// Code generated by software.amazon.smithy.rust.codegen.smithy-rs. DO NOT EDIT.
use std::fmt::Write;
/// See [`CancelKeyDeletionInput`](crate::input::CancelKeyDeletionInput).
pub mod cancel_key_deletion_input {
/// A builder for [`CancelKeyDeletionInput`](crate::input::CancelKeyDeletionInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Identifies the KMS key whose deletion is being canceled.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the KMS key whose deletion is being canceled.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Consumes the builder and constructs a [`CancelKeyDeletionInput`](crate::input::CancelKeyDeletionInput).
pub fn build(
self,
) -> Result<
crate::input::CancelKeyDeletionInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::CancelKeyDeletionInput {
key_id: self.key_id,
})
}
}
}
impl CancelKeyDeletionInput {
/// Consumes the builder and constructs an Operation<[`CancelKeyDeletion`](crate::operation::CancelKeyDeletion)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::CancelKeyDeletion,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::CancelKeyDeletionInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::CancelKeyDeletionInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.CancelKeyDeletion",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_cancel_key_deletion(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::CancelKeyDeletion::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"CancelKeyDeletion",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`CancelKeyDeletionInput`](crate::input::CancelKeyDeletionInput).
pub fn builder() -> crate::input::cancel_key_deletion_input::Builder {
crate::input::cancel_key_deletion_input::Builder::default()
}
}
/// See [`ConnectCustomKeyStoreInput`](crate::input::ConnectCustomKeyStoreInput).
pub mod connect_custom_key_store_input {
/// A builder for [`ConnectCustomKeyStoreInput`](crate::input::ConnectCustomKeyStoreInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) custom_key_store_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Enter the key store ID of the custom key store that you want to connect. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn custom_key_store_id(mut self, input: impl Into<std::string::String>) -> Self {
self.custom_key_store_id = Some(input.into());
self
}
/// <p>Enter the key store ID of the custom key store that you want to connect. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn set_custom_key_store_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.custom_key_store_id = input;
self
}
/// Consumes the builder and constructs a [`ConnectCustomKeyStoreInput`](crate::input::ConnectCustomKeyStoreInput).
pub fn build(
self,
) -> Result<
crate::input::ConnectCustomKeyStoreInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::ConnectCustomKeyStoreInput {
custom_key_store_id: self.custom_key_store_id,
})
}
}
}
impl ConnectCustomKeyStoreInput {
/// Consumes the builder and constructs an Operation<[`ConnectCustomKeyStore`](crate::operation::ConnectCustomKeyStore)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ConnectCustomKeyStore,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ConnectCustomKeyStoreInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ConnectCustomKeyStoreInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ConnectCustomKeyStore",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_connect_custom_key_store(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::ConnectCustomKeyStore::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"ConnectCustomKeyStore",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ConnectCustomKeyStoreInput`](crate::input::ConnectCustomKeyStoreInput).
pub fn builder() -> crate::input::connect_custom_key_store_input::Builder {
crate::input::connect_custom_key_store_input::Builder::default()
}
}
/// See [`CreateAliasInput`](crate::input::CreateAliasInput).
pub mod create_alias_input {
/// A builder for [`CreateAliasInput`](crate::input::CreateAliasInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) alias_name: std::option::Option<std::string::String>,
pub(crate) target_key_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Specifies the alias name. This value must begin with <code>alias/</code> followed by a name, such as <code>alias/ExampleAlias</code>. </p>
/// <p>The <code>AliasName</code> value must be string of 1-256 characters. It can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). The alias name cannot begin with <code>alias/aws/</code>. The <code>alias/aws/</code> prefix is reserved for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed keys</a>.</p>
pub fn alias_name(mut self, input: impl Into<std::string::String>) -> Self {
self.alias_name = Some(input.into());
self
}
/// <p>Specifies the alias name. This value must begin with <code>alias/</code> followed by a name, such as <code>alias/ExampleAlias</code>. </p>
/// <p>The <code>AliasName</code> value must be string of 1-256 characters. It can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). The alias name cannot begin with <code>alias/aws/</code>. The <code>alias/aws/</code> prefix is reserved for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed keys</a>.</p>
pub fn set_alias_name(mut self, input: std::option::Option<std::string::String>) -> Self {
self.alias_name = input;
self
}
/// <p>Associates the alias with the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>. The KMS key must be in the same Amazon Web Services Region. </p>
/// <p>A valid key ID is required. If you supply a null or empty string value, this operation returns an error.</p>
/// <p>For help finding the key ID and ARN, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn">Finding the Key ID and ARN</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn target_key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.target_key_id = Some(input.into());
self
}
/// <p>Associates the alias with the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>. The KMS key must be in the same Amazon Web Services Region. </p>
/// <p>A valid key ID is required. If you supply a null or empty string value, this operation returns an error.</p>
/// <p>For help finding the key ID and ARN, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn">Finding the Key ID and ARN</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_target_key_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.target_key_id = input;
self
}
/// Consumes the builder and constructs a [`CreateAliasInput`](crate::input::CreateAliasInput).
pub fn build(
self,
) -> Result<crate::input::CreateAliasInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::CreateAliasInput {
alias_name: self.alias_name,
target_key_id: self.target_key_id,
})
}
}
}
impl CreateAliasInput {
/// Consumes the builder and constructs an Operation<[`CreateAlias`](crate::operation::CreateAlias)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::CreateAlias,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::CreateAliasInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::CreateAliasInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.CreateAlias",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_create_alias(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::CreateAlias::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"CreateAlias",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`CreateAliasInput`](crate::input::CreateAliasInput).
pub fn builder() -> crate::input::create_alias_input::Builder {
crate::input::create_alias_input::Builder::default()
}
}
/// See [`CreateCustomKeyStoreInput`](crate::input::CreateCustomKeyStoreInput).
pub mod create_custom_key_store_input {
/// A builder for [`CreateCustomKeyStoreInput`](crate::input::CreateCustomKeyStoreInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default)]
pub struct Builder {
pub(crate) custom_key_store_name: std::option::Option<std::string::String>,
pub(crate) cloud_hsm_cluster_id: std::option::Option<std::string::String>,
pub(crate) trust_anchor_certificate: std::option::Option<std::string::String>,
pub(crate) key_store_password: std::option::Option<std::string::String>,
pub(crate) custom_key_store_type: std::option::Option<crate::model::CustomKeyStoreType>,
pub(crate) xks_proxy_uri_endpoint: std::option::Option<std::string::String>,
pub(crate) xks_proxy_uri_path: std::option::Option<std::string::String>,
pub(crate) xks_proxy_vpc_endpoint_service_name: std::option::Option<std::string::String>,
pub(crate) xks_proxy_authentication_credential:
std::option::Option<crate::model::XksProxyAuthenticationCredentialType>,
pub(crate) xks_proxy_connectivity:
std::option::Option<crate::model::XksProxyConnectivityType>,
}
impl Builder {
/// <p>Specifies a friendly name for the custom key store. The name must be unique in your Amazon Web Services account and Region. This parameter is required for all custom key stores.</p>
pub fn custom_key_store_name(mut self, input: impl Into<std::string::String>) -> Self {
self.custom_key_store_name = Some(input.into());
self
}
/// <p>Specifies a friendly name for the custom key store. The name must be unique in your Amazon Web Services account and Region. This parameter is required for all custom key stores.</p>
pub fn set_custom_key_store_name(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.custom_key_store_name = input;
self
}
/// <p>Identifies the CloudHSM cluster for an CloudHSM key store. This parameter is required for custom key stores with <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the cluster ID of any active CloudHSM cluster that is not already associated with a custom key store. To find the cluster ID, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation.</p>
pub fn cloud_hsm_cluster_id(mut self, input: impl Into<std::string::String>) -> Self {
self.cloud_hsm_cluster_id = Some(input.into());
self
}
/// <p>Identifies the CloudHSM cluster for an CloudHSM key store. This parameter is required for custom key stores with <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the cluster ID of any active CloudHSM cluster that is not already associated with a custom key store. To find the cluster ID, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation.</p>
pub fn set_cloud_hsm_cluster_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.cloud_hsm_cluster_id = input;
self
}
/// <p>Specifies the certificate for an CloudHSM key store. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the content of the trust anchor certificate for the CloudHSM cluster. This is the content of the <code>customerCA.crt</code> file that you created when you <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html">initialized the cluster</a>.</p>
pub fn trust_anchor_certificate(mut self, input: impl Into<std::string::String>) -> Self {
self.trust_anchor_certificate = Some(input.into());
self
}
/// <p>Specifies the certificate for an CloudHSM key store. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the content of the trust anchor certificate for the CloudHSM cluster. This is the content of the <code>customerCA.crt</code> file that you created when you <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html">initialized the cluster</a>.</p>
pub fn set_trust_anchor_certificate(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.trust_anchor_certificate = input;
self
}
/// <p>Specifies the <code>kmsuser</code> password for an CloudHSM key store. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the password of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser"> <code>kmsuser</code> crypto user (CU) account</a> in the specified CloudHSM cluster. KMS logs into the cluster as this user to manage key material on your behalf.</p>
/// <p>The password must be a string of 7 to 32 characters. Its value is case sensitive.</p>
/// <p>This parameter tells KMS the <code>kmsuser</code> account password; it does not change the password in the CloudHSM cluster.</p>
pub fn key_store_password(mut self, input: impl Into<std::string::String>) -> Self {
self.key_store_password = Some(input.into());
self
}
/// <p>Specifies the <code>kmsuser</code> password for an CloudHSM key store. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the password of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser"> <code>kmsuser</code> crypto user (CU) account</a> in the specified CloudHSM cluster. KMS logs into the cluster as this user to manage key material on your behalf.</p>
/// <p>The password must be a string of 7 to 32 characters. Its value is case sensitive.</p>
/// <p>This parameter tells KMS the <code>kmsuser</code> account password; it does not change the password in the CloudHSM cluster.</p>
pub fn set_key_store_password(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.key_store_password = input;
self
}
/// <p>Specifies the type of custom key store. The default value is <code>AWS_CLOUDHSM</code>.</p>
/// <p>For a custom key store backed by an CloudHSM cluster, omit the parameter or enter <code>AWS_CLOUDHSM</code>. For a custom key store backed by an external key manager outside of Amazon Web Services, enter <code>EXTERNAL_KEY_STORE</code>. You cannot change this property after the key store is created.</p>
pub fn custom_key_store_type(mut self, input: crate::model::CustomKeyStoreType) -> Self {
self.custom_key_store_type = Some(input);
self
}
/// <p>Specifies the type of custom key store. The default value is <code>AWS_CLOUDHSM</code>.</p>
/// <p>For a custom key store backed by an CloudHSM cluster, omit the parameter or enter <code>AWS_CLOUDHSM</code>. For a custom key store backed by an external key manager outside of Amazon Web Services, enter <code>EXTERNAL_KEY_STORE</code>. You cannot change this property after the key store is created.</p>
pub fn set_custom_key_store_type(
mut self,
input: std::option::Option<crate::model::CustomKeyStoreType>,
) -> Self {
self.custom_key_store_type = input;
self
}
/// <p>Specifies the endpoint that KMS uses to send requests to the external key store proxy (XKS proxy). This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The protocol must be HTTPS. KMS communicates on port 443. Do not specify the port in the <code>XksProxyUriEndpoint</code> value.</p>
/// <p>For external key stores with <code>XksProxyConnectivity</code> value of <code>VPC_ENDPOINT_SERVICE</code>, specify <code>https://</code> followed by the private DNS name of the VPC endpoint service.</p>
/// <p>For external key stores with <code>PUBLIC_ENDPOINT</code> connectivity, this endpoint must be reachable before you create the custom key store. KMS connects to the external key store proxy while creating the custom key store. For external key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity, KMS connects when you call the <code>ConnectCustomKeyStore</code> operation.</p>
/// <p>The value of this parameter must begin with <code>https://</code>. The remainder can contain upper and lower case letters (A-Z and a-z), numbers (0-9), dots (<code>.</code>), and hyphens (<code>-</code>). Additional slashes (<code>/</code> and <code>\</code>) are not permitted.</p>
/// <p> <b>Uniqueness requirements: </b> </p>
/// <ul>
/// <li> <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p> </li>
/// <li> <p>An external key store with <code>PUBLIC_ENDPOINT</code> connectivity cannot use the same <code>XksProxyUriEndpoint</code> value as an external key store with <code>VPC_ENDPOINT_SERVICE</code> connectivity in the same Amazon Web Services Region.</p> </li>
/// <li> <p>Each external key store with <code>VPC_ENDPOINT_SERVICE</code> connectivity must have its own private DNS name. The <code>XksProxyUriEndpoint</code> value for external key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity (private DNS name) must be unique in the Amazon Web Services account and Region.</p> </li>
/// </ul>
pub fn xks_proxy_uri_endpoint(mut self, input: impl Into<std::string::String>) -> Self {
self.xks_proxy_uri_endpoint = Some(input.into());
self
}
/// <p>Specifies the endpoint that KMS uses to send requests to the external key store proxy (XKS proxy). This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The protocol must be HTTPS. KMS communicates on port 443. Do not specify the port in the <code>XksProxyUriEndpoint</code> value.</p>
/// <p>For external key stores with <code>XksProxyConnectivity</code> value of <code>VPC_ENDPOINT_SERVICE</code>, specify <code>https://</code> followed by the private DNS name of the VPC endpoint service.</p>
/// <p>For external key stores with <code>PUBLIC_ENDPOINT</code> connectivity, this endpoint must be reachable before you create the custom key store. KMS connects to the external key store proxy while creating the custom key store. For external key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity, KMS connects when you call the <code>ConnectCustomKeyStore</code> operation.</p>
/// <p>The value of this parameter must begin with <code>https://</code>. The remainder can contain upper and lower case letters (A-Z and a-z), numbers (0-9), dots (<code>.</code>), and hyphens (<code>-</code>). Additional slashes (<code>/</code> and <code>\</code>) are not permitted.</p>
/// <p> <b>Uniqueness requirements: </b> </p>
/// <ul>
/// <li> <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p> </li>
/// <li> <p>An external key store with <code>PUBLIC_ENDPOINT</code> connectivity cannot use the same <code>XksProxyUriEndpoint</code> value as an external key store with <code>VPC_ENDPOINT_SERVICE</code> connectivity in the same Amazon Web Services Region.</p> </li>
/// <li> <p>Each external key store with <code>VPC_ENDPOINT_SERVICE</code> connectivity must have its own private DNS name. The <code>XksProxyUriEndpoint</code> value for external key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity (private DNS name) must be unique in the Amazon Web Services account and Region.</p> </li>
/// </ul>
pub fn set_xks_proxy_uri_endpoint(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.xks_proxy_uri_endpoint = input;
self
}
/// <p>Specifies the base path to the proxy APIs for this external key store. To find this value, see the documentation for your external key store proxy. This parameter is required for all custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The value must start with <code>/</code> and must end with <code>/kms/xks/v1</code> where <code>v1</code> represents the version of the KMS external key store proxy API. This path can include an optional prefix between the required elements such as <code>/<i>prefix</i>/kms/xks/v1</code>.</p>
/// <p> <b>Uniqueness requirements: </b> </p>
/// <ul>
/// <li> <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p> </li>
/// </ul>
pub fn xks_proxy_uri_path(mut self, input: impl Into<std::string::String>) -> Self {
self.xks_proxy_uri_path = Some(input.into());
self
}
/// <p>Specifies the base path to the proxy APIs for this external key store. To find this value, see the documentation for your external key store proxy. This parameter is required for all custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The value must start with <code>/</code> and must end with <code>/kms/xks/v1</code> where <code>v1</code> represents the version of the KMS external key store proxy API. This path can include an optional prefix between the required elements such as <code>/<i>prefix</i>/kms/xks/v1</code>.</p>
/// <p> <b>Uniqueness requirements: </b> </p>
/// <ul>
/// <li> <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p> </li>
/// </ul>
pub fn set_xks_proxy_uri_path(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.xks_proxy_uri_path = input;
self
}
/// <p>Specifies the name of the Amazon VPC endpoint service for interface endpoints that is used to communicate with your external key store proxy (XKS proxy). This parameter is required when the value of <code>CustomKeyStoreType</code> is <code>EXTERNAL_KEY_STORE</code> and the value of <code>XksProxyConnectivity</code> is <code>VPC_ENDPOINT_SERVICE</code>.</p>
/// <p>The Amazon VPC endpoint service must <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keystore.html#xks-requirements">fulfill all requirements</a> for use with an external key store. </p>
