class Aws::KMS::Types::GenerateDataKeyRequest

@see docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyRequest AWS API Documentation
@return [Boolean]<br>: docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html<br><br><br><br>permissions][1] in the *Key Management Service Developer Guide*.
To learn more about how to use this parameter, see [Testing your
parameter.
Checks if your request will succeed. ‘DryRun` is an optional
@!attribute [rw] dry_run
@return [Types::RecipientInfo]<br>: docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html<br>[2]: docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk<br>[1]: docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc<br><br><br><br>uses KMS] in the *Key Management Service Developer Guide*.
Services Nitro Enclaves, see [How Amazon Web Services Nitro Enclaves
For information about the interaction between KMS and Amazon Web
The `Plaintext` field in the response is null or empty.
key encrypted under the KMS key specified by the `KeyId` parameter.
`CiphertextBlob` field in the response contains a copy of the data
be decrypted only with the private key in the enclave. The
`CiphertextForRecipient` field in the response. This ciphertext can
attestation document, and returns the resulting ciphertext in the
key, KMS encrypts the plaintext data key under the public key in the
When you use this parameter, instead of returning the plaintext data
Web Services Nitro Enclaves SDK] or any Amazon Web Services SDK.
Services Nitro Enclaves. To include this parameter, use the [Amazon
This parameter only supports attestation documents for Amazon Web
`RSAES_OAEP_SHA_256`.
public key. The only valid encryption algorithm is
enclave and the encryption algorithm to use with the enclave’s
A signed [attestation document] from an Amazon Web Services Nitro
@!attribute [rw] recipient
@return [Array<String>]<br>: docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html<br>[1]: docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token<br><br><br><br>token][2] in the *Key Management Service Developer Guide*.
For more information, see [Grant token] and [Using a grant
from a new grant that has not yet achieved *eventual consistency*.
Use a grant token when your permission to call this operation comes
A list of grant tokens.
@!attribute [rw] grant_tokens
@return [String]
parameter (but not both) in every ‘GenerateDataKey` request.
You must specify either the `KeySpec` or the `NumberOfBytes`
key.
128-bit symmetric key, or `AES_256` to generate a 256-bit symmetric
Specifies the length of the data key. Use `AES_128` to generate a
@!attribute [rw] key_spec
@return [Integer]
parameter (but not both) in every `GenerateDataKey` request.
You must specify either the `KeySpec` or the `NumberOfBytes`
parameter.
128-bit (16-byte) and 256-bit (32-byte) data keys, use the `KeySpec`
value 64 to generate a 512-bit data key (64 bytes is 512 bits). For
Specifies the length of the data key in bytes. For example, use the
@!attribute [rw] number_of_bytes
@return [Hash<String,String>]<br>: docs.aws.amazon.com/kms/latest/developerguide/encrypt_context.html<br><br><br><br>Management Service Developer Guide*.
For more information, see [Encryption context] in the *Key
recommended.
keys, an encryption context is optional, but it is strongly
encryption KMS keys. On operations with symmetric encryption KMS
An encryption context is supported only on operations with symmetric
exact case-sensitive match) encryption context to decrypt the data.
encryption context to encrypt data, you must specify the same (an
pairs that represent additional authenticated data. When you use an
An *encryption context* is a collection of non-secret key-value
other output.
This field may be displayed in plaintext in CloudTrail logs and
Do not include confidential or sensitive information in this field.
the data key.
Specifies the encryption context that will be used when encrypting
@!attribute [rw] encryption_context
@return [String]
DescribeKey. To get the alias name and alias ARN, use ListAliases.
To get the key ID and key ARN for a KMS key, use ListKeys or
* Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`
* Alias name: `alias/ExampleAlias`
`arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
* Key ARN:
* Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`
For example:
the key ARN or alias ARN.
a KMS key in a different Amazon Web Services account, you must use
ARN. When using an alias name, prefix it with `“alias/”`. To specify
To specify a KMS key, use its key ID, key ARN, alias name, or alias
the DescribeKey operation.
custom key store. To get the type and origin of your KMS key, use
key. You cannot specify an asymmetric KMS key or a KMS key in a
Specifies the symmetric encryption KMS key that encrypts the data
@!attribute [rw] key_id