botocore 1.40.44__tar.gz → 1.40.45__tar.gz

{botocore-1.40.44/botocore.egg-info → botocore-1.40.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: botocore
-Version: 1.40.44
+Version: 1.40.45
 Summary: Low-level, data-driven core of boto 3.
 Home-page: https://github.com/boto/botocore
 Author: Amazon Web Services

{botocore-1.40.44 → botocore-1.40.45}/botocore/__init__.py

@@ -17,7 +17,7 @@ import os
 import re
 from logging import NullHandler
 
-__version__ = '1.40.44'
+__version__ = '1.40.45'
 
 
 # Configure default logger to do nothing

{botocore-1.40.44 → botocore-1.40.45}/botocore/data/cleanrooms/2022-02-17/endpoint-rule-set-1.json

@@ -5,27 +5,27 @@
             "builtIn": "AWS::Region",
             "required": false,
             "documentation": "The AWS region used to dispatch the request.",
-            "type": "String"
+            "type": "string"
         },
         "UseDualStack": {
             "builtIn": "AWS::UseDualStack",
             "required": true,
             "default": false,
             "documentation": "When true, use the dual-stack endpoint. If the configured endpoint does not support dual-stack, dispatching the request MAY return an error.",
-            "type": "Boolean"
+            "type": "boolean"
         },
         "UseFIPS": {
             "builtIn": "AWS::UseFIPS",
             "required": true,
             "default": false,
             "documentation": "When true, send this request to the FIPS-compliant regional endpoint. If the configured endpoint does not have a FIPS compliant endpoint, dispatching the request will return an error.",
-            "type": "Boolean"
+            "type": "boolean"
         },
         "Endpoint": {
             "builtIn": "SDK::Endpoint",
             "required": false,
             "documentation": "Override the endpoint used to send this request",
-            "type": "String"
+            "type": "string"
         }
     },
     "rules": [

{botocore-1.40.44 → botocore-1.40.45}/botocore/data/cleanrooms/2022-02-17/service-2.json

@@ -1914,6 +1914,10 @@
       "type":"list",
       "member":{"shape":"AccountId"}
     },
+    "AllowedResultRegions":{
+      "type":"list",
+      "member":{"shape":"SupportedS3Region"}
+    },
     "AnalysisFormat":{
       "type":"string",
       "enum":[
@@ -2566,6 +2570,10 @@
         "tableName"
       ],
       "members":{
+        "region":{
+          "shape":"CommercialRegion",
+          "documentation":"<p>The Amazon Web Services Region where the Athena table is located. This parameter is required to uniquely identify and access tables across different Regions.</p>"
+        },
         "workGroup":{
           "shape":"AthenaWorkGroup",
           "documentation":"<p> The workgroup of the Athena table reference.</p>"
@@ -3042,6 +3050,10 @@
         "autoApprovedChangeTypes":{
           "shape":"AutoApprovedChangeTypeList",
           "documentation":"<p>The types of change requests that are automatically approved for this collaboration.</p>"
+        },
+        "allowedResultRegions":{
+          "shape":"AllowedResultRegions",
+          "documentation":"<p>The Amazon Web Services Regions where collaboration query results can be stored. Returns the list of Region identifiers that were specified when the collaboration was created. This list is used to enforce regional storage policies and compliance requirements.</p>"
         }
       },
       "documentation":"<p>The multi-party data share environment. The collaboration contains metadata about its purpose and participants.</p>"
@@ -3836,6 +3848,44 @@
       "min":0,
       "pattern":"[\\u0020-\\uD7FF\\uE000-\\uFFFD\\uD800\\uDBFF-\\uDC00\\uDFFF\\t]*"
     },
+    "CommercialRegion":{
+      "type":"string",
+      "enum":[
+        "us-west-1",
+        "us-west-2",
+        "us-east-1",
+        "us-east-2",
+        "af-south-1",
+        "ap-east-1",
+        "ap-south-2",
+        "ap-southeast-1",
+        "ap-southeast-2",
+        "ap-southeast-3",
+        "ap-southeast-5",
+        "ap-southeast-4",
+        "ap-southeast-7",
+        "ap-south-1",
+        "ap-northeast-3",
+        "ap-northeast-1",
+        "ap-northeast-2",
+        "ca-central-1",
+        "ca-west-1",
+        "eu-south-1",
+        "eu-west-3",
+        "eu-south-2",
+        "eu-central-2",
+        "eu-central-1",
+        "eu-north-1",
+        "eu-west-1",
+        "eu-west-2",
