awscli 1.40.17__py3-none-any.whl → 1.44.26__py3-none-any.whl

awscli/examples/kms/create-key.rst

@@ -17,6 +17,7 @@ Output::
             "AWSAccountId": "111122223333",
             "Arn": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
             "CreationDate": "2017-07-05T14:04:55-07:00",
+            "CurrentKeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
             "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
             "Description": "",
             "Enabled": true,
@@ -40,7 +41,7 @@ For more information, see `Creating keys <https://docs.aws.amazon.com/kms/latest
 
 **Example 2: To create an asymmetric RSA KMS key for encryption and decryption**
 
-The following ``create-key`` example creates a KMS key that contains an asymmetric RSA key pair for encryption and decryption. ::
+The following ``create-key`` example creates a KMS key that contains an asymmetric RSA key pair for encryption and decryption. The key spec and key usage can't be changed after the key is created.::
 
     aws kms create-key \
        --key-spec RSA_4096 \
@@ -75,7 +76,7 @@ For more information, see `Asymmetric keys in AWS KMS <https://docs.aws.amazon.c
 
 **Example 3: To create an asymmetric elliptic curve KMS key for signing and verification**
 
-To create an asymmetric KMS key that contains an asymmetric elliptic curve (ECC) key pair for signing and verification. The ``--key-usage`` parameter is required even though ``SIGN_VERIFY`` is the only valid value for ECC KMS keys. ::
+To create an asymmetric KMS key that contains an asymmetric elliptic curve (ECC) key pair for signing and verification. The ``--key-usage`` parameter is required even though ``SIGN_VERIFY`` is the only valid value for ECC KMS keys. The key spec and key usage can't be changed after the key is created.::
 
     aws kms create-key \
         --key-spec ECC_NIST_P521 \
@@ -105,10 +106,43 @@ Output::
     }
 
 
-For more information, see `Asymmetric keys in AWS KMS <https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html>`__ in the *AWS Key Management Service Developer Guide*.   
+For more information, see `Asymmetric keys in AWS KMS <https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html>`__ in the *AWS Key Management Service Developer Guide*.
+
+**Example 4: To create an asymmetric ML-DSA KMS key for signing and verification**
+
+This example creates a module-lattice digital signature algorithm (ML-DSA) key for signing and verification. The key-usage parameter is required even though ``SIGN_VERIFY`` is the only valid value for ML-DSA keys. ::
+
+    aws kms create-key \
+        --key-spec ML_DSA_65 \
+        --key-usage SIGN_VERIFY
+
+Output::
+
+    {
+        "KeyMetadata": {
+            "Arn": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+            "AWSAccountId": "111122223333",
+            "CreationDate": "2019-12-02T07:48:55-07:00",
+            "Description": "",
+            "Enabled": true,
+            "KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
+            "KeyManager": "CUSTOMER",
+            "KeySpec": "ML_DSA_65",
+            "KeyState": "Enabled",
+            "KeyUsage": "SIGN_VERIFY",
+            "MultiRegion": false,
+            "Origin": "AWS_KMS",
+            "SigningAlgorithms": [
+                "ML_DSA_SHAKE_256"
+            ]
+        }
+    }
+
+
+For more information, see `Asymmetric keys in AWS KMS <https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html>`__ in the *AWS Key Management Service Developer Guide*.
 
 
-**Example 4: To create an HMAC KMS key**
+**Example 5: To create an HMAC KMS key**
 
 The following ``create-key`` example creates a 384-bit HMAC KMS key. The ``GENERATE_VERIFY_MAC`` value for the ``--key-usage`` parameter is required even though it's the only valid value for HMAC KMS keys. ::
 
@@ -142,7 +176,7 @@ Output::
 For more information, see `HMAC keys in AWS KMS <https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html>`__ in the *AWS Key Management Service Developer Guide*.  
 
 
-**Example 4: To create a multi-Region primary KMS key**
+**Example 6: To create a multi-Region primary KMS key**
 
 The following ``create-key`` example creates a multi-Region primary symmetric encryption key. Because the default values for all parameters create a symmetric encryption key, only the ``--multi-region`` parameter is required for this KMS key. In the AWS CLI, to indicate that a Boolean parameter is true, just specify the parameter name. ::
 
@@ -156,6 +190,7 @@ Output::
             "Arn": "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef12345678990ab",
             "AWSAccountId": "111122223333",
             "CreationDate": "2021-09-02T016:15:21-09:00",
+            "CurrentKeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
             "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
             "Description": "",
             "Enabled": true,
@@ -183,7 +218,7 @@ Output::
 For more information, see `Asymmetric keys in AWS KMS <https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html>`__ in the *AWS Key Management Service Developer Guide*.  
 