/// <p> <b>Uniqueness requirements:</b> </p>
/// <ul>
/// <li> <p>External key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity can share an Amazon VPC, but each external key store must have its own VPC endpoint service and private DNS name.</p> </li>
/// </ul>
pub fn xks_proxy_vpc_endpoint_service_name(
mut self,
input: impl Into<std::string::String>,
) -> Self {
self.xks_proxy_vpc_endpoint_service_name = Some(input.into());
self
}
/// <p>Specifies the name of the Amazon VPC endpoint service for interface endpoints that is used to communicate with your external key store proxy (XKS proxy). This parameter is required when the value of <code>CustomKeyStoreType</code> is <code>EXTERNAL_KEY_STORE</code> and the value of <code>XksProxyConnectivity</code> is <code>VPC_ENDPOINT_SERVICE</code>.</p>
/// <p>The Amazon VPC endpoint service must <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keystore.html#xks-requirements">fulfill all requirements</a> for use with an external key store. </p>
/// <p> <b>Uniqueness requirements:</b> </p>
/// <ul>
/// <li> <p>External key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity can share an Amazon VPC, but each external key store must have its own VPC endpoint service and private DNS name.</p> </li>
/// </ul>
pub fn set_xks_proxy_vpc_endpoint_service_name(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.xks_proxy_vpc_endpoint_service_name = input;
self
}
/// <p>Specifies an authentication credential for the external key store proxy (XKS proxy). This parameter is required for all custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The <code>XksProxyAuthenticationCredential</code> has two required elements: <code>RawSecretAccessKey</code>, a secret key, and <code>AccessKeyId</code>, a unique identifier for the <code>RawSecretAccessKey</code>. For character requirements, see <a href="kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html">XksProxyAuthenticationCredentialType</a>.</p>
/// <p>KMS uses this authentication credential to sign requests to the external key store proxy on your behalf. This credential is unrelated to Identity and Access Management (IAM) and Amazon Web Services credentials.</p>
/// <p>This parameter doesn't set or change the authentication credentials on the XKS proxy. It just tells KMS the credential that you established on your external key store proxy. If you rotate your proxy authentication credential, use the <code>UpdateCustomKeyStore</code> operation to provide the new credential to KMS.</p>
pub fn xks_proxy_authentication_credential(
mut self,
input: crate::model::XksProxyAuthenticationCredentialType,
) -> Self {
self.xks_proxy_authentication_credential = Some(input);
self
}
/// <p>Specifies an authentication credential for the external key store proxy (XKS proxy). This parameter is required for all custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The <code>XksProxyAuthenticationCredential</code> has two required elements: <code>RawSecretAccessKey</code>, a secret key, and <code>AccessKeyId</code>, a unique identifier for the <code>RawSecretAccessKey</code>. For character requirements, see <a href="kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html">XksProxyAuthenticationCredentialType</a>.</p>
/// <p>KMS uses this authentication credential to sign requests to the external key store proxy on your behalf. This credential is unrelated to Identity and Access Management (IAM) and Amazon Web Services credentials.</p>
/// <p>This parameter doesn't set or change the authentication credentials on the XKS proxy. It just tells KMS the credential that you established on your external key store proxy. If you rotate your proxy authentication credential, use the <code>UpdateCustomKeyStore</code> operation to provide the new credential to KMS.</p>
pub fn set_xks_proxy_authentication_credential(
mut self,
input: std::option::Option<crate::model::XksProxyAuthenticationCredentialType>,
) -> Self {
self.xks_proxy_authentication_credential = input;
self
}
/// <p>Indicates how KMS communicates with the external key store proxy. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>If the external key store proxy uses a public endpoint, specify <code>PUBLIC_ENDPOINT</code>. If the external key store proxy uses a Amazon VPC endpoint service for communication with KMS, specify <code>VPC_ENDPOINT_SERVICE</code>. For help making this choice, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity">Choosing a connectivity option</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>An Amazon VPC endpoint service keeps your communication with KMS in a private address space entirely within Amazon Web Services, but it requires more configuration, including establishing a Amazon VPC with multiple subnets, a VPC endpoint service, a network load balancer, and a verified private DNS name. A public endpoint is simpler to set up, but it might be slower and might not fulfill your security requirements. You might consider testing with a public endpoint, and then establishing a VPC endpoint service for production tasks. Note that this choice does not determine the location of the external key store proxy. Even if you choose a VPC endpoint service, the proxy can be hosted within the VPC or outside of Amazon Web Services such as in your corporate data center.</p>
pub fn xks_proxy_connectivity(
mut self,
input: crate::model::XksProxyConnectivityType,
) -> Self {
self.xks_proxy_connectivity = Some(input);
self
}
/// <p>Indicates how KMS communicates with the external key store proxy. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>If the external key store proxy uses a public endpoint, specify <code>PUBLIC_ENDPOINT</code>. If the external key store proxy uses a Amazon VPC endpoint service for communication with KMS, specify <code>VPC_ENDPOINT_SERVICE</code>. For help making this choice, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity">Choosing a connectivity option</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>An Amazon VPC endpoint service keeps your communication with KMS in a private address space entirely within Amazon Web Services, but it requires more configuration, including establishing a Amazon VPC with multiple subnets, a VPC endpoint service, a network load balancer, and a verified private DNS name. A public endpoint is simpler to set up, but it might be slower and might not fulfill your security requirements. You might consider testing with a public endpoint, and then establishing a VPC endpoint service for production tasks. Note that this choice does not determine the location of the external key store proxy. Even if you choose a VPC endpoint service, the proxy can be hosted within the VPC or outside of Amazon Web Services such as in your corporate data center.</p>
pub fn set_xks_proxy_connectivity(
mut self,
input: std::option::Option<crate::model::XksProxyConnectivityType>,
) -> Self {
self.xks_proxy_connectivity = input;
self
}
/// Consumes the builder and constructs a [`CreateCustomKeyStoreInput`](crate::input::CreateCustomKeyStoreInput).
pub fn build(
self,
) -> Result<
crate::input::CreateCustomKeyStoreInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::CreateCustomKeyStoreInput {
custom_key_store_name: self.custom_key_store_name,
cloud_hsm_cluster_id: self.cloud_hsm_cluster_id,
trust_anchor_certificate: self.trust_anchor_certificate,
key_store_password: self.key_store_password,
custom_key_store_type: self.custom_key_store_type,
xks_proxy_uri_endpoint: self.xks_proxy_uri_endpoint,
xks_proxy_uri_path: self.xks_proxy_uri_path,
xks_proxy_vpc_endpoint_service_name: self.xks_proxy_vpc_endpoint_service_name,
xks_proxy_authentication_credential: self.xks_proxy_authentication_credential,
xks_proxy_connectivity: self.xks_proxy_connectivity,
})
}
}
impl std::fmt::Debug for Builder {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("Builder");
formatter.field("custom_key_store_name", &self.custom_key_store_name);
formatter.field("cloud_hsm_cluster_id", &self.cloud_hsm_cluster_id);
formatter.field("trust_anchor_certificate", &self.trust_anchor_certificate);
formatter.field("key_store_password", &"*** Sensitive Data Redacted ***");
formatter.field("custom_key_store_type", &self.custom_key_store_type);
formatter.field("xks_proxy_uri_endpoint", &self.xks_proxy_uri_endpoint);
formatter.field("xks_proxy_uri_path", &self.xks_proxy_uri_path);
formatter.field(
"xks_proxy_vpc_endpoint_service_name",
&self.xks_proxy_vpc_endpoint_service_name,
);
formatter.field(
"xks_proxy_authentication_credential",
&self.xks_proxy_authentication_credential,
);
formatter.field("xks_proxy_connectivity", &self.xks_proxy_connectivity);
formatter.finish()
}
}
}
impl CreateCustomKeyStoreInput {
/// Consumes the builder and constructs an Operation<[`CreateCustomKeyStore`](crate::operation::CreateCustomKeyStore)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::CreateCustomKeyStore,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::CreateCustomKeyStoreInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::CreateCustomKeyStoreInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.CreateCustomKeyStore",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_create_custom_key_store(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::CreateCustomKeyStore::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"CreateCustomKeyStore",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`CreateCustomKeyStoreInput`](crate::input::CreateCustomKeyStoreInput).
pub fn builder() -> crate::input::create_custom_key_store_input::Builder {
crate::input::create_custom_key_store_input::Builder::default()
}
}
/// See [`CreateGrantInput`](crate::input::CreateGrantInput).
pub mod create_grant_input {
/// A builder for [`CreateGrantInput`](crate::input::CreateGrantInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) grantee_principal: std::option::Option<std::string::String>,
pub(crate) retiring_principal: std::option::Option<std::string::String>,
pub(crate) operations: std::option::Option<std::vec::Vec<crate::model::GrantOperation>>,
pub(crate) constraints: std::option::Option<crate::model::GrantConstraints>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
pub(crate) name: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Identifies the KMS key for the grant. The grant gives principals permission to use this KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the KMS key for the grant. The grant gives principals permission to use this KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>The identity that gets the permissions specified in the grant.</p>
/// <p>To specify the principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, IAM roles, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
pub fn grantee_principal(mut self, input: impl Into<std::string::String>) -> Self {
self.grantee_principal = Some(input.into());
self
}
/// <p>The identity that gets the permissions specified in the grant.</p>
/// <p>To specify the principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, IAM roles, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
pub fn set_grantee_principal(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.grantee_principal = input;
self
}
/// <p>The principal that has permission to use the <code>RetireGrant</code> operation to retire the grant. </p>
/// <p>To specify the principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
/// <p>The grant determines the retiring principal. Other principals might have permission to retire the grant or revoke the grant. For details, see <code>RevokeGrant</code> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete">Retiring and revoking grants</a> in the <i>Key Management Service Developer Guide</i>. </p>
pub fn retiring_principal(mut self, input: impl Into<std::string::String>) -> Self {
self.retiring_principal = Some(input.into());
self
}
/// <p>The principal that has permission to use the <code>RetireGrant</code> operation to retire the grant. </p>
/// <p>To specify the principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
/// <p>The grant determines the retiring principal. Other principals might have permission to retire the grant or revoke the grant. For details, see <code>RevokeGrant</code> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete">Retiring and revoking grants</a> in the <i>Key Management Service Developer Guide</i>. </p>
pub fn set_retiring_principal(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.retiring_principal = input;
self
}
/// Appends an item to `operations`.
///
/// To override the contents of this collection use [`set_operations`](Self::set_operations).
///
/// <p>A list of operations that the grant permits. </p>
/// <p>This list must include only operations that are permitted in a grant. Also, the operation must be supported on the KMS key. For example, you cannot create a grant for a symmetric encryption KMS key that allows the <code>Sign</code> operation, or a grant for an asymmetric KMS key that allows the <code>GenerateDataKey</code> operation. If you try, KMS returns a <code>ValidationError</code> exception. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">Grant operations</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn operations(mut self, input: crate::model::GrantOperation) -> Self {
let mut v = self.operations.unwrap_or_default();
v.push(input);
self.operations = Some(v);
self
}
/// <p>A list of operations that the grant permits. </p>
/// <p>This list must include only operations that are permitted in a grant. Also, the operation must be supported on the KMS key. For example, you cannot create a grant for a symmetric encryption KMS key that allows the <code>Sign</code> operation, or a grant for an asymmetric KMS key that allows the <code>GenerateDataKey</code> operation. If you try, KMS returns a <code>ValidationError</code> exception. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">Grant operations</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_operations(
mut self,
input: std::option::Option<std::vec::Vec<crate::model::GrantOperation>>,
) -> Self {
self.operations = input;
self
}
/// <p>Specifies a grant constraint. </p>
/// <p>KMS supports the <code>EncryptionContextEquals</code> and <code>EncryptionContextSubset</code> grant constraints. Each constraint value can include up to 8 encryption context pairs. The encryption context value in each constraint cannot exceed 384 characters. For information about grant constraints, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-grant-overview.html#grant-constraints">Using grant constraints</a> in the <i>Key Management Service Developer Guide</i>. For more information about encryption context, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i> <i>Key Management Service Developer Guide</i> </i>. </p>
/// <p>The encryption context grant constraints allow the permissions in the grant only when the encryption context in the request matches (<code>EncryptionContextEquals</code>) or includes (<code>EncryptionContextSubset</code>) the encryption context specified in this structure. </p>
/// <p>The encryption context grant constraints are supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">grant operations</a> that include an <code>EncryptionContext</code> parameter, such as cryptographic operations on symmetric encryption KMS keys. Grants with grant constraints can include the <code>DescribeKey</code> and <code>RetireGrant</code> operations, but the constraint doesn't apply to these operations. If a grant with a grant constraint includes the <code>CreateGrant</code> operation, the constraint requires that any grants created with the <code>CreateGrant</code> permission have an equally strict or stricter encryption context constraint.</p>
/// <p>You cannot use an encryption context grant constraint for cryptographic operations with asymmetric KMS keys or HMAC KMS keys. These keys don't support an encryption context. </p>
/// <p></p>
pub fn constraints(mut self, input: crate::model::GrantConstraints) -> Self {
self.constraints = Some(input);
self
}
/// <p>Specifies a grant constraint. </p>
/// <p>KMS supports the <code>EncryptionContextEquals</code> and <code>EncryptionContextSubset</code> grant constraints. Each constraint value can include up to 8 encryption context pairs. The encryption context value in each constraint cannot exceed 384 characters. For information about grant constraints, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-grant-overview.html#grant-constraints">Using grant constraints</a> in the <i>Key Management Service Developer Guide</i>. For more information about encryption context, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i> <i>Key Management Service Developer Guide</i> </i>. </p>
/// <p>The encryption context grant constraints allow the permissions in the grant only when the encryption context in the request matches (<code>EncryptionContextEquals</code>) or includes (<code>EncryptionContextSubset</code>) the encryption context specified in this structure. </p>
/// <p>The encryption context grant constraints are supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">grant operations</a> that include an <code>EncryptionContext</code> parameter, such as cryptographic operations on symmetric encryption KMS keys. Grants with grant constraints can include the <code>DescribeKey</code> and <code>RetireGrant</code> operations, but the constraint doesn't apply to these operations. If a grant with a grant constraint includes the <code>CreateGrant</code> operation, the constraint requires that any grants created with the <code>CreateGrant</code> permission have an equally strict or stricter encryption context constraint.</p>
/// <p>You cannot use an encryption context grant constraint for cryptographic operations with asymmetric KMS keys or HMAC KMS keys. These keys don't support an encryption context. </p>
/// <p></p>
pub fn set_constraints(
mut self,
input: std::option::Option<crate::model::GrantConstraints>,
) -> Self {
self.constraints = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens. </p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens. </p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// <p>A friendly name for the grant. Use this value to prevent the unintended creation of duplicate grants when retrying this request.</p>
/// <p>When this value is absent, all <code>CreateGrant</code> requests result in a new grant with a unique <code>GrantId</code> even if all the supplied parameters are identical. This can result in unintended duplicates when you retry the <code>CreateGrant</code> request.</p>
/// <p>When this value is present, you can retry a <code>CreateGrant</code> request with identical parameters; if the grant already exists, the original <code>GrantId</code> is returned without creating a new grant. Note that the returned grant token is unique with every <code>CreateGrant</code> request, even when a duplicate <code>GrantId</code> is returned. All grant tokens for the same grant ID can be used interchangeably.</p>
pub fn name(mut self, input: impl Into<std::string::String>) -> Self {
self.name = Some(input.into());
self
}
/// <p>A friendly name for the grant. Use this value to prevent the unintended creation of duplicate grants when retrying this request.</p>
/// <p>When this value is absent, all <code>CreateGrant</code> requests result in a new grant with a unique <code>GrantId</code> even if all the supplied parameters are identical. This can result in unintended duplicates when you retry the <code>CreateGrant</code> request.</p>
/// <p>When this value is present, you can retry a <code>CreateGrant</code> request with identical parameters; if the grant already exists, the original <code>GrantId</code> is returned without creating a new grant. Note that the returned grant token is unique with every <code>CreateGrant</code> request, even when a duplicate <code>GrantId</code> is returned. All grant tokens for the same grant ID can be used interchangeably.</p>
pub fn set_name(mut self, input: std::option::Option<std::string::String>) -> Self {
self.name = input;
self
}
/// Consumes the builder and constructs a [`CreateGrantInput`](crate::input::CreateGrantInput).
