@jjrawlins/cdk-ami-builder 0.0.65 → 0.0.67

package/node_modules/@aws-sdk/client-kms/dist-types/models/models_0.d.ts

@@ -662,6 +662,13 @@ export interface CreateCustomKeyStoreRequest {
      * @public
      */
     XksProxyVpcEndpointServiceName?: string | undefined;
+    /**
+     * <p>Specifies the Amazon Web Services account ID that owns the Amazon VPC service endpoint for the interface that
+     *       is used to communicate with your external key store proxy (XKS proxy). This parameter is
+     *       optional. If not provided, the Amazon Web Services account ID calling the action will be used.</p>
+     * @public
+     */
+    XksProxyVpcEndpointServiceOwner?: string | undefined;
     /**
      * <p>Specifies an authentication credential for the external key store proxy (XKS proxy). This
      *       parameter is required for all custom key stores with a <code>CustomKeyStoreType</code> of
@@ -1144,6 +1151,7 @@ export type CustomerMasterKeySpec = (typeof CustomerMasterKeySpec)[keyof typeof
  * @enum
  */
 export declare const KeySpec: {
+    readonly ECC_NIST_EDWARDS25519: "ECC_NIST_EDWARDS25519";
     readonly ECC_NIST_P256: "ECC_NIST_P256";
     readonly ECC_NIST_P384: "ECC_NIST_P384";
     readonly ECC_NIST_P521: "ECC_NIST_P521";
@@ -1292,7 +1300,7 @@ export interface CreateKeyRequest {
      *             <code>SIGN_VERIFY</code>.</p>
      *             </li>
      *             <li>
-     *                <p>For asymmetric KMS keys with NIST-recommended elliptic curve key pairs, specify
+     *                <p>For asymmetric KMS keys with NIST-standard elliptic curve key pairs, specify
      *             <code>SIGN_VERIFY</code> or <code>KEY_AGREEMENT</code>.</p>
      *             </li>
      *             <li>
@@ -1402,7 +1410,7 @@ export interface CreateKeyRequest {
      *                </ul>
      *             </li>
      *             <li>
-     *                <p>Asymmetric NIST-recommended elliptic curve key pairs (signing and verification -or-
+     *                <p>Asymmetric NIST-standard elliptic curve key pairs (signing and verification -or-
      *           deriving shared secrets)</p>
      *                <ul>
      *                   <li>
@@ -1417,6 +1425,21 @@ export interface CreateKeyRequest {
      *                      <p>
      *                         <code>ECC_NIST_P521</code> (secp521r1)</p>
      *                   </li>
+     *                   <li>
+     *                      <p>
+     *                         <code>ECC_NIST_EDWARDS25519</code> (ed25519) - signing and verification only</p>
+     *                      <ul>
+     *                         <li>
+     *                            <p>
+     *                               <b>Note:</b> For ECC_NIST_EDWARDS25519 KMS keys, the
+     *                           ED25519_SHA_512 signing algorithm requires <a href="kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType">
+     *                                  <code>MessageType:RAW</code>
+     *                               </a>, while ED25519_PH_SHA_512 requires <a href="kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType">
+     *                                  <code>MessageType:DIGEST</code>
+     *                               </a>. These message types cannot be used interchangeably.</p>
+     *                         </li>
+     *                      </ul>
+     *                   </li>
      *                </ul>