+        "me-south-1",
+        "me-central-1",
+        "il-central-1",
+        "sa-east-1",
+        "mx-central-1",
+        "ap-east-2"
+      ]
+    },
     "ComputeConfiguration":{
       "type":"structure",
       "members":{
@@ -4825,6 +4875,10 @@
         "autoApprovedChangeRequestTypes":{
           "shape":"AutoApprovedChangeTypeList",
           "documentation":"<p>The types of change requests that are automatically approved for this collaboration.</p>"
+        },
+        "allowedResultRegions":{
+          "shape":"AllowedResultRegions",
+          "documentation":"<p>The Amazon Web Services Regions where collaboration query results can be stored. When specified, results can only be written to these Regions. This parameter enables you to meet your compliance and data governance requirements, and implement regional data governance policies.</p>"
         }
       }
     },
@@ -6502,6 +6556,10 @@
         "databaseName"
       ],
       "members":{
+        "region":{
+          "shape":"CommercialRegion",
+          "documentation":"<p>The Amazon Web Services Region where the Glue table is located. This parameter is required to uniquely identify and access tables across different Regions.</p>"
+        },
         "tableName":{
           "shape":"GlueTableName",
           "documentation":"<p>The name of the Glue table.</p>"
@@ -10281,6 +10339,44 @@
       }
     },
     "String":{"type":"string"},
+    "SupportedS3Region":{
+      "type":"string",
+      "enum":[
+        "us-west-1",
+        "us-west-2",
+        "us-east-1",
+        "us-east-2",
+        "af-south-1",
+        "ap-east-1",
+        "ap-east-2",
+        "ap-south-2",
+        "ap-southeast-1",
+        "ap-southeast-2",
+        "ap-southeast-3",
+        "ap-southeast-5",
+        "ap-southeast-4",
+        "ap-southeast-7",
+        "ap-south-1",
+        "ap-northeast-3",
+        "ap-northeast-1",
+        "ap-northeast-2",
+        "ca-central-1",
+        "ca-west-1",
+        "eu-south-1",
+        "eu-west-3",
+        "eu-south-2",
+        "eu-central-2",
+        "eu-central-1",
+        "eu-north-1",
+        "eu-west-1",
+        "eu-west-2",
+        "me-south-1",
+        "me-central-1",
+        "il-central-1",
+        "sa-east-1",
+        "mx-central-1"
+      ]
+    },
     "TableAlias":{
       "type":"string",
       "max":128,

{botocore-1.40.44 → botocore-1.40.45}/botocore/data/medialive/2017-10-14/service-2.json

@@ -5783,7 +5783,7 @@
         "ContainerSettings": {
           "shape": "ArchiveContainerSettings",
           "locationName": "containerSettings",
-          "documentation": "Settings specific to the container type of the file."
+          "documentation": "Container for this output. Can be auto-detected from extension field."
         },
         "Extension": {
           "shape": "__string",
@@ -11006,7 +11006,7 @@
         "ColorSpaceSettings": {
           "shape": "H264ColorSpaceSettings",
           "locationName": "colorSpaceSettings",
-          "documentation": "Color Space settings"
+          "documentation": "Specify the type of color space to apply or choose to pass through. The default is to pass through the color space that is in the source."
         },
         "EntropyEncoding": {
           "shape": "H264EntropyEncoding",
@@ -11419,7 +11419,7 @@
         "ColorSpaceSettings": {
           "shape": "H265ColorSpaceSettings",
           "locationName": "colorSpaceSettings",
-          "documentation": "Color Space settings"
+          "documentation": "Specify the type of color space to apply or choose to pass through. The default is to pass through the color space that is in the source."
         },
         "FilterSettings": {
           "shape": "H265FilterSettings",
@@ -19725,12 +19725,12 @@
         "ColorSpace": {
           "shape": "VideoSelectorColorSpace",
           "locationName": "colorSpace",
-          "documentation": "Specifies the color space of an input. This setting works in tandem with colorSpaceUsage and a video description's colorSpaceSettingsChoice to determine if any conversion will be performed."
+          "documentation": "Controls how MediaLive will use the color space metadata from the source. Typically, choose FOLLOW, which means to use the color space metadata without changing it. Or choose another value (a standard). In this case, the handling is controlled by the colorspaceUsage property."