pub fn build(
self,
) -> Result<crate::input::CreateGrantInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::CreateGrantInput {
key_id: self.key_id,
grantee_principal: self.grantee_principal,
retiring_principal: self.retiring_principal,
operations: self.operations,
constraints: self.constraints,
grant_tokens: self.grant_tokens,
name: self.name,
})
}
}
}
impl CreateGrantInput {
/// Consumes the builder and constructs an Operation<[`CreateGrant`](crate::operation::CreateGrant)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::CreateGrant,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::CreateGrantInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::CreateGrantInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.CreateGrant",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_create_grant(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::CreateGrant::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"CreateGrant",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`CreateGrantInput`](crate::input::CreateGrantInput).
pub fn builder() -> crate::input::create_grant_input::Builder {
crate::input::create_grant_input::Builder::default()
}
}
/// See [`CreateKeyInput`](crate::input::CreateKeyInput).
pub mod create_key_input {
/// A builder for [`CreateKeyInput`](crate::input::CreateKeyInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) policy: std::option::Option<std::string::String>,
pub(crate) description: std::option::Option<std::string::String>,
pub(crate) key_usage: std::option::Option<crate::model::KeyUsageType>,
pub(crate) customer_master_key_spec:
std::option::Option<crate::model::CustomerMasterKeySpec>,
pub(crate) key_spec: std::option::Option<crate::model::KeySpec>,
pub(crate) origin: std::option::Option<crate::model::OriginType>,
pub(crate) custom_key_store_id: std::option::Option<std::string::String>,
pub(crate) bypass_policy_lockout_safety_check: std::option::Option<bool>,
pub(crate) tags: std::option::Option<std::vec::Vec<crate::model::Tag>>,
pub(crate) multi_region: std::option::Option<bool>,
pub(crate) xks_key_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>The key policy to attach to the KMS key.</p>
/// <p>If you provide a key policy, it must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must allow the principal that is making the <code>CreateKey</code> request to make a subsequent <code>PutKeyPolicy</code> request on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i> <i>Key Management Service Developer Guide</i> </i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i>Amazon Web Services Identity and Access Management User Guide</i>.</p> </li>
/// </ul>
/// <p>If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">Default Key Policy</a> in the <i>Key Management Service Developer Guide</i>. </p>
/// <p>The key policy size quota is 32 kilobytes (32768 bytes).</p>
/// <p>For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
pub fn policy(mut self, input: impl Into<std::string::String>) -> Self {
self.policy = Some(input.into());
self
}
/// <p>The key policy to attach to the KMS key.</p>
/// <p>If you provide a key policy, it must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must allow the principal that is making the <code>CreateKey</code> request to make a subsequent <code>PutKeyPolicy</code> request on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i> <i>Key Management Service Developer Guide</i> </i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i>Amazon Web Services Identity and Access Management User Guide</i>.</p> </li>
/// </ul>
/// <p>If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">Default Key Policy</a> in the <i>Key Management Service Developer Guide</i>. </p>
/// <p>The key policy size quota is 32 kilobytes (32768 bytes).</p>
/// <p>For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
pub fn set_policy(mut self, input: std::option::Option<std::string::String>) -> Self {
self.policy = input;
self
}
/// <p>A description of the KMS key.</p>
/// <p>Use a description that helps you decide whether the KMS key is appropriate for a task. The default value is an empty string (no description).</p>
/// <p>To set or change the description after the key is created, use <code>UpdateKeyDescription</code>.</p>
pub fn description(mut self, input: impl Into<std::string::String>) -> Self {
self.description = Some(input.into());
self
}
/// <p>A description of the KMS key.</p>
/// <p>Use a description that helps you decide whether the KMS key is appropriate for a task. The default value is an empty string (no description).</p>
/// <p>To set or change the description after the key is created, use <code>UpdateKeyDescription</code>.</p>
pub fn set_description(mut self, input: std::option::Option<std::string::String>) -> Self {
self.description = input;
self
}
/// <p>Determines the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> for which you can use the KMS key. The default value is <code>ENCRYPT_DECRYPT</code>. This parameter is optional when you are creating a symmetric encryption KMS key; otherwise, it is required. You can't change the <code>KeyUsage</code> value after the KMS key is created.</p>
/// <p>Select only one valid value.</p>
/// <ul>
/// <li> <p>For symmetric encryption KMS keys, omit the parameter or specify <code>ENCRYPT_DECRYPT</code>.</p> </li>
/// <li> <p>For HMAC KMS keys (symmetric), specify <code>GENERATE_VERIFY_MAC</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with RSA key material, specify <code>ENCRYPT_DECRYPT</code> or <code>SIGN_VERIFY</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with ECC key material, specify <code>SIGN_VERIFY</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with SM2 key material (China Regions only), specify <code>ENCRYPT_DECRYPT</code> or <code>SIGN_VERIFY</code>.</p> </li>
/// </ul>
pub fn key_usage(mut self, input: crate::model::KeyUsageType) -> Self {
self.key_usage = Some(input);
self
}
/// <p>Determines the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> for which you can use the KMS key. The default value is <code>ENCRYPT_DECRYPT</code>. This parameter is optional when you are creating a symmetric encryption KMS key; otherwise, it is required. You can't change the <code>KeyUsage</code> value after the KMS key is created.</p>
/// <p>Select only one valid value.</p>
/// <ul>
/// <li> <p>For symmetric encryption KMS keys, omit the parameter or specify <code>ENCRYPT_DECRYPT</code>.</p> </li>
/// <li> <p>For HMAC KMS keys (symmetric), specify <code>GENERATE_VERIFY_MAC</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with RSA key material, specify <code>ENCRYPT_DECRYPT</code> or <code>SIGN_VERIFY</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with ECC key material, specify <code>SIGN_VERIFY</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with SM2 key material (China Regions only), specify <code>ENCRYPT_DECRYPT</code> or <code>SIGN_VERIFY</code>.</p> </li>
/// </ul>
pub fn set_key_usage(
mut self,
input: std::option::Option<crate::model::KeyUsageType>,
) -> Self {
self.key_usage = input;
self
}
/// <p>Instead, use the <code>KeySpec</code> parameter.</p>
/// <p>The <code>KeySpec</code> and <code>CustomerMasterKeySpec</code> parameters work the same way. Only the names differ. We recommend that you use <code>KeySpec</code> parameter in your code. However, to avoid breaking changes, KMS supports both parameters.</p>
#[deprecated(
note = "This parameter has been deprecated. Instead, use the KeySpec parameter."
)]
pub fn customer_master_key_spec(
mut self,
input: crate::model::CustomerMasterKeySpec,
) -> Self {
self.customer_master_key_spec = Some(input);
self
}
/// <p>Instead, use the <code>KeySpec</code> parameter.</p>
/// <p>The <code>KeySpec</code> and <code>CustomerMasterKeySpec</code> parameters work the same way. Only the names differ. We recommend that you use <code>KeySpec</code> parameter in your code. However, to avoid breaking changes, KMS supports both parameters.</p>
#[deprecated(
note = "This parameter has been deprecated. Instead, use the KeySpec parameter."
)]
pub fn set_customer_master_key_spec(
mut self,
input: std::option::Option<crate::model::CustomerMasterKeySpec>,
) -> Self {
self.customer_master_key_spec = input;
self
}
/// <p>Specifies the type of KMS key to create. The default value, <code>SYMMETRIC_DEFAULT</code>, creates a KMS key with a 256-bit AES-GCM key that is used for encryption and decryption, except in China Regions, where it creates a 128-bit symmetric key that uses SM4 encryption. For help choosing a key spec for your KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose">Choosing a KMS key type</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// <p>The <code>KeySpec</code> determines whether the KMS key contains a symmetric key or an asymmetric key pair. It also determines the algorithms that the KMS key supports. You can't change the <code>KeySpec</code> after the KMS key is created. To further restrict the algorithms that can be used with the KMS key, use a condition key in its key policy or IAM policy. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm">kms:EncryptionAlgorithm</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm">kms:MacAlgorithm</a> or <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm">kms:Signing Algorithm</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p> <important>
/// <p> <a href="http://aws.amazon.com/kms/features/#AWS_Service_Integration">Amazon Web Services services that are integrated with KMS</a> use symmetric encryption KMS keys to protect your data. These services do not support asymmetric KMS keys or HMAC KMS keys.</p>
/// </important>
/// <p>KMS supports the following key specs for KMS keys:</p>
/// <ul>
/// <li> <p>Symmetric encryption key (default)</p>
/// <ul>
/// <li> <p> <code>SYMMETRIC_DEFAULT</code> </p> </li>
/// </ul> </li>
/// <li> <p>HMAC keys (symmetric)</p>
/// <ul>
/// <li> <p> <code>HMAC_224</code> </p> </li>
/// <li> <p> <code>HMAC_256</code> </p> </li>
/// <li> <p> <code>HMAC_384</code> </p> </li>
/// <li> <p> <code>HMAC_512</code> </p> </li>
/// </ul> </li>
/// <li> <p>Asymmetric RSA key pairs</p>
/// <ul>
/// <li> <p> <code>RSA_2048</code> </p> </li>
/// <li> <p> <code>RSA_3072</code> </p> </li>
/// <li> <p> <code>RSA_4096</code> </p> </li>
/// </ul> </li>
/// <li> <p>Asymmetric NIST-recommended elliptic curve key pairs</p>
/// <ul>
/// <li> <p> <code>ECC_NIST_P256</code> (secp256r1)</p> </li>
/// <li> <p> <code>ECC_NIST_P384</code> (secp384r1)</p> </li>
/// <li> <p> <code>ECC_NIST_P521</code> (secp521r1)</p> </li>
/// </ul> </li>
/// <li> <p>Other asymmetric elliptic curve key pairs</p>
/// <ul>
/// <li> <p> <code>ECC_SECG_P256K1</code> (secp256k1), commonly used for cryptocurrencies.</p> </li>
/// </ul> </li>
/// <li> <p>SM2 key pairs (China Regions only)</p>
/// <ul>
/// <li> <p> <code>SM2</code> </p> </li>
/// </ul> </li>
/// </ul>
pub fn key_spec(mut self, input: crate::model::KeySpec) -> Self {
self.key_spec = Some(input);
self
}
/// <p>Specifies the type of KMS key to create. The default value, <code>SYMMETRIC_DEFAULT</code>, creates a KMS key with a 256-bit AES-GCM key that is used for encryption and decryption, except in China Regions, where it creates a 128-bit symmetric key that uses SM4 encryption. For help choosing a key spec for your KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose">Choosing a KMS key type</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// <p>The <code>KeySpec</code> determines whether the KMS key contains a symmetric key or an asymmetric key pair. It also determines the algorithms that the KMS key supports. You can't change the <code>KeySpec</code> after the KMS key is created. To further restrict the algorithms that can be used with the KMS key, use a condition key in its key policy or IAM policy. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm">kms:EncryptionAlgorithm</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm">kms:MacAlgorithm</a> or <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm">kms:Signing Algorithm</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p> <important>
/// <p> <a href="http://aws.amazon.com/kms/features/#AWS_Service_Integration">Amazon Web Services services that are integrated with KMS</a> use symmetric encryption KMS keys to protect your data. These services do not support asymmetric KMS keys or HMAC KMS keys.</p>
/// </important>
/// <p>KMS supports the following key specs for KMS keys:</p>
/// <ul>
/// <li> <p>Symmetric encryption key (default)</p>
/// <ul>
/// <li> <p> <code>SYMMETRIC_DEFAULT</code> </p> </li>
/// </ul> </li>
/// <li> <p>HMAC keys (symmetric)</p>
/// <ul>
/// <li> <p> <code>HMAC_224</code> </p> </li>
/// <li> <p> <code>HMAC_256</code> </p> </li>
/// <li> <p> <code>HMAC_384</code> </p> </li>
/// <li> <p> <code>HMAC_512</code> </p> </li>
/// </ul> </li>
/// <li> <p>Asymmetric RSA key pairs</p>
/// <ul>
/// <li> <p> <code>RSA_2048</code> </p> </li>
/// <li> <p> <code>RSA_3072</code> </p> </li>
/// <li> <p> <code>RSA_4096</code> </p> </li>
/// </ul> </li>
/// <li> <p>Asymmetric NIST-recommended elliptic curve key pairs</p>
/// <ul>
/// <li> <p> <code>ECC_NIST_P256</code> (secp256r1)</p> </li>
/// <li> <p> <code>ECC_NIST_P384</code> (secp384r1)</p> </li>
/// <li> <p> <code>ECC_NIST_P521</code> (secp521r1)</p> </li>
/// </ul> </li>
/// <li> <p>Other asymmetric elliptic curve key pairs</p>
/// <ul>
/// <li> <p> <code>ECC_SECG_P256K1</code> (secp256k1), commonly used for cryptocurrencies.</p> </li>
/// </ul> </li>
/// <li> <p>SM2 key pairs (China Regions only)</p>
/// <ul>
/// <li> <p> <code>SM2</code> </p> </li>
/// </ul> </li>
/// </ul>
pub fn set_key_spec(mut self, input: std::option::Option<crate::model::KeySpec>) -> Self {
self.key_spec = input;
self
}
/// <p>The source of the key material for the KMS key. You cannot change the origin after you create the KMS key. The default is <code>AWS_KMS</code>, which means that KMS creates the key material.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html">create a KMS key with no key material</a> (for imported key material), set this value to <code>EXTERNAL</code>. For more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the <i>Key Management Service Developer Guide</i>. The <code>EXTERNAL</code> origin value is valid only for symmetric KMS keys.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html">create a KMS key in an CloudHSM key store</a> and create its key material in the associated CloudHSM cluster, set this value to <code>AWS_CLOUDHSM</code>. You must also use the <code>CustomKeyStoreId</code> parameter to identify the CloudHSM key store. The <code>KeySpec</code> value must be <code>SYMMETRIC_DEFAULT</code>.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html">create a KMS key in an external key store</a>, set this value to <code>EXTERNAL_KEY_STORE</code>. You must also use the <code>CustomKeyStoreId</code> parameter to identify the external key store and the <code>XksKeyId</code> parameter to identify the associated external key. The <code>KeySpec</code> value must be <code>SYMMETRIC_DEFAULT</code>.</p>
pub fn origin(mut self, input: crate::model::OriginType) -> Self {
self.origin = Some(input);
self
}
/// <p>The source of the key material for the KMS key. You cannot change the origin after you create the KMS key. The default is <code>AWS_KMS</code>, which means that KMS creates the key material.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html">create a KMS key with no key material</a> (for imported key material), set this value to <code>EXTERNAL</code>. For more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the <i>Key Management Service Developer Guide</i>. The <code>EXTERNAL</code> origin value is valid only for symmetric KMS keys.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html">create a KMS key in an CloudHSM key store</a> and create its key material in the associated CloudHSM cluster, set this value to <code>AWS_CLOUDHSM</code>. You must also use the <code>CustomKeyStoreId</code> parameter to identify the CloudHSM key store. The <code>KeySpec</code> value must be <code>SYMMETRIC_DEFAULT</code>.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html">create a KMS key in an external key store</a>, set this value to <code>EXTERNAL_KEY_STORE</code>. You must also use the <code>CustomKeyStoreId</code> parameter to identify the external key store and the <code>XksKeyId</code> parameter to identify the associated external key. The <code>KeySpec</code> value must be <code>SYMMETRIC_DEFAULT</code>.</p>
pub fn set_origin(mut self, input: std::option::Option<crate::model::OriginType>) -> Self {
self.origin = input;
self
}
/// <p>Creates the KMS key in the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The <code>ConnectionState</code> of the custom key store must be <code>CONNECTED</code>. To find the CustomKeyStoreID and ConnectionState use the <code>DescribeCustomKeyStores</code> operation.</p>
/// <p>This parameter is valid only for symmetric encryption KMS keys in a single Region. You cannot create any other type of KMS key in a custom key store.</p>
/// <p>When you create a KMS key in an CloudHSM key store, KMS generates a non-exportable 256-bit symmetric key in its associated CloudHSM cluster and associates it with the KMS key. When you create a KMS key in an external key store, you must use the <code>XksKeyId</code> parameter to specify an external key that serves as key material for the KMS key.</p>
pub fn custom_key_store_id(mut self, input: impl Into<std::string::String>) -> Self {
self.custom_key_store_id = Some(input.into());
self
}
/// <p>Creates the KMS key in the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The <code>ConnectionState</code> of the custom key store must be <code>CONNECTED</code>. To find the CustomKeyStoreID and ConnectionState use the <code>DescribeCustomKeyStores</code> operation.</p>
/// <p>This parameter is valid only for symmetric encryption KMS keys in a single Region. You cannot create any other type of KMS key in a custom key store.</p>
/// <p>When you create a KMS key in an CloudHSM key store, KMS generates a non-exportable 256-bit symmetric key in its associated CloudHSM cluster and associates it with the KMS key. When you create a KMS key in an external key store, you must use the <code>XksKeyId</code> parameter to specify an external key that serves as key material for the KMS key.</p>
pub fn set_custom_key_store_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.custom_key_store_id = input;
self
}
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// </important>
/// <p>Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
pub fn bypass_policy_lockout_safety_check(mut self, input: bool) -> Self {
self.bypass_policy_lockout_safety_check = Some(input);
self
}
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// </important>
/// <p>Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
pub fn set_bypass_policy_lockout_safety_check(
mut self,
input: std::option::Option<bool>,
) -> Self {
self.bypass_policy_lockout_safety_check = input;
self
}
/// Appends an item to `tags`.