 
-**Example 5: To create a KMS key for imported key material**
+**Example 7: To create a KMS key for imported key material**
 
 The following ``create-key`` example creates a creates a KMS key with no key material. When the operation is complete, you can import your own key material into the KMS key. To create this KMS key, set the ``--origin`` parameter to ``EXTERNAL``. ::
 
@@ -253,7 +288,7 @@ Output::
 For more information, see `AWS CloudHSM key stores <https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html>`__ in the *AWS Key Management Service Developer Guide*. 
 
 
-**Example 7: To create a KMS key in an external key store**
+**Example 8: To create a KMS key in an external key store**
 
 The following ``create-key`` example creates a creates a KMS key in the specified external key store. The ``--custom-key-store-id``, ``--origin``, and ``--xks-key-id`` parameters are required in this command. 
 

awscli/examples/kms/delete-imported-key-material.rst

@@ -5,6 +5,12 @@ The following ``delete-imported-key-material`` example deletes key material that
     aws kms delete-imported-key-material \
        --key-id 1234abcd-12ab-34cd-56ef-1234567890ab
 
-This command produces no output. To verify that the key material is deleted, use the ``describe-key`` command to look for a key state of ``PendingImport`` or ``PendingDeletion``.
 
-For more information, see `Deleting imported key material<https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-delete-key-material.html>`__ in the *AWS Key Management Service Developer Guide*.
+Output::
+
+    {
+        "KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
+        "KeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6"
+    }
+
+For more information, see `Deleting imported key material <https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-delete-key-material.html>`__ in the *AWS Key Management Service Developer Guide*.

awscli/examples/kms/describe-key.rst

@@ -14,6 +14,7 @@ Output::
             "AWSAccountId": "846764612917",
             "KeyId": "b8a9477d-836c-491f-857e-07937918959b",
             "Arn": "arn:aws:kms:us-west-2:846764612917:key/b8a9477d-836c-491f-857e-07937918959b",
+            "CurrentKeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
             "CreationDate": 2017-06-30T21:44:32.140000+00:00,
             "Enabled": true,
             "Description": "Default KMS key that protects my S3 objects when no other key is defined",
@@ -80,6 +81,7 @@ Output::
             "AWSAccountId": "111122223333",
             "Arn": "arn:aws:kms:ap-northeast-1:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab",
             "CreationDate": "2021-06-28T21:09:16.114000+00:00",
+            "CurrentKeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
             "Description": "",
             "Enabled": true,
             "KeyId": "mrk-1234abcd12ab34cd56ef1234567890ab",

awscli/examples/kms/disable-key.rst

@@ -1,6 +1,6 @@
 **To temporarily disable a KMS key**
 
-The following example uses the ``disable-key`` command to disable a customer managed KMS key. To re-enable the KMS key, use the ``enable-key`` command. ::
+The following ``disable-key`` command disables a customer managed KMS key. To re-enable the KMS key, use the ``enable-key`` command. ::
 
     aws kms disable-key \
         --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

awscli/examples/kms/generate-data-key-pair-without-plaintext.rst

@@ -20,6 +20,7 @@ Output::
         "PrivateKeyCiphertextBlob": "AQIDAHi6LtupRpdKl2aJTzkK6FbhOtQkMlQJJH3PdtHvS/y+hAFFxmiD134doUDzMGmfCEtcAAAHaTCCB2UGCSqGSIb3DQEHBqCCB1...",
         "PublicKey": "MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA3A3eGMyPrvSn7+LdlJE1oUoQV5HpEuHAVbdOyND+NmYDH/mL1OSIEuLrcdZ5hrMH4pk83r40l...",
         "KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+        "KeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
         "KeyPairSpec": "ECC_NIST_P384"
     }
 

awscli/examples/kms/generate-data-key-pair.rst

@@ -19,6 +19,7 @@ Output::
         "PrivateKeyPlaintext": "MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDcDd4YzI+u9Kfv4t2UkTWhShBXkekS4cBVt07I0P42ZgMf+YvU5IgS4ut...",
         "PublicKey": "MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA3A3eGMyPrvSn7+LdlJE1oUoQV5HpEuHAVbdOyND+NmYDH/mL1OSIEuLrcdZ5hrMH4pk83r40l...",
         "KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+        "KeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6"
         "KeyPairSpec": "RSA_2048"
     }
 

awscli/examples/kms/generate-data-key-without-plaintext.rst

@@ -14,7 +14,8 @@ Output::
 