         },
         "ColorSpaceSettings": {
           "shape": "VideoSelectorColorSpaceSettings",
           "locationName": "colorSpaceSettings",
-          "documentation": "Color space settings"
+          "documentation": "Choose HDR10 only if the following situation applies. Firstly, you specified HDR10 in ColorSpace. Secondly, the attached input is for AWS Elemental Link. Thirdly, you plan to convert the content to another color space. You need to specify the color space metadata that is missing from the source sent from AWS Elemental Link."
         },
         "ColorSpaceUsage": {
           "shape": "VideoSelectorColorSpaceUsage",
@@ -25806,7 +25806,7 @@
         "ColorSpaceSettings": {
           "shape": "Av1ColorSpaceSettings",
           "locationName": "colorSpaceSettings",
-          "documentation": "Color Space settings"
+          "documentation": "Specify the type of color space to apply or choose to pass through. The default is to pass through the color space that is in the source."
         },
         "FixedAfd": {
           "shape": "FixedAfd",
@@ -29424,6 +29424,51 @@
           "shape": "__listOfCaptionLanguageMapping",
           "locationName": "captionLanguageMappings",
           "documentation": "Mapping of up to 4 caption channels to caption languages."
+        },
+        "Id3Behavior": {
+          "shape": "CmafId3Behavior",
+          "locationName": "id3Behavior",
+          "documentation": "Set to ENABLED to enable ID3 metadata insertion. To include metadata, you configure other parameters in the output group, or you add an ID3 action to the channel schedule."
+        },
+        "KlvBehavior": {
+          "shape": "CmafKLVBehavior",
+          "locationName": "klvBehavior",
+          "documentation": "If set to passthrough, passes any KLV data from the input source to this output."
+        },
+        "NielsenId3Behavior": {
+          "shape": "CmafNielsenId3Behavior",
+          "locationName": "nielsenId3Behavior",
+          "documentation": "If set to passthrough, Nielsen inaudible tones for media tracking will be detected in the input audio and an equivalent ID3 tag will be inserted in the output."
+        },
+        "Scte35Type": {
+          "shape": "Scte35Type",
+          "locationName": "scte35Type",
+          "documentation": "Type of scte35 track to add. none or scte35WithoutSegmentation"
+        },
+        "SegmentLength": {
+          "shape": "__integerMin1",
+          "locationName": "segmentLength",
+          "documentation": "The nominal duration of segments. The units are specified in SegmentLengthUnits. The segments will end on the next keyframe after the specified duration, so the actual segment length might be longer, and it might be a fraction of the units."
+        },
+        "SegmentLengthUnits": {
+          "shape": "CmafIngestSegmentLengthUnits",
+          "locationName": "segmentLengthUnits",
+          "documentation": "Time unit for segment length parameter."
+        },
+        "TimedMetadataId3Frame": {
+          "shape": "CmafTimedMetadataId3Frame",
+          "locationName": "timedMetadataId3Frame",
+          "documentation": "Set to none if you don't want to insert a timecode in the output. Otherwise choose the frame type for the timecode."
+        },
+        "TimedMetadataId3Period": {
+          "shape": "__integerMin0Max10000",
+          "locationName": "timedMetadataId3Period",
+          "documentation": "If you set up to insert a timecode in the output, specify the frequency for the frame, in seconds."
+        },
+        "TimedMetadataPassthrough": {
+          "shape": "CmafTimedMetadataPassthrough",
+          "locationName": "timedMetadataPassthrough",
+          "documentation": "Set to enabled to pass through ID3 metadata from the input sources."