///
/// To override the contents of this collection use [`set_tags`](Self::set_tags).
///
/// <p>Assigns one or more tags to the KMS key. Use this parameter to tag the KMS key when it is created. To tag an existing KMS key, use the <code>TagResource</code> operation.</p> <note>
/// <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>To use this parameter, you must have <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:TagResource</a> permission in an IAM policy.</p>
/// <p>Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
/// <p>When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">Tagging Keys</a>.</p>
pub fn tags(mut self, input: crate::model::Tag) -> Self {
let mut v = self.tags.unwrap_or_default();
v.push(input);
self.tags = Some(v);
self
}
/// <p>Assigns one or more tags to the KMS key. Use this parameter to tag the KMS key when it is created. To tag an existing KMS key, use the <code>TagResource</code> operation.</p> <note>
/// <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>To use this parameter, you must have <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:TagResource</a> permission in an IAM policy.</p>
/// <p>Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
/// <p>When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">Tagging Keys</a>.</p>
pub fn set_tags(
mut self,
input: std::option::Option<std::vec::Vec<crate::model::Tag>>,
) -> Self {
self.tags = input;
self
}
/// <p>Creates a multi-Region primary key that you can replicate into other Amazon Web Services Regions. You cannot change this value after you create the KMS key. </p>
/// <p>For a multi-Region key, set this parameter to <code>True</code>. For a single-Region KMS key, omit this parameter or set it to <code>False</code>. The default value is <code>False</code>.</p>
/// <p>This operation supports <i>multi-Region keys</i>, an KMS feature that lets you create multiple interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>This value creates a <i>primary key</i>, not a replica. To create a <i>replica key</i>, use the <code>ReplicateKey</code> operation. </p>
/// <p>You can create a symmetric or asymmetric multi-Region key, and you can create a multi-Region key with imported key material. However, you cannot create a multi-Region key in a custom key store.</p>
pub fn multi_region(mut self, input: bool) -> Self {
self.multi_region = Some(input);
self
}
/// <p>Creates a multi-Region primary key that you can replicate into other Amazon Web Services Regions. You cannot change this value after you create the KMS key. </p>
/// <p>For a multi-Region key, set this parameter to <code>True</code>. For a single-Region KMS key, omit this parameter or set it to <code>False</code>. The default value is <code>False</code>.</p>
/// <p>This operation supports <i>multi-Region keys</i>, an KMS feature that lets you create multiple interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>This value creates a <i>primary key</i>, not a replica. To create a <i>replica key</i>, use the <code>ReplicateKey</code> operation. </p>
/// <p>You can create a symmetric or asymmetric multi-Region key, and you can create a multi-Region key with imported key material. However, you cannot create a multi-Region key in a custom key store.</p>
pub fn set_multi_region(mut self, input: std::option::Option<bool>) -> Self {
self.multi_region = input;
self
}
/// <p>Identifies the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key">external key</a> that serves as key material for the KMS key in an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html">external key store</a>. Specify the ID that the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy">external key store proxy</a> uses to refer to the external key. For help, see the documentation for your external key store proxy.</p>
/// <p>This parameter is required for a KMS key with an <code>Origin</code> value of <code>EXTERNAL_KEY_STORE</code>. It is not valid for KMS keys with any other <code>Origin</code> value.</p>
/// <p>The external key must be an existing 256-bit AES symmetric encryption key hosted outside of Amazon Web Services in an external key manager associated with the external key store specified by the <code>CustomKeyStoreId</code> parameter. This key must be enabled and configured to perform encryption and decryption. Each KMS key in an external key store must use a different external key. For details, see <a href="https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements">Requirements for a KMS key in an external key store</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>Each KMS key in an external key store is associated two backing keys. One is key material that KMS generates. The other is the external key specified by this parameter. When you use the KMS key in an external key store to encrypt data, the encryption operation is performed first by KMS using the KMS key material, and then by the external key manager using the specified external key, a process known as <i>double encryption</i>. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption">Double encryption</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn xks_key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.xks_key_id = Some(input.into());
self
}
/// <p>Identifies the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key">external key</a> that serves as key material for the KMS key in an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html">external key store</a>. Specify the ID that the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy">external key store proxy</a> uses to refer to the external key. For help, see the documentation for your external key store proxy.</p>
/// <p>This parameter is required for a KMS key with an <code>Origin</code> value of <code>EXTERNAL_KEY_STORE</code>. It is not valid for KMS keys with any other <code>Origin</code> value.</p>
/// <p>The external key must be an existing 256-bit AES symmetric encryption key hosted outside of Amazon Web Services in an external key manager associated with the external key store specified by the <code>CustomKeyStoreId</code> parameter. This key must be enabled and configured to perform encryption and decryption. Each KMS key in an external key store must use a different external key. For details, see <a href="https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements">Requirements for a KMS key in an external key store</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>Each KMS key in an external key store is associated two backing keys. One is key material that KMS generates. The other is the external key specified by this parameter. When you use the KMS key in an external key store to encrypt data, the encryption operation is performed first by KMS using the KMS key material, and then by the external key manager using the specified external key, a process known as <i>double encryption</i>. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption">Double encryption</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_xks_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.xks_key_id = input;
self
}
/// Consumes the builder and constructs a [`CreateKeyInput`](crate::input::CreateKeyInput).
pub fn build(
self,
) -> Result<crate::input::CreateKeyInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::CreateKeyInput {
policy: self.policy,
description: self.description,
key_usage: self.key_usage,
customer_master_key_spec: self.customer_master_key_spec,
key_spec: self.key_spec,
origin: self.origin,
custom_key_store_id: self.custom_key_store_id,
bypass_policy_lockout_safety_check: self
.bypass_policy_lockout_safety_check
.unwrap_or_default(),
tags: self.tags,
multi_region: self.multi_region,
xks_key_id: self.xks_key_id,
})
}
}
}
impl CreateKeyInput {
/// Consumes the builder and constructs an Operation<[`CreateKey`](crate::operation::CreateKey)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::CreateKey,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::CreateKeyInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::CreateKeyInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.CreateKey",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_create_key(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op =
aws_smithy_http::operation::Operation::new(request, crate::operation::CreateKey::new())
.with_metadata(aws_smithy_http::operation::Metadata::new(
"CreateKey",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`CreateKeyInput`](crate::input::CreateKeyInput).
pub fn builder() -> crate::input::create_key_input::Builder {
crate::input::create_key_input::Builder::default()
}
}
/// See [`DecryptInput`](crate::input::DecryptInput).
pub mod decrypt_input {
/// A builder for [`DecryptInput`](crate::input::DecryptInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) ciphertext_blob: std::option::Option<aws_smithy_types::Blob>,
pub(crate) encryption_context: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) encryption_algorithm: std::option::Option<crate::model::EncryptionAlgorithmSpec>,
}
impl Builder {
/// <p>Ciphertext to be decrypted. The blob includes metadata.</p>
pub fn ciphertext_blob(mut self, input: aws_smithy_types::Blob) -> Self {
self.ciphertext_blob = Some(input);
self
}
/// <p>Ciphertext to be decrypted. The blob includes metadata.</p>
pub fn set_ciphertext_blob(
mut self,
input: std::option::Option<aws_smithy_types::Blob>,
) -> Self {
self.ciphertext_blob = input;
self
}
/// Adds a key-value pair to `encryption_context`.
///
/// To override the contents of this collection use [`set_encryption_context`](Self::set_encryption_context).
///
/// <p>Specifies the encryption context to use when decrypting the data. An encryption context is valid only for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> with a symmetric encryption KMS key. The standard asymmetric encryption algorithms and HMAC algorithms that KMS uses do not support an encryption context.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
mut self,
k: impl Into<std::string::String>,
v: impl Into<std::string::String>,
) -> Self {
let mut hash_map = self.encryption_context.unwrap_or_default();
hash_map.insert(k.into(), v.into());
self.encryption_context = Some(hash_map);
self
}
/// <p>Specifies the encryption context to use when decrypting the data. An encryption context is valid only for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> with a symmetric encryption KMS key. The standard asymmetric encryption algorithms and HMAC algorithms that KMS uses do not support an encryption context.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_encryption_context(
mut self,
input: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
) -> Self {
self.encryption_context = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens. </p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens. </p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// <p>Specifies the KMS key that KMS uses to decrypt the ciphertext.</p>
/// <p>Enter a key ID of the KMS key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>Decrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to the symmetric ciphertext blob. However, it is always recommended as a best practice. This practice ensures that you use the KMS key that you intend.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Specifies the KMS key that KMS uses to decrypt the ciphertext.</p>
/// <p>Enter a key ID of the KMS key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>Decrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to the symmetric ciphertext blob. However, it is always recommended as a best practice. This practice ensures that you use the KMS key that you intend.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Specifies the encryption algorithm that will be used to decrypt the ciphertext. Specify the same algorithm that was used to encrypt the data. If you specify a different algorithm, the <code>Decrypt</code> operation fails.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the only supported algorithm that is valid for symmetric encryption KMS keys.</p>
pub fn encryption_algorithm(
mut self,
input: crate::model::EncryptionAlgorithmSpec,
) -> Self {
self.encryption_algorithm = Some(input);
self
}
/// <p>Specifies the encryption algorithm that will be used to decrypt the ciphertext. Specify the same algorithm that was used to encrypt the data. If you specify a different algorithm, the <code>Decrypt</code> operation fails.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the only supported algorithm that is valid for symmetric encryption KMS keys.</p>
pub fn set_encryption_algorithm(
mut self,
input: std::option::Option<crate::model::EncryptionAlgorithmSpec>,
) -> Self {
self.encryption_algorithm = input;
self
}
/// Consumes the builder and constructs a [`DecryptInput`](crate::input::DecryptInput).
pub fn build(
self,
) -> Result<crate::input::DecryptInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::DecryptInput {
ciphertext_blob: self.ciphertext_blob,
encryption_context: self.encryption_context,
grant_tokens: self.grant_tokens,
key_id: self.key_id,
encryption_algorithm: self.encryption_algorithm,
})
}
}
}
impl DecryptInput {
/// Consumes the builder and constructs an Operation<[`Decrypt`](crate::operation::Decrypt)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::Decrypt,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::DecryptInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::DecryptInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.Decrypt",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_decrypt(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op =
aws_smithy_http::operation::Operation::new(request, crate::operation::Decrypt::new())
.with_metadata(aws_smithy_http::operation::Metadata::new("Decrypt", "kms"));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`DecryptInput`](crate::input::DecryptInput).
pub fn builder() -> crate::input::decrypt_input::Builder {
crate::input::decrypt_input::Builder::default()
}
}
/// See [`DeleteAliasInput`](crate::input::DeleteAliasInput).
pub mod delete_alias_input {
/// A builder for [`DeleteAliasInput`](crate::input::DeleteAliasInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) alias_name: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>The alias to be deleted. The alias name must begin with <code>alias/</code> followed by the alias name, such as <code>alias/ExampleAlias</code>.</p>
pub fn alias_name(mut self, input: impl Into<std::string::String>) -> Self {
self.alias_name = Some(input.into());
self
}
/// <p>The alias to be deleted. The alias name must begin with <code>alias/</code> followed by the alias name, such as <code>alias/ExampleAlias</code>.</p>
pub fn set_alias_name(mut self, input: std::option::Option<std::string::String>) -> Self {
self.alias_name = input;
self
}
/// Consumes the builder and constructs a [`DeleteAliasInput`](crate::input::DeleteAliasInput).
pub fn build(
self,
) -> Result<crate::input::DeleteAliasInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::DeleteAliasInput {
alias_name: self.alias_name,
})
}
}
}
impl DeleteAliasInput {
/// Consumes the builder and constructs an Operation<[`DeleteAlias`](crate::operation::DeleteAlias)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::DeleteAlias,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::DeleteAliasInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::DeleteAliasInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.DeleteAlias",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_delete_alias(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::DeleteAlias::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"DeleteAlias",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`DeleteAliasInput`](crate::input::DeleteAliasInput).
pub fn builder() -> crate::input::delete_alias_input::Builder {
crate::input::delete_alias_input::Builder::default()
}
}
/// See [`DeleteCustomKeyStoreInput`](crate::input::DeleteCustomKeyStoreInput).
pub mod delete_custom_key_store_input {
/// A builder for [`DeleteCustomKeyStoreInput`](crate::input::DeleteCustomKeyStoreInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) custom_key_store_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Enter the ID of the custom key store you want to delete. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn custom_key_store_id(mut self, input: impl Into<std::string::String>) -> Self {
self.custom_key_store_id = Some(input.into());
self
}
/// <p>Enter the ID of the custom key store you want to delete. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn set_custom_key_store_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.custom_key_store_id = input;
self
}
/// Consumes the builder and constructs a [`DeleteCustomKeyStoreInput`](crate::input::DeleteCustomKeyStoreInput).
pub fn build(
self,
) -> Result<
crate::input::DeleteCustomKeyStoreInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::DeleteCustomKeyStoreInput {
custom_key_store_id: self.custom_key_store_id,
})
}
}
}
impl DeleteCustomKeyStoreInput {
/// Consumes the builder and constructs an Operation<[`DeleteCustomKeyStore`](crate::operation::DeleteCustomKeyStore)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::DeleteCustomKeyStore,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::DeleteCustomKeyStoreInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::DeleteCustomKeyStoreInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.DeleteCustomKeyStore",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_delete_custom_key_store(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::DeleteCustomKeyStore::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"DeleteCustomKeyStore",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`DeleteCustomKeyStoreInput`](crate::input::DeleteCustomKeyStoreInput).
pub fn builder() -> crate::input::delete_custom_key_store_input::Builder {
crate::input::delete_custom_key_store_input::Builder::default()
}
}
/// See [`DeleteImportedKeyMaterialInput`](crate::input::DeleteImportedKeyMaterialInput).
pub mod delete_imported_key_material_input {
/// A builder for [`DeleteImportedKeyMaterialInput`](crate::input::DeleteImportedKeyMaterialInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Identifies the KMS key from which you are deleting imported key material. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the KMS key from which you are deleting imported key material. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Consumes the builder and constructs a [`DeleteImportedKeyMaterialInput`](crate::input::DeleteImportedKeyMaterialInput).
pub fn build(
self,
) -> Result<
crate::input::DeleteImportedKeyMaterialInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::DeleteImportedKeyMaterialInput {
key_id: self.key_id,
})
}
}
}
impl DeleteImportedKeyMaterialInput {
/// Consumes the builder and constructs an Operation<[`DeleteImportedKeyMaterial`](crate::operation::DeleteImportedKeyMaterial)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::DeleteImportedKeyMaterial,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::DeleteImportedKeyMaterialInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::DeleteImportedKeyMaterialInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.DeleteImportedKeyMaterial",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_delete_imported_key_material(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::DeleteImportedKeyMaterial::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"DeleteImportedKeyMaterial",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`DeleteImportedKeyMaterialInput`](crate::input::DeleteImportedKeyMaterialInput).
