Skip to content

Commit de7b7f0

Browse files
author
awstools
committed
feat(client-kms): AWS KMS announces the support for on-demand rotation of symmetric-encryption KMS keys with imported key material (EXTERNAL origin).
1 parent a79fcb1 commit de7b7f0

File tree

56 files changed

+1506
-857
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+1506
-857
lines changed

‎clients/client-kms/src/commands/CancelKeyDeletionCommand.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ export interface CancelKeyDeletionCommandOutput extends CancelKeyDeletionRespons
4343
* </p>
4444
* <p>
4545
* <b>Eventual consistency</b>: The KMS API follows an eventual consistency model.
46-
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html">KMS eventual consistency</a>.</p>
46+
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency">KMS eventual consistency</a>.</p>
4747
* @example
4848
* Use a bare-bones client and the command you need to make an API call.
4949
* ```javascript

‎clients/client-kms/src/commands/ConnectCustomKeyStoreCommand.ts

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ export interface ConnectCustomKeyStoreCommandInput extends ConnectCustomKeyStore
2828
export interface ConnectCustomKeyStoreCommandOutput extends ConnectCustomKeyStoreResponse, __MetadataBearer {}
2929

3030
/**
31-
* <p>Connects or reconnects a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a> to its backing key store. For an CloudHSM key
31+
* <p>Connects or reconnects a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html">custom key store</a> to its backing key store. For an CloudHSM key
3232
* store, <code>ConnectCustomKeyStore</code> connects the key store to its associated CloudHSM
3333
* cluster. For an external key store, <code>ConnectCustomKeyStore</code> connects the key store
3434
* to the external key store proxy that communicates with your external key manager.</p>
@@ -40,7 +40,7 @@ export interface ConnectCustomKeyStoreCommandOutput extends ConnectCustomKeyStor
4040
* complete. When it succeeds, this operation quickly returns an HTTP 200 response and a JSON
4141
* object with no properties. However, this response does not indicate that the custom key store
4242
* is connected. To get the connection state of the custom key store, use the <a>DescribeCustomKeyStores</a> operation.</p>
43-
* <p> This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key stores</a> feature in KMS, which
43+
* <p> This operation is part of the custom key stores feature in KMS, which
4444
* combines the convenience and extensive integration of KMS with the isolation and control of a
4545
* key store that you own and manage.</p>
4646
* <p>The <code>ConnectCustomKeyStore</code> operation might fail for various reasons. To find
@@ -59,7 +59,7 @@ export interface ConnectCustomKeyStoreCommandOutput extends ConnectCustomKeyStor
5959
* password.</p>
6060
* <p>To connect an CloudHSM key store, its associated CloudHSM cluster must have at least one active
6161
* HSM. To get the number of active HSMs in a cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation. To add HSMs
62-
* to the cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html">CreateHsm</a> operation. Also, the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser">
62+
* to the cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html">CreateHsm</a> operation. Also, the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html#concept-kmsuser">
6363
* <code>kmsuser</code> crypto
6464
* user</a> (CU) must not be logged into the cluster. This prevents KMS from using this
6565
* account to log in.</p>
@@ -117,7 +117,7 @@ export interface ConnectCustomKeyStoreCommandOutput extends ConnectCustomKeyStor
117117
* </ul>
118118
* <p>
119119
* <b>Eventual consistency</b>: The KMS API follows an eventual consistency model.
120-
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html">KMS eventual consistency</a>.</p>
120+
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency">KMS eventual consistency</a>.</p>
121121
* @example
122122
* Use a bare-bones client and the command you need to make an API call.
123123
* ```javascript