     {
         "CiphertextBlob": "AQEDAHjRYf5WytIc0C857tFSnBaPn2F8DgfmThbJlGfR8P3WlwAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDEFogL",
-        "KeyId": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
+        "KeyId": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+        "KeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6"
     }
 
 The ``CiphertextBlob`` (encrypted data key) is returned in base64-encoded format. 

awscli/examples/kms/generate-data-key.rst

@@ -15,13 +15,13 @@ Output::
     {
         "Plaintext": "VdzKNHGzUAzJeRBVY+uUmofUGGiDzyB3+i9fVkh3piw=",
         "KeyId": "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+        "KeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6",
         "CiphertextBlob": "AQEDAHjRYf5WytIc0C857tFSnBaPn2F8DgfmThbJlGfR8P3WlwAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDEFogLqPWZconQhwHAIBEIA7d9AC7GeJJM34njQvg4Wf1d5sw0NIo1MrBqZa+YdhV8MrkBQPeac0ReRVNDt9qleAt+SHgIRF8P0H+7U="
     }
 
 The ``Plaintext`` (plaintext data key) and the ``CiphertextBlob`` (encrypted data key) are returned in base64-encoded format. 
 
-For more information, see `Data keys <https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-keys`__ in the *AWS Key Management Service Developer Guide*.
- 
+For more information, see `Data keys <https://docs.aws.amazon.com/kms/latest/developerguide/data-keys.html>`__ in the *AWS Key Management Service Developer Guide*.
 **Example 2: To generate a 512-bit symmetric data key**
 
 The following ``generate-data-key`` example requests a 512-bit symmetric data key for encryption and decryption. The command returns a plaintext data key for immediate use and deletion, and a copy of that data key encrypted under the specified KMS key. You can safely store the encrypted data key with the encrypted data. 
@@ -41,9 +41,10 @@ Output::
     {
         "CiphertextBlob": "AQIBAHi6LtupRpdKl2aJTzkK6FbhOtQkMlQJJH3PdtHvS/y+hAEnX/QQNmMwDfg2korNMEc8AAACaDCCAmQGCSqGSIb3DQEHBqCCAlUwggJRAgEAMIICSgYJKoZ...",
         "Plaintext": "ty8Lr0Bk6OF07M2BWt6qbFdNB+G00ZLtf5MSEb4al3R2UKWGOp06njAwy2n72VRm2m7z/Pm9Wpbvttz6a4lSo9hgPvKhZ5y6RTm4OovEXiVfBveyX3DQxDzRSwbKDPk/...",
-        "KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
+        "KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+        "KeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6"
     }
 
 The ``Plaintext`` (plaintext data key) and ``CiphertextBlob`` (encrypted data key) are returned in base64-encoded format. 
 
-For more information, see `Data keys <https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-keys`__ in the *AWS Key Management Service Developer Guide*.
+For more information, see `Data keys <https://docs.aws.amazon.com/kms/latest/developerguide/data-keys.html>`__ in the *AWS Key Management Service Developer Guide*.