pub fn builder() -> crate::input::delete_imported_key_material_input::Builder {
crate::input::delete_imported_key_material_input::Builder::default()
}
}
/// See [`DescribeCustomKeyStoresInput`](crate::input::DescribeCustomKeyStoresInput).
pub mod describe_custom_key_stores_input {
/// A builder for [`DescribeCustomKeyStoresInput`](crate::input::DescribeCustomKeyStoresInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) custom_key_store_id: std::option::Option<std::string::String>,
pub(crate) custom_key_store_name: std::option::Option<std::string::String>,
pub(crate) limit: std::option::Option<i32>,
pub(crate) marker: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Gets only information about the specified custom key store. Enter the key store ID.</p>
/// <p>By default, this operation gets information about all custom key stores in the account and Region. To limit the output to a particular custom key store, provide either the <code>CustomKeyStoreId</code> or <code>CustomKeyStoreName</code> parameter, but not both.</p>
pub fn custom_key_store_id(mut self, input: impl Into<std::string::String>) -> Self {
self.custom_key_store_id = Some(input.into());
self
}
/// <p>Gets only information about the specified custom key store. Enter the key store ID.</p>
/// <p>By default, this operation gets information about all custom key stores in the account and Region. To limit the output to a particular custom key store, provide either the <code>CustomKeyStoreId</code> or <code>CustomKeyStoreName</code> parameter, but not both.</p>
pub fn set_custom_key_store_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.custom_key_store_id = input;
self
}
/// <p>Gets only information about the specified custom key store. Enter the friendly name of the custom key store.</p>
/// <p>By default, this operation gets information about all custom key stores in the account and Region. To limit the output to a particular custom key store, provide either the <code>CustomKeyStoreId</code> or <code>CustomKeyStoreName</code> parameter, but not both.</p>
pub fn custom_key_store_name(mut self, input: impl Into<std::string::String>) -> Self {
self.custom_key_store_name = Some(input.into());
self
}
/// <p>Gets only information about the specified custom key store. Enter the friendly name of the custom key store.</p>
/// <p>By default, this operation gets information about all custom key stores in the account and Region. To limit the output to a particular custom key store, provide either the <code>CustomKeyStoreId</code> or <code>CustomKeyStoreName</code> parameter, but not both.</p>
pub fn set_custom_key_store_name(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.custom_key_store_name = input;
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
pub fn limit(mut self, input: i32) -> Self {
self.limit = Some(input);
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
pub fn set_limit(mut self, input: std::option::Option<i32>) -> Self {
self.limit = input;
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(mut self, input: impl Into<std::string::String>) -> Self {
self.marker = Some(input.into());
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn set_marker(mut self, input: std::option::Option<std::string::String>) -> Self {
self.marker = input;
self
}
/// Consumes the builder and constructs a [`DescribeCustomKeyStoresInput`](crate::input::DescribeCustomKeyStoresInput).
pub fn build(
self,
) -> Result<
crate::input::DescribeCustomKeyStoresInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::DescribeCustomKeyStoresInput {
custom_key_store_id: self.custom_key_store_id,
custom_key_store_name: self.custom_key_store_name,
limit: self.limit,
marker: self.marker,
})
}
}
}
impl DescribeCustomKeyStoresInput {
/// Consumes the builder and constructs an Operation<[`DescribeCustomKeyStores`](crate::operation::DescribeCustomKeyStores)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::DescribeCustomKeyStores,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::DescribeCustomKeyStoresInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::DescribeCustomKeyStoresInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.DescribeCustomKeyStores",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_describe_custom_key_stores(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::DescribeCustomKeyStores::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"DescribeCustomKeyStores",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`DescribeCustomKeyStoresInput`](crate::input::DescribeCustomKeyStoresInput).
pub fn builder() -> crate::input::describe_custom_key_stores_input::Builder {
crate::input::describe_custom_key_stores_input::Builder::default()
}
}
/// See [`DescribeKeyInput`](crate::input::DescribeKeyInput).
pub mod describe_key_input {
/// A builder for [`DescribeKeyInput`](crate::input::DescribeKeyInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// <p>Describes the specified KMS key. </p>
/// <p>If you specify a predefined Amazon Web Services alias (an Amazon Web Services alias with no key ID), KMS associates the alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html##aws-managed-cmk">Amazon Web Services managed key</a> and returns its <code>KeyId</code> and <code>Arn</code> in the response.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Describes the specified KMS key. </p>
/// <p>If you specify a predefined Amazon Web Services alias (an Amazon Web Services alias with no key ID), KMS associates the alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html##aws-managed-cmk">Amazon Web Services managed key</a> and returns its <code>KeyId</code> and <code>Arn</code> in the response.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// Consumes the builder and constructs a [`DescribeKeyInput`](crate::input::DescribeKeyInput).
pub fn build(
self,
) -> Result<crate::input::DescribeKeyInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::DescribeKeyInput {
key_id: self.key_id,
grant_tokens: self.grant_tokens,
})
}
}
}
impl DescribeKeyInput {
/// Consumes the builder and constructs an Operation<[`DescribeKey`](crate::operation::DescribeKey)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::DescribeKey,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::DescribeKeyInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::DescribeKeyInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.DescribeKey",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_describe_key(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::DescribeKey::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"DescribeKey",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`DescribeKeyInput`](crate::input::DescribeKeyInput).
pub fn builder() -> crate::input::describe_key_input::Builder {
crate::input::describe_key_input::Builder::default()
}
}
/// See [`DisableKeyInput`](crate::input::DisableKeyInput).
pub mod disable_key_input {
/// A builder for [`DisableKeyInput`](crate::input::DisableKeyInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Identifies the KMS key to disable.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the KMS key to disable.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Consumes the builder and constructs a [`DisableKeyInput`](crate::input::DisableKeyInput).
pub fn build(
self,
) -> Result<crate::input::DisableKeyInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::DisableKeyInput {
key_id: self.key_id,
})
}
}
}
impl DisableKeyInput {
/// Consumes the builder and constructs an Operation<[`DisableKey`](crate::operation::DisableKey)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::DisableKey,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::DisableKeyInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::DisableKeyInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.DisableKey",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_disable_key(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::DisableKey::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"DisableKey",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`DisableKeyInput`](crate::input::DisableKeyInput).
pub fn builder() -> crate::input::disable_key_input::Builder {
crate::input::disable_key_input::Builder::default()
}
}
/// See [`DisableKeyRotationInput`](crate::input::DisableKeyRotationInput).
pub mod disable_key_rotation_input {
/// A builder for [`DisableKeyRotationInput`](crate::input::DisableKeyRotationInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Identifies a symmetric encryption KMS key. You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies a symmetric encryption KMS key. You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Consumes the builder and constructs a [`DisableKeyRotationInput`](crate::input::DisableKeyRotationInput).
pub fn build(
self,
) -> Result<
crate::input::DisableKeyRotationInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::DisableKeyRotationInput {
key_id: self.key_id,
})
}
}
}
impl DisableKeyRotationInput {
/// Consumes the builder and constructs an Operation<[`DisableKeyRotation`](crate::operation::DisableKeyRotation)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::DisableKeyRotation,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::DisableKeyRotationInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::DisableKeyRotationInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.DisableKeyRotation",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_disable_key_rotation(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::DisableKeyRotation::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"DisableKeyRotation",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`DisableKeyRotationInput`](crate::input::DisableKeyRotationInput).
pub fn builder() -> crate::input::disable_key_rotation_input::Builder {
crate::input::disable_key_rotation_input::Builder::default()
}
}
/// See [`DisconnectCustomKeyStoreInput`](crate::input::DisconnectCustomKeyStoreInput).
pub mod disconnect_custom_key_store_input {
/// A builder for [`DisconnectCustomKeyStoreInput`](crate::input::DisconnectCustomKeyStoreInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) custom_key_store_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Enter the ID of the custom key store you want to disconnect. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn custom_key_store_id(mut self, input: impl Into<std::string::String>) -> Self {
self.custom_key_store_id = Some(input.into());
self
}
/// <p>Enter the ID of the custom key store you want to disconnect. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn set_custom_key_store_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.custom_key_store_id = input;
self
}
/// Consumes the builder and constructs a [`DisconnectCustomKeyStoreInput`](crate::input::DisconnectCustomKeyStoreInput).
pub fn build(
self,
) -> Result<
crate::input::DisconnectCustomKeyStoreInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::DisconnectCustomKeyStoreInput {
custom_key_store_id: self.custom_key_store_id,
})
}
}
}
impl DisconnectCustomKeyStoreInput {
/// Consumes the builder and constructs an Operation<[`DisconnectCustomKeyStore`](crate::operation::DisconnectCustomKeyStore)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::DisconnectCustomKeyStore,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::DisconnectCustomKeyStoreInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::DisconnectCustomKeyStoreInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.DisconnectCustomKeyStore",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_disconnect_custom_key_store(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::DisconnectCustomKeyStore::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"DisconnectCustomKeyStore",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`DisconnectCustomKeyStoreInput`](crate::input::DisconnectCustomKeyStoreInput).
pub fn builder() -> crate::input::disconnect_custom_key_store_input::Builder {
crate::input::disconnect_custom_key_store_input::Builder::default()
}
}
/// See [`EnableKeyInput`](crate::input::EnableKeyInput).
pub mod enable_key_input {
/// A builder for [`EnableKeyInput`](crate::input::EnableKeyInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Identifies the KMS key to enable.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the KMS key to enable.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Consumes the builder and constructs a [`EnableKeyInput`](crate::input::EnableKeyInput).
pub fn build(
self,
) -> Result<crate::input::EnableKeyInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::EnableKeyInput {
key_id: self.key_id,
})
}
}
}
impl EnableKeyInput {
/// Consumes the builder and constructs an Operation<[`EnableKey`](crate::operation::EnableKey)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::EnableKey,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::EnableKeyInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::EnableKeyInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.EnableKey",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_enable_key(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op =
aws_smithy_http::operation::Operation::new(request, crate::operation::EnableKey::new())
.with_metadata(aws_smithy_http::operation::Metadata::new(
"EnableKey",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`EnableKeyInput`](crate::input::EnableKeyInput).
pub fn builder() -> crate::input::enable_key_input::Builder {
crate::input::enable_key_input::Builder::default()
}
}
/// See [`EnableKeyRotationInput`](crate::input::EnableKeyRotationInput).
pub mod enable_key_rotation_input {
/// A builder for [`EnableKeyRotationInput`](crate::input::EnableKeyRotationInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Identifies a symmetric encryption KMS key. You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies a symmetric encryption KMS key. You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Consumes the builder and constructs a [`EnableKeyRotationInput`](crate::input::EnableKeyRotationInput).
pub fn build(
self,
) -> Result<
crate::input::EnableKeyRotationInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::EnableKeyRotationInput {
key_id: self.key_id,
})
}
}
}
impl EnableKeyRotationInput {
/// Consumes the builder and constructs an Operation<[`EnableKeyRotation`](crate::operation::EnableKeyRotation)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::EnableKeyRotation,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::EnableKeyRotationInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::EnableKeyRotationInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.EnableKeyRotation",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_enable_key_rotation(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::EnableKeyRotation::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"EnableKeyRotation",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`EnableKeyRotationInput`](crate::input::EnableKeyRotationInput).
pub fn builder() -> crate::input::enable_key_rotation_input::Builder {
crate::input::enable_key_rotation_input::Builder::default()
}
}
/// See [`EncryptInput`](crate::input::EncryptInput).
pub mod encrypt_input {
/// A builder for [`EncryptInput`](crate::input::EncryptInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) plaintext: std::option::Option<aws_smithy_types::Blob>,
pub(crate) encryption_context: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
pub(crate) encryption_algorithm: std::option::Option<crate::model::EncryptionAlgorithmSpec>,
}
impl Builder {
/// <p>Identifies the KMS key to use in the encryption operation. The KMS key must have a <code>KeyUsage</code> of <code>ENCRYPT_DECRYPT</code>. To find the <code>KeyUsage</code> of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the KMS key to use in the encryption operation. The KMS key must have a <code>KeyUsage</code> of <code>ENCRYPT_DECRYPT</code>. To find the <code>KeyUsage</code> of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Data to be encrypted.</p>
pub fn plaintext(mut self, input: aws_smithy_types::Blob) -> Self {
self.plaintext = Some(input);
self
}
/// <p>Data to be encrypted.</p>
pub fn set_plaintext(mut self, input: std::option::Option<aws_smithy_types::Blob>) -> Self {
self.plaintext = input;
self
}
/// Adds a key-value pair to `encryption_context`.
///
/// To override the contents of this collection use [`set_encryption_context`](Self::set_encryption_context).
///
/// <p>Specifies the encryption context that will be used to encrypt the data. An encryption context is valid only for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> with a symmetric encryption KMS key. The standard asymmetric encryption algorithms and HMAC algorithms that KMS uses do not support an encryption context. </p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
mut self,
k: impl Into<std::string::String>,
v: impl Into<std::string::String>,
) -> Self {
let mut hash_map = self.encryption_context.unwrap_or_default();
hash_map.insert(k.into(), v.into());
self.encryption_context = Some(hash_map);
self
}
/// <p>Specifies the encryption context that will be used to encrypt the data. An encryption context is valid only for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> with a symmetric encryption KMS key. The standard asymmetric encryption algorithms and HMAC algorithms that KMS uses do not support an encryption context. </p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_encryption_context(
mut self,
input: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
) -> Self {
self.encryption_context = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// <p>Specifies the encryption algorithm that KMS will use to encrypt the plaintext message. The algorithm must be compatible with the KMS key that you specify.</p>
/// <p>This parameter is required only for asymmetric KMS keys. The default value, <code>SYMMETRIC_DEFAULT</code>, is the algorithm used for symmetric encryption KMS keys. If you are using an asymmetric KMS key, we recommend RSAES_OAEP_SHA_256.</p>
/// <p>The SM2PKE algorithm is only available in China Regions.</p>
pub fn encryption_algorithm(
mut self,
input: crate::model::EncryptionAlgorithmSpec,
) -> Self {
self.encryption_algorithm = Some(input);
self
}
/// <p>Specifies the encryption algorithm that KMS will use to encrypt the plaintext message. The algorithm must be compatible with the KMS key that you specify.</p>
/// <p>This parameter is required only for asymmetric KMS keys. The default value, <code>SYMMETRIC_DEFAULT</code>, is the algorithm used for symmetric encryption KMS keys. If you are using an asymmetric KMS key, we recommend RSAES_OAEP_SHA_256.</p>
/// <p>The SM2PKE algorithm is only available in China Regions.</p>
pub fn set_encryption_algorithm(
mut self,
input: std::option::Option<crate::model::EncryptionAlgorithmSpec>,
) -> Self {
self.encryption_algorithm = input;
self
}
/// Consumes the builder and constructs a [`EncryptInput`](crate::input::EncryptInput).
pub fn build(
self,
) -> Result<crate::input::EncryptInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::EncryptInput {
key_id: self.key_id,
plaintext: self.plaintext,
encryption_context: self.encryption_context,
grant_tokens: self.grant_tokens,
encryption_algorithm: self.encryption_algorithm,
})
}
}
impl std::fmt::Debug for Builder {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("Builder");
formatter.field("key_id", &self.key_id);
formatter.field("plaintext", &"*** Sensitive Data Redacted ***");
formatter.field("encryption_context", &self.encryption_context);
formatter.field("grant_tokens", &self.grant_tokens);
formatter.field("encryption_algorithm", &self.encryption_algorithm);
formatter.finish()
}
}
}
impl EncryptInput {
/// Consumes the builder and constructs an Operation<[`Encrypt`](crate::operation::Encrypt)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::Encrypt,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::EncryptInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::EncryptInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.Encrypt",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_encrypt(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op =
aws_smithy_http::operation::Operation::new(request, crate::operation::Encrypt::new())
.with_metadata(aws_smithy_http::operation::Metadata::new("Encrypt", "kms"));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`EncryptInput`](crate::input::EncryptInput).
pub fn builder() -> crate::input::encrypt_input::Builder {
crate::input::encrypt_input::Builder::default()
}
}
/// See [`GenerateDataKeyInput`](crate::input::GenerateDataKeyInput).
pub mod generate_data_key_input {
/// A builder for [`GenerateDataKeyInput`](crate::input::GenerateDataKeyInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) encryption_context: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
pub(crate) number_of_bytes: std::option::Option<i32>,
pub(crate) key_spec: std::option::Option<crate::model::DataKeySpec>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// <p>Specifies the symmetric encryption KMS key that encrypts the data key. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Specifies the symmetric encryption KMS key that encrypts the data key. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Adds a key-value pair to `encryption_context`.
