourceKeyId</code>
1576
+ * in a <a>ReEncrypt</a> request must identify the same KMS key that was used to
1565
1577
  * encrypt the ciphertext.</p>
1566
1578
  */
1567
1579
  export declare class IncorrectKeyException extends __BaseException {
@@ -1604,8 +1616,8 @@ export declare class InvalidCiphertextException extends __BaseException {
1604
1616
  * <code>KeyUsage</code> must be <code>ENCRYPT_DECRYPT</code>. For signing and verifying
1605
1617
  * messages, the <code>KeyUsage</code> must be <code>SIGN_VERIFY</code>. For generating and
1606
1618
  * verifying message authentication codes (MACs), the <code>KeyUsage</code> must be
1607
- * <code>GENERATE_VERIFY_MAC</code>. To find the <code>KeyUsage</code> of a KMS key, use the
1608
- * <a>DescribeKey</a> operation.</p>
1619
+ * <code>GENERATE_VERIFY_MAC</code>. To find the <code>KeyUsage</code> of
1620
+ * a KMS key, use the <a>DescribeKey</a> operation.</p>
1609
1621
  * <p>To find the encryption or signing algorithms supported for a particular KMS key, use the
1610
1622
  * <a>DescribeKey</a> operation.</p>
1611
1623
  */
@@ -1916,7 +1928,9 @@ export declare namespace EnableKeyRequest {
1916
1928
  }
1917
1929
  export interface EnableKeyRotationRequest {
1918
1930
  /**
1919
- * <p>Identifies a symmetric encryption KMS key. You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
1931
+ * <p>Identifies a symmetric encryption KMS key. You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
1932
+ * To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
1933
+ *
1920
1934
  * <p>Specify the key ID or key ARN of the KMS key.</p>
1921
1935
  * <p>For example:</p>
1922
1936
  * <ul>
@@ -2229,7 +2243,8 @@ export interface GenerateDataKeyPairWithoutPlaintextRequest {
2229
2243
  /**
2230
2244
  * <p>Specifies the symmetric encryption KMS key that encrypts the private key in the data key
2231
2245
  * pair. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the
2232
- * type and origin of your KMS key, use the <a>DescribeKey</a> operation.</p>
2246
+ * type and origin of your KMS key, use the <a>DescribeKey</a> operation.
2247
+ * </p>
2233
2248
  * <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
2234
2249
  * <p>For example:</p>
2235
2250
  * <ul>
@@ -2760,8 +2775,7 @@ export declare namespace GrantListEntry {
2760
2775
  export interface ImportKeyMaterialRequest {
2761
2776
  /**
2762
2777
  * <p>The identifier of the symmetric encryption KMS key that receives the imported key
2763
- * material. This must be the same KMS key specified in the <code>KeyID</code> parameter of the
2764
- * corresponding <a>GetParametersForImport</a> request. The <code>Origin</code> of the
2778
+ * material. This must be the same KMS key specified in the <code>KeyID</code> parameter of the corresponding <a>GetParametersForImport</a> request. The <code>Origin</code> of the
2765
2779
  * KMS key must be <code>EXTERNAL</code>. You cannot perform this operation on an asymmetric KMS
2766
2780
  * key, an HMAC KMS key, a KMS key in a custom key store, or on a KMS key in a different
2767
2781
  * Amazon Web Services account</p>
@@ -3297,8 +3311,23 @@ export interface PutKeyPolicyRequest {
3297
3311
  * Identity and Access Management User Guide</i>.</p>
3298
3312
  * </li>
3299
3313
  * </ul>
3300
- * <p>The key policy cannot exceed 32 kilobytes (32768 bytes). For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/resource-limits.html">Resource Quotas</a> in the
3301
- * <i>Key Management Service Developer Guide</i>.</p>
3314
+ *
3315
+ * <p>A key policy document must conform to the following rules.</p>
3316
+ * <ul>
3317
+ * <li>
3318
+ * <p>Up to 32 kilobytes (32768 bytes)</p>
3319
+ * </li>
3320
+ * <li>
3321
+ * <p>Must be UTF-8 encoded</p>
3322
+ * </li>
3323
+ * <li>
3324