      *             </li>
      *             <li>
@@ -1719,6 +1742,8 @@ export declare const SigningAlgorithmSpec: {
     readonly ECDSA_SHA_256: "ECDSA_SHA_256";
     readonly ECDSA_SHA_384: "ECDSA_SHA_384";
     readonly ECDSA_SHA_512: "ECDSA_SHA_512";
+    readonly ED25519_PH_SHA_512: "ED25519_PH_SHA_512";
+    readonly ED25519_SHA_512: "ED25519_SHA_512";
     readonly ML_DSA_SHAKE_256: "ML_DSA_SHAKE_256";
     readonly RSASSA_PKCS1_V1_5_SHA_256: "RSASSA_PKCS1_V1_5_SHA_256";
     readonly RSASSA_PKCS1_V1_5_SHA_384: "RSASSA_PKCS1_V1_5_SHA_384";
@@ -2117,6 +2142,13 @@ export interface XksProxyConfigurationType {
      * @public
      */
     VpcEndpointServiceName?: string | undefined;
+    /**
+     * <p>The Amazon Web Services account ID that owns the Amazon VPC endpoint service used to communicate with the
+     *       external key store proxy (XKS). This field appears only when the XKS uses an VPC endpoint
+     *       service to communicate with KMS.</p>
+     * @public
+     */
+    VpcEndpointServiceOwner?: string | undefined;
 }
 /**
  * <p>Contains information about each custom key store in the custom key store list.</p>
@@ -2387,6 +2419,7 @@ export interface CustomKeyStoresListEntry {
  * @enum
  */
 export declare const DataKeyPairSpec: {
+    readonly ECC_NIST_EDWARDS25519: "ECC_NIST_EDWARDS25519";
     readonly ECC_NIST_P256: "ECC_NIST_P256";
     readonly ECC_NIST_P384: "ECC_NIST_P384";
     readonly ECC_NIST_P521: "ECC_NIST_P521";
@@ -2426,8 +2459,8 @@ export type KeyEncryptionMechanism = (typeof KeyEncryptionMechanism)[keyof typeo
 /**
  * <p>Contains information about the party that receives the response from the API
  *       operation.</p>
- *          <p>This data type is designed to support Amazon Web Services Nitro Enclaves and Amazon Web Services NitroTPM, which lets you create an attested
- *       environment in Amazon EC2. For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
+ *          <p>This data type is designed to support Amazon Web Services Nitro Enclaves and Amazon Web Services NitroTPM,
+ *       which lets you create an attested environment in Amazon EC2. For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
  * @public
  */
 export interface RecipientInfo {
@@ -2439,8 +2472,8 @@ export interface RecipientInfo {
      */
     KeyEncryptionAlgorithm?: KeyEncryptionMechanism | undefined;
     /**
-     * <p>The attestation document for an Amazon Web Services Nitro Enclave or a NitroTPM. This document includes the enclave's
-     *       public key.</p>
+     * <p>The attestation document for an Amazon Web Services Nitro Enclave or a NitroTPM. This document includes
+     *       the enclave's public key.</p>
      * @public
      */
     AttestationDocument?: Uint8Array | undefined;
@@ -2517,16 +2550,16 @@ export interface DecryptRequest {
     EncryptionAlgorithm?: EncryptionAlgorithmSpec | undefined;
     /**
      * <p>A signed <a href="https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave-concepts.html#term-attestdoc">attestation
-     *         document</a> from an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the
-     *       public key in the attestation document. The only valid encryption algorithm is <code>RSAES_OAEP_SHA_256</code>. </p>
-     *          <p>This parameter supports the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK for Amazon Web Services Nitro Enclaves. It supports
-     *       any Amazon Web Services SDK for Amazon Web Services NitroTPM.