awscli/examples/kms/generate-mac.rst

@@ -0,0 +1,45 @@
+**Example 1: To generate an HMAC for a message**
+
+The following ``generate-mac`` command generates an HMAC for a message, an HMAC KMS key, and a MAC algorithm. The algorithm must be supported by the specified HMAC KMS key.
+
+In AWS CLI v2, the value of the ``message`` parameter must be Base64-encoded. Or, you can save the message in a file and use the ``fileb://`` prefix, which tells the AWS CLI to read binary data from the file.
+
+Before running this command, replace the example key ID with a valid key ID from your AWS account. The key ID must represent a HMAC KMS key with a key usage of ``GENERATE_VERIFY_MAC``. ::
+
+    msg=(echo 'Hello World' | base64)
+    
+    aws kms generate-mac \
+        --key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
+        --message fileb://Message \
+        --mac-algorithm HMAC_SHA_384
+
+Output::
+
+    {
+        "KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+        "Mac": "<HMAC_TAG>",
+        "MacAlgorithm": "HMAC_SHA_384"
+    }
+
+For more information about using HMAC KMS keys in AWS KMS, see `HMAC keys in AWS KMS <https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html>`__ in the *AWS Key Management Service Developer Guide*.
+
+**Example 2: To save an HMAC in a file (Linux and macOs)**
+
+The following ``generate-mac``  example generates an HMAC for a short message stored in a local file. The command also gets the ``Mac`` property from the response, Base64-decodes it and saves it in the ExampleMac file. You can use the MAC file in a ``verify-mac`` command that verifies the MAC.
+
+The ``generate-mac`` command requires a Base64-encoded message and a MAC algorithm that your HMAC KMS key supports. To get the MAC algorithms that your KMS key supports, use the ``describe-key`` command.
+
+Before running this command, replace the example key ID with a valid key ID from your AWS account. The key ID must represent an asymmetric KMS key with a key usage of GENERATE_VERIFY_MAC. ::
+
+    echo 'hello world' | base64 > EncodedMessage
+
+    aws kms generate-mac \
+        --key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
+        --message fileb://EncodedMessage \
+        --mac-algorithm HMAC_SHA_384 \
+        --output text \
+        --query Mac | base64 --decode > ExampleMac
+
+This command produces no output. This example extracts the ``Mac`` property of the output and saves it in a file.
+
+For more information about using HMAC KMS keys in AWS KMS, see `HMAC keys in AWS KMS <https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html>`__ in the *AWS Key Management Service Developer Guide*.

awscli/examples/kms/generate-random.rst

@@ -6,7 +6,7 @@ When you run this command, you must use the ``number-of-bytes`` parameter to spe
 
 You don't specify a KMS key when you run this command. The random byte string is unrelated to any KMS key. 
 
-By default, AWS KMS generates the random number. However, if you specify a `custom key store<https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html>`__, the random byte string is generated in the AWS CloudHSM cluster associated with the custom key store.
+By default, AWS KMS generates the random number. However, if you specify a `custom key store <https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html>`__, the random byte string is generated in the AWS CloudHSM cluster associated with the custom key store.
 
 This example uses the following parameters and values:
 

awscli/examples/kms/get-public-key.rst

@@ -20,8 +20,7 @@ Output::
         ]
     }
 
-For more information about using asymmetric KMS keys in AWS KMS, see `Using Symmetric and Asymmetric Keys <https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html>`__ in the *AWS Key Management Service API Reference*.
-
+For more information about using asymmetric KMS keys in AWS KMS, see `Asymmetric keys in AWS KMS <https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html>`__ in the *AWS Key Management Service Developer Guide*.
 **Example 2: To convert a public key to DER format (Linux and macOS)**
 
 The following ``get-public-key`` example downloads the public key of an asymmetric KMS key and saves it in a DER file.
@@ -37,4 +36,4 @@ Before running this command, replace the example key ID with a valid key ID from
 
 This command produces no output.
 
-For more information about using asymmetric KMS keys in AWS KMS, see `Using Symmetric and Asymmetric Keys <https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html>`__ in the *AWS Key Management Service API Reference*.
+For more information about using asymmetric KMS keys in AWS KMS, see `Asymmetric keys in AWS KMS <https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html>`__ in the *AWS Key Management Service Developer Guide*.

awscli/examples/kms/import-key-material.rst

@@ -15,6 +15,11 @@ Before running this command, replace the example key ID with a valid key ID or k
         --expiration-model KEY_MATERIAL_EXPIRES \
         --valid-to 2021-09-21T19:00:00Z
 
-This command produces no output.
+Output::
+
+    {
+        "KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
+        "KeyMaterialId": "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6"
+    }
 
 For more information about importing key material, see `Importing Key Material <https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html>`__ in the *AWS Key Management Service Developer Guide*.

awscli/examples/kms/re-encrypt.rst

@@ -4,7 +4,7 @@ The following ``re-encrypt`` command example demonstrates the recommended way to
 
 * Provide the ciphertext in a file. 
 