///
/// To override the contents of this collection use [`set_encryption_context`](Self::set_encryption_context).
///
/// <p>Specifies the encryption context that will be used when encrypting the data key.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
mut self,
k: impl Into<std::string::String>,
v: impl Into<std::string::String>,
) -> Self {
let mut hash_map = self.encryption_context.unwrap_or_default();
hash_map.insert(k.into(), v.into());
self.encryption_context = Some(hash_map);
self
}
/// <p>Specifies the encryption context that will be used when encrypting the data key.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_encryption_context(
mut self,
input: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
) -> Self {
self.encryption_context = input;
self
}
/// <p>Specifies the length of the data key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For 128-bit (16-byte) and 256-bit (32-byte) data keys, use the <code>KeySpec</code> parameter.</p>
/// <p>You must specify either the <code>KeySpec</code> or the <code>NumberOfBytes</code> parameter (but not both) in every <code>GenerateDataKey</code> request.</p>
pub fn number_of_bytes(mut self, input: i32) -> Self {
self.number_of_bytes = Some(input);
self
}
/// <p>Specifies the length of the data key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For 128-bit (16-byte) and 256-bit (32-byte) data keys, use the <code>KeySpec</code> parameter.</p>
/// <p>You must specify either the <code>KeySpec</code> or the <code>NumberOfBytes</code> parameter (but not both) in every <code>GenerateDataKey</code> request.</p>
pub fn set_number_of_bytes(mut self, input: std::option::Option<i32>) -> Self {
self.number_of_bytes = input;
self
}
/// <p>Specifies the length of the data key. Use <code>AES_128</code> to generate a 128-bit symmetric key, or <code>AES_256</code> to generate a 256-bit symmetric key.</p>
/// <p>You must specify either the <code>KeySpec</code> or the <code>NumberOfBytes</code> parameter (but not both) in every <code>GenerateDataKey</code> request.</p>
pub fn key_spec(mut self, input: crate::model::DataKeySpec) -> Self {
self.key_spec = Some(input);
self
}
/// <p>Specifies the length of the data key. Use <code>AES_128</code> to generate a 128-bit symmetric key, or <code>AES_256</code> to generate a 256-bit symmetric key.</p>
/// <p>You must specify either the <code>KeySpec</code> or the <code>NumberOfBytes</code> parameter (but not both) in every <code>GenerateDataKey</code> request.</p>
pub fn set_key_spec(
mut self,
input: std::option::Option<crate::model::DataKeySpec>,
) -> Self {
self.key_spec = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// Consumes the builder and constructs a [`GenerateDataKeyInput`](crate::input::GenerateDataKeyInput).
pub fn build(
self,
) -> Result<crate::input::GenerateDataKeyInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::GenerateDataKeyInput {
key_id: self.key_id,
encryption_context: self.encryption_context,
number_of_bytes: self.number_of_bytes,
key_spec: self.key_spec,
grant_tokens: self.grant_tokens,
})
}
}
}
impl GenerateDataKeyInput {
/// Consumes the builder and constructs an Operation<[`GenerateDataKey`](crate::operation::GenerateDataKey)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::GenerateDataKey,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::GenerateDataKeyInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::GenerateDataKeyInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.GenerateDataKey",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_generate_data_key(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::GenerateDataKey::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"GenerateDataKey",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`GenerateDataKeyInput`](crate::input::GenerateDataKeyInput).
pub fn builder() -> crate::input::generate_data_key_input::Builder {
crate::input::generate_data_key_input::Builder::default()
}
}
/// See [`GenerateDataKeyPairInput`](crate::input::GenerateDataKeyPairInput).
pub mod generate_data_key_pair_input {
/// A builder for [`GenerateDataKeyPairInput`](crate::input::GenerateDataKeyPairInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) encryption_context: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) key_pair_spec: std::option::Option<crate::model::DataKeyPairSpec>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// Adds a key-value pair to `encryption_context`.
///
/// To override the contents of this collection use [`set_encryption_context`](Self::set_encryption_context).
///
/// <p>Specifies the encryption context that will be used when encrypting the private key in the data key pair.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
mut self,
k: impl Into<std::string::String>,
v: impl Into<std::string::String>,
) -> Self {
let mut hash_map = self.encryption_context.unwrap_or_default();
hash_map.insert(k.into(), v.into());
self.encryption_context = Some(hash_map);
self
}
/// <p>Specifies the encryption context that will be used when encrypting the private key in the data key pair.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_encryption_context(
mut self,
input: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
) -> Self {
self.encryption_context = input;
self
}
/// <p>Specifies the symmetric encryption KMS key that encrypts the private key in the data key pair. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Specifies the symmetric encryption KMS key that encrypts the private key in the data key pair. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Determines the type of data key pair that is generated. </p>
/// <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), and the rule that permits you to use ECC KMS keys only to sign and verify, are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
pub fn key_pair_spec(mut self, input: crate::model::DataKeyPairSpec) -> Self {
self.key_pair_spec = Some(input);
self
}
/// <p>Determines the type of data key pair that is generated. </p>
/// <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), and the rule that permits you to use ECC KMS keys only to sign and verify, are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
pub fn set_key_pair_spec(
mut self,
input: std::option::Option<crate::model::DataKeyPairSpec>,
) -> Self {
self.key_pair_spec = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// Consumes the builder and constructs a [`GenerateDataKeyPairInput`](crate::input::GenerateDataKeyPairInput).
pub fn build(
self,
) -> Result<
crate::input::GenerateDataKeyPairInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::GenerateDataKeyPairInput {
encryption_context: self.encryption_context,
key_id: self.key_id,
key_pair_spec: self.key_pair_spec,
grant_tokens: self.grant_tokens,
})
}
}
}
impl GenerateDataKeyPairInput {
/// Consumes the builder and constructs an Operation<[`GenerateDataKeyPair`](crate::operation::GenerateDataKeyPair)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::GenerateDataKeyPair,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::GenerateDataKeyPairInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::GenerateDataKeyPairInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.GenerateDataKeyPair",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_generate_data_key_pair(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::GenerateDataKeyPair::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"GenerateDataKeyPair",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`GenerateDataKeyPairInput`](crate::input::GenerateDataKeyPairInput).
pub fn builder() -> crate::input::generate_data_key_pair_input::Builder {
crate::input::generate_data_key_pair_input::Builder::default()
}
}
/// See [`GenerateDataKeyPairWithoutPlaintextInput`](crate::input::GenerateDataKeyPairWithoutPlaintextInput).
pub mod generate_data_key_pair_without_plaintext_input {
/// A builder for [`GenerateDataKeyPairWithoutPlaintextInput`](crate::input::GenerateDataKeyPairWithoutPlaintextInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) encryption_context: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) key_pair_spec: std::option::Option<crate::model::DataKeyPairSpec>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// Adds a key-value pair to `encryption_context`.
///
/// To override the contents of this collection use [`set_encryption_context`](Self::set_encryption_context).
///
/// <p>Specifies the encryption context that will be used when encrypting the private key in the data key pair.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
mut self,
k: impl Into<std::string::String>,
v: impl Into<std::string::String>,
) -> Self {
let mut hash_map = self.encryption_context.unwrap_or_default();
hash_map.insert(k.into(), v.into());
self.encryption_context = Some(hash_map);
self
}
/// <p>Specifies the encryption context that will be used when encrypting the private key in the data key pair.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_encryption_context(
mut self,
input: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
) -> Self {
self.encryption_context = input;
self
}
/// <p>Specifies the symmetric encryption KMS key that encrypts the private key in the data key pair. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation. </p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Specifies the symmetric encryption KMS key that encrypts the private key in the data key pair. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation. </p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Determines the type of data key pair that is generated.</p>
/// <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), and the rule that permits you to use ECC KMS keys only to sign and verify, are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
pub fn key_pair_spec(mut self, input: crate::model::DataKeyPairSpec) -> Self {
self.key_pair_spec = Some(input);
self
}
/// <p>Determines the type of data key pair that is generated.</p>
/// <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), and the rule that permits you to use ECC KMS keys only to sign and verify, are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
pub fn set_key_pair_spec(
mut self,
input: std::option::Option<crate::model::DataKeyPairSpec>,
) -> Self {
self.key_pair_spec = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// Consumes the builder and constructs a [`GenerateDataKeyPairWithoutPlaintextInput`](crate::input::GenerateDataKeyPairWithoutPlaintextInput).
pub fn build(
self,
) -> Result<
crate::input::GenerateDataKeyPairWithoutPlaintextInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::GenerateDataKeyPairWithoutPlaintextInput {
encryption_context: self.encryption_context,
key_id: self.key_id,
key_pair_spec: self.key_pair_spec,
grant_tokens: self.grant_tokens,
})
}
}
}
impl GenerateDataKeyPairWithoutPlaintextInput {
/// Consumes the builder and constructs an Operation<[`GenerateDataKeyPairWithoutPlaintext`](crate::operation::GenerateDataKeyPairWithoutPlaintext)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::GenerateDataKeyPairWithoutPlaintext,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::GenerateDataKeyPairWithoutPlaintextInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::GenerateDataKeyPairWithoutPlaintextInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.GenerateDataKeyPairWithoutPlaintext",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_generate_data_key_pair_without_plaintext(&self)?
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::GenerateDataKeyPairWithoutPlaintext::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"GenerateDataKeyPairWithoutPlaintext",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`GenerateDataKeyPairWithoutPlaintextInput`](crate::input::GenerateDataKeyPairWithoutPlaintextInput).
pub fn builder() -> crate::input::generate_data_key_pair_without_plaintext_input::Builder {
crate::input::generate_data_key_pair_without_plaintext_input::Builder::default()
}
}
/// See [`GenerateDataKeyWithoutPlaintextInput`](crate::input::GenerateDataKeyWithoutPlaintextInput).
pub mod generate_data_key_without_plaintext_input {
/// A builder for [`GenerateDataKeyWithoutPlaintextInput`](crate::input::GenerateDataKeyWithoutPlaintextInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) encryption_context: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
pub(crate) key_spec: std::option::Option<crate::model::DataKeySpec>,
pub(crate) number_of_bytes: std::option::Option<i32>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// <p>Specifies the symmetric encryption KMS key that encrypts the data key. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Specifies the symmetric encryption KMS key that encrypts the data key. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Adds a key-value pair to `encryption_context`.
///
/// To override the contents of this collection use [`set_encryption_context`](Self::set_encryption_context).
///
/// <p>Specifies the encryption context that will be used when encrypting the data key.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
mut self,
k: impl Into<std::string::String>,
v: impl Into<std::string::String>,
) -> Self {
let mut hash_map = self.encryption_context.unwrap_or_default();
hash_map.insert(k.into(), v.into());
self.encryption_context = Some(hash_map);
self
}
/// <p>Specifies the encryption context that will be used when encrypting the data key.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_encryption_context(
mut self,
input: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
) -> Self {
self.encryption_context = input;
self
}
/// <p>The length of the data key. Use <code>AES_128</code> to generate a 128-bit symmetric key, or <code>AES_256</code> to generate a 256-bit symmetric key.</p>
pub fn key_spec(mut self, input: crate::model::DataKeySpec) -> Self {
self.key_spec = Some(input);
self
}
/// <p>The length of the data key. Use <code>AES_128</code> to generate a 128-bit symmetric key, or <code>AES_256</code> to generate a 256-bit symmetric key.</p>
pub fn set_key_spec(
mut self,
input: std::option::Option<crate::model::DataKeySpec>,
) -> Self {
self.key_spec = input;
self
}
/// <p>The length of the data key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For common key lengths (128-bit and 256-bit symmetric keys), we recommend that you use the <code>KeySpec</code> field instead of this one.</p>
pub fn number_of_bytes(mut self, input: i32) -> Self {
self.number_of_bytes = Some(input);
self
}
/// <p>The length of the data key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For common key lengths (128-bit and 256-bit symmetric keys), we recommend that you use the <code>KeySpec</code> field instead of this one.</p>
pub fn set_number_of_bytes(mut self, input: std::option::Option<i32>) -> Self {
self.number_of_bytes = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// Consumes the builder and constructs a [`GenerateDataKeyWithoutPlaintextInput`](crate::input::GenerateDataKeyWithoutPlaintextInput).
pub fn build(
self,
) -> Result<
crate::input::GenerateDataKeyWithoutPlaintextInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::GenerateDataKeyWithoutPlaintextInput {
key_id: self.key_id,
encryption_context: self.encryption_context,
key_spec: self.key_spec,
number_of_bytes: self.number_of_bytes,
grant_tokens: self.grant_tokens,
})
}
}
}
impl GenerateDataKeyWithoutPlaintextInput {
/// Consumes the builder and constructs an Operation<[`GenerateDataKeyWithoutPlaintext`](crate::operation::GenerateDataKeyWithoutPlaintext)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::GenerateDataKeyWithoutPlaintext,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::GenerateDataKeyWithoutPlaintextInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::GenerateDataKeyWithoutPlaintextInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.GenerateDataKeyWithoutPlaintext",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_generate_data_key_without_plaintext(&self)?
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::GenerateDataKeyWithoutPlaintext::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"GenerateDataKeyWithoutPlaintext",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`GenerateDataKeyWithoutPlaintextInput`](crate::input::GenerateDataKeyWithoutPlaintextInput).
pub fn builder() -> crate::input::generate_data_key_without_plaintext_input::Builder {
crate::input::generate_data_key_without_plaintext_input::Builder::default()
}
}
/// See [`GenerateMacInput`](crate::input::GenerateMacInput).
pub mod generate_mac_input {
/// A builder for [`GenerateMacInput`](crate::input::GenerateMacInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default)]
pub struct Builder {
pub(crate) message: std::option::Option<aws_smithy_types::Blob>,
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) mac_algorithm: std::option::Option<crate::model::MacAlgorithmSpec>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// <p>The message to be hashed. Specify a message of up to 4,096 bytes. </p>
/// <p> <code>GenerateMac</code> and <code>VerifyMac</code> do not provide special handling for message digests. If you generate an HMAC for a hash digest of a message, you must verify the HMAC of the same hash digest.</p>
pub fn message(mut self, input: aws_smithy_types::Blob) -> Self {
self.message = Some(input);
self
}
/// <p>The message to be hashed. Specify a message of up to 4,096 bytes. </p>
/// <p> <code>GenerateMac</code> and <code>VerifyMac</code> do not provide special handling for message digests. If you generate an HMAC for a hash digest of a message, you must verify the HMAC of the same hash digest.</p>
pub fn set_message(mut self, input: std::option::Option<aws_smithy_types::Blob>) -> Self {
self.message = input;
self
}
/// <p>The HMAC KMS key to use in the operation. The MAC algorithm computes the HMAC for the message and the key as described in <a href="https://datatracker.ietf.org/doc/html/rfc2104">RFC 2104</a>.</p>
/// <p>To identify an HMAC KMS key, use the <code>DescribeKey</code> operation and see the <code>KeySpec</code> field in the response.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>The HMAC KMS key to use in the operation. The MAC algorithm computes the HMAC for the message and the key as described in <a href="https://datatracker.ietf.org/doc/html/rfc2104">RFC 2104</a>.</p>
/// <p>To identify an HMAC KMS key, use the <code>DescribeKey</code> operation and see the <code>KeySpec</code> field in the response.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>The MAC algorithm used in the operation.</p>
/// <p> The algorithm must be compatible with the HMAC KMS key that you specify. To find the MAC algorithms that your HMAC KMS key supports, use the <code>DescribeKey</code> operation and see the <code>MacAlgorithms</code> field in the <code>DescribeKey</code> response.</p>
pub fn mac_algorithm(mut self, input: crate::model::MacAlgorithmSpec) -> Self {
self.mac_algorithm = Some(input);
self
}
/// <p>The MAC algorithm used in the operation.</p>
/// <p> The algorithm must be compatible with the HMAC KMS key that you specify. To find the MAC algorithms that your HMAC KMS key supports, use the <code>DescribeKey</code> operation and see the <code>MacAlgorithms</code> field in the <code>DescribeKey</code> response.</p>
pub fn set_mac_algorithm(
mut self,
input: std::option::Option<crate::model::MacAlgorithmSpec>,
) -> Self {
self.mac_algorithm = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// Consumes the builder and constructs a [`GenerateMacInput`](crate::input::GenerateMacInput).