-     *     </p>
+     *         document</a> from an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to
+     *       use with the public key in the attestation document. The only valid encryption algorithm is
+     *         <code>RSAES_OAEP_SHA_256</code>. </p>
+     *          <p>This parameter supports the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK for
+     *       Amazon Web Services Nitro Enclaves. It supports any Amazon Web Services SDK for Amazon Web Services NitroTPM. </p>
      *          <p>When you use this parameter, instead of returning the plaintext data, KMS encrypts the
      *       plaintext data with the public key in the attestation document, and returns the resulting
      *       ciphertext in the <code>CiphertextForRecipient</code> field in the response. This ciphertext
-     *       can be decrypted only with the private key in the attested environment. The <code>Plaintext</code> field in
-     *       the response is null or empty.</p>
+     *       can be decrypted only with the private key in the attested environment. The
+     *         <code>Plaintext</code> field in the response is null or empty.</p>
      *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
@@ -2731,7 +2764,7 @@ export interface DeleteImportedKeyMaterialResponse {
  */
 export interface DeriveSharedSecretRequest {
     /**
-     * <p>Identifies an asymmetric NIST-recommended ECC or SM2 (China Regions only) KMS key. KMS
+     * <p>Identifies an asymmetric NIST-standard ECC or SM2 (China Regions only) KMS key. KMS
      *       uses the private key in the specified key pair to derive the shared secret. The key usage of
      *       the KMS key must be <code>KEY_AGREEMENT</code>. To find the <code>KeyUsage</code> of a KMS
      *       key, use the <a>DescribeKey</a> operation.</p>
@@ -2766,7 +2799,7 @@ export interface DeriveSharedSecretRequest {
      */
     KeyAgreementAlgorithm: KeyAgreementAlgorithmSpec | undefined;
     /**
-     * <p>Specifies the public key in your peer's NIST-recommended elliptic curve (ECC) or SM2
+     * <p>Specifies the public key in your peer's NIST-standard elliptic curve (ECC) or SM2
      *       (China Regions only) key pair.</p>
      *          <p>The public key must be a DER-encoded X.509 public key, also known as
      *         <code>SubjectPublicKeyInfo</code> (SPKI), as defined in <a href="https://tools.ietf.org/html/rfc5280">RFC 5280</a>.</p>
@@ -2798,20 +2831,22 @@ export interface DeriveSharedSecretRequest {
     DryRun?: boolean | undefined;
     /**
      * <p>A signed <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc">attestation document</a> from
-     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in the attestation document. The
-     *       only valid encryption algorithm is <code>RSAES_OAEP_SHA_256</code>. </p>
-     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM. To call
-     *       DeriveSharedSecret generate an attestation document use either <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> for an Amazon Web Services Nitro Enclaves or
-     *       <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attestation-get-doc.html">Amazon Web Services NitroTPM tools</a> for Amazon Web Services NitroTPM. Then use the Recipient parameter from any Amazon Web Services SDK to provide the
+     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in
+     *       the attestation document. The only valid encryption algorithm is
+     *         <code>RSAES_OAEP_SHA_256</code>. </p>
+     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves or
+     *       Amazon Web Services NitroTPM. To call DeriveSharedSecret generate an attestation document use either
+     *       <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> for an Amazon Web Services Nitro Enclaves or <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attestation-get-doc.html">Amazon Web Services NitroTPM tools</a> for
+     *       Amazon Web Services NitroTPM. Then use the Recipient parameter from any Amazon Web Services SDK to provide the
      *       attestation document for the attested environment.</p>
      *          <p>When you use this parameter, instead of returning a plaintext copy of the shared secret,
      *       KMS encrypts the plaintext shared secret under the public key in the attestation document,
      *       and returns the resulting ciphertext in the <code>CiphertextForRecipient</code> field in the
-     *       response. This ciphertext can be decrypted only with the private key in the attested environment. The
-     *         <code>CiphertextBlob</code> field in the response contains the encrypted shared secret
-     *       derived from the KMS key specified by the <code>KeyId</code> parameter and public key
-     *       specified by the <code>PublicKey</code> parameter. The <code>SharedSecret</code> field in the
-     *       response is null or empty.</p>
+     *       response. This ciphertext can be decrypted only with the private key in the attested
+     *       environment. The <code>CiphertextBlob</code> field in the response contains the encrypted
+     *       shared secret derived from the KMS key specified by the <code>KeyId</code> parameter and
+     *       public key specified by the <code>PublicKey</code> parameter. The <code>SharedSecret</code>
+     *       field in the response is null or empty.</p>
      *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
@@ -2835,8 +2870,8 @@ export interface DeriveSharedSecretResponse {
      */
     SharedSecret?: Uint8Array | undefined;
     /**
-     * <p>The plaintext shared secret encrypted with the public key from the attestation document. This
-     *       ciphertext can be decrypted only by using a private key from the attested environment. </p>
+     * <p>The plaintext shared secret encrypted with the public key from the attestation document.
