@aws-sdk/client-kms 3.87.0 → 3.94.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +24 -0
- package/README.md +2 -1
- package/dist-types/KMS.d.ts +98 -38
- package/dist-types/KMSClient.d.ts +2 -1
- package/dist-types/commands/CreateKeyCommand.d.ts +3 -4
- package/dist-types/commands/DecryptCommand.d.ts +1 -1
- package/dist-types/commands/DisableKeyRotationCommand.d.ts +12 -2
- package/dist-types/commands/EnableKeyRotationCommand.d.ts +20 -2
- package/dist-types/commands/GenerateDataKeyCommand.d.ts +5 -6
- package/dist-types/commands/GenerateDataKeyPairCommand.d.ts +2 -1
- package/dist-types/commands/GenerateDataKeyPairWithoutPlaintextCommand.d.ts +2 -1
- package/dist-types/commands/GenerateDataKeyWithoutPlaintextCommand.d.ts +9 -7
- package/dist-types/commands/GenerateMacCommand.d.ts +7 -0
- package/dist-types/commands/GetKeyRotationStatusCommand.d.ts +20 -4
- package/dist-types/commands/GetParametersForImportCommand.d.ts +2 -2
- package/dist-types/commands/ImportKeyMaterialCommand.d.ts +6 -5
- package/dist-types/commands/SignCommand.d.ts +7 -2
- package/dist-types/models/models_0.d.ts +80 -36
- package/package.json +4 -4
package/CHANGELOG.md
CHANGED
|
@@ -3,6 +3,30 @@
|
|
|
3
3
|
All notable changes to this project will be documented in this file.
|
|
4
4
|
See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
|
|
5
5
|
|
|
6
|
+
# [3.94.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.93.0...v3.94.0) (2022-05-18)
|
|
7
|
+
|
|
8
|
+
**Note:** Version bump only for package @aws-sdk/client-kms
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
|
|
14
|
+
# [3.93.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.92.0...v3.93.0) (2022-05-17)
|
|
15
|
+
|
|
16
|
+
**Note:** Version bump only for package @aws-sdk/client-kms
|
|
17
|
+
|
|
18
|
+
|
|
19
|
+
|
|
20
|
+
|
|
21
|
+
|
|
22
|
+
# [3.92.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.91.0...v3.92.0) (2022-05-16)
|
|
23
|
+
|
|
24
|
+
**Note:** Version bump only for package @aws-sdk/client-kms
|
|
25
|
+
|
|
26
|
+
|
|
27
|
+
|
|
28
|
+
|
|
29
|
+
|
|
6
30
|
# [3.87.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.86.0...v3.87.0) (2022-05-09)
|
|
7
31
|
|
|
8
32
|
**Note:** Version bump only for package @aws-sdk/client-kms
|
package/README.md
CHANGED
|
@@ -30,7 +30,8 @@ Services</a>.</p>
|
|
|
30
30
|
<p>If you need to use FIPS 140-2 validated cryptographic modules when communicating with
|
|
31
31
|
Amazon Web Services, use the FIPS endpoint in your preferred Amazon Web Services Region. For more information about the
|
|
32
32
|
available FIPS endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">Service endpoints</a> in the Key Management Service topic of the <i>Amazon Web Services General Reference</i>.</p>
|
|
33
|
-
<p>
|
|
33
|
+
<p>All KMS API calls must be signed and be transmitted using Transport Layer Security (TLS).
|
|
34
|
+
KMS recommends you always use the latest supported TLS version. Clients
|
|
34
35
|
must also support cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral
|
|
35
36
|
Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems
|
|
36
37
|
such as Java 7 and later support these modes.</p>
|
package/dist-types/KMS.d.ts
CHANGED
|
@@ -71,7 +71,8 @@ import { KMSClient } from "./KMSClient";
|
|
|
71
71
|
* <p>If you need to use FIPS 140-2 validated cryptographic modules when communicating with
|
|
72
72
|
* Amazon Web Services, use the FIPS endpoint in your preferred Amazon Web Services Region. For more information about the
|
|
73
73
|
* available FIPS endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">Service endpoints</a> in the Key Management Service topic of the <i>Amazon Web Services General Reference</i>.</p>
|
|
74
|
-
* <p>
|
|
74
|
+
* <p>All KMS API calls must be signed and be transmitted using Transport Layer Security (TLS).
|
|
75
|
+
* KMS recommends you always use the latest supported TLS version. Clients
|
|
75
76
|
* must also support cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral
|
|
76
77
|
* Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems
|
|
77
78
|
* such as Java 7 and later support these modes.</p>
|
|
@@ -420,13 +421,12 @@ export declare class KMS extends KMSClient {
|
|
|
420
421
|
createGrant(args: CreateGrantCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: CreateGrantCommandOutput) => void): void;
|
|
421
422
|
/**
|
|
422
423
|
* <p>Creates a unique customer managed <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys">KMS key</a> in your Amazon Web Services account and
|
|
423
|
-
* Region
|
|
424
|
+
* Region.</p>
|
|
424
425
|
* <p>In addition to the required parameters, you can use the optional parameters to specify a key policy, description, tags, and other useful elements for any key type.</p>
|
|
425
426
|
* <note>
|
|
426
427
|
* <p>KMS is replacing the term <i>customer master key (CMK)</i> with <i>KMS key</i> and <i>KMS key</i>. The concept has not changed. To prevent breaking changes, KMS is keeping some variations of this term.</p>
|
|
427
428
|
* </note>
|
|
428
429
|
*
|
|
429
|
-
*
|
|
430
430
|
* <p>To create different types of KMS keys, use the following guidance:</p>
|
|
431
431
|
*
|
|
432
432
|
* <dl>
|
|
@@ -446,8 +446,8 @@ export declare class KMS extends KMSClient {
|
|
|
446
446
|
* to determine whether the KMS key will be used to encrypt and decrypt or sign and verify.
|
|
447
447
|
* You can't change these properties after the KMS key is created.</p>
|
|
448
448
|
* <p>Asymmetric KMS keys contain an RSA key pair or an Elliptic Curve (ECC) key pair. The private key in an asymmetric
|
|
449
|
-
* KMS key never leaves
|
|
450
|
-
* so it can be used outside of
|
|
449
|
+
* KMS key never leaves KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to download the public key
|
|
450
|
+
* so it can be used outside of KMS. KMS keys with RSA key pairs can be used to encrypt or decrypt data or sign and verify messages (but not both).
|
|
451
451
|
* KMS keys with ECC key pairs can be used only to sign and verify messages.
|
|
452
452
|
* For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
453
453
|
* <p> </p>
|
|
@@ -586,7 +586,7 @@ export declare class KMS extends KMSClient {
|
|
|
586
586
|
* asymmetric encryption KMS key. When the KMS key is asymmetric, you must specify the KMS key and the
|
|
587
587
|
* encryption algorithm that was used to encrypt the ciphertext. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
588
588
|
* <p>The <code>Decrypt</code> operation also decrypts ciphertext that was encrypted outside of KMS by the
|
|
589
|
-
* public key in an KMS asymmetric KMS key. However, it cannot decrypt
|
|
589
|
+
* public key in an KMS asymmetric KMS key. However, it cannot decrypt ciphertext produced by
|
|
590
590
|
* other libraries, such as the <a href="https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/">Amazon Web Services
|
|
591
591
|
* Encryption SDK</a> or <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html">Amazon S3 client-side encryption</a>.
|
|
592
592
|
* These libraries return a ciphertext format that is incompatible with KMS.</p>
|
|
@@ -958,8 +958,18 @@ export declare class KMS extends KMSClient {
|
|
|
958
958
|
disableKey(args: DisableKeyCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: DisableKeyCommandOutput) => void): void;
|
|
959
959
|
/**
|
|
960
960
|
* <p>Disables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic
|
|
961
|
-
* rotation of the key material</a>
|
|
962
|
-
* <p>
|
|
961
|
+
* rotation of the key material</a> of the specified symmetric encryption KMS key.</p>
|
|
962
|
+
* <p>Automatic key rotation is supported only on symmetric encryption KMS keys.