         }
       },
       "documentation": "Media Package V2 Group Settings"

{botocore-1.40.44 → botocore-1.40.45}/botocore/data/payment-cryptography-data/2022-02-03/service-2.json

@@ -83,7 +83,7 @@
         {"shape":"ThrottlingException"},
         {"shape":"InternalServerException"}
       ],
-      "documentation":"<p>Generates a Message Authentication Code (MAC) cryptogram within Amazon Web Services Payment Cryptography. </p> <p>You can use this operation to authenticate card-related data by using known data values to generate MAC for data validation between the sending and receiving parties. This operation uses message data, a secret encryption key and MAC algorithm to generate a unique MAC value for transmission. The receiving party of the MAC must use the same message data, secret encryption key and MAC algorithm to reproduce another MAC value for comparision.</p> <p>You can use this operation to generate a DUPKT, CMAC, HMAC or EMV MAC by setting generation attributes and algorithm to the associated values. The MAC generation encryption key must have valid values for <code>KeyUsage</code> such as <code>TR31_M7_HMAC_KEY</code> for HMAC generation, and they key must have <code>KeyModesOfUse</code> set to <code>Generate</code> and <code>Verify</code>.</p> <p>For information about valid keys for this operation, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html\">Understanding key attributes</a> and <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html\">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>. </p> <p> <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a>VerifyMac</a> </p> </li> </ul>"
+      "documentation":"<p>Generates a Message Authentication Code (MAC) cryptogram within Amazon Web Services Payment Cryptography. </p> <p>You can use this operation to authenticate card-related data by using known data values to generate MAC for data validation between the sending and receiving parties. This operation uses message data, a secret encryption key and MAC algorithm to generate a unique MAC value for transmission. The receiving party of the MAC must use the same message data, secret encryption key and MAC algorithm to reproduce another MAC value for comparision.</p> <p>You can use this operation to generate a DUPKT, CMAC, HMAC or EMV MAC by setting generation attributes and algorithm to the associated values. The MAC generation encryption key must have valid values for <code>KeyUsage</code> such as <code>TR31_M7_HMAC_KEY</code> for HMAC generation, and the key must have <code>KeyModesOfUse</code> set to <code>Generate</code> and <code>Verify</code>.</p> <p>For information about valid keys for this operation, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html\">Understanding key attributes</a> and <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html\">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>. </p> <p> <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a>VerifyMac</a> </p> </li> </ul>"
     },
     "GenerateMacEmvPinChange":{
       "name":"GenerateMacEmvPinChange",
@@ -139,6 +139,24 @@
       ],
       "documentation":"<p>Re-encrypt ciphertext using DUKPT or Symmetric data encryption keys. </p> <p>You can either generate an encryption key within Amazon Web Services Payment Cryptography by calling <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html\">CreateKey</a> or import your own encryption key by calling <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html\">ImportKey</a>. The <code>KeyArn</code> for use with this operation must be in a compatible key state with <code>KeyModesOfUse</code> set to <code>Encrypt</code>. </p> <p>This operation also supports dynamic keys, allowing you to pass a dynamic encryption key as a TR-31 WrappedKeyBlock. This can be used when key material is frequently rotated, such as during every card transaction, and there is need to avoid importing short-lived keys into Amazon Web Services Payment Cryptography. To re-encrypt using dynamic keys, the <code>keyARN</code> is the Key Encryption Key (KEK) of the TR-31 wrapped encryption key material. The incoming wrapped key shall have a key purpose of D0 with a mode of use of B or D. For more information, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-acquirers-dynamickeys.html\">Using Dynamic Keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>For symmetric and DUKPT encryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> and <code>AES</code> algorithms. To encrypt using DUKPT, a DUKPT key must already exist within your account with <code>KeyModesOfUse</code> set to <code>DeriveKey</code> or a new DUKPT can be generated by calling <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html\">CreateKey</a>.</p> <p>For information about valid keys for this operation, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html\">Understanding key attributes</a> and <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html\">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>. </p> <p> <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a>DecryptData</a> </p> </li> <li> <p> <a>EncryptData</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_GetPublicKeyCertificate.html\">GetPublicCertificate</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html\">ImportKey</a> </p> </li> </ul>"