+     *       This ciphertext can be decrypted only by using a private key from the attested environment. </p>
      *          <p>This field is included in the response only when the <code>Recipient</code> parameter in
      *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave or NitroTPM.
      *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
@@ -3290,11 +3325,11 @@ export interface GenerateDataKeyRequest {
     GrantTokens?: string[] | undefined;
     /**
      * <p>A signed <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc">attestation document</a> from
-     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in the attestation document. The
-     *       only valid encryption algorithm is <code>RSAES_OAEP_SHA_256</code>. </p>
-     *          <p>This parameter supports the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK for Amazon Web Services Nitro Enclaves. It supports
-     *       any Amazon Web Services SDK for Amazon Web Services NitroTPM.
-     *     </p>
+     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in
+     *       the attestation document. The only valid encryption algorithm is
+     *         <code>RSAES_OAEP_SHA_256</code>. </p>
+     *          <p>This parameter supports the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK for
+     *       Amazon Web Services Nitro Enclaves. It supports any Amazon Web Services SDK for Amazon Web Services NitroTPM. </p>
      *          <p>When you use this parameter, instead of returning the plaintext data key, KMS encrypts
      *       the plaintext data key under the public key in the attestation document, and returns the
      *       resulting ciphertext in the <code>CiphertextForRecipient</code> field in the response. This
@@ -3412,19 +3447,21 @@ export interface GenerateDataKeyPairRequest {
     GrantTokens?: string[] | undefined;
     /**
      * <p>A signed <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc">attestation document</a> from
-     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in the attestation document. The
-     *       only valid encryption algorithm is <code>RSAES_OAEP_SHA_256</code>. </p>
-     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM. To call
-     *       GenerateDataKeyPair generate an attestation document use either <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> for an Amazon Web Services Nitro Enclaves or
-     *       <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attestation-get-doc.html">Amazon Web Services NitroTPM tools</a> for Amazon Web Services NitroTPM. Then use the Recipient parameter from any Amazon Web Services SDK to provide the
+     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in
+     *       the attestation document. The only valid encryption algorithm is
+     *         <code>RSAES_OAEP_SHA_256</code>. </p>
+     *          <p>This parameter only supports attestation documents for Amazon Web Services Nitro Enclaves or
+     *       Amazon Web Services NitroTPM. To call GenerateDataKeyPair generate an attestation document use either
+     *       <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> for an Amazon Web Services Nitro Enclaves or <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/attestation-get-doc.html">Amazon Web Services NitroTPM tools</a> for
+     *       Amazon Web Services NitroTPM. Then use the Recipient parameter from any Amazon Web Services SDK to provide the
      *       attestation document for the attested environment.</p>
      *          <p>When you use this parameter, instead of returning a plaintext copy of the private data
      *       key, KMS encrypts the plaintext private data key under the public key in the attestation
      *       document, and returns the resulting ciphertext in the <code>CiphertextForRecipient</code>
      *       field in the response. This ciphertext can be decrypted only with the private key in the
-     *       attested environment. The <code>CiphertextBlob</code> field in the response contains a copy of the private
-     *       data key encrypted under the KMS key specified by the <code>KeyId</code> parameter. The
-     *         <code>PrivateKeyPlaintext</code> field in the response is null or empty.</p>
+     *       attested environment. The <code>CiphertextBlob</code> field in the response contains a copy of
+     *       the private data key encrypted under the KMS key specified by the <code>KeyId</code>
+     *       parameter. The <code>PrivateKeyPlaintext</code> field in the response is null or empty.</p>
      *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
@@ -3468,8 +3505,9 @@ export interface GenerateDataKeyPairResponse {
      */
     KeyPairSpec?: DataKeyPairSpec | undefined;
     /**
-     * <p>The plaintext private data key encrypted with the public key from the attestation document. This
-     *       ciphertext can be decrypted only by using a private key from the attested environment. </p>
+     * <p>The plaintext private data key encrypted with the public key from the attestation
+     *       document. This ciphertext can be decrypted only by using a private key from the attested
+     *       environment. </p>
      *          <p>This field is included in the response only when the <code>Recipient</code> parameter in
      *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave or NitroTPM.