-    In the value of the ``--ciphertext-blob`` parameter, use the ``fileb://`` prefix, which tells the CLI to read the data from a binary file. If the file is not in the current directory, type the full path to file. For more information about reading AWS CLI parameter values from a file, see `Loading AWS CLI parameters from a file <https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-parameters-file.html>` in the *AWS Command Line Interface User Guide* and `Best Practices for Local File Parameters<https://aws.amazon.com/blogs/developer/best-practices-for-local-file-parameters/>` in the *AWS Command Line Tool Blog*.
+    In the value of the ``--ciphertext-blob`` parameter, use the ``fileb://`` prefix, which tells the CLI to read the data from a binary file. If the file is not in the current directory, type the full path to file. For more information about reading AWS CLI parameter values from a file, see `Loading AWS CLI parameters from a file <https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-parameters-file.html>`__ in the *AWS Command Line Interface User Guide* and `Best Practices for Local File Parameters <https://aws.amazon.com/blogs/developer/best-practices-for-local-file-parameters/>`__ in the *AWS Command Line Tool Blog*.
 
 * Specify the source KMS key, which decrypts the ciphertext.
 
@@ -34,7 +34,7 @@ Before running this command, replace the example key IDs with valid key identifi
 
 This command produces no output. The output from the ``re-encrypt`` command is base64-decoded and saved in a file.
 
-For more information, see `ReEncrypt <https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html`__ in the *AWS Key Management Service API Reference*.
+For more information, see `ReEncrypt <https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html>`__ in the *AWS Key Management Service API Reference*.
 
 **Example 2: To re-encrypt an encrypted message under a different symmetric KMS key (Windows command prompt).**
 
@@ -59,4 +59,4 @@ Output::
     Output Length = 12
     CertUtil: -decode command completed successfully.
 
-For more information, see `ReEncrypt <https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html`__ in the *AWS Key Management Service API Reference*.
+For more information, see `ReEncrypt <https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html>`__ in the *AWS Key Management Service API Reference*.

awscli/examples/kms/sign.rst

@@ -4,7 +4,7 @@ The following ``sign`` example generates a cryptographic signature for a short m
 
 You must specify a message to sign and a signing algorithm that your asymmetric KMS key supports. To get the signing algorithms for your KMS key, use the ``describe-key`` command. 
 
-In AWS CLI 2.0, the value of the ``message`` parameter must be Base64-encoded. Or, you can save the message in a file and use the ``fileb://`` prefix, which tells the AWS CLI to read binary data from the file.
+In AWS CLI v2, the value of the ``message`` parameter must be Base64-encoded. Or, you can save the message in a file and use the ``fileb://`` prefix, which tells the AWS CLI to read binary data from the file.
 
 Before running this command, replace the example key ID with a valid key ID from your AWS account. The key ID must represent an asymmetric KMS key with a key usage of SIGN_VERIFY. ::
 

awscli/examples/kms/verify-mac.rst

@@ -0,0 +1,27 @@
+**Example 1: To verify an HMAC**
+
+The following ``verify-mac`` command verifies an HMAC for a particular message, HMAC KMS keys, and MAC algorithm. A value of 'true' in the MacValid value in the response indicates that the HMAC is valid.
+
+In AWS CLI v2, the value of the ``message`` parameter must be Base64-encoded. Or, you can save the message in a file and use the ``fileb://`` prefix, which tells the AWS CLI to read binary data from the file.
+
+The MAC that you specify cannot be base64-encoded. For help decoding the MAC that the ``generate-mac`` command returns, see the ``generate-mac`` command examples.
+
+Before running this command, replace the example key ID with a valid key ID from your AWS account. The key ID must represent a HMAC KMS key with a key usage of ``GENERATE_VERIFY_MAC``. ::
+
+    msg=(echo 'Hello World' | base64)
+    
+    aws kms verify-mac \
+        --key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
+        --message fileb://Message \
+        --mac-algorithm HMAC_SHA_384 \
+        --mac fileb://ExampleMac
+
+Output::
+
+    {
+        "KeyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+        "MacValid": true,
+        "MacAlgorithm": "HMAC_SHA_384"
+    }
+
+For more information about using HMAC KMS keys in AWS KMS, see `HMAC keys in AWS KMS <https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html>`__ in the *AWS Key Management Service Developer Guide*.