pub fn build(
self,
) -> Result<crate::input::GenerateMacInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::GenerateMacInput {
message: self.message,
key_id: self.key_id,
mac_algorithm: self.mac_algorithm,
grant_tokens: self.grant_tokens,
})
}
}
impl std::fmt::Debug for Builder {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("Builder");
formatter.field("message", &"*** Sensitive Data Redacted ***");
formatter.field("key_id", &self.key_id);
formatter.field("mac_algorithm", &self.mac_algorithm);
formatter.field("grant_tokens", &self.grant_tokens);
formatter.finish()
}
}
}
impl GenerateMacInput {
/// Consumes the builder and constructs an Operation<[`GenerateMac`](crate::operation::GenerateMac)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::GenerateMac,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::GenerateMacInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::GenerateMacInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.GenerateMac",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_generate_mac(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::GenerateMac::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"GenerateMac",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`GenerateMacInput`](crate::input::GenerateMacInput).
pub fn builder() -> crate::input::generate_mac_input::Builder {
crate::input::generate_mac_input::Builder::default()
}
}
/// See [`GenerateRandomInput`](crate::input::GenerateRandomInput).
pub mod generate_random_input {
/// A builder for [`GenerateRandomInput`](crate::input::GenerateRandomInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) number_of_bytes: std::option::Option<i32>,
pub(crate) custom_key_store_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>The length of the random byte string. This parameter is required.</p>
pub fn number_of_bytes(mut self, input: i32) -> Self {
self.number_of_bytes = Some(input);
self
}
/// <p>The length of the random byte string. This parameter is required.</p>
pub fn set_number_of_bytes(mut self, input: std::option::Option<i32>) -> Self {
self.number_of_bytes = input;
self
}
/// <p>Generates the random byte string in the CloudHSM cluster that is associated with the specified CloudHSM key store. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
/// <p>External key store IDs are not valid for this parameter. If you specify the ID of an external key store, <code>GenerateRandom</code> throws an <code>UnsupportedOperationException</code>.</p>
pub fn custom_key_store_id(mut self, input: impl Into<std::string::String>) -> Self {
self.custom_key_store_id = Some(input.into());
self
}
/// <p>Generates the random byte string in the CloudHSM cluster that is associated with the specified CloudHSM key store. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
/// <p>External key store IDs are not valid for this parameter. If you specify the ID of an external key store, <code>GenerateRandom</code> throws an <code>UnsupportedOperationException</code>.</p>
pub fn set_custom_key_store_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.custom_key_store_id = input;
self
}
/// Consumes the builder and constructs a [`GenerateRandomInput`](crate::input::GenerateRandomInput).
pub fn build(
self,
) -> Result<crate::input::GenerateRandomInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::GenerateRandomInput {
number_of_bytes: self.number_of_bytes,
custom_key_store_id: self.custom_key_store_id,
})
}
}
}
impl GenerateRandomInput {
/// Consumes the builder and constructs an Operation<[`GenerateRandom`](crate::operation::GenerateRandom)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::GenerateRandom,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::GenerateRandomInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::GenerateRandomInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.GenerateRandom",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_generate_random(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::GenerateRandom::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"GenerateRandom",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`GenerateRandomInput`](crate::input::GenerateRandomInput).
pub fn builder() -> crate::input::generate_random_input::Builder {
crate::input::generate_random_input::Builder::default()
}
}
/// See [`GetKeyPolicyInput`](crate::input::GetKeyPolicyInput).
pub mod get_key_policy_input {
/// A builder for [`GetKeyPolicyInput`](crate::input::GetKeyPolicyInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) policy_name: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Gets the key policy for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Gets the key policy for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Specifies the name of the key policy. The only valid name is <code>default</code>. To get the names of key policies, use <code>ListKeyPolicies</code>.</p>
pub fn policy_name(mut self, input: impl Into<std::string::String>) -> Self {
self.policy_name = Some(input.into());
self
}
/// <p>Specifies the name of the key policy. The only valid name is <code>default</code>. To get the names of key policies, use <code>ListKeyPolicies</code>.</p>
pub fn set_policy_name(mut self, input: std::option::Option<std::string::String>) -> Self {
self.policy_name = input;
self
}
/// Consumes the builder and constructs a [`GetKeyPolicyInput`](crate::input::GetKeyPolicyInput).
pub fn build(
self,
) -> Result<crate::input::GetKeyPolicyInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::GetKeyPolicyInput {
key_id: self.key_id,
policy_name: self.policy_name,
})
}
}
}
impl GetKeyPolicyInput {
/// Consumes the builder and constructs an Operation<[`GetKeyPolicy`](crate::operation::GetKeyPolicy)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::GetKeyPolicy,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::GetKeyPolicyInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::GetKeyPolicyInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.GetKeyPolicy",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_get_key_policy(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::GetKeyPolicy::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"GetKeyPolicy",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`GetKeyPolicyInput`](crate::input::GetKeyPolicyInput).
pub fn builder() -> crate::input::get_key_policy_input::Builder {
crate::input::get_key_policy_input::Builder::default()
}
}
/// See [`GetKeyRotationStatusInput`](crate::input::GetKeyRotationStatusInput).
pub mod get_key_rotation_status_input {
/// A builder for [`GetKeyRotationStatusInput`](crate::input::GetKeyRotationStatusInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Gets the rotation status for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Gets the rotation status for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Consumes the builder and constructs a [`GetKeyRotationStatusInput`](crate::input::GetKeyRotationStatusInput).
pub fn build(
self,
) -> Result<
crate::input::GetKeyRotationStatusInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::GetKeyRotationStatusInput {
key_id: self.key_id,
})
}
}
}
impl GetKeyRotationStatusInput {
/// Consumes the builder and constructs an Operation<[`GetKeyRotationStatus`](crate::operation::GetKeyRotationStatus)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::GetKeyRotationStatus,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::GetKeyRotationStatusInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::GetKeyRotationStatusInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.GetKeyRotationStatus",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_get_key_rotation_status(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::GetKeyRotationStatus::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"GetKeyRotationStatus",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`GetKeyRotationStatusInput`](crate::input::GetKeyRotationStatusInput).
pub fn builder() -> crate::input::get_key_rotation_status_input::Builder {
crate::input::get_key_rotation_status_input::Builder::default()
}
}
/// See [`GetParametersForImportInput`](crate::input::GetParametersForImportInput).
pub mod get_parameters_for_import_input {
/// A builder for [`GetParametersForImportInput`](crate::input::GetParametersForImportInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) wrapping_algorithm: std::option::Option<crate::model::AlgorithmSpec>,
pub(crate) wrapping_key_spec: std::option::Option<crate::model::WrappingKeySpec>,
}
impl Builder {
/// <p>The identifier of the symmetric encryption KMS key into which you will import key material. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>The identifier of the symmetric encryption KMS key into which you will import key material. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>The algorithm you will use to encrypt the key material before importing it with <code>ImportKeyMaterial</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-encrypt-key-material.html">Encrypt the Key Material</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn wrapping_algorithm(mut self, input: crate::model::AlgorithmSpec) -> Self {
self.wrapping_algorithm = Some(input);
self
}
/// <p>The algorithm you will use to encrypt the key material before importing it with <code>ImportKeyMaterial</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-encrypt-key-material.html">Encrypt the Key Material</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_wrapping_algorithm(
mut self,
input: std::option::Option<crate::model::AlgorithmSpec>,
) -> Self {
self.wrapping_algorithm = input;
self
}
/// <p>The type of wrapping key (public key) to return in the response. Only 2048-bit RSA public keys are supported.</p>
pub fn wrapping_key_spec(mut self, input: crate::model::WrappingKeySpec) -> Self {
self.wrapping_key_spec = Some(input);
self
}
/// <p>The type of wrapping key (public key) to return in the response. Only 2048-bit RSA public keys are supported.</p>
pub fn set_wrapping_key_spec(
mut self,
input: std::option::Option<crate::model::WrappingKeySpec>,
) -> Self {
self.wrapping_key_spec = input;
self
}
/// Consumes the builder and constructs a [`GetParametersForImportInput`](crate::input::GetParametersForImportInput).
pub fn build(
self,
) -> Result<
crate::input::GetParametersForImportInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::GetParametersForImportInput {
key_id: self.key_id,
wrapping_algorithm: self.wrapping_algorithm,
wrapping_key_spec: self.wrapping_key_spec,
})
}
}
}
impl GetParametersForImportInput {
/// Consumes the builder and constructs an Operation<[`GetParametersForImport`](crate::operation::GetParametersForImport)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::GetParametersForImport,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::GetParametersForImportInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::GetParametersForImportInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.GetParametersForImport",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_get_parameters_for_import(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::GetParametersForImport::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"GetParametersForImport",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`GetParametersForImportInput`](crate::input::GetParametersForImportInput).
pub fn builder() -> crate::input::get_parameters_for_import_input::Builder {
crate::input::get_parameters_for_import_input::Builder::default()
}
}
/// See [`GetPublicKeyInput`](crate::input::GetPublicKeyInput).
pub mod get_public_key_input {
/// A builder for [`GetPublicKeyInput`](crate::input::GetPublicKeyInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// <p>Identifies the asymmetric KMS key that includes the public key.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the asymmetric KMS key that includes the public key.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// Consumes the builder and constructs a [`GetPublicKeyInput`](crate::input::GetPublicKeyInput).
pub fn build(
self,
) -> Result<crate::input::GetPublicKeyInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::GetPublicKeyInput {
key_id: self.key_id,
grant_tokens: self.grant_tokens,
})
}
}
}
impl GetPublicKeyInput {
/// Consumes the builder and constructs an Operation<[`GetPublicKey`](crate::operation::GetPublicKey)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::GetPublicKey,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::GetPublicKeyInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::GetPublicKeyInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.GetPublicKey",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_get_public_key(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::GetPublicKey::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"GetPublicKey",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`GetPublicKeyInput`](crate::input::GetPublicKeyInput).
pub fn builder() -> crate::input::get_public_key_input::Builder {
crate::input::get_public_key_input::Builder::default()
}
}
/// See [`ImportKeyMaterialInput`](crate::input::ImportKeyMaterialInput).
pub mod import_key_material_input {
/// A builder for [`ImportKeyMaterialInput`](crate::input::ImportKeyMaterialInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) import_token: std::option::Option<aws_smithy_types::Blob>,
pub(crate) encrypted_key_material: std::option::Option<aws_smithy_types::Blob>,
pub(crate) valid_to: std::option::Option<aws_smithy_types::DateTime>,
pub(crate) expiration_model: std::option::Option<crate::model::ExpirationModelType>,
}
impl Builder {
/// <p>The identifier of the symmetric encryption KMS key that receives the imported key material. This must be the same KMS key specified in the <code>KeyID</code> parameter of the corresponding <code>GetParametersForImport</code> request. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>. You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, a KMS key in a custom key store, or on a KMS key in a different Amazon Web Services account</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>The identifier of the symmetric encryption KMS key that receives the imported key material. This must be the same KMS key specified in the <code>KeyID</code> parameter of the corresponding <code>GetParametersForImport</code> request. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>. You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, a KMS key in a custom key store, or on a KMS key in a different Amazon Web Services account</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>The import token that you received in the response to a previous <code>GetParametersForImport</code> request. It must be from the same response that contained the public key that you used to encrypt the key material.</p>
pub fn import_token(mut self, input: aws_smithy_types::Blob) -> Self {
self.import_token = Some(input);
self
}
/// <p>The import token that you received in the response to a previous <code>GetParametersForImport</code> request. It must be from the same response that contained the public key that you used to encrypt the key material.</p>
pub fn set_import_token(
mut self,
input: std::option::Option<aws_smithy_types::Blob>,
) -> Self {
self.import_token = input;
self
}
/// <p>The encrypted key material to import. The key material must be encrypted with the public wrapping key that <code>GetParametersForImport</code> returned, using the wrapping algorithm that you specified in the same <code>GetParametersForImport</code> request.</p>
pub fn encrypted_key_material(mut self, input: aws_smithy_types::Blob) -> Self {
self.encrypted_key_material = Some(input);
self
}
/// <p>The encrypted key material to import. The key material must be encrypted with the public wrapping key that <code>GetParametersForImport</code> returned, using the wrapping algorithm that you specified in the same <code>GetParametersForImport</code> request.</p>
pub fn set_encrypted_key_material(
mut self,
input: std::option::Option<aws_smithy_types::Blob>,
) -> Self {
self.encrypted_key_material = input;
self
}
/// <p>The date and time when the imported key material expires. This parameter is required when the value of the <code>ExpirationModel</code> parameter is <code>KEY_MATERIAL_EXPIRES</code>. Otherwise it is not valid.</p>
/// <p>The value of this parameter must be a future date and time. The maximum value is 365 days from the request date.</p>
/// <p>When the key material expires, KMS deletes the key material from the KMS key. Without its key material, the KMS key is unusable. To use the KMS key in cryptographic operations, you must reimport the same key material.</p>
/// <p>You cannot change the <code>ExpirationModel</code> or <code>ValidTo</code> values for the current import after the request completes. To change either value, you must delete (<code>DeleteImportedKeyMaterial</code>) and reimport the key material.</p>
pub fn valid_to(mut self, input: aws_smithy_types::DateTime) -> Self {
self.valid_to = Some(input);
self
}
/// <p>The date and time when the imported key material expires. This parameter is required when the value of the <code>ExpirationModel</code> parameter is <code>KEY_MATERIAL_EXPIRES</code>. Otherwise it is not valid.</p>
/// <p>The value of this parameter must be a future date and time. The maximum value is 365 days from the request date.</p>
/// <p>When the key material expires, KMS deletes the key material from the KMS key. Without its key material, the KMS key is unusable. To use the KMS key in cryptographic operations, you must reimport the same key material.</p>
/// <p>You cannot change the <code>ExpirationModel</code> or <code>ValidTo</code> values for the current import after the request completes. To change either value, you must delete (<code>DeleteImportedKeyMaterial</code>) and reimport the key material.</p>
pub fn set_valid_to(
mut self,
input: std::option::Option<aws_smithy_types::DateTime>,
) -> Self {
self.valid_to = input;
self
}
/// <p>Specifies whether the key material expires. The default is <code>KEY_MATERIAL_EXPIRES</code>.</p>
/// <p>When the value of <code>ExpirationModel</code> is <code>KEY_MATERIAL_EXPIRES</code>, you must specify a value for the <code>ValidTo</code> parameter. When value is <code>KEY_MATERIAL_DOES_NOT_EXPIRE</code>, you must omit the <code>ValidTo</code> parameter.</p>
/// <p>You cannot change the <code>ExpirationModel</code> or <code>ValidTo</code> values for the current import after the request completes. To change either value, you must delete (<code>DeleteImportedKeyMaterial</code>) and reimport the key material.</p>
pub fn expiration_model(mut self, input: crate::model::ExpirationModelType) -> Self {
self.expiration_model = Some(input);
self
}
/// <p>Specifies whether the key material expires. The default is <code>KEY_MATERIAL_EXPIRES</code>.</p>
/// <p>When the value of <code>ExpirationModel</code> is <code>KEY_MATERIAL_EXPIRES</code>, you must specify a value for the <code>ValidTo</code> parameter. When value is <code>KEY_MATERIAL_DOES_NOT_EXPIRE</code>, you must omit the <code>ValidTo</code> parameter.</p>
/// <p>You cannot change the <code>ExpirationModel</code> or <code>ValidTo</code> values for the current import after the request completes. To change either value, you must delete (<code>DeleteImportedKeyMaterial</code>) and reimport the key material.</p>
pub fn set_expiration_model(
mut self,
input: std::option::Option<crate::model::ExpirationModelType>,
) -> Self {
self.expiration_model = input;
self
}
/// Consumes the builder and constructs a [`ImportKeyMaterialInput`](crate::input::ImportKeyMaterialInput).