      *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
@@ -3755,16 +3793,16 @@ export interface GenerateRandomRequest {
     CustomKeyStoreId?: string | undefined;
     /**
      * <p>A signed <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc">attestation document</a> from
-     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in the attestation document. The
-     *       only valid encryption algorithm is <code>RSAES_OAEP_SHA_256</code>. </p>
-     *          <p>This parameter supports the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK for Amazon Web Services Nitro Enclaves. It supports
-     *       any Amazon Web Services SDK for Amazon Web Services NitroTPM.
-     *     </p>
+     *       an Amazon Web Services Nitro enclave or NitroTPM, and the encryption algorithm to use with the public key in
+     *       the attestation document. The only valid encryption algorithm is
+     *         <code>RSAES_OAEP_SHA_256</code>. </p>
+     *          <p>This parameter supports the <a href="https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk">Amazon Web Services Nitro Enclaves SDK</a> or any Amazon Web Services SDK for
+     *       Amazon Web Services Nitro Enclaves. It supports any Amazon Web Services SDK for Amazon Web Services NitroTPM. </p>
      *          <p>When you use this parameter, instead of returning plaintext bytes, KMS encrypts the
      *       plaintext bytes under the public key in the attestation document, and returns the resulting
      *       ciphertext in the <code>CiphertextForRecipient</code> field in the response. This ciphertext
-     *       can be decrypted only with the private key in the attested environment. The <code>Plaintext</code> field in
-     *       the response is null or empty.</p>
+     *       can be decrypted only with the private key in the attested environment. The
+     *         <code>Plaintext</code> field in the response is null or empty.</p>
      *          <p>For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
      * @public
      */
@@ -3782,8 +3820,8 @@ export interface GenerateRandomResponse {
      */
     Plaintext?: Uint8Array | undefined;
     /**
-     * <p>The plaintext random bytes encrypted with the public key from the attestation document. This
-     *       ciphertext can be decrypted only by using a private key from the attested environment. </p>
+     * <p>The plaintext random bytes encrypted with the public key from the attestation document.
+     *       This ciphertext can be decrypted only by using a private key from the attested environment. </p>
      *          <p>This field is included in the response only when the <code>Recipient</code> parameter in
      *       the request includes a valid attestation document from an Amazon Web Services Nitro enclave or NitroTPM.
      *       For information about the interaction between KMS and Amazon Web Services Nitro Enclaves or Amazon Web Services NitroTPM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/cryptographic-attestation.html">Cryptographic attestation support in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
@@ -5628,6 +5666,17 @@ export interface SignRequest {
      *         value with an unhashed message, the security of the signing operation can be
      *         compromised.</p>
      *          </important>
+     *          <p>When using ECC_NIST_EDWARDS25519 KMS keys:</p>
+     *          <ul>
+     *             <li>