|
|
963
|
+
* You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
|
|
964
|
+
* To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
|
|
965
|
+
* <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation of the
|
|
966
|
+
* key material in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>. Key material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
|
|
967
|
+
* configurable. KMS always rotates the key material for every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
|
|
968
|
+
* keys</a> varies.</p>
|
|
969
|
+
* <note>
|
|
970
|
+
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every
|
|
971
|
+
* three years to every year. For details, see <a>EnableKeyRotation</a>.</p>
|
|
972
|
+
* </note>
|
|
963
973
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
964
974
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
965
975
|
* <p>
|
|
@@ -1065,8 +1075,26 @@ export declare class KMS extends KMSClient {
|
|
|
1065
1075
|
enableKey(args: EnableKeyCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: EnableKeyCommandOutput) => void): void;
|
|
1066
1076
|
/**
|
|
1067
1077
|
* <p>Enables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation
|
|
1068
|
-
* of the key material</a>
|
|
1069
|
-
* <p>
|
|
1078
|
+
* of the key material</a> of the specified symmetric encryption KMS key. </p>
|
|
1079
|
+
* <p>When you enable automatic rotation of a<a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS key</a>, KMS
|
|
1080
|
+
* rotates the key material of the KMS key one year (approximately 365 days) from the enable date
|
|
1081
|
+
* and every year thereafter. You can monitor rotation of the key material for your KMS keys in
|
|
1082
|
+
* CloudTrail and Amazon CloudWatch. To disable rotation of the key material in a customer
|
|
1083
|
+
* managed KMS key, use the <a>DisableKeyRotation</a> operation.</p>
|
|
1084
|
+
* <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
|
|
1085
|
+
* You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
|
|
1086
|
+
* To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
|
|
1087
|
+
* <p>You cannot enable or disable automatic rotation <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a>. KMS
|
|
1088
|
+
* always rotates the key material of Amazon Web Services managed keys every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
|
|
1089
|
+
* keys</a> varies.</p>
|
|
1090
|
+
* <note>
|
|
1091
|
+
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
|
|
1092
|
+
* years (approximately 1,095 days) to every year (approximately 365 days).</p>
|
|
1093
|
+
* <p>New Amazon Web Services managed keys are automatically rotated one year after they
|
|
1094
|
+
* are created, and approximately every year thereafter. </p>
|
|
1095
|
+
* <p>Existing Amazon Web Services managed keys are automatically rotated one year after
|
|
1096
|
+
* their most recent rotation, and every year thereafter.</p>
|
|
1097
|
+
* </note>
|
|
1070
1098
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1071
1099
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1072
1100
|
* <p>
|
|
@@ -1210,15 +1238,14 @@ export declare class KMS extends KMSClient {
|
|
|
1210
1238
|
* <p>Returns a unique symmetric data key for use outside of KMS. This operation returns a
|
|
1211
1239
|
* plaintext copy of the data key and a copy that is encrypted under a symmetric encryption KMS
|
|
1212
1240
|
* key that you specify. The bytes in the plaintext key are random; they are not related to the caller or the KMS
|
|
1213
|
-
* key. You can use the plaintext key to encrypt your data outside of KMS and store the
|
|
1214
|
-
*
|
|
1241
|
+
* key. You can use the plaintext key to encrypt your data outside of KMS and store the encrypted
|
|
1242
|
+
* data key with the encrypted data.</p>
|
|
1215
1243
|
*
|
|
1216
1244
|
* <p>To generate a data key, specify the symmetric encryption KMS key that will be used to
|
|
1217
1245
|
* encrypt the data key. You cannot use an asymmetric KMS key to encrypt data keys. To get the
|
|
1218
|
-
* type of your KMS key, use the <a>DescribeKey</a> operation. You must also specify
|
|
1219
|
-
* the
|
|
1220
|
-
*
|
|
1221
|
-
* parameter. </p>
|
|
1246
|
+
* type of your KMS key, use the <a>DescribeKey</a> operation. You must also specify the length of
|
|
1247
|
+
* the data key. Use either the <code>KeySpec</code> or <code>NumberOfBytes</code> parameters
|
|
1248
|
+
* (but not both). For 128-bit and 256-bit data keys, use the <code>KeySpec</code> parameter. </p>
|
|
1222
1249
|
*
|
|
1223
1250
|
* <p>To get only an encrypted copy of the data key, use <a>GenerateDataKeyWithoutPlaintext</a>. To generate an asymmetric data key pair, use
|
|
1224
1251
|
* the <a>GenerateDataKeyPair</a> or <a>GenerateDataKeyPairWithoutPlaintext</a> operation. To get a cryptographically secure
|
|
@@ -1321,7 +1348,8 @@ export declare class KMS extends KMSClient {
|
|
|
1321
1348
|
*
|
|
1322
1349
|
* <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
|
|
1323
1350
|
* the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
|
|
1324
|
-
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
|
|
1351
|
+
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
|
|
1352
|
+
* operation. </p>
|
|
1325
1353
|
* <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
|
|
1326
1354
|
* key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for
|
|
1327
1355
|
* either encryption or signing, but not both. However, KMS cannot enforce any restrictions on
|
|
@@ -1401,7 +1429,8 @@ export declare class KMS extends KMSClient {
|
|
|
1401
1429
|
* with the data. When you are ready to decrypt data or sign a message, you can use the <a>Decrypt</a> operation to decrypt the encrypted private key.</p>
|
|
1402
1430
|
* <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
|
|
1403
1431
|
* the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
|
|
1404
|
-
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
|
|
1432
|
+
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
|
|
1433
|
+
* operation. </p>
|
|
1405
1434
|
* <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
|
|
1406
1435
|
* key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for
|
|
1407
1436
|
* either encryption or signing, but not both. However, KMS cannot enforce any restrictions on
|
|
@@ -1470,19 +1499,21 @@ export declare class KMS extends KMSClient {
|
|
|
1470
1499
|
* data key. </p>
|
|
1471
1500
|
* <p>This operation is useful for systems that need to encrypt data at some point, but not
|
|
1472
1501
|
* immediately. When you need to encrypt the data, you call the <a>Decrypt</a>
|
|
1473
|
-
* operation on the encrypted copy of the key
|
|
1474
|
-
*
|
|
1475
|
-
*
|
|
1476
|
-
* container. Then, a different component puts the
|
|
1477
|
-
*
|
|
1478
|
-
*
|
|
1479
|
-
* that creates the containers never sees the
|
|
1502
|
+
* operation on the encrypted copy of the key.</p>
|
|
1503
|
+
* <p>It's also useful in distributed systems with different levels of trust. For example, you
|
|
1504
|
+
* might store encrypted data in containers. One component of your system creates new containers
|
|
1505
|
+
* and stores an encrypted data key with each container. Then, a different component puts the
|
|
1506
|
+
* data into the containers. That component first decrypts the data key, uses the plaintext data
|
|
1507
|
+
* key to encrypt data, puts the encrypted data into the container, and then destroys the
|
|
1508
|
+
* plaintext data key. In this system, the component that creates the containers never sees the
|
|
1509
|
+
* plaintext data key.</p>
|
|
1480
1510
|
* <p>To request an asymmetric data key pair, use the <a>GenerateDataKeyPair</a> or
|
|
1481
1511
|
* <a>GenerateDataKeyPairWithoutPlaintext</a> operations.</p>
|
|
1482
1512
|
*
|
|
1483
1513
|
* <p>To generate a data key, you must specify the symmetric encryption KMS key that is used to
|
|
1484
1514
|
* encrypt the data key. You cannot use an asymmetric KMS key or a key in a custom key store to generate a data key. To get the
|
|
1485
1515
|
* type of your KMS key, use the <a>DescribeKey</a> operation.</p>
|
|
1516
|
+
*
|
|
1486
1517
|
* <p>If the operation succeeds, you will find the encrypted copy of the data key in the
|
|
1487
1518
|
* <code>CiphertextBlob</code> field.</p>
|
|
1488
1519
|
*
|
|
@@ -1546,6 +1577,13 @@ export declare class KMS extends KMSClient {
|
|
|
1546
1577
|
* For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>
|
|
1547
1578
|