‎clients/client-kms/src/commands/CreateAliasCommand.ts

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,15 @@ export interface CreateAliasCommandOutput extends __MetadataBearer {}
3232
* <note>
3333
* <p>Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
3434
* </note>
35-
* <p>You can use an alias to identify a KMS key in the KMS console, in the <a>DescribeKey</a> operation and in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a>, such as <a>Encrypt</a> and
35+
* <p>You can use an alias to identify a KMS key in the KMS console, in the <a>DescribeKey</a> operation and in <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html#cryptographic-operations">cryptographic operations</a>, such as <a>Encrypt</a> and
3636
* <a>GenerateDataKey</a>. You can also change the KMS key that's associated with
3737
* the alias (<a>UpdateAlias</a>) or delete the alias (<a>DeleteAlias</a>)
3838
* at any time. These operations don't affect the underlying KMS key. </p>
3939
* <p>You can associate the alias with any customer managed key in the same Amazon Web Services Region. Each
4040
* alias is associated with only one KMS key at a time, but a KMS key can have multiple aliases.
4141
* A valid KMS key is required. You can't create an alias without a KMS key.</p>
4242
* <p>The alias must be unique in the account and Region, but you can have aliases with the same
43-
* name in different Regions. For detailed information about aliases, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html">Using aliases</a> in the
43+
* name in different Regions. For detailed information about aliases, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html">Aliases in KMS</a> in the
4444
* <i>Key Management Service Developer Guide</i>.</p>
4545
* <p>This operation does not return a response. To get the alias that you created, use the
4646
* <a>ListAliases</a> operation.</p>
@@ -63,8 +63,7 @@ export interface CreateAliasCommandOutput extends __MetadataBearer {}
6363
* the KMS key (key policy).</p>
6464
* </li>
6565
* </ul>
66-
* <p>For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html#alias-access">Controlling access to aliases</a> in the
67-
* <i>Key Management Service Developer Guide</i>.</p>
66+
* <p>For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/alias-access.html">Controlling access to aliases</a> in the <i>Key Management Service Developer Guide</i>.</p>
6867
* <p>
6968
* <b>Related operations:</b>
7069
* </p>
@@ -87,7 +86,7 @@ export interface CreateAliasCommandOutput extends __MetadataBearer {}
8786
* </ul>
8887
* <p>
8988
* <b>Eventual consistency</b>: The KMS API follows an eventual consistency model.
90-
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html">KMS eventual consistency</a>.</p>
89+
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency">KMS eventual consistency</a>.</p>
9190
* @example
9291
* Use a bare-bones client and the command you need to make an API call.
9392
* ```javascript
@@ -146,8 +145,9 @@ export interface CreateAliasCommandOutput extends __MetadataBearer {}
146145
* </ul>
147146
*
148147
* @throws {@link LimitExceededException} (client fault)
149-
* <p>The request was rejected because a quota was exceeded. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/limits.html">Quotas</a> in the
150-
* <i>Key Management Service Developer Guide</i>.</p>
148+
* <p>The request was rejected because a length constraint or quota was exceeded. For more
149+
* information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/limits.html">Quotas</a> in
150+
* the <i>Key Management Service Developer Guide</i>.</p>
151151
*
152152
* @throws {@link NotFoundException} (client fault)
153153
* <p>The request was rejected because the specified entity or resource could not be

‎clients/client-kms/src/commands/CreateCustomKeyStoreCommand.ts

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,14 @@ export interface CreateCustomKeyStoreCommandInput extends CreateCustomKeyStoreRe
3232
export interface CreateCustomKeyStoreCommandOutput extends CreateCustomKeyStoreResponse, __MetadataBearer {}
3333

3434
/**
35-
* <p>Creates a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a> backed by a key store that you own and manage. When you use a
35+
* <p>Creates a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html">custom key store</a> backed by a key store that you own and manage. When you use a
3636
* KMS key in a custom key store for a cryptographic operation, the cryptographic operation is
3737
* actually performed in your key store using your keys. KMS supports <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-cloudhsm.html">CloudHSM key stores</a>
3838
* backed by an <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/clusters.html">CloudHSM cluster</a>
3939
* and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html">external key
4040
* stores</a> backed by an external key store proxy and external key manager outside of
4141
* Amazon Web Services.</p>
42-
* <p> This operation is part of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key stores</a> feature in KMS, which
42+
* <p> This operation is part of the custom key stores feature in KMS, which
4343
* combines the convenience and extensive integration of KMS with the isolation and control of a
4444
* key store that you own and manage.</p>
4545
* <p>Before you create the custom key store, the required elements must be in place and
@@ -85,8 +85,6 @@ export interface CreateCustomKeyStoreCommandOutput extends CreateCustomKeyStoreR
8585
* external key manager. Even if you are not going to use your custom key store immediately, you
8686
* might want to connect it to verify that all settings are correct and then disconnect it until
8787
* you are ready to use it.</p>
88-
* <p>For help with failures, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html">Troubleshooting a custom key store</a> in the
89-
* <i>Key Management Service Developer Guide</i>.</p>
9088
* <p>
9189
* <b>Cross-account use</b>: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account.</p>
9290
* <p>
@@ -123,7 +121,7 @@ export interface CreateCustomKeyStoreCommandOutput extends CreateCustomKeyStoreR
123121
* </ul>
124122
* <p>
125123
* <b>Eventual consistency</b>: The KMS API follows an eventual consistency model.
126-
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html">KMS eventual consistency</a>.</p>
124+
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency">KMS eventual consistency</a>.</p>
127125
* @example
128126
* Use a bare-bones client and the command you need to make an API call.
129127
* ```javascript
@@ -227,8 +225,9 @@ export interface CreateCustomKeyStoreCommandOutput extends CreateCustomKeyStoreR
227225
* retried.</p>
228226
*
229227
* @throws {@link LimitExceededException} (client fault)
230-
* <p>The request was rejected because a quota was exceeded. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/limits.html">Quotas</a> in the
231-
* <i>Key Management Service Developer Guide</i>.</p>
228+
* <p>The request was rejected because a length constraint or quota was exceeded. For more
229+
* information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/limits.html">Quotas</a> in
230+
* the <i>Key Management Service Developer Guide</i>.</p>
232231
*
233232
* @throws {@link XksProxyIncorrectAuthenticationCredentialException} (client fault)
234233
* <p>The request was rejected because the proxy credentials failed to authenticate to the