+     *                <p>ED25519_SHA_512 signing algorithm requires KMS <code>MessageType:RAW</code>
+     *                </p>
+     *             </li>
+     *             <li>
+     *                <p>ED25519_PH_SHA_512 signing algorithm requires KMS <code>MessageType:DIGEST</code>
+     *                </p>
+     *             </li>
+     *          </ul>
      *          <p>When the value of <code>MessageType</code> is <code>DIGEST</code>, the length of the
      *         <code>Message</code> value must match the length of hashed messages for the specified
      *       signing algorithm.</p>
@@ -5903,6 +5952,14 @@ export interface UpdateCustomKeyStoreRequest {
      * @public
      */
     XksProxyVpcEndpointServiceName?: string | undefined;
+    /**
+     * <p>Changes the Amazon Web Services account ID that KMS uses to identify the Amazon VPC endpoint service for
+     *       your external key store proxy (XKS proxy). This parameter is optional. If not specified, the current
+     *       Amazon Web Services account ID for the VPC endpoint service will not be updated.</p>
+     *          <p>To change this value, the external key store must be disconnected.</p>
+     * @public
+     */
+    XksProxyVpcEndpointServiceOwner?: string | undefined;
     /**
      * <p>Changes the credentials that KMS uses to sign requests to the external key store proxy
      *       (XKS proxy). This parameter is valid only for custom key stores with a
@@ -6060,6 +6117,17 @@ export interface VerifyRequest {
      *         value with an unhashed message, the security of the signing operation can be
      *         compromised.</p>
      *          </important>
+     *          <p>When using ECC_NIST_EDWARDS25519 KMS keys:</p>
+     *          <ul>
+     *             <li>
+     *                <p>ED25519_SHA_512 signing algorithm requires KMS <code>MessageType:RAW</code>
+     *                </p>
+     *             </li>
+     *             <li>
+     *                <p>ED25519_PH_SHA_512 signing algorithm requires KMS <code>MessageType:DIGEST</code>
+     *                </p>
+     *             </li>
+     *          </ul>
      *          <p>When the value of <code>MessageType</code> is <code>DIGEST</code>, the length of the
      *         <code>Message</code> value must match the length of hashed messages for the specified
      *       signing algorithm.</p>

package/node_modules/@aws-sdk/client-kms/dist-types/runtimeConfig.d.ts

@@ -8,7 +8,7 @@ export declare const getRuntimeConfig: (config: KMSClientConfig) => {
     defaultsMode: import("@smithy/types").Provider<import("@smithy/smithy-client").ResolvedDefaultsMode>;
     authSchemePreference: string[] | import("@smithy/types").Provider<string[]>;
     bodyLengthChecker: import("@smithy/types").BodyLengthCalculator;
-    credentialDefaultProvider: ((input: any) => import("@smithy/types").AwsCredentialIdentityProvider) | ((init?: import("@aws-sdk/credential-provider-node").DefaultProviderInit) => import("@smithy/types").MemoizedProvider<import("@smithy/types").AwsCredentialIdentity>);
+    credentialDefaultProvider: ((input: any) => import("@smithy/types").AwsCredentialIdentityProvider) | ((init?: import("@aws-sdk/credential-provider-node").DefaultProviderInit) => import("@aws-sdk/credential-provider-node/dist-types/runtime/memoize-chain").MemoizedRuntimeConfigAwsCredentialIdentityProvider);