* <i>Key Management Service Developer Guide</i>
|
|
1548
1579
|
* </i>.</p>
|
|
1580
|
+
* <note>
|
|
1581
|
+
* <p>Best practices recommend that you limit the time during which any signing mechanism,
|
|
1582
|
+
* including an HMAC, is effective. This deters an attack where the actor uses a signed
|
|
1583
|
+
* message to establish validity repeatedly or long after the message is superseded. HMAC
|
|
1584
|
+
* tags do not include a timestamp, but you can include a timestamp in the token or message
|
|
1585
|
+
* to help you detect when its time to refresh the HMAC. </p>
|
|
1586
|
+
* </note>
|
|
1549
1587
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1550
1588
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1551
1589
|
* <p>
|
|
@@ -1593,19 +1631,35 @@ export declare class KMS extends KMSClient {
|
|
|
1593
1631
|
/**
|
|
1594
1632
|
* <p>Gets a Boolean value that indicates whether <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation of the key material</a> is
|
|
1595
1633
|
* enabled for the specified KMS key.</p>
|
|
1596
|
-
* <p>
|
|
1597
|
-
*
|
|
1634
|
+
* <p>When you enable automatic rotation for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>, KMS
|
|
1635
|
+
* rotates the key material of the KMS key one year (approximately 365 days) from the enable date
|
|
1636
|
+
* and every year thereafter. You can monitor rotation of the key material for your KMS keys in
|
|
1637
|
+
* CloudTrail and Amazon CloudWatch.</p>
|
|
1638
|
+
* <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
|
|
1639
|
+
* You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
|
|
1640
|
+
* To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key..</p>
|
|
1641
|
+
* <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation (<a>DisableKeyRotation</a>) of the key material in customer managed KMS keys. Key
|
|
1642
|
+
* material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
|
|
1643
|
+
* configurable. KMS always rotates the key material in Amazon Web Services managed KMS keys every year. The
|
|
1644
|
+
* key rotation status for Amazon Web Services managed KMS keys is always <code>true</code>.</p>
|
|
1645
|
+
* <note>
|
|
1646
|
+
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three years to every year. For details, see <a>EnableKeyRotation</a>.</p>
|
|
1647
|
+
* </note>
|
|
1598
1648
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
1599
1649
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1600
1650
|
* <ul>
|
|
1601
1651
|
* <li>
|
|
1602
1652
|
* <p>Disabled: The key rotation status does not change when you disable a KMS key. However,
|
|
1603
|
-
* while the KMS key is disabled, KMS does not rotate the key material
|
|
1653
|
+
* while the KMS key is disabled, KMS does not rotate the key material. When you re-enable
|
|
1654
|
+
* the KMS key, rotation resumes. If the key material in the re-enabled KMS key hasn't been
|
|
1655
|
+
* rotated in one year, KMS rotates it immediately, and every year thereafter. If it's been
|
|
1656
|
+
* less than a year since the key material in the re-enabled KMS key was rotated, the KMS key
|
|
1657
|
+
* resumes its prior rotation schedule.</p>
|
|
1604
1658
|
* </li>
|
|
1605
1659
|
* <li>
|
|
1606
1660
|
* <p>Pending deletion: While a KMS key is pending deletion, its key rotation status is
|
|
1607
1661
|
* <code>false</code> and KMS does not rotate the key material. If you cancel the
|
|
1608
|
-
* deletion, the original key rotation status
|
|
1662
|
+
* deletion, the original key rotation status returns to <code>true</code>.</p>
|
|
1609
1663
|
* </li>
|
|
1610
1664
|
* </ul>
|
|
1611
1665
|
* <p>
|
|
@@ -1635,8 +1689,8 @@ export declare class KMS extends KMSClient {
|
|
|
1635
1689
|
getKeyRotationStatus(args: GetKeyRotationStatusCommandInput, options: __HttpHandlerOptions, cb: (err: any, data?: GetKeyRotationStatusCommandOutput) => void): void;
|
|
1636
1690
|
/**
|
|
1637
1691
|
* <p>Returns the items you need to import key material into a symmetric encryption KMS key. For
|
|
1638
|
-
* more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a>
|
|
1639
|
-
* <i>Key Management Service Developer Guide</i>.</p>
|
|
1692
|
+
* more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a>
|
|
1693
|
+
* in the <i>Key Management Service Developer Guide</i>.</p>
|
|
1640
1694
|
* <p>This operation returns a public key and an import token. Use the public key to encrypt the
|
|
1641
1695
|
* symmetric key material. Store the import token to send with a subsequent <a>ImportKeyMaterial</a> request.</p>
|
|
1642
1696
|
* <p>You must specify the key ID of the symmetric encryption KMS key into which you will import
|
|
@@ -1728,11 +1782,12 @@ export declare class KMS extends KMSClient {
|
|
|
1728
1782
|
/**
|
|
1729
1783
|
* <p>Imports key material into an existing symmetric encryption KMS key that was created
|
|
1730
1784
|
* without key material. After you successfully import key material into a KMS key, you can
|
|
1731
|
-
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport
|
|
1732
|
-
*
|
|
1733
|
-
*
|
|
1734
|
-
*
|
|
1735
|
-
*
|
|
1785
|
+
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport
|
|
1786
|
+
* the same key material</a> into that KMS key, but you cannot import different key
|
|
1787
|
+
* material. </p>
|
|
1788
|
+
* <p>You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account. For more information about creating KMS keys with no key material
|
|
1789
|
+
* and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the
|
|
1790
|
+
* <i>Key Management Service Developer Guide</i>.</p>
|
|
1736
1791
|
* <p>Before using this operation, call <a>GetParametersForImport</a>. Its response
|
|
1737
1792
|
* includes a public key and an import token. Use the public key to encrypt the key material.
|
|
1738
1793
|
* Then, submit the import token from the same <code>GetParametersForImport</code>
|
|
@@ -2418,8 +2473,8 @@ export declare class KMS extends KMSClient {
|
|
|
2418
2473
|
/**
|
|
2419
2474
|
* <p>Creates a <a href="https://en.wikipedia.org/wiki/Digital_signature">digital
|
|
2420
2475
|
* signature</a> for a message or message digest by using the private key in an asymmetric
|
|
2421
|
-
* signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use
|
|
2422
|
-
*
|
|
2476
|
+
* signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use the
|
|
2477
|
+
* public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
2423
2478
|
* <p>Digital signatures are generated and verified by using asymmetric key pair, such as an RSA
|
|
2424
2479
|
* or ECC pair that is represented by an asymmetric KMS key. The key owner (or an authorized
|
|
2425
2480
|
* user) uses their private key to sign a message. Anyone with the public key can verify that the
|
|
@@ -2448,6 +2503,11 @@ export declare class KMS extends KMSClient {
|
|
|
2448
2503
|
* <p>When signing a message, be sure to record the KMS key and the signing algorithm. This
|
|
2449
2504
|
* information is required to verify the signature.</p>
|
|
2450
2505
|
* </important>
|
|
2506
|
+
* <note>
|
|
2507
|
+
* <p>Best practices recommend that you limit the time during which any signature is effective. This deters an attack where the actor uses a signed
|
|
2508
|
+
* message to establish validity repeatedly or long after the message is superseded. Signatures do not include a timestamp, but you can include a timestamp in the signed message
|
|
2509
|
+
* to help you detect when its time to refresh the signature. </p>
|
|
2510
|
+
* </note>
|
|
2451
2511
|
* <p>To verify the signature that this operation generates, use the <a>Verify</a>
|
|
2452
2512
|
* operation. Or use the <a>GetPublicKey</a> operation to download the public key and
|
|
2453
2513
|
* then use the public key to verify the signature outside of KMS. </p>
|
|
@@ -196,7 +196,8 @@ export interface KMSClientResolvedConfig extends KMSClientResolvedConfigType {
|
|
|
196
196
|
* <p>If you need to use FIPS 140-2 validated cryptographic modules when communicating with
|
|
197
197
|
* Amazon Web Services, use the FIPS endpoint in your preferred Amazon Web Services Region. For more information about the
|
|
198
198
|
* available FIPS endpoints, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">Service endpoints</a> in the Key Management Service topic of the <i>Amazon Web Services General Reference</i>.</p>
|
|
199
|
-
* <p>
|
|
199
|
+
* <p>All KMS API calls must be signed and be transmitted using Transport Layer Security (TLS).