     },
+    "TranslateKeyMaterial":{
+      "name":"TranslateKeyMaterial",
+      "http":{
+        "method":"POST",
+        "requestUri":"/keymaterial/translate",
+        "responseCode":200
+      },
+      "input":{"shape":"TranslateKeyMaterialInput"},
+      "output":{"shape":"TranslateKeyMaterialOutput"},
+      "errors":[
+        {"shape":"ValidationException"},
+        {"shape":"AccessDeniedException"},
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"ThrottlingException"},
+        {"shape":"InternalServerException"}
+      ],
+      "documentation":"<p>Translates an encryption key between different wrapping keys without importing the key into Amazon Web Services Payment Cryptography.</p> <p>This operation can be used when key material is frequently rotated, such as during every card transaction, and there is a need to avoid importing short-lived keys into Amazon Web Services Payment Cryptography. It translates short-lived transaction keys such as Pin Encryption Key (PEK) generated for each transaction and wrapped with an ECDH (Elliptic Curve Diffie-Hellman) derived wrapping key to another KEK (Key Encryption Key) wrapping key. </p> <p>Before using this operation, you must first request the public key certificate of the ECC key pair generated within Amazon Web Services Payment Cryptography to establish an ECDH key agreement. In <code>TranslateKeyData</code>, the service uses its own ECC key pair, public certificate of receiving ECC key pair, and the key derivation parameters to generate a derived key. The service uses this derived key to unwrap the incoming transaction key received as a TR31WrappedKeyBlock and re-wrap using a user provided KEK to generate an outgoing Tr31WrappedKeyBlock. For more information on establishing ECDH derived keys, see the <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/create-keys.html\">Creating keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>For information about valid keys for this operation, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html\">Understanding key attributes</a> and <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html\">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>. </p> <p> <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html\">CreateKey</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_GetPublicKeyCertificate.html\">GetPublicCertificate</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html\">ImportKey</a> </p> </li> </ul>"
+    },
     "TranslatePinData":{
       "name":"TranslatePinData",
       "http":{
@@ -155,7 +173,7 @@
         {"shape":"ThrottlingException"},
         {"shape":"InternalServerException"}
       ],
-      "documentation":"<p>Translates encrypted PIN block from and to ISO 9564 formats 0,1,3,4. For more information, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/translate-pin-data.html\">Translate PIN data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>PIN block translation involves changing a PIN block from one encryption key to another and optionally change its format. PIN block translation occurs entirely within the HSM boundary and PIN data never enters or leaves Amazon Web Services Payment Cryptography in clear text. The encryption key transformation can be from PEK (Pin Encryption Key) to BDK (Base Derivation Key) for DUKPT or from BDK for DUKPT to PEK.</p> <p>Amazon Web Services Payment Cryptography also supports use of dynamic keys and ECDH (Elliptic Curve Diffie-Hellman) based key exchange for this operation.</p> <p>Dynamic keys allow you to pass a PEK as a TR-31 WrappedKeyBlock. They can be used when key material is frequently rotated, such as during every card transaction, and there is need to avoid importing short-lived keys into Amazon Web Services Payment Cryptography. To translate PIN block using dynamic keys, the <code>keyARN</code> is the Key Encryption Key (KEK) of the TR-31 wrapped PEK. The incoming wrapped key shall have a key purpose of P0 with a mode of use of B or D. For more information, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-acquirers-dynamickeys.html\">Using Dynamic Keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>Using ECDH key exchange, you can receive cardholder selectable PINs into Amazon Web Services Payment Cryptography. The ECDH derived key protects the incoming PIN block, which is translated to a PEK encrypted PIN block for use within the service. You can also use ECDH for reveal PIN, wherein the service translates the PIN block from PEK to a ECDH derived encryption key. For more information on establishing ECDH derived keys, see the <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/create-keys.html\">Generating keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>The allowed combinations of PIN block format translations are guided by PCI. It is important to note that not all encrypted PIN block formats (example, format 1) require PAN (Primary Account Number) as input. And as such, PIN block format that requires PAN (example, formats 0,3,4) cannot be translated to a format (format 1) that does not require a PAN for generation. </p> <p>For information about valid keys for this operation, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html\">Understanding key attributes</a> and <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html\">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <note> <p>Amazon Web Services Payment Cryptography currently supports ISO PIN block 4 translation for PIN block built using legacy PAN length. That is, PAN is the right most 12 digits excluding the check digits.