     defaultUserAgentProvider: (config?: import("@aws-sdk/util-user-agent-node").PreviouslyResolved) => Promise<import("@smithy/types").UserAgent>;
     maxAttempts: number | import("@smithy/types").Provider<number>;
     region: string | import("@smithy/types").Provider<string>;

package/node_modules/@aws-sdk/client-kms/dist-types/ts3.4/models/models_0.d.ts

@@ -212,6 +212,7 @@ export interface CreateCustomKeyStoreRequest {
   XksProxyUriEndpoint?: string | undefined;
   XksProxyUriPath?: string | undefined;
   XksProxyVpcEndpointServiceName?: string | undefined;
+  XksProxyVpcEndpointServiceOwner?: string | undefined;
   XksProxyAuthenticationCredential?:
     | XksProxyAuthenticationCredentialType
     | undefined;
@@ -400,6 +401,7 @@ export declare const CustomerMasterKeySpec: {
 export type CustomerMasterKeySpec =
   (typeof CustomerMasterKeySpec)[keyof typeof CustomerMasterKeySpec];
 export declare const KeySpec: {
+  readonly ECC_NIST_EDWARDS25519: "ECC_NIST_EDWARDS25519";
   readonly ECC_NIST_P256: "ECC_NIST_P256";
   readonly ECC_NIST_P384: "ECC_NIST_P384";
   readonly ECC_NIST_P521: "ECC_NIST_P521";
@@ -512,6 +514,8 @@ export declare const SigningAlgorithmSpec: {
   readonly ECDSA_SHA_256: "ECDSA_SHA_256";
   readonly ECDSA_SHA_384: "ECDSA_SHA_384";
   readonly ECDSA_SHA_512: "ECDSA_SHA_512";
+  readonly ED25519_PH_SHA_512: "ED25519_PH_SHA_512";
+  readonly ED25519_SHA_512: "ED25519_SHA_512";
   readonly ML_DSA_SHAKE_256: "ML_DSA_SHAKE_256";
   readonly RSASSA_PKCS1_V1_5_SHA_256: "RSASSA_PKCS1_V1_5_SHA_256";
   readonly RSASSA_PKCS1_V1_5_SHA_384: "RSASSA_PKCS1_V1_5_SHA_384";
@@ -616,6 +620,7 @@ export interface XksProxyConfigurationType {
   UriEndpoint?: string | undefined;
   UriPath?: string | undefined;
   VpcEndpointServiceName?: string | undefined;
+  VpcEndpointServiceOwner?: string | undefined;
 }
 export interface CustomKeyStoresListEntry {
   CustomKeyStoreId?: string | undefined;
@@ -629,6 +634,7 @@ export interface CustomKeyStoresListEntry {
   XksProxyConfiguration?: XksProxyConfigurationType | undefined;
 }
 export declare const DataKeyPairSpec: {
+  readonly ECC_NIST_EDWARDS25519: "ECC_NIST_EDWARDS25519";
   readonly ECC_NIST_P256: "ECC_NIST_P256";
   readonly ECC_NIST_P384: "ECC_NIST_P384";
   readonly ECC_NIST_P521: "ECC_NIST_P521";
@@ -1197,6 +1203,7 @@ export interface UpdateCustomKeyStoreRequest {
   XksProxyUriEndpoint?: string | undefined;
   XksProxyUriPath?: string | undefined;
   XksProxyVpcEndpointServiceName?: string | undefined;
+  XksProxyVpcEndpointServiceOwner?: string | undefined;
   XksProxyAuthenticationCredential?:
     | XksProxyAuthenticationCredentialType
     | undefined;

package/node_modules/@aws-sdk/client-kms/dist-types/ts3.4/runtimeConfig.d.ts

@@ -11,9 +11,7 @@ export declare const getRuntimeConfig: (config: KMSClientConfig) => {
     | ((input: any) => import("@smithy/types").AwsCredentialIdentityProvider)
     | ((
         init?: import("@aws-sdk/credential-provider-node").DefaultProviderInit
-      ) => import("@smithy/types").MemoizedProvider<
-        import("@smithy/types").AwsCredentialIdentity
-      >);
+      ) => import("@aws-sdk/credential-provider-node/dist-types/runtime/memoize-chain").MemoizedRuntimeConfigAwsCredentialIdentityProvider);
   defaultUserAgentProvider: (
     config?: import("@aws-sdk/util-user-agent-node").PreviouslyResolved
   ) => Promise<import("@smithy/types").UserAgent>;

package/node_modules/@aws-sdk/client-kms/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aws-sdk/client-kms",