|
|
200
|
+
* KMS recommends you always use the latest supported TLS version. Clients
|
|
200
201
|
* must also support cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral
|
|
201
202
|
* Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems
|
|
202
203
|
* such as Java 7 and later support these modes.</p>
|
|
@@ -8,13 +8,12 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
|
|
|
8
8
|
}
|
|
9
9
|
/**
|
|
10
10
|
* <p>Creates a unique customer managed <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms-keys">KMS key</a> in your Amazon Web Services account and
|
|
11
|
-
* Region
|
|
11
|
+
* Region.</p>
|
|
12
12
|
* <p>In addition to the required parameters, you can use the optional parameters to specify a key policy, description, tags, and other useful elements for any key type.</p>
|
|
13
13
|
* <note>
|
|
14
14
|
* <p>KMS is replacing the term <i>customer master key (CMK)</i> with <i>KMS key</i> and <i>KMS key</i>. The concept has not changed. To prevent breaking changes, KMS is keeping some variations of this term.</p>
|
|
15
15
|
* </note>
|
|
16
16
|
*
|
|
17
|
-
*
|
|
18
17
|
* <p>To create different types of KMS keys, use the following guidance:</p>
|
|
19
18
|
*
|
|
20
19
|
* <dl>
|
|
@@ -34,8 +33,8 @@ export interface CreateKeyCommandOutput extends CreateKeyResponse, __MetadataBea
|
|
|
34
33
|
* to determine whether the KMS key will be used to encrypt and decrypt or sign and verify.
|
|
35
34
|
* You can't change these properties after the KMS key is created.</p>
|
|
36
35
|
* <p>Asymmetric KMS keys contain an RSA key pair or an Elliptic Curve (ECC) key pair. The private key in an asymmetric
|
|
37
|
-
* KMS key never leaves
|
|
38
|
-
* so it can be used outside of
|
|
36
|
+
* KMS key never leaves KMS unencrypted. However, you can use the <a>GetPublicKey</a> operation to download the public key
|
|
37
|
+
* so it can be used outside of KMS. KMS keys with RSA key pairs can be used to encrypt or decrypt data or sign and verify messages (but not both).
|
|
39
38
|
* KMS keys with ECC key pairs can be used only to sign and verify messages.
|
|
40
39
|
* For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
41
40
|
* <p> </p>
|
|
@@ -40,7 +40,7 @@ export interface DecryptCommandOutput extends DecryptResponse, __MetadataBearer
|
|
|
40
40
|
* asymmetric encryption KMS key. When the KMS key is asymmetric, you must specify the KMS key and the
|
|
41
41
|
* encryption algorithm that was used to encrypt the ciphertext. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
42
42
|
* <p>The <code>Decrypt</code> operation also decrypts ciphertext that was encrypted outside of KMS by the
|
|
43
|
-
* public key in an KMS asymmetric KMS key. However, it cannot decrypt
|
|
43
|
+
* public key in an KMS asymmetric KMS key. However, it cannot decrypt ciphertext produced by
|
|
44
44
|
* other libraries, such as the <a href="https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/">Amazon Web Services
|
|
45
45
|
* Encryption SDK</a> or <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html">Amazon S3 client-side encryption</a>.
|
|
46
46
|
* These libraries return a ciphertext format that is incompatible with KMS.</p>
|
|
@@ -8,8 +8,18 @@ export interface DisableKeyRotationCommandOutput extends __MetadataBearer {
|
|
|
8
8
|
}
|
|
9
9
|
/**
|
|
10
10
|
* <p>Disables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic
|
|
11
|
-
* rotation of the key material</a>
|
|
12
|
-
* <p>
|
|
11
|
+
* rotation of the key material</a> of the specified symmetric encryption KMS key.</p>
|
|
12
|
+
* <p>Automatic key rotation is supported only on symmetric encryption KMS keys.
|
|
13
|
+
* You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
|
|
14
|
+
* To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
|
|
15
|
+
* <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation of the
|
|
16
|
+
* key material in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>. Key material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
|
|
17
|
+
* configurable. KMS always rotates the key material for every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
|
|
18
|
+
* keys</a> varies.</p>
|
|
19
|
+
* <note>
|
|
20
|
+
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every
|
|
21
|
+
* three years to every year. For details, see <a>EnableKeyRotation</a>.</p>
|
|
22
|
+
* </note>
|
|
13
23
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
14
24
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
15
25
|
* <p>
|
|
@@ -8,8 +8,26 @@ export interface EnableKeyRotationCommandOutput extends __MetadataBearer {
|
|
|
8
8
|
}
|
|
9
9
|
/**
|
|
10
10
|
* <p>Enables <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation
|
|
11
|
-
* of the key material</a>
|
|
12
|
-
* <p>
|
|
11
|
+
* of the key material</a> of the specified symmetric encryption KMS key. </p>
|
|
12
|
+
* <p>When you enable automatic rotation of a<a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS key</a>, KMS
|
|
13
|
+
* rotates the key material of the KMS key one year (approximately 365 days) from the enable date
|
|
14
|
+
* and every year thereafter. You can monitor rotation of the key material for your KMS keys in
|
|
15
|
+
* CloudTrail and Amazon CloudWatch. To disable rotation of the key material in a customer
|
|
16
|
+
* managed KMS key, use the <a>DisableKeyRotation</a> operation.</p>
|
|
17
|
+
* <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
|
|
18
|
+
* You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
|
|
19
|
+
* To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key. </p>
|
|
20
|
+
* <p>You cannot enable or disable automatic rotation <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a>. KMS
|
|
21
|
+
* always rotates the key material of Amazon Web Services managed keys every year. Rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk">Amazon Web Services owned KMS
|
|
22
|
+
* keys</a> varies.</p>
|
|
23
|
+
* <note>
|
|
24
|
+
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three
|
|
25
|
+
* years (approximately 1,095 days) to every year (approximately 365 days).</p>
|
|
26
|
+
* <p>New Amazon Web Services managed keys are automatically rotated one year after they
|
|
27
|
+
* are created, and approximately every year thereafter. </p>
|
|
28
|
+
* <p>Existing Amazon Web Services managed keys are automatically rotated one year after
|
|
29
|
+
* their most recent rotation, and every year thereafter.</p>
|
|
30
|
+
* </note>
|
|
13
31
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
14
32
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
15
33
|
* <p>
|
|
@@ -10,15 +10,14 @@ export interface GenerateDataKeyCommandOutput extends GenerateDataKeyResponse, _
|
|
|
10
10
|
* <p>Returns a unique symmetric data key for use outside of KMS. This operation returns a
|
|
11
11
|