awscli/examples/kms/verify.rst

@@ -1,6 +1,10 @@
 **To verify a digital signature**
 
-The following ``verify`` example verifies a cryptographic signature for a short, Base64-encoded message. The key ID, message, message type, and signing algorithm must be same ones that were used to sign the message. The signature that you specify cannot be base64-encoded. For help decoding the signature that the ``sign`` command returns, see the ``sign`` command examples.
+The following ``verify`` command verifies a cryptographic signature for a short, Base64-encoded message. The key ID, message, message type, and signing algorithm must be same ones that were used to sign the message.
+
+In AWS CLI v2, the value of the ``message`` parameter must be Base64-encoded. Or, you can save the message in a file and use the ``fileb://`` prefix, which tells the AWS CLI to read binary data from the file.
+
+The signature that you specify cannot be base64-encoded. For help decoding the signature that the ``sign`` command returns, see the ``sign`` command examples.
 
 The output of the command includes a Boolean ``SignatureValid`` field that indicates that the signature was verified. If the signature validation fails, the ``verify`` command fails, too.
 

awscli/examples/lambda/create-function.rst

@@ -4,7 +4,7 @@ The following ``create-function`` example creates a Lambda function named ``my-f
 
     aws lambda create-function \
         --function-name my-function \
-        --runtime nodejs18.x \
+        --runtime nodejs22.x \
         --zip-file fileb://my-function.zip \
         --handler my-function.handler \
         --role arn:aws:iam::123456789012:role/service-role/MyTestFunction-role-tges6bf4
@@ -28,10 +28,10 @@ Output::
         "Version": "$LATEST",
         "Role": "arn:aws:iam::123456789012:role/service-role/MyTestFunction-role-zgur6bf4",
         "Timeout": 3,
-        "LastModified": "2023-10-14T22:26:11.234+0000",
+        "LastModified": "2025-10-14T22:26:11.234+0000",
         "Handler": "my-function.handler",
-        "Runtime": "nodejs18.x",
+        "Runtime": "nodejs22.x",
         "Description": ""
     }
 
-For more information, see `AWS Lambda Function Configuration <https://docs.aws.amazon.com/lambda/latest/dg/resource-model.html>`__ in the *AWS Lambda Developer Guide*.
+For more information, see `Configure Lambda function memory <https://docs.aws.amazon.com/lambda/latest/dg/configuration-memory.html>`__ in the *AWS Lambda Developer Guide*.

awscli/examples/lambda/get-function.rst

@@ -34,10 +34,10 @@ Output::
             "Handler": "index.handler",
             "Role": "arn:aws:iam::123456789012:role/service-role/helloWorldPython-role-uy3l9qyq",
             "Timeout": 3,
-            "LastModified": "2019-09-24T18:20:35.054+0000",
-            "Runtime": "nodejs10.x",
+            "LastModified": "2025-09-24T18:20:35.054+0000",
+            "Runtime": "nodejs22.x",
             "Description": ""
         }
     }
 
-For more information, see `AWS Lambda Function Configuration <https://docs.aws.amazon.com/lambda/latest/dg/resource-model.html>`__ in the *AWS Lambda Developer Guide*.
+For more information, see `Configure Lambda function memory <https://docs.aws.amazon.com/lambda/latest/dg/configuration-memory.html>`__ in the *AWS Lambda Developer Guide*.

awscli/examples/lambda/list-functions.rst

@@ -22,8 +22,8 @@ Output::
                 "Handler": "helloworld.handler",
                 "Role": "arn:aws:iam::123456789012:role/service-role/MyTestFunction-role-zgur6bf4",
                 "Timeout": 3,
-                "LastModified": "2023-09-23T18:32:33.857+0000",
-                "Runtime": "nodejs18.x",
+                "LastModified": "2025-09-23T18:32:33.857+0000",
+                "Runtime": "nodejs22.x",
                 "Description": ""
             },
             {
@@ -45,8 +45,8 @@ Output::
                 "Handler": "index.handler",
                 "Role": "arn:aws:iam::123456789012:role/service-role/helloWorldPython-role-uy3l9qyq",
                 "Timeout": 3,
-                "LastModified": "2023-10-01T16:47:28.490+0000",
-                "Runtime": "nodejs18.x",
+                "LastModified": "2025-10-01T16:47:28.490+0000",
+                "Runtime": "nodejs22.x",
                 "Description": ""
             },
             {
@@ -78,11 +78,11 @@ Output::
                 "Handler": "lambda_function.lambda_handler",
                 "Role": "arn:aws:iam::123456789012:role/service-role/my-python-function-role-z5g7dr6n",
                 "Timeout": 3,
-                "LastModified": "2023-10-01T19:40:41.643+0000",
+                "LastModified": "2025-10-01T19:40:41.643+0000",
                 "Runtime": "python3.11",
                 "Description": ""
             }
         ]
     }
 