   "description": "AWS SDK for JavaScript Kms Client for Node.js, Browser and React Native",
-  "version": "3.919.0",
+  "version": "3.927.0",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
     "build:cjs": "node ../../scripts/compilation/inline client-kms",
@@ -20,41 +20,41 @@
   "dependencies": {
     "@aws-crypto/sha256-browser": "5.2.0",
     "@aws-crypto/sha256-js": "5.2.0",
-    "@aws-sdk/core": "3.916.0",
-    "@aws-sdk/credential-provider-node": "3.919.0",
-    "@aws-sdk/middleware-host-header": "3.914.0",
-    "@aws-sdk/middleware-logger": "3.914.0",
-    "@aws-sdk/middleware-recursion-detection": "3.919.0",
-    "@aws-sdk/middleware-user-agent": "3.916.0",
-    "@aws-sdk/region-config-resolver": "3.914.0",
-    "@aws-sdk/types": "3.914.0",
-    "@aws-sdk/util-endpoints": "3.916.0",
-    "@aws-sdk/util-user-agent-browser": "3.914.0",
-    "@aws-sdk/util-user-agent-node": "3.916.0",
-    "@smithy/config-resolver": "^4.4.0",
-    "@smithy/core": "^3.17.1",
-    "@smithy/fetch-http-handler": "^5.3.4",
-    "@smithy/hash-node": "^4.2.3",
-    "@smithy/invalid-dependency": "^4.2.3",
-    "@smithy/middleware-content-length": "^4.2.3",
-    "@smithy/middleware-endpoint": "^4.3.5",
-    "@smithy/middleware-retry": "^4.4.5",
-    "@smithy/middleware-serde": "^4.2.3",
-    "@smithy/middleware-stack": "^4.2.3",
-    "@smithy/node-config-provider": "^4.3.3",
-    "@smithy/node-http-handler": "^4.4.3",
-    "@smithy/protocol-http": "^5.3.3",
-    "@smithy/smithy-client": "^4.9.1",
-    "@smithy/types": "^4.8.0",
-    "@smithy/url-parser": "^4.2.3",
+    "@aws-sdk/core": "3.927.0",
+    "@aws-sdk/credential-provider-node": "3.927.0",
+    "@aws-sdk/middleware-host-header": "3.922.0",
+    "@aws-sdk/middleware-logger": "3.922.0",
+    "@aws-sdk/middleware-recursion-detection": "3.922.0",
+    "@aws-sdk/middleware-user-agent": "3.927.0",
+    "@aws-sdk/region-config-resolver": "3.925.0",
+    "@aws-sdk/types": "3.922.0",
+    "@aws-sdk/util-endpoints": "3.922.0",
+    "@aws-sdk/util-user-agent-browser": "3.922.0",
+    "@aws-sdk/util-user-agent-node": "3.927.0",
+    "@smithy/config-resolver": "^4.4.2",
+    "@smithy/core": "^3.17.2",
+    "@smithy/fetch-http-handler": "^5.3.5",
+    "@smithy/hash-node": "^4.2.4",
+    "@smithy/invalid-dependency": "^4.2.4",
+    "@smithy/middleware-content-length": "^4.2.4",
+    "@smithy/middleware-endpoint": "^4.3.6",
+    "@smithy/middleware-retry": "^4.4.6",
+    "@smithy/middleware-serde": "^4.2.4",
+    "@smithy/middleware-stack": "^4.2.4",
+    "@smithy/node-config-provider": "^4.3.4",
+    "@smithy/node-http-handler": "^4.4.4",
+    "@smithy/protocol-http": "^5.3.4",
+    "@smithy/smithy-client": "^4.9.2",
+    "@smithy/types": "^4.8.1",
+    "@smithy/url-parser": "^4.2.4",
     "@smithy/util-base64": "^4.3.0",
     "@smithy/util-body-length-browser": "^4.2.0",
     "@smithy/util-body-length-node": "^4.2.1",
-    "@smithy/util-defaults-mode-browser": "^4.3.4",
-    "@smithy/util-defaults-mode-node": "^4.2.6",
-    "@smithy/util-endpoints": "^3.2.3",
-    "@smithy/util-middleware": "^4.2.3",
-    "@smithy/util-retry": "^4.2.3",
+    "@smithy/util-defaults-mode-browser": "^4.3.5",
+    "@smithy/util-defaults-mode-node": "^4.2.8",
+    "@smithy/util-endpoints": "^3.2.4",
+    "@smithy/util-middleware": "^4.2.4",
+    "@smithy/util-retry": "^4.2.4",
     "@smithy/util-utf8": "^4.2.0",
     "tslib": "^2.6.2"
   },