* plaintext copy of the data key and a copy that is encrypted under a symmetric encryption KMS
|
|
12
12
|
* key that you specify. The bytes in the plaintext key are random; they are not related to the caller or the KMS
|
|
13
|
-
* key. You can use the plaintext key to encrypt your data outside of KMS and store the
|
|
14
|
-
*
|
|
13
|
+
* key. You can use the plaintext key to encrypt your data outside of KMS and store the encrypted
|
|
14
|
+
* data key with the encrypted data.</p>
|
|
15
15
|
*
|
|
16
16
|
* <p>To generate a data key, specify the symmetric encryption KMS key that will be used to
|
|
17
17
|
* encrypt the data key. You cannot use an asymmetric KMS key to encrypt data keys. To get the
|
|
18
|
-
* type of your KMS key, use the <a>DescribeKey</a> operation. You must also specify
|
|
19
|
-
* the
|
|
20
|
-
*
|
|
21
|
-
* parameter. </p>
|
|
18
|
+
* type of your KMS key, use the <a>DescribeKey</a> operation. You must also specify the length of
|
|
19
|
+
* the data key. Use either the <code>KeySpec</code> or <code>NumberOfBytes</code> parameters
|
|
20
|
+
* (but not both). For 128-bit and 256-bit data keys, use the <code>KeySpec</code> parameter. </p>
|
|
22
21
|
*
|
|
23
22
|
* <p>To get only an encrypted copy of the data key, use <a>GenerateDataKeyWithoutPlaintext</a>. To generate an asymmetric data key pair, use
|
|
24
23
|
* the <a>GenerateDataKeyPair</a> or <a>GenerateDataKeyPairWithoutPlaintext</a> operation. To get a cryptographically secure
|
|
@@ -20,7 +20,8 @@ export interface GenerateDataKeyPairCommandOutput extends GenerateDataKeyPairRes
|
|
|
20
20
|
*
|
|
21
21
|
* <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
|
|
22
22
|
* the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
|
|
23
|
-
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
|
|
23
|
+
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
|
|
24
|
+
* operation. </p>
|
|
24
25
|
* <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
|
|
25
26
|
* key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for
|
|
26
27
|
* either encryption or signing, but not both. However, KMS cannot enforce any restrictions on
|
|
@@ -17,7 +17,8 @@ export interface GenerateDataKeyPairWithoutPlaintextCommandOutput extends Genera
|
|
|
17
17
|
* with the data. When you are ready to decrypt data or sign a message, you can use the <a>Decrypt</a> operation to decrypt the encrypted private key.</p>
|
|
18
18
|
* <p>To generate a data key pair, you must specify a symmetric encryption KMS key to encrypt
|
|
19
19
|
* the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a
|
|
20
|
-
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
|
|
20
|
+
* custom key store. To get the type and origin of your KMS key, use the <a>DescribeKey</a>
|
|
21
|
+
* operation. </p>
|
|
21
22
|
* <p>Use the <code>KeyPairSpec</code> parameter to choose an RSA or Elliptic Curve (ECC) data
|
|
22
23
|
* key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for
|
|
23
24
|
* either encryption or signing, but not both. However, KMS cannot enforce any restrictions on
|
|
@@ -15,19 +15,21 @@ export interface GenerateDataKeyWithoutPlaintextCommandOutput extends GenerateDa
|
|
|
15
15
|
* data key. </p>
|
|
16
16
|
* <p>This operation is useful for systems that need to encrypt data at some point, but not
|
|
17
17
|
* immediately. When you need to encrypt the data, you call the <a>Decrypt</a>
|
|
18
|
-
* operation on the encrypted copy of the key
|
|
19
|
-
*
|
|
20
|
-
*
|
|
21
|
-
* container. Then, a different component puts the
|
|
22
|
-
*
|
|
23
|
-
*
|
|
24
|
-
* that creates the containers never sees the
|
|
18
|
+
* operation on the encrypted copy of the key.</p>
|
|
19
|
+
* <p>It's also useful in distributed systems with different levels of trust. For example, you
|
|
20
|
+
* might store encrypted data in containers. One component of your system creates new containers
|
|
21
|
+
* and stores an encrypted data key with each container. Then, a different component puts the
|
|
22
|
+
* data into the containers. That component first decrypts the data key, uses the plaintext data
|
|
23
|
+
* key to encrypt data, puts the encrypted data into the container, and then destroys the
|
|
24
|
+
* plaintext data key. In this system, the component that creates the containers never sees the
|
|
25
|
+
* plaintext data key.</p>
|
|
25
26
|
* <p>To request an asymmetric data key pair, use the <a>GenerateDataKeyPair</a> or
|
|
26
27
|
* <a>GenerateDataKeyPairWithoutPlaintext</a> operations.</p>
|
|
27
28
|
*
|
|
28
29
|
* <p>To generate a data key, you must specify the symmetric encryption KMS key that is used to
|
|
29
30
|
* encrypt the data key. You cannot use an asymmetric KMS key or a key in a custom key store to generate a data key. To get the
|
|
30
31
|
* type of your KMS key, use the <a>DescribeKey</a> operation.</p>
|
|
32
|
+
*
|
|
31
33
|
* <p>If the operation succeeds, you will find the encrypted copy of the data key in the
|
|
32
34
|
* <code>CiphertextBlob</code> field.</p>
|
|
33
35
|
*
|
|
@@ -17,6 +17,13 @@ export interface GenerateMacCommandOutput extends GenerateMacResponse, __Metadat
|
|
|
17
17
|
* For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>
|
|
18
18
|
* <i>Key Management Service Developer Guide</i>
|
|
19
19
|
* </i>.</p>
|
|
20
|
+
* <note>
|
|
21
|
+
* <p>Best practices recommend that you limit the time during which any signing mechanism,
|
|
22
|
+
* including an HMAC, is effective. This deters an attack where the actor uses a signed
|
|
23
|
+
* message to establish validity repeatedly or long after the message is superseded. HMAC
|
|
24
|
+
* tags do not include a timestamp, but you can include a timestamp in the token or message
|
|
25
|
+
* to help you detect when its time to refresh the HMAC. </p>
|
|
26
|
+
* </note>
|
|
20
27
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
21
28
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
22
29
|
* <p>
|
|
@@ -9,19 +9,35 @@ export interface GetKeyRotationStatusCommandOutput extends GetKeyRotationStatusR
|
|
|
9
9
|
/**
|
|
10
10
|
* <p>Gets a Boolean value that indicates whether <a href="https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html">automatic rotation of the key material</a> is
|
|
11
11
|
* enabled for the specified KMS key.</p>
|
|
12
|
-
* <p>
|
|
13
|
-
*
|
|
12
|
+
* <p>When you enable automatic rotation for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed KMS keys</a>, KMS
|
|
13
|
+
* rotates the key material of the KMS key one year (approximately 365 days) from the enable date
|
|
14
|
+
* and every year thereafter. You can monitor rotation of the key material for your KMS keys in
|
|
15
|
+
* CloudTrail and Amazon CloudWatch.</p>
|
|
16
|
+
* <p>Automatic key rotation is supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#symmetric-cmks">symmetric encryption KMS keys</a>.