-For more information, see `AWS Lambda Function Configuration <https://docs.aws.amazon.com/lambda/latest/dg/resource-model.html>`__ in the *AWS Lambda Developer Guide*.
+For more information, see `Configure Lambda function memory <https://docs.aws.amazon.com/lambda/latest/dg/configuration-memory.html>`__ in the *AWS Lambda Developer Guide*.

awscli/examples/medical-imaging/create-datastore.rst

@@ -1,6 +1,7 @@
-**To create a data store**
+**Example 1: To create a data store**
 
-The following ``create-datastore`` code example creates a data store with the name ``my-datastore``. ::
+The following ``create-datastore`` code example creates a data store with the name ``my-datastore``.
+When you create a datastore without specifying a ``--lossless-storage-format``, AWS HealthImaging defaults to HTJ2K (High Throughput JPEG 2000). ::
 
     aws medical-imaging create-datastore \
         --datastore-name "my-datastore"
@@ -12,4 +13,20 @@ Output::
         "datastoreStatus": "CREATING"
     }
 
+**Example 2: To create a data store with JPEG 2000 Lossless storage format**
+
+A data store configured with JPEG 2000 Lossless storage format will transcode and persist lossless image frames in JPEG 2000 format. Image frames can then be retrieved in 
+JPEG 2000 Lossless without transcoding. The following ``create-datastore`` code example creates a data store configured for JPEG 2000 Lossless storage format with the name ``my-datastore``. ::
+
+    aws medical-imaging create-datastore \
+        --datastore-name "my-datastore" \
+        --lossless-storage-format JPEG_2000_LOSSLESS
+
+Output::
+
+    {
+        "datastoreId": "12345678901234567890123456789012",
+        "datastoreStatus": "CREATING"
+    }
+
 For more information, see `Creating a data store <https://docs.aws.amazon.com/healthimaging/latest/devguide/create-data-store.html>`__ in the *AWS HealthImaging Developer Guide*.

awscli/examples/medical-imaging/get-datastore.rst

@@ -1,4 +1,4 @@
-**To get a data store's properties**
+**Example 1: To get a data store's properties**
 
 The following ``get-datastore`` code example gets a data store's properties. ::
 
@@ -13,6 +13,29 @@ Output::
             "datastoreId": "12345678901234567890123456789012",
             "datastoreName": "TestDatastore123",
             "datastoreStatus": "ACTIVE",
+            "losslessStorageFormat": "HTJ2K"
+            "datastoreArn": "arn:aws:medical-imaging:us-east-1:123456789012:datastore/12345678901234567890123456789012",
+            "createdAt": "2022-11-15T23:33:09.643000+00:00",
+            "updatedAt": "2022-11-15T23:33:09.643000+00:00"
+        }
+    }
+
+**Example 2: To get data store's properties configured for JPEG2000** 
+
+The following ``get-datastore`` code example gets a data store's properties for a data store configured for JPEG 2000 Lossless storage format. ::
+
+    aws medical-imaging get-datastore \
+        --datastore-id 12345678901234567890123456789012
+
+
+Output::
+
+    {
+        "datastoreProperties": {
+            "datastoreId": "12345678901234567890123456789012",
+            "datastoreName": "TestDatastore123",
+            "datastoreStatus": "ACTIVE",
+            "losslessStorageFormat": "JPEG_2000_LOSSLESS",
             "datastoreArn": "arn:aws:medical-imaging:us-east-1:123456789012:datastore/12345678901234567890123456789012",
             "createdAt": "2022-11-15T23:33:09.643000+00:00",
             "updatedAt": "2022-11-15T23:33:09.643000+00:00"

