class Aws::KMS::Types::GenerateDataKeyPairRequest

@see docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairRequest AWS API Documentation
@return [Boolean] : docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html permissions][1] in the *Key Management Service Developer Guide*.
To learn more about how to use this parameter, see [Testing your
parameter.
Checks if your request will succeed. ‘DryRun` is an optional
@!attribute [rw] dry_run
@return [Types::RecipientInfo] : docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html [2]: docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk [1]: docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc uses KMS] in the *Key Management Service Developer Guide*.
Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
For information about the interaction between KMS and Amazon Web
response is null or empty.
by the `KeyId` parameter. The `PrivateKeyPlaintext` field in the
a copy of the private data key encrypted under the KMS key specified
in the enclave. The `CiphertextBlob` field in the response contains
response. This ciphertext can be decrypted only with the private key
resulting ciphertext in the `CiphertextForRecipient` field in the
under the public key in the attestation document, and returns the
of the private data key, KMS encrypts the plaintext private data key
When you use this parameter, instead of returning a plaintext copy
the attestation document for the enclave.
the Recipient parameter from any Amazon Web Services SDK to provide
Enclaves SDK] to generate the attestation document and then use
Web Services Nitro Enclaves, use the [Amazon Web Services Nitro
Services Nitro Enclaves. To call DeriveSharedSecret for an Amazon
This parameter only supports attestation documents for Amazon Web
`RSAES_OAEP_SHA_256`.
public key. The only valid encryption algorithm is
enclave and the encryption algorithm to use with the enclave’s
A signed [attestation document] from an Amazon Web Services Nitro
@!attribute [rw] recipient
@return [Array<String>] : docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html [1]: docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token token][2] in the *Key Management Service Developer Guide*.
For more information, see [Grant token] and [Using a grant
from a new grant that has not yet achieved *eventual consistency*.
Use a grant token when your permission to call this operation comes
A list of grant tokens.
@!attribute [rw] grant_tokens
@return [String]
Regions.
used outside of KMS. The SM2 key spec is only available in China
sign and verify only are not effective on data key pairs, which are
verify, and the rule that permits you to use ML-DSA key pairs to
the rule that permits you to use ECC KMS keys only to sign and
keys to encrypt and decrypt or to sign and verify (but not both),
The KMS rule that restricts the use of asymmetric RSA and SM2 KMS
Determines the type of data key pair that is generated.
@!attribute [rw] key_pair_spec
@return [String]
DescribeKey. To get the alias name and alias ARN, use ListAliases.
To get the key ID and key ARN for a KMS key, use ListKeys or
* Alias ARN: ‘arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
* Alias name: `alias/ExampleAlias`
`arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
* Key ARN:
* Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
For example:
the key ARN or alias ARN.
a KMS key in a different Amazon Web Services account, you must use
ARN. When using an alias name, prefix it with `“alias/”`. To specify
To specify a KMS key, use its key ID, key ARN, alias name, or alias
your KMS key, use the DescribeKey operation.
or a KMS key in a custom key store. To get the type and origin of
key in the data key pair. You cannot specify an asymmetric KMS key
Specifies the symmetric encryption KMS key that encrypts the private
@!attribute [rw] key_id
@return [Hash<String,String>] : docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html Management Service Developer Guide*.
For more information, see [Encryption context] in the *Key
recommended.
keys, an encryption context is optional, but it is strongly
encryption KMS keys. On operations with symmetric encryption KMS
An encryption context is supported only on operations with symmetric
exact case-sensitive match) encryption context to decrypt the data.
encryption context to encrypt data, you must specify the same (an
pairs that represent additional authenticated data. When you use an
An *encryption context* is a collection of non-secret key-value
other output.
This field may be displayed in plaintext in CloudTrail logs and
Do not include confidential or sensitive information in this field.
the private key in the data key pair.
Specifies the encryption context that will be used when encrypting
@!attribute [rw] encryption_context

class Aws::KMS::Types::GenerateDataKeyPairRequest

Namespace

Included Modules

Defined in