|
|
17
|
+
* You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
|
|
18
|
+
* To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key..</p>
|
|
19
|
+
* <p>You can enable (<a>EnableKeyRotation</a>) and disable automatic rotation (<a>DisableKeyRotation</a>) of the key material in customer managed KMS keys. Key
|
|
20
|
+
* material rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed KMS keys</a> is not
|
|
21
|
+
* configurable. KMS always rotates the key material in Amazon Web Services managed KMS keys every year. The
|
|
22
|
+
* key rotation status for Amazon Web Services managed KMS keys is always <code>true</code>.</p>
|
|
23
|
+
* <note>
|
|
24
|
+
* <p>In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three years to every year. For details, see <a>EnableKeyRotation</a>.</p>
|
|
25
|
+
* </note>
|
|
14
26
|
* <p>The KMS key that you use for this operation must be in a compatible key state. For
|
|
15
27
|
* details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
16
28
|
* <ul>
|
|
17
29
|
* <li>
|
|
18
30
|
* <p>Disabled: The key rotation status does not change when you disable a KMS key. However,
|
|
19
|
-
* while the KMS key is disabled, KMS does not rotate the key material
|
|
31
|
+
* while the KMS key is disabled, KMS does not rotate the key material. When you re-enable
|
|
32
|
+
* the KMS key, rotation resumes. If the key material in the re-enabled KMS key hasn't been
|
|
33
|
+
* rotated in one year, KMS rotates it immediately, and every year thereafter. If it's been
|
|
34
|
+
* less than a year since the key material in the re-enabled KMS key was rotated, the KMS key
|
|
35
|
+
* resumes its prior rotation schedule.</p>
|
|
20
36
|
* </li>
|
|
21
37
|
* <li>
|
|
22
38
|
* <p>Pending deletion: While a KMS key is pending deletion, its key rotation status is
|
|
23
39
|
* <code>false</code> and KMS does not rotate the key material. If you cancel the
|
|
24
|
-
* deletion, the original key rotation status
|
|
40
|
+
* deletion, the original key rotation status returns to <code>true</code>.</p>
|
|
25
41
|
* </li>
|
|
26
42
|
* </ul>
|
|
27
43
|
* <p>
|
|
@@ -8,8 +8,8 @@ export interface GetParametersForImportCommandOutput extends GetParametersForImp
|
|
|
8
8
|
}
|
|
9
9
|
/**
|
|
10
10
|
* <p>Returns the items you need to import key material into a symmetric encryption KMS key. For
|
|
11
|
-
* more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a>
|
|
12
|
-
* <i>Key Management Service Developer Guide</i>.</p>
|
|
11
|
+
* more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing key material</a>
|
|
12
|
+
* in the <i>Key Management Service Developer Guide</i>.</p>
|
|
13
13
|
* <p>This operation returns a public key and an import token. Use the public key to encrypt the
|
|
14
14
|
* symmetric key material. Store the import token to send with a subsequent <a>ImportKeyMaterial</a> request.</p>
|
|
15
15
|
* <p>You must specify the key ID of the symmetric encryption KMS key into which you will import
|
|
@@ -9,11 +9,12 @@ export interface ImportKeyMaterialCommandOutput extends ImportKeyMaterialRespons
|
|
|
9
9
|
/**
|
|
10
10
|
* <p>Imports key material into an existing symmetric encryption KMS key that was created
|
|
11
11
|
* without key material. After you successfully import key material into a KMS key, you can
|
|
12
|
-
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
12
|
+
* <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material">reimport
|
|
13
|
+
* the same key material</a> into that KMS key, but you cannot import different key
|
|
14
|
+
* material. </p>
|
|
15
|
+
* <p>You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, or on any KMS key in a different Amazon Web Services account. For more information about creating KMS keys with no key material
|
|
16
|
+
* and then importing key material, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the
|
|
17
|
+
* <i>Key Management Service Developer Guide</i>.</p>
|
|
17
18
|
* <p>Before using this operation, call <a>GetParametersForImport</a>. Its response
|
|
18
19
|
* includes a public key and an import token. Use the public key to encrypt the key material.
|
|
19
20
|
* Then, submit the import token from the same <code>GetParametersForImport</code>
|
|
@@ -9,8 +9,8 @@ export interface SignCommandOutput extends SignResponse, __MetadataBearer {
|
|
|
9
9
|
/**
|
|
10
10
|
* <p>Creates a <a href="https://en.wikipedia.org/wiki/Digital_signature">digital
|
|
11
11
|
* signature</a> for a message or message digest by using the private key in an asymmetric
|
|
12
|
-
* signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use
|
|
13
|
-
*
|
|
12
|
+
* signing KMS key. To verify the signature, use the <a>Verify</a> operation, or use the
|
|
13
|
+
* public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">Asymmetric KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
14
14
|
* <p>Digital signatures are generated and verified by using asymmetric key pair, such as an RSA
|
|
15
15
|
* or ECC pair that is represented by an asymmetric KMS key. The key owner (or an authorized
|
|
16
16
|
* user) uses their private key to sign a message. Anyone with the public key can verify that the
|
|
@@ -39,6 +39,11 @@ export interface SignCommandOutput extends SignResponse, __MetadataBearer {
|
|
|
39
39
|
* <p>When signing a message, be sure to record the KMS key and the signing algorithm. This
|
|
40
40
|
* information is required to verify the signature.</p>
|
|
41
41
|
* </important>
|
|
42
|
+
* <note>
|
|
43
|
+
* <p>Best practices recommend that you limit the time during which any signature is effective. This deters an attack where the actor uses a signed
|
|
44
|
+
* message to establish validity repeatedly or long after the message is superseded. Signatures do not include a timestamp, but you can include a timestamp in the signed message
|
|
45
|
+
* to help you detect when its time to refresh the signature. </p>
|
|
46
|
+
* </note>
|
|
42
47
|
* <p>To verify the signature that this operation generates, use the <a>Verify</a>
|
|
43
48
|
* operation. Or use the <a>GetPublicKey</a> operation to download the public key and
|
|
44
49
|
* then use the public key to verify the signature outside of KMS. </p>
|
|
@@ -584,10 +584,10 @@ export interface CreateGrantRequest {
|
|
|
584
584
|
/**
|
|
585
585
|
* <p>A list of operations that the grant permits. </p>
|
|
586
586
|
* <p>This list must include only operations that are permitted in a grant. Also, the operation
|
|
587
|
-
* must be supported on the KMS key. For example, you cannot create a grant for a symmetric encryption KMS key that allows the <a>Sign</a> operation, or a grant for an
|
|
588
|
-
* that allows the <a>GenerateDataKey</a> operation. If you try,
|
|
589
|
-
*
|
|
590
|
-
*
|
|
587
|
+
* must be supported on the KMS key. For example, you cannot create a grant for a symmetric encryption KMS key that allows the <a>Sign</a> operation, or a grant for an
|
|
588
|
+
* asymmetric KMS key that allows the <a>GenerateDataKey</a> operation. If you try,
|
|
589
|
+
* KMS returns a <code>ValidationError</code> exception. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">Grant
|
|
590
|
+
* operations</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
591
591
|
*/
|
|
592
592
|
Operations: (GrantOperation | string)[] | undefined;
|
|
593
593
|
/**
|
|
@@ -745,11 +745,13 @@ export declare namespace Tag {
|
|
|
745
745
|
}
|
|
746
746
|
export interface CreateKeyRequest {
|
|
747
747
|
/**
|
|
748
|
-
* <p>The key policy to attach to the KMS key
|
|
748
|
+
* <p>The key policy to attach to the KMS key. If you do not specify a key policy, KMS attaches a default key policy to the KMS key.