awscli/examples/networkmanager/get-vpc-attachment.rst

@@ -1,4 +1,4 @@
-**To get an a VPC attachment**
+**To get a VPC attachment**
 
 The following ``get-vpc-attachment`` example returns information about a VPC attachment. ::
 

awscli/examples/omics/cancel-run.rst

@@ -5,4 +5,4 @@ The following ``cancel-run`` example cancels a run with ID ``1234567``. ::
     aws omics cancel-run \
         --id 1234567
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Run lifecycle in a workflow <https://docs.aws.amazon.com/omics/latest/dev/monitoring-runs.html>`__ in the *AWS HealthOmics User Guide*.

awscli/examples/omics/create-run-group.rst

@@ -5,7 +5,9 @@ The following ``create-run-group`` example creates a run group named ``cram-conv
     aws omics create-run-group \
         --name cram-converter \
         --max-cpus 20 \
-        --max-duration 600
+        --max-gpus 10 \
+        --max-duration 600 \
+        --max-runs 5 
 
 Output::
 
@@ -15,4 +17,4 @@ Output::
         "tags": {}
     }
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Creating run groups <https://docs.aws.amazon.com/omics/latest/dev/creating-run-groups.html>`__ in the *AWS HealthOmics User Guide*.

awscli/examples/omics/create-workflow.rst

@@ -42,4 +42,4 @@ Output::
         "tags": {}
     }
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Creating private workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows-setup.html>`__ in the *AWS HealthOmics User Guide*.

awscli/examples/omics/delete-run-group.rst

@@ -5,4 +5,4 @@ The following ``delete-run-group`` example deletes a run group with ID ``1234567
     aws omics delete-run-group \
         --id 1234567
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Deleting runs and run groups <https://docs.aws.amazon.com/omics/latest/dev/deleting-workflows-and-runs.html>`__ in the *AWS HealthOmics User Guide*.

awscli/examples/omics/delete-run.rst

@@ -5,4 +5,4 @@ The following ``delete-run`` example deletes a run with ID ``1234567``. ::
     aws omics delete-run \
         --id 1234567
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Deleting runs and run groups <https://docs.aws.amazon.com/omics/latest/dev/deleting-workflows-and-runs.html>`__ in the *AWS HealthOmics User Guide*.

awscli/examples/omics/delete-workflow.rst

@@ -5,4 +5,4 @@ The following ``delete-workflow`` example deletes a workflow with ID ``1234567``
     aws omics delete-workflow \
         --id 1234567
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Delete a private workflow <https://docs.aws.amazon.com/omics/latest/dev/delete-private-workflow.html>`__ in the *AWS HealthOmics User Guide*.

awscli/examples/omics/get-run-group.rst

@@ -17,4 +17,4 @@ Output::
         "tags": {}
     }
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Creating run groups <https://docs.aws.amazon.com/omics/latest/dev/creating-run-groups.html>`__ in the *AWS HealthOmics User Guide*.

awscli/examples/omics/get-run-task.rst

@@ -20,4 +20,4 @@ Output::
         "taskId": "1234567"
     }
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Task lifecycle in a HealthOmics run <https://docs.aws.amazon.com/omics/latest/dev/workflow-run-tasks.html>`__ in the *AWS HealthOmics User Guide*.

awscli/examples/omics/get-run.rst

@@ -35,4 +35,4 @@ Output::
         "workflowType": "PRIVATE"
     }
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Run lifecycle in a workflow <https://docs.aws.amazon.com/omics/latest/dev/monitoring-runs.html>`__ in the *AWS HealthOmics User Guide*.

awscli/examples/omics/get-workflow.rst

@@ -38,4 +38,4 @@ Output::
         "type": "PRIVATE"
     }
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Creating private workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows-setup.html>`__ in the *AWS HealthOmics User Guide*.

awscli/examples/omics/list-run-groups.rst

@@ -19,4 +19,4 @@ Output::
         ]
     }
 
-For more information, see `Omics Workflows <https://docs.aws.amazon.com/omics/latest/dev/workflows.html>`__ in the *Amazon Omics Developer Guide*.
+For more information, see `Creating run groups <https://docs.aws.amazon.com/omics/latest/dev/creating-run-groups.html>`__ in the *AWS HealthOmics User Guide*.