</p> </note> <p> <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a>GeneratePinData</a> </p> </li> <li> <p> <a>VerifyPinData</a> </p> </li> </ul>"
+      "documentation":"<p>Translates encrypted PIN block from and to ISO 9564 formats 0,1,3,4. For more information, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/translate-pin-data.html\">Translate PIN data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>PIN block translation involves changing a PIN block from one encryption key to another and optionally change its format. PIN block translation occurs entirely within the HSM boundary and PIN data never enters or leaves Amazon Web Services Payment Cryptography in clear text. The encryption key transformation can be from PEK (Pin Encryption Key) to BDK (Base Derivation Key) for DUKPT or from BDK for DUKPT to PEK.</p> <p>Amazon Web Services Payment Cryptography also supports use of dynamic keys and ECDH (Elliptic Curve Diffie-Hellman) based key exchange for this operation.</p> <p>Dynamic keys allow you to pass a PEK as a TR-31 WrappedKeyBlock. They can be used when key material is frequently rotated, such as during every card transaction, and there is need to avoid importing short-lived keys into Amazon Web Services Payment Cryptography. To translate PIN block using dynamic keys, the <code>keyARN</code> is the Key Encryption Key (KEK) of the TR-31 wrapped PEK. The incoming wrapped key shall have a key purpose of P0 with a mode of use of B or D. For more information, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-acquirers-dynamickeys.html\">Using Dynamic Keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>Using ECDH key exchange, you can receive cardholder selectable PINs into Amazon Web Services Payment Cryptography. The ECDH derived key protects the incoming PIN block, which is translated to a PEK encrypted PIN block for use within the service. You can also use ECDH for reveal PIN, wherein the service translates the PIN block from PEK to a ECDH derived encryption key. For more information on establishing ECDH derived keys, see the <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/create-keys.html\">Creating keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>The allowed combinations of PIN block format translations are guided by PCI. It is important to note that not all encrypted PIN block formats (example, format 1) require PAN (Primary Account Number) as input. And as such, PIN block format that requires PAN (example, formats 0,3,4) cannot be translated to a format (format 1) that does not require a PAN for generation. </p> <p>For information about valid keys for this operation, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html\">Understanding key attributes</a> and <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html\">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <note> <p>Amazon Web Services Payment Cryptography currently supports ISO PIN block 4 translation for PIN block built using legacy PAN length. That is, PAN is the right most 12 digits excluding the check digits.</p> </note> <p> <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a>GeneratePinData</a> </p> </li> <li> <p> <a>VerifyPinData</a> </p> </li> </ul>"
     },
     "VerifyAuthRequestCryptogram":{
       "name":"VerifyAuthRequestCryptogram",
@@ -475,8 +493,7 @@
       "type":"string",
       "max":32768,
       "min":1,
-      "pattern":"[^\\[;\\]<>]+",
-      "sensitive":true
+      "pattern":"[^\\[;\\]<>]+"
     },
     "CipherTextType":{
       "type":"string",
@@ -635,6 +652,17 @@
       "documentation":"<p>Parameters to derive the payment card specific confidentiality and integrity keys.</p>",
       "union":true
     },
+    "DiffieHellmanDerivationData":{
+      "type":"structure",
+      "members":{
+        "SharedInformation":{
+          "shape":"SharedInformation",
+          "documentation":"<p>A string containing information that binds the ECDH derived key to the two parties involved or to the context of the key.</p> <p>It may include details like identities of the two parties deriving the key, context of the operation, session IDs, and optionally a nonce. It must not contain zero bytes. It is not recommended to reuse shared information for multiple ECDH key derivations, as it could result in derived key material being the same across different derivations.</p>"
+        }
+      },
+      "documentation":"<p>The shared information used when deriving a key using ECDH.</p>",
+      "union":true
+    },