pub fn build(
self,
) -> Result<
crate::input::ImportKeyMaterialInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::ImportKeyMaterialInput {
key_id: self.key_id,
import_token: self.import_token,
encrypted_key_material: self.encrypted_key_material,
valid_to: self.valid_to,
expiration_model: self.expiration_model,
})
}
}
}
impl ImportKeyMaterialInput {
/// Consumes the builder and constructs an Operation<[`ImportKeyMaterial`](crate::operation::ImportKeyMaterial)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ImportKeyMaterial,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ImportKeyMaterialInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ImportKeyMaterialInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ImportKeyMaterial",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_import_key_material(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::ImportKeyMaterial::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"ImportKeyMaterial",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ImportKeyMaterialInput`](crate::input::ImportKeyMaterialInput).
pub fn builder() -> crate::input::import_key_material_input::Builder {
crate::input::import_key_material_input::Builder::default()
}
}
/// See [`ListAliasesInput`](crate::input::ListAliasesInput).
pub mod list_aliases_input {
/// A builder for [`ListAliasesInput`](crate::input::ListAliasesInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) limit: std::option::Option<i32>,
pub(crate) marker: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Lists only aliases that are associated with the specified KMS key. Enter a KMS key in your Amazon Web Services account. </p>
/// <p>This parameter is optional. If you omit it, <code>ListAliases</code> returns all aliases in the account and Region.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Lists only aliases that are associated with the specified KMS key. Enter a KMS key in your Amazon Web Services account. </p>
/// <p>This parameter is optional. If you omit it, <code>ListAliases</code> returns all aliases in the account and Region.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn limit(mut self, input: i32) -> Self {
self.limit = Some(input);
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn set_limit(mut self, input: std::option::Option<i32>) -> Self {
self.limit = input;
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(mut self, input: impl Into<std::string::String>) -> Self {
self.marker = Some(input.into());
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn set_marker(mut self, input: std::option::Option<std::string::String>) -> Self {
self.marker = input;
self
}
/// Consumes the builder and constructs a [`ListAliasesInput`](crate::input::ListAliasesInput).
pub fn build(
self,
) -> Result<crate::input::ListAliasesInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::ListAliasesInput {
key_id: self.key_id,
limit: self.limit,
marker: self.marker,
})
}
}
}
impl ListAliasesInput {
/// Consumes the builder and constructs an Operation<[`ListAliases`](crate::operation::ListAliases)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ListAliases,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ListAliasesInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ListAliasesInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ListAliases",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_list_aliases(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::ListAliases::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"ListAliases",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ListAliasesInput`](crate::input::ListAliasesInput).
pub fn builder() -> crate::input::list_aliases_input::Builder {
crate::input::list_aliases_input::Builder::default()
}
}
/// See [`ListGrantsInput`](crate::input::ListGrantsInput).
pub mod list_grants_input {
/// A builder for [`ListGrantsInput`](crate::input::ListGrantsInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) limit: std::option::Option<i32>,
pub(crate) marker: std::option::Option<std::string::String>,
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) grant_id: std::option::Option<std::string::String>,
pub(crate) grantee_principal: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn limit(mut self, input: i32) -> Self {
self.limit = Some(input);
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn set_limit(mut self, input: std::option::Option<i32>) -> Self {
self.limit = input;
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(mut self, input: impl Into<std::string::String>) -> Self {
self.marker = Some(input.into());
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn set_marker(mut self, input: std::option::Option<std::string::String>) -> Self {
self.marker = input;
self
}
/// <p>Returns only grants for the specified KMS key. This parameter is required.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Returns only grants for the specified KMS key. This parameter is required.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Returns only the grant with the specified grant ID. The grant ID uniquely identifies the grant. </p>
pub fn grant_id(mut self, input: impl Into<std::string::String>) -> Self {
self.grant_id = Some(input.into());
self
}
/// <p>Returns only the grant with the specified grant ID. The grant ID uniquely identifies the grant. </p>
pub fn set_grant_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.grant_id = input;
self
}
/// <p>Returns only grants where the specified principal is the grantee principal for the grant.</p>
pub fn grantee_principal(mut self, input: impl Into<std::string::String>) -> Self {
self.grantee_principal = Some(input.into());
self
}
/// <p>Returns only grants where the specified principal is the grantee principal for the grant.</p>
pub fn set_grantee_principal(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.grantee_principal = input;
self
}
/// Consumes the builder and constructs a [`ListGrantsInput`](crate::input::ListGrantsInput).
pub fn build(
self,
) -> Result<crate::input::ListGrantsInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::ListGrantsInput {
limit: self.limit,
marker: self.marker,
key_id: self.key_id,
grant_id: self.grant_id,
grantee_principal: self.grantee_principal,
})
}
}
}
impl ListGrantsInput {
/// Consumes the builder and constructs an Operation<[`ListGrants`](crate::operation::ListGrants)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ListGrants,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ListGrantsInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ListGrantsInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ListGrants",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_list_grants(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::ListGrants::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"ListGrants",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ListGrantsInput`](crate::input::ListGrantsInput).
pub fn builder() -> crate::input::list_grants_input::Builder {
crate::input::list_grants_input::Builder::default()
}
}
/// See [`ListKeyPoliciesInput`](crate::input::ListKeyPoliciesInput).
pub mod list_key_policies_input {
/// A builder for [`ListKeyPoliciesInput`](crate::input::ListKeyPoliciesInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) limit: std::option::Option<i32>,
pub(crate) marker: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Gets the names of key policies for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Gets the names of key policies for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100.</p>
/// <p>Only one policy can be attached to a key.</p>
pub fn limit(mut self, input: i32) -> Self {
self.limit = Some(input);
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100.</p>
/// <p>Only one policy can be attached to a key.</p>
pub fn set_limit(mut self, input: std::option::Option<i32>) -> Self {
self.limit = input;
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(mut self, input: impl Into<std::string::String>) -> Self {
self.marker = Some(input.into());
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn set_marker(mut self, input: std::option::Option<std::string::String>) -> Self {
self.marker = input;
self
}
/// Consumes the builder and constructs a [`ListKeyPoliciesInput`](crate::input::ListKeyPoliciesInput).
pub fn build(
self,
) -> Result<crate::input::ListKeyPoliciesInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::ListKeyPoliciesInput {
key_id: self.key_id,
limit: self.limit,
marker: self.marker,
})
}
}
}
impl ListKeyPoliciesInput {
/// Consumes the builder and constructs an Operation<[`ListKeyPolicies`](crate::operation::ListKeyPolicies)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ListKeyPolicies,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ListKeyPoliciesInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ListKeyPoliciesInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ListKeyPolicies",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_list_key_policies(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::ListKeyPolicies::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"ListKeyPolicies",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ListKeyPoliciesInput`](crate::input::ListKeyPoliciesInput).
pub fn builder() -> crate::input::list_key_policies_input::Builder {
crate::input::list_key_policies_input::Builder::default()
}
}
/// See [`ListKeysInput`](crate::input::ListKeysInput).
pub mod list_keys_input {
/// A builder for [`ListKeysInput`](crate::input::ListKeysInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) limit: std::option::Option<i32>,
pub(crate) marker: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100.</p>
pub fn limit(mut self, input: i32) -> Self {
self.limit = Some(input);
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100.</p>
pub fn set_limit(mut self, input: std::option::Option<i32>) -> Self {
self.limit = input;
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(mut self, input: impl Into<std::string::String>) -> Self {
self.marker = Some(input.into());
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn set_marker(mut self, input: std::option::Option<std::string::String>) -> Self {
self.marker = input;
self
}
/// Consumes the builder and constructs a [`ListKeysInput`](crate::input::ListKeysInput).
pub fn build(
self,
) -> Result<crate::input::ListKeysInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::ListKeysInput {
limit: self.limit,
marker: self.marker,
})
}
}
}
impl ListKeysInput {
/// Consumes the builder and constructs an Operation<[`ListKeys`](crate::operation::ListKeys)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ListKeys,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ListKeysInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ListKeysInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ListKeys",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_list_keys(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op =
aws_smithy_http::operation::Operation::new(request, crate::operation::ListKeys::new())
.with_metadata(aws_smithy_http::operation::Metadata::new("ListKeys", "kms"));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ListKeysInput`](crate::input::ListKeysInput).
pub fn builder() -> crate::input::list_keys_input::Builder {
crate::input::list_keys_input::Builder::default()
}
}
/// See [`ListResourceTagsInput`](crate::input::ListResourceTagsInput).
pub mod list_resource_tags_input {
/// A builder for [`ListResourceTagsInput`](crate::input::ListResourceTagsInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) limit: std::option::Option<i32>,
pub(crate) marker: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Gets tags on the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Gets tags on the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 50, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn limit(mut self, input: i32) -> Self {
self.limit = Some(input);
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 50, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn set_limit(mut self, input: std::option::Option<i32>) -> Self {
self.limit = input;
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
/// <p>Do not attempt to construct this value. Use only the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(mut self, input: impl Into<std::string::String>) -> Self {
self.marker = Some(input.into());
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
/// <p>Do not attempt to construct this value. Use only the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn set_marker(mut self, input: std::option::Option<std::string::String>) -> Self {
self.marker = input;
self
}
/// Consumes the builder and constructs a [`ListResourceTagsInput`](crate::input::ListResourceTagsInput).
pub fn build(
self,
) -> Result<
crate::input::ListResourceTagsInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::ListResourceTagsInput {
key_id: self.key_id,
limit: self.limit,
marker: self.marker,
})
}
}
}
impl ListResourceTagsInput {
/// Consumes the builder and constructs an Operation<[`ListResourceTags`](crate::operation::ListResourceTags)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ListResourceTags,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ListResourceTagsInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ListResourceTagsInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ListResourceTags",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_list_resource_tags(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::ListResourceTags::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"ListResourceTags",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ListResourceTagsInput`](crate::input::ListResourceTagsInput).
pub fn builder() -> crate::input::list_resource_tags_input::Builder {
crate::input::list_resource_tags_input::Builder::default()
}
}
/// See [`ListRetirableGrantsInput`](crate::input::ListRetirableGrantsInput).
pub mod list_retirable_grants_input {
/// A builder for [`ListRetirableGrantsInput`](crate::input::ListRetirableGrantsInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) limit: std::option::Option<i32>,
pub(crate) marker: std::option::Option<std::string::String>,
pub(crate) retiring_principal: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn limit(mut self, input: i32) -> Self {
self.limit = Some(input);
self
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn set_limit(mut self, input: std::option::Option<i32>) -> Self {
self.limit = input;
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(mut self, input: impl Into<std::string::String>) -> Self {
self.marker = Some(input.into());
self
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn set_marker(mut self, input: std::option::Option<std::string::String>) -> Self {
self.marker = input;
self
}
/// <p>The retiring principal for which to list grants. Enter a principal in your Amazon Web Services account.</p>
/// <p>To specify the retiring principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
pub fn retiring_principal(mut self, input: impl Into<std::string::String>) -> Self {
self.retiring_principal = Some(input.into());
self
}
/// <p>The retiring principal for which to list grants. Enter a principal in your Amazon Web Services account.</p>
/// <p>To specify the retiring principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
pub fn set_retiring_principal(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.retiring_principal = input;
self
}
/// Consumes the builder and constructs a [`ListRetirableGrantsInput`](crate::input::ListRetirableGrantsInput).
pub fn build(
self,
) -> Result<
crate::input::ListRetirableGrantsInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::ListRetirableGrantsInput {
limit: self.limit,
marker: self.marker,
retiring_principal: self.retiring_principal,
})
}
}
}
impl ListRetirableGrantsInput {
/// Consumes the builder and constructs an Operation<[`ListRetirableGrants`](crate::operation::ListRetirableGrants)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ListRetirableGrants,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ListRetirableGrantsInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ListRetirableGrantsInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ListRetirableGrants",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_list_retirable_grants(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::ListRetirableGrants::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"ListRetirableGrants",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ListRetirableGrantsInput`](crate::input::ListRetirableGrantsInput).
pub fn builder() -> crate::input::list_retirable_grants_input::Builder {
crate::input::list_retirable_grants_input::Builder::default()
}
}
/// See [`PutKeyPolicyInput`](crate::input::PutKeyPolicyInput).
pub mod put_key_policy_input {
/// A builder for [`PutKeyPolicyInput`](crate::input::PutKeyPolicyInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) policy_name: std::option::Option<std::string::String>,
pub(crate) policy: std::option::Option<std::string::String>,
pub(crate) bypass_policy_lockout_safety_check: std::option::Option<bool>,
}
impl Builder {
/// <p>Sets the key policy on the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Sets the key policy on the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>The name of the key policy. The only valid value is <code>default</code>.</p>
pub fn policy_name(mut self, input: impl Into<std::string::String>) -> Self {
self.policy_name = Some(input.into());
self
}
/// <p>The name of the key policy. The only valid value is <code>default</code>.</p>
pub fn set_policy_name(mut self, input: std::option::Option<std::string::String>) -> Self {
self.policy_name = input;
self
}
/// <p>The key policy to attach to the KMS key.</p>
/// <p>The key policy must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must allow the principal that is making the <code>PutKeyPolicy</code> request to make a subsequent <code>PutKeyPolicy</code> request on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i>Key Management Service Developer Guide</i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i>Amazon Web Services Identity and Access Management User Guide</i>.</p> </li>
/// </ul>
/// <p>A key policy document can include only the following characters:</p>
/// <ul>
/// <li> <p>Printable ASCII characters from the space character (<code>\u0020</code>) through the end of the ASCII character range.</p> </li>
/// <li> <p>Printable characters in the Basic Latin and Latin-1 Supplement character set (through <code>\u00FF</code>).</p> </li>
/// <li> <p>The tab (<code>\u0009</code>), line feed (<code>\u000A</code>), and carriage return (<code>\u000D</code>) special characters</p> </li>
/// </ul>
/// <p>For information about key policies, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">Key policies in KMS</a> in the <i>Key Management Service Developer Guide</i>.For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
pub fn policy(mut self, input: impl Into<std::string::String>) -> Self {
self.policy = Some(input.into());
self
}
/// <p>The key policy to attach to the KMS key.</p>
/// <p>The key policy must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must allow the principal that is making the <code>PutKeyPolicy</code> request to make a subsequent <code>PutKeyPolicy</code> request on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i>Key Management Service Developer Guide</i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i>Amazon Web Services Identity and Access Management User Guide</i>.</p> </li>
/// </ul>
/// <p>A key policy document can include only the following characters:</p>
/// <ul>
/// <li> <p>Printable ASCII characters from the space character (<code>\u0020</code>) through the end of the ASCII character range.</p> </li>
/// <li> <p>Printable characters in the Basic Latin and Latin-1 Supplement character set (through <code>\u00FF</code>).</p> </li>
/// <li> <p>The tab (<code>\u0009</code>), line feed (<code>\u000A</code>), and carriage return (<code>\u000D</code>) special characters</p> </li>
/// </ul>
/// <p>For information about key policies, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">Key policies in KMS</a> in the <i>Key Management Service Developer Guide</i>.For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
pub fn set_policy(mut self, input: std::option::Option<std::string::String>) -> Self {
self.policy = input;
self
}
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i>Key Management Service Developer Guide</i>.</p>
/// </important>
/// <p>Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
pub fn bypass_policy_lockout_safety_check(mut self, input: bool) -> Self {
self.bypass_policy_lockout_safety_check = Some(input);
self
}
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i>Key Management Service Developer Guide</i>.</p>
/// </important>
/// <p>Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
pub fn set_bypass_policy_lockout_safety_check(
mut self,
input: std::option::Option<bool>,
) -> Self {
self.bypass_policy_lockout_safety_check = input;
self
}
/// Consumes the builder and constructs a [`PutKeyPolicyInput`](crate::input::PutKeyPolicyInput).
pub fn build(
self,
) -> Result<crate::input::PutKeyPolicyInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::PutKeyPolicyInput {
key_id: self.key_id,
policy_name: self.policy_name,
policy: self.policy,
bypass_policy_lockout_safety_check: self
.bypass_policy_lockout_safety_check
.unwrap_or_default(),
})
}
}
}
impl PutKeyPolicyInput {
/// Consumes the builder and constructs an Operation<[`PutKeyPolicy`](