|
|
749
|
+
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">Default key policy</a> in the
|
|
750
|
+
* <i>Key Management Service Developer Guide</i>.</p>
|
|
749
751
|
* <p>If you provide a key policy, it must meet the following criteria:</p>
|
|
750
752
|
* <ul>
|
|
751
753
|
* <li>
|
|
752
|
-
* <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to
|
|
754
|
+
* <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to <code>True</code>, the key policy
|
|
753
755
|
* must allow the principal that is making the <code>CreateKey</code> request to make a
|
|
754
756
|
* subsequent <a>PutKeyPolicy</a> request on the KMS key. This reduces the risk
|
|
755
757
|
* that the KMS key becomes unmanageable. For more information, refer to the scenario in the
|
|
@@ -766,10 +768,23 @@ export interface CreateKeyRequest {
|
|
|
766
768
|
* Identity and Access Management User Guide</i>.</p>
|
|
767
769
|
* </li>
|
|
768
770
|
* </ul>
|
|
769
|
-
*
|
|
770
|
-
*
|
|
771
|
-
*
|
|
772
|
-
*
|
|
771
|
+
*
|
|
772
|
+
* <p>A key policy document must conform to the following rules.</p>
|
|
773
|
+
* <ul>
|
|
774
|
+
* <li>
|
|
775
|
+
* <p>Up to 32 kilobytes (32768 bytes)</p>
|
|
776
|
+
* </li>
|
|
777
|
+
* <li>
|
|
778
|
+
* <p>Must be UTF-8 encoded</p>
|
|
779
|
+
* </li>
|
|
780
|
+
* <li>
|
|
781
|
+
* <p>The only Unicode characters that are permitted in a key policy document are the horizontal tab (U+0009), linefeed (U+000A), carriage return (U+000D), and characters in the range U+0020 to U+00FF.</p>
|
|
782
|
+
* </li>
|
|
783
|
+
* <li>
|
|
784
|
+
* <p>The <code>Sid</code> element in a key policy statement can include spaces. (Spaces are
|
|
785
|
+
* prohibited in the <code>Sid</code> element of an IAM policy document.)</p>
|
|
786
|
+
* </li>
|
|
787
|
+
* </ul>
|
|
773
788
|
* <p>For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i>
|
|
774
789
|
* <i>Identity and Access Management User Guide</i>
|
|
775
790
|
* </i>.</p>
|
|
@@ -784,7 +799,7 @@ export interface CreateKeyRequest {
|
|
|
784
799
|
Description?: string;
|
|
785
800
|
/**
|
|
786
801
|
* <p>Determines the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> for which you can use the KMS key. The default value is
|
|
787
|
-
*
|
|
802
|
+
* <code>ENCRYPT_DECRYPT</code>. This parameter is optional when you are creating a symmetric
|
|
788
803
|
* encryption KMS key; otherwise, it is required. You
|
|
789
804
|
* can't change the <code>KeyUsage</code> value after the KMS key is created.</p>
|
|
790
805
|
* <p>Select only one valid value.</p>
|
|
@@ -819,15 +834,14 @@ export interface CreateKeyRequest {
|
|
|
819
834
|
/**
|
|
820
835
|
* <p>Specifies the type of KMS key to create. The default value,
|
|
821
836
|
* <code>SYMMETRIC_DEFAULT</code>, creates a KMS key with a 256-bit symmetric key for encryption
|
|
822
|
-
* and decryption. For help choosing a key spec for your KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose">Choosing a KMS key type</a> in
|
|
823
|
-
* the <i>
|
|
837
|
+
* and decryption. For help choosing a key spec for your KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose">Choosing a KMS key type</a> in the <i>
|
|
824
838
|
* <i>Key Management Service Developer Guide</i>
|
|
825
839
|
* </i>.</p>
|
|
826
840
|
* <p>The <code>KeySpec</code> determines whether the KMS key contains a symmetric key or an
|
|
827
|
-
* asymmetric key pair. It also determines the algorithms that the KMS key supports. You can't
|
|
828
|
-
* change the <code>KeySpec</code> after the KMS key is created.
|
|
829
|
-
* algorithms that can be used with the KMS key, use a condition key in
|
|
830
|
-
* policy. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm">kms:EncryptionAlgorithm</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm">kms:MacAlgorithm</a> or <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm">kms:Signing Algorithm</a> in the <i>
|
|
841
|
+
* asymmetric key pair. It also determines the cryptographic algorithms that the KMS key supports. You can't
|
|
842
|
+
* change the <code>KeySpec</code> after the KMS key is created.
|
|
843
|
+
* To further restrict the algorithms that can be used with the KMS key, use a condition key in
|
|
844
|
+
* its key policy or IAM policy. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm">kms:EncryptionAlgorithm</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm">kms:MacAlgorithm</a> or <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm">kms:Signing Algorithm</a> in the <i>
|
|
831
845
|
* <i>Key Management Service Developer Guide</i>
|
|
832
846
|
* </i>.</p>
|
|
833
847
|
* <important>
|
|
@@ -993,8 +1007,8 @@ export interface CreateKeyRequest {
|
|
|
993
1007
|
* it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
|
|
994
1008
|
* <p>This value creates a <i>primary key</i>, not a replica. To create a
|
|
995
1009
|
* <i>replica key</i>, use the <a>ReplicateKey</a> operation. </p>
|
|
996
|
-
* <p>You can create a symmetric
|
|
997
|
-
*
|
|
1010
|
+
* <p>You can create a multi-Region version of a symmetric encryption KMS key, an HMAC KMS key, an asymmetric KMS key, or a
|
|
1011
|
+
* KMS key with imported key material. However, you cannot create a multi-Region key in
|
|
998
1012
|
* a custom key store.</p>
|
|
999
1013
|
*/
|
|
1000
1014
|
MultiRegion?: boolean;
|
|
@@ -1490,10 +1504,8 @@ export interface DecryptRequest {
|
|
|
1490
1504
|
GrantTokens?: string[];
|
|
1491
1505
|
/**
|
|
1492
1506
|
* <p>Specifies the KMS key that KMS uses to decrypt the ciphertext.</p>
|
|
1493
|
-
*
|
|
1494
1507
|
* <p>Enter a key ID of the KMS
|
|
1495
1508
|
* key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>Decrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
|
|
1496
|
-
*
|
|
1497
1509
|
* <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS
|
|
1498
1510
|
* key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to
|
|
1499
1511
|
* the symmetric ciphertext blob. However, it is always recommended as a best practice. This
|
|
@@ -1560,8 +1572,8 @@ export declare namespace DecryptResponse {
|
|
|
1560
1572
|
}
|
|
1561
1573
|
/**
|
|
1562
1574
|
* <p>The request was rejected because the specified KMS key cannot decrypt the data. The
|
|
1563
|
-
* <code>KeyId</code> in a <
|
|
1564
|
-
* in a <
|
|
1575
|
+
* <code>KeyId</code> in a <a>Decrypt</a> request and the <code>SourceKeyId</code>
|
|
1576
|
+
* in a <a>ReEncrypt</a> request must identify the same KMS key that was used to
|
|
1565
1577
|
* encrypt the ciphertext.</p>
|
|
1566
1578
|
*/
|
|
1567
1579
|
export declare class IncorrectKeyException extends __BaseException {
|
|
@@ -1604,8 +1616,8 @@ export declare class InvalidCiphertextException extends __BaseException {
|
|
|
1604
1616
|
* <code>KeyUsage</code> must be <code>ENCRYPT_DECRYPT</code>. For signing and verifying
|
|
1605
1617
|
* messages, the <code>KeyUsage</code> must be <code>SIGN_VERIFY</code>. For generating and
|
|
1606
1618
|
* verifying message authentication codes (MACs), the <code>KeyUsage</code> must be
|
|
1607
|
-
* <code>GENERATE_VERIFY_MAC</code>. To find the <code>KeyUsage</code> of
|
|
1608
|
-
*
|
|
1619
|
+
* <code>GENERATE_VERIFY_MAC</code>. To find the <code>KeyUsage</code> of
|
|
1620
|
+
* a KMS key, use the <a>DescribeKey</a> operation.</p>
|
|
1609
1621
|
* <p>To find the encryption or signing algorithms supported for a particular KMS key, use the
|
|
1610
1622
|
* <a>DescribeKey</a> operation.</p>
|
|
1611
1623
|
*/
|
|
@@ -1916,7 +1928,9 @@ export declare namespace EnableKeyRequest {
|
|
|
1916
1928
|
}
|
|
1917
1929
|
export interface EnableKeyRotationRequest {
|
|
1918
1930
|
/**
|
|
1919
|
-
* <p>Identifies a symmetric encryption KMS key. You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>.
|
|
1931
|
+
* <p>Identifies a symmetric encryption KMS key. You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The key rotation status of these KMS keys is always <code>false</code>.
|
|
1932
|
+
* To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
|
|
1933
|
+
*
|
|
1920
1934
|
* <p>Specify the key ID or key ARN of the KMS key.</p>
|
|
1921
1935
|
* <p>For example:</p>
|
|
1922
1936
|
* <ul>
|
|
@@ -2229,7 +2243,8 @@ export interface GenerateDataKeyPairWithoutPlaintextRequest {
|
|
|
2229
2243
|
/**
|
|
2230
2244
|
* <p>Specifies the symmetric encryption KMS key that encrypts the private key in the data key
|
|
2231
2245
|
* pair. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the
|
|
2232
|
-
* type and origin of your KMS key, use the <a>DescribeKey</a> operation
|
|
2246
|
+
* type and origin of your KMS key, use the <a>DescribeKey</a> operation.