     "DiscoverDynamicCardVerificationCode":{
       "type":"structure",
       "required":[
@@ -1243,7 +1271,6 @@
         "GenerationKeyIdentifier",
         "EncryptionKeyIdentifier",
         "GenerationAttributes",
-        "PrimaryAccountNumber",
         "PinBlockFormat"
       ],
       "members":{
@@ -1269,7 +1296,7 @@
         },
         "PinBlockFormat":{
           "shape":"PinBlockFormatForPinData",
-          "documentation":"<p>The PIN encoding format for pin data generation as specified in ISO 9564. Amazon Web Services Payment Cryptography supports <code>ISO_Format_0</code> and <code>ISO_Format_3</code>.</p> <p>The <code>ISO_Format_0</code> PIN block format is equivalent to the ANSI X9.8, VISA-1, and ECI-1 PIN block formats. It is similar to a VISA-4 PIN block format. It supports a PIN from 4 to 12 digits in length.</p> <p>The <code>ISO_Format_3</code> PIN block format is the same as <code>ISO_Format_0</code> except that the fill digits are random values from 10 to 15.</p>"
+          "documentation":"<p>The PIN encoding format for pin data generation as specified in ISO 9564. Amazon Web Services Payment Cryptography supports <code>ISO_Format_0</code>, <code>ISO_Format_3</code> and <code>ISO_Format_4</code>.</p> <p>The <code>ISO_Format_0</code> PIN block format is equivalent to the ANSI X9.8, VISA-1, and ECI-1 PIN block formats. It is similar to a VISA-4 PIN block format. It supports a PIN from 4 to 12 digits in length.</p> <p>The <code>ISO_Format_3</code> PIN block format is the same as <code>ISO_Format_0</code> except that the fill digits are random values from 10 to 15.</p> <p>The <code>ISO_Format_4</code> PIN block format is the only one supporting AES encryption. It is similar to <code>ISO_Format_3</code> but doubles the pin block length by padding with fill digit A and random values from 10 to 15.</p>"
         },
         "EncryptionWrappedKey":{"shape":"WrappedKey"}
       }
@@ -1484,6 +1511,62 @@
       },
       "documentation":"<p>Parameters that are required to generate or verify Ibm3624 random PIN.</p>"
     },
+    "IncomingDiffieHellmanTr31KeyBlock":{
+      "type":"structure",
+      "required":[
+        "PrivateKeyIdentifier",
+        "CertificateAuthorityPublicKeyIdentifier",
+        "PublicKeyCertificate",
+        "DeriveKeyAlgorithm",
+        "KeyDerivationFunction",
+        "KeyDerivationHashAlgorithm",
+        "DerivationData",
+        "WrappedKeyBlock"
+      ],
+      "members":{
+        "PrivateKeyIdentifier":{
+          "shape":"KeyArnOrKeyAliasType",
+          "documentation":"<p>The <code>keyARN</code> of the asymmetric ECC key pair.</p>"
+        },
+        "CertificateAuthorityPublicKeyIdentifier":{
+          "shape":"KeyArnOrKeyAliasType",
+          "documentation":"<p>The <code>keyArn</code> of the certificate that signed the client's <code>PublicKeyCertificate</code>.</p>"
+        },
+        "PublicKeyCertificate":{
+          "shape":"CertificateType",
+          "documentation":"<p>The client's public key certificate in PEM format (base64 encoded) to use for ECDH key derivation.</p>"
+        },
+        "DeriveKeyAlgorithm":{
+          "shape":"SymmetricKeyAlgorithm",
+          "documentation":"<p>The key algorithm of the derived ECDH key.</p>"
+        },
+        "KeyDerivationFunction":{
+          "shape":"KeyDerivationFunction",
+          "documentation":"<p>The key derivation function to use for deriving a key using ECDH.</p>"
+        },
+        "KeyDerivationHashAlgorithm":{
+          "shape":"KeyDerivationHashAlgorithm",
+          "documentation":"<p>The hash type to use for deriving a key using ECDH.</p>"
+        },
+        "DerivationData":{"shape":"DiffieHellmanDerivationData"},
+        "WrappedKeyBlock":{
+          "shape":"Tr31WrappedKeyBlock",
+          "documentation":"<p>The WrappedKeyBlock containing the transaction key wrapped using an ECDH dervied key. </p>"
+        }
+      },
+      "documentation":"<p>Parameter information of a TR31KeyBlock wrapped using an ECDH derived key.</p>"
+    },
+    "IncomingKeyMaterial":{
+      "type":"structure",
+      "members":{
+        "DiffieHellmanTr31KeyBlock":{
+          "shape":"IncomingDiffieHellmanTr31KeyBlock",
+          "documentation":"<p>Parameter information of the TR31WrappedKeyBlock containing the transaction key wrapped using an ECDH dervied key.</p>"
+        }
+      },
+      "documentation":"<p>Parameter information of the incoming WrappedKeyBlock containing the transaction key.</p>",
+      "union":true
+    },
     "InitializationVectorType":{
       "type":"string",
       "max":32,
@@ -1567,6 +1650,12 @@
         "SHA_512"
       ]
     },
+    "KeyMaterial":{
+      "type":"string",
+      "max":16384,
+      "min":48,
+      "sensitive":true
+    },
     "MacAlgorithm":{
       "type":"string",
       "enum":[
@@ -1724,6 +1813,28 @@
       "min":2,
       "pattern":"[0-9]+"
     },
+    "OutgoingKeyMaterial":{
+      "type":"structure",
+      "members":{
+        "Tr31KeyBlock":{
+          "shape":"OutgoingTr31KeyBlock",
+          "documentation":"<p>Parameter information of the TR31WrappedKeyBlock containing the transaction key wrapped using a KEK.</p>"