+ * <p>The only Unicode characters that are permitted in a key policy document are the horizontal tab (U+0009), linefeed (U+000A), carriage return (U+000D), and characters in the range U+0020 to U+00FF.</p>
3325
+ * </li>
3326
+ * <li>
3327
+ * <p>The <code>Sid</code> element in a key policy statement can include spaces. (Spaces are
3328
+ * prohibited in the <code>Sid</code> element of an IAM policy document.)</p>
3329
+ * </li>
3330
+ * </ul>
3302
3331
  */
3303
3332
  Policy: string | undefined;
3304
3333
  /**
@@ -3342,9 +3371,9 @@ export interface ReEncryptRequest {
3342
3371
  * re-encrypted.</p>
3343
3372
  * <p>Enter a key ID of the KMS key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>ReEncrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
3344
3373
  * <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS
3345
- * key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that
3346
- * it adds to the symmetric ciphertext blob. However, it is always recommended as a best
3347
- * practice. This practice ensures that you use the KMS key that you intend.</p>
3374
+ * key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to
3375
+ * the symmetric ciphertext blob. However, it is always recommended as a best practice. This
3376
+ * practice ensures that you use the KMS key that you intend.</p>
3348
3377
  *
3349
3378
  * <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
3350
3379
  * <p>For example:</p>
@@ -3538,8 +3567,23 @@ export interface ReplicateKeyRequest {
3538
3567
  * <i>Identity and Access Management User Guide</i>
3539
3568
  * </i>.</p>
3540
3569
  * </li>
3570
+ * </ul>
3571
+ *
3572
+ *
3573
+ * <p>A key policy document must conform to the following rules.</p>
3574
+ * <ul>
3575
+ * <li>
3576
+ * <p>Up to 32 kilobytes (32768 bytes)</p>
3577
+ * </li>
3541
3578
  * <li>
3542
- * <p>The key policy size quota is 32 kilobytes (32768 bytes).</p>
3579
+ * <p>Must be UTF-8 encoded</p>
3580
+ * </li>
3581
+ * <li>
3582
+ * <p>The only Unicode characters that are permitted in a key policy document are the horizontal tab (U+0009), linefeed (U+000A), carriage return (U+000D), and characters in the range U+0020 to U+00FF.</p>
3583
+ * </li>
3584
+ * <li>
3585
+ * <p>The <code>Sid</code> element in a key policy statement can include spaces. (Spaces are
3586
+ * prohibited in the <code>Sid</code> element of an IAM policy document.)</p>
3543
3587
  * </li>
3544
3588
  * </ul>
3545
3589
  */
@@ -3702,7 +3746,7 @@ export interface ScheduleKeyDeletionRequest {
3702
3746
  /**
3703
3747
  * <p>The waiting period, specified in number of days. After the waiting period ends, KMS
3704
3748
  * deletes the KMS key.</p>
3705
- * <p>If the KMS key is a multi-Region primary key with replicas, the waiting period begins when
3749
+ * <p>If the KMS key is a multi-Region primary key with replica keys, the waiting period begins when
3706
3750
  * the last of its replica keys is deleted. Otherwise, the waiting period begins
3707
3751
  * immediately.</p>
3708
3752
  * <p>This value is optional. If you include a value, it must be between 7 and 30, inclusive. If
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@aws-sdk/client-kms",
3
3
  "description": "AWS SDK for JavaScript Kms Client for Node.js, Browser and React Native",
4
- "version": "3.85.0",
4
+ "version": "3.93.0",
5
5
  "scripts": {
6
6
  "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
7
7
  "build:cjs": "tsc -p tsconfig.cjs.json",
@@ -18,9 +18,9 @@
18
18
  "dependencies": {
19
19
  "@aws-crypto/sha256-browser": "2.0.0",
20
20
  "@aws-crypto/sha256-js": "2.0.0",
21
- "@aws-sdk/client-sts": "3.85.0",
21
+ "@aws-sdk/client-sts": "3.92.0",
22
22
  "@aws-sdk/config-resolver": "3.80.0",
23
- "@aws-sdk/credential-provider-node": "3.85.0",
23
+ "@aws-sdk/credential-provider-node": "3.87.0",
24
24
  "@aws-sdk/fetch-http-handler": "3.78.0",
25
25
  "@aws-sdk/hash-node": "3.78.0",
26
26
  "@aws-sdk/invalid-dependency": "3.78.0",