‎clients/client-kms/src/commands/CreateGrantCommand.ts

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,17 +37,17 @@ export interface CreateGrantCommandOutput extends CreateGrantResponse, __Metadat
3737
* <p>For detailed information about grants, including grant terminology, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html">Grants in KMS</a> in the
3838
* <i>
3939
* <i>Key Management Service Developer Guide</i>
40-
* </i>. For examples of working with grants in several
41-
* programming languages, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/programming-grants.html">Programming grants</a>. </p>
40+
* </i>. For examples of creating grants in several
41+
* programming languages, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/example_kms_CreateGrant_section.html">Use CreateGrant with an Amazon Web Services SDK or CLI</a>. </p>
4242
* <p>The <code>CreateGrant</code> operation returns a <code>GrantToken</code> and a
4343
* <code>GrantId</code>.</p>
4444
* <ul>
4545
* <li>
4646
* <p>When you create, retire, or revoke a grant, there might be a brief delay, usually less than five minutes, until the grant is available throughout KMS. This state is known as <i>eventual consistency</i>. Once the grant has achieved eventual consistency, the grantee
4747
* principal can use the permissions in the grant without identifying the grant. </p>
4848
* <p>However, to use the permissions in the grant immediately, use the
49-
* <code>GrantToken</code> that <code>CreateGrant</code> returns. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a
50-
* grant token</a> in the <i>
49+
* <code>GrantToken</code> that <code>CreateGrant</code> returns. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html">Using a grant
50+
* token</a> in the <i>
5151
* <i>Key Management Service Developer Guide</i>
5252
* </i>.</p>
5353
* </li>
@@ -92,7 +92,7 @@ export interface CreateGrantCommandOutput extends CreateGrantResponse, __Metadat
9292
* </ul>
9393
* <p>
9494
* <b>Eventual consistency</b>: The KMS API follows an eventual consistency model.
95-
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html">KMS eventual consistency</a>.</p>
95+
* For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency">KMS eventual consistency</a>.</p>
9696
* @example
9797
* Use a bare-bones client and the command you need to make an API call.
9898
* ```javascript
@@ -177,8 +177,9 @@ export interface CreateGrantCommandOutput extends CreateGrantResponse, __Metadat
177177
* </ul>
178178
*
179179
* @throws {@link LimitExceededException} (client fault)
180-
* <p>The request was rejected because a quota was exceeded. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/limits.html">Quotas</a> in the
181-
* <i>Key Management Service Developer Guide</i>.</p>
180+
* <p>The request was rejected because a length constraint or quota was exceeded. For more
181+
* information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/limits.html">Quotas</a> in
182+
* the <i>Key Management Service Developer Guide</i>.</p>
182183
*
183184
* @throws {@link NotFoundException} (client fault)
184185
* <p>The request was rejected because the specified entity or resource could not be

0 commit comments

Comments
 (0)