+        }
+      },
+      "documentation":"<p>Parameter information of the outgoing TR31WrappedKeyBlock containing the transaction key.</p>",
+      "union":true
+    },
+    "OutgoingTr31KeyBlock":{
+      "type":"structure",
+      "required":["WrappingKeyIdentifier"],
+      "members":{
+        "WrappingKeyIdentifier":{
+          "shape":"KeyArnOrKeyAliasType",
+          "documentation":"<p>The <code>keyARN</code> of the KEK used to wrap the transaction key.</p>"
+        }
+      },
+      "documentation":"<p>Parameter information of the TR31WrappedKeyBlock containing the transaction key wrapped using a KEK.</p>"
+    },
     "PaddingType":{
       "type":"string",
       "enum":[
@@ -1745,6 +1856,7 @@
       "type":"string",
       "enum":[
         "ISO_FORMAT_0",
+        "ISO_FORMAT_1",
         "ISO_FORMAT_3",
         "ISO_FORMAT_4"
       ]
@@ -2203,7 +2315,7 @@
       "type":"string",
       "max":9984,
       "min":56,
-      "pattern":"[0-9A-Z]+",
+      "pattern":"[0-9a-zA-Z]+",
       "sensitive":true
     },
     "TrackDataType":{
@@ -2220,6 +2332,37 @@
       "pattern":"[0-9a-fA-F]+",
       "sensitive":true
     },
+    "TranslateKeyMaterialInput":{
+      "type":"structure",
+      "required":[
+        "IncomingKeyMaterial",
+        "OutgoingKeyMaterial"
+      ],
+      "members":{
+        "IncomingKeyMaterial":{
+          "shape":"IncomingKeyMaterial",
+          "documentation":"<p>Parameter information of the TR31WrappedKeyBlock containing the transaction key.</p>"
+        },
+        "OutgoingKeyMaterial":{
+          "shape":"OutgoingKeyMaterial",
+          "documentation":"<p>Parameter information of the wrapping key used to wrap the transaction key in the outgoing TR31WrappedKeyBlock.</p>"
+        },
+        "KeyCheckValueAlgorithm":{
+          "shape":"KeyCheckValueAlgorithm",
+          "documentation":"<p>The key check value (KCV) algorithm used for calculating the KCV.</p>"
+        }
+      }
+    },
+    "TranslateKeyMaterialOutput":{
+      "type":"structure",
+      "required":["WrappedKey"],
+      "members":{
+        "WrappedKey":{
+          "shape":"WrappedWorkingKey",
+          "documentation":"<p>The outgoing KEK wrapped TR31WrappedKeyBlock.</p>"
+        }
+      }
+    },
     "TranslatePinDataInput":{
       "type":"structure",
       "required":[
@@ -2326,8 +2469,7 @@
     },
     "TranslationPinDataIsoFormat1":{
       "type":"structure",
-      "members":{
-      },
+      "members":{},
       "documentation":"<p>Parameters that are required for ISO9564 PIN format 1 tranlation.</p>"
     },
     "ValidationDataType":{
@@ -2564,7 +2706,6 @@
         "EncryptionKeyIdentifier",
         "VerificationAttributes",
         "EncryptedPinBlock",
-        "PrimaryAccountNumber",
         "PinBlockFormat"
       ],
       "members":{
@@ -2769,6 +2910,37 @@
       },
       "documentation":"<p>Parameter information of a WrappedKeyBlock for encryption key exchange.</p>",
       "union":true
+    },
+    "WrappedKeyMaterialFormat":{
+      "type":"string",
+      "enum":[
+        "KEY_CRYPTOGRAM",
+        "TR31_KEY_BLOCK",
+        "TR34_KEY_BLOCK"
+      ]
+    },
+    "WrappedWorkingKey":{
+      "type":"structure",
+      "required":[
+        "WrappedKeyMaterial",
+        "KeyCheckValue",
+        "WrappedKeyMaterialFormat"
+      ],
+      "members":{
+        "WrappedKeyMaterial":{
+          "shape":"KeyMaterial",
+          "documentation":"<p>The wrapped key block of the outgoing transaction key.</p>"
+        },
+        "KeyCheckValue":{
+          "shape":"KeyCheckValue",
+          "documentation":"<p>The key check value (KCV) of the key contained within the outgoing TR31WrappedKeyBlock.</p> <p> The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. For more information on KCV, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/terminology.html#terms.kcv\">KCV</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>"
+        },
+        "WrappedKeyMaterialFormat":{
+          "shape":"WrappedKeyMaterialFormat",
+          "documentation":"<p>The key block format of the wrapped key.</p>"
+        }
+      },
+      "documentation":"<p>The parameter information of the outgoing wrapped key block.</p>"
     }
   },
   "documentation":"<p>You use the Amazon Web Services Payment Cryptography Data Plane to manage how encryption keys are used for payment-related transaction processing and associated cryptographic operations. You can encrypt, decrypt, generate, verify, and translate payment-related cryptographic operations in Amazon Web Services Payment Cryptography. For more information, see <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/userguide/data-operations.html\">Data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>To manage your encryption keys, you use the <a href=\"https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/Welcome.html\">Amazon Web Services Payment Cryptography Control Plane</a>. You can create, import, export, share, manage, and delete keys. You can also manage Identity and Access Management (IAM) policies for keys. </p>"