|
|
2247
|
+
* </p>
|
|
2233
2248
|
* <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
|
|
2234
2249
|
* <p>For example:</p>
|
|
2235
2250
|
* <ul>
|
|
@@ -2760,8 +2775,7 @@ export declare namespace GrantListEntry {
|
|
|
2760
2775
|
export interface ImportKeyMaterialRequest {
|
|
2761
2776
|
/**
|
|
2762
2777
|
* <p>The identifier of the symmetric encryption KMS key that receives the imported key
|
|
2763
|
-
* material. This must be the same KMS key specified in the <code>KeyID</code> parameter of the
|
|
2764
|
-
* corresponding <a>GetParametersForImport</a> request. The <code>Origin</code> of the
|
|
2778
|
+
* material. This must be the same KMS key specified in the <code>KeyID</code> parameter of the corresponding <a>GetParametersForImport</a> request. The <code>Origin</code> of the
|
|
2765
2779
|
* KMS key must be <code>EXTERNAL</code>. You cannot perform this operation on an asymmetric KMS
|
|
2766
2780
|
* key, an HMAC KMS key, a KMS key in a custom key store, or on a KMS key in a different
|
|
2767
2781
|
* Amazon Web Services account</p>
|
|
@@ -3297,8 +3311,23 @@ export interface PutKeyPolicyRequest {
|
|
|
3297
3311
|
* Identity and Access Management User Guide</i>.</p>
|
|
3298
3312
|
* </li>
|
|
3299
3313
|
* </ul>
|
|
3300
|
-
*
|
|
3301
|
-
*
|
|
3314
|
+
*
|
|
3315
|
+
* <p>A key policy document must conform to the following rules.</p>
|
|
3316
|
+
* <ul>
|
|
3317
|
+
* <li>
|
|
3318
|
+
* <p>Up to 32 kilobytes (32768 bytes)</p>
|
|
3319
|
+
* </li>
|
|
3320
|
+
* <li>
|
|
3321
|
+
* <p>Must be UTF-8 encoded</p>
|
|
3322
|
+
* </li>
|
|
3323
|
+
* <li>
|
|
3324
|
+
* <p>The only Unicode characters that are permitted in a key policy document are the horizontal tab (U+0009), linefeed (U+000A), carriage return (U+000D), and characters in the range U+0020 to U+00FF.</p>
|
|
3325
|
+
* </li>
|
|
3326
|
+
* <li>
|
|
3327
|
+
* <p>The <code>Sid</code> element in a key policy statement can include spaces. (Spaces are
|
|
3328
|
+
* prohibited in the <code>Sid</code> element of an IAM policy document.)</p>
|
|
3329
|
+
* </li>
|
|
3330
|
+
* </ul>
|
|
3302
3331
|
*/
|
|
3303
3332
|
Policy: string | undefined;
|
|
3304
3333
|
/**
|
|
@@ -3342,9 +3371,9 @@ export interface ReEncryptRequest {
|
|
|
3342
3371
|
* re-encrypted.</p>
|
|
3343
3372
|
* <p>Enter a key ID of the KMS key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>ReEncrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
|
|
3344
3373
|
* <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS
|
|
3345
|
-
* key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that
|
|
3346
|
-
*
|
|
3347
|
-
* practice
|
|
3374
|
+
* key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to
|
|
3375
|
+
* the symmetric ciphertext blob. However, it is always recommended as a best practice. This
|
|
3376
|
+
* practice ensures that you use the KMS key that you intend.</p>
|
|
3348
3377
|
*
|
|
3349
3378
|
* <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
|
|
3350
3379
|
* <p>For example:</p>
|
|
@@ -3538,8 +3567,23 @@ export interface ReplicateKeyRequest {
|
|
|
3538
3567
|
* <i>Identity and Access Management User Guide</i>
|
|
3539
3568
|
* </i>.</p>
|
|
3540
3569
|
* </li>
|
|
3570
|
+
* </ul>
|
|
3571
|
+
*
|
|
3572
|
+
*
|
|
3573
|
+
* <p>A key policy document must conform to the following rules.</p>
|
|
3574
|
+
* <ul>
|
|
3575
|
+
* <li>
|
|
3576
|
+
* <p>Up to 32 kilobytes (32768 bytes)</p>
|
|
3577
|
+
* </li>
|
|
3541
3578
|
* <li>
|
|
3542
|
-
* <p>
|
|
3579
|
+
* <p>Must be UTF-8 encoded</p>
|
|
3580
|
+
* </li>
|
|
3581
|
+
* <li>
|
|
3582
|
+
* <p>The only Unicode characters that are permitted in a key policy document are the horizontal tab (U+0009), linefeed (U+000A), carriage return (U+000D), and characters in the range U+0020 to U+00FF.</p>
|
|
3583
|
+
* </li>
|
|
3584
|
+
* <li>
|
|
3585
|
+
* <p>The <code>Sid</code> element in a key policy statement can include spaces. (Spaces are
|
|
3586
|
+
* prohibited in the <code>Sid</code> element of an IAM policy document.)</p>
|
|
3543
3587
|
* </li>
|
|
3544
3588
|
* </ul>
|
|
3545
3589
|
*/
|
|
@@ -3702,7 +3746,7 @@ export interface ScheduleKeyDeletionRequest {
|
|
|
3702
3746
|
/**
|
|
3703
3747
|
* <p>The waiting period, specified in number of days. After the waiting period ends, KMS
|
|
3704
3748
|
* deletes the KMS key.</p>
|
|
3705
|
-
* <p>If the KMS key is a multi-Region primary key with
|
|
3749
|
+
* <p>If the KMS key is a multi-Region primary key with replica keys, the waiting period begins when
|
|
3706
3750
|
* the last of its replica keys is deleted. Otherwise, the waiting period begins
|
|
3707
3751
|
* immediately.</p>
|
|
3708
3752
|
* <p>This value is optional. If you include a value, it must be between 7 and 30, inclusive. If
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@aws-sdk/client-kms",
|
|
3
3
|
"description": "AWS SDK for JavaScript Kms Client for Node.js, Browser and React Native",
|
|
4
|
-
"version": "3.
|
|
4
|
+
"version": "3.94.0",
|
|
5
5
|
"scripts": {
|
|
6
6
|
"build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
|
|
7
7
|
"build:cjs": "tsc -p tsconfig.cjs.json",
|
|
@@ -18,9 +18,9 @@
|
|
|
18
18
|
"dependencies": {
|
|
19
19
|
"@aws-crypto/sha256-browser": "2.0.0",
|
|
20
20
|
"@aws-crypto/sha256-js": "2.0.0",
|
|
21
|
-
"@aws-sdk/client-sts": "3.
|
|
21
|
+
"@aws-sdk/client-sts": "3.94.0",
|
|
22
22
|
"@aws-sdk/config-resolver": "3.80.0",
|
|
23
|
-
"@aws-sdk/credential-provider-node": "3.
|
|
23
|
+
"@aws-sdk/credential-provider-node": "3.94.0",
|
|
24
24
|
"@aws-sdk/fetch-http-handler": "3.78.0",
|
|
25
25
|
"@aws-sdk/hash-node": "3.78.0",
|
|
26
26
|
"@aws-sdk/invalid-dependency": "3.78.0",
|
|
@@ -33,7 +33,7 @@
|
|
|
33
33
|
"@aws-sdk/middleware-stack": "3.78.0",
|
|
34
34
|
"@aws-sdk/middleware-user-agent": "3.78.0",
|
|
35
35
|
"@aws-sdk/node-config-provider": "3.80.0",
|
|
36
|
-
"@aws-sdk/node-http-handler": "3.
|
|
36
|
+
"@aws-sdk/node-http-handler": "3.94.0",
|
|
37
37
|
"@aws-sdk/protocol-http": "3.78.0",
|
|
38
38
|
"@aws-sdk/smithy-client": "3.85.0",
|
|
39
39
|
"@aws-sdk/types": "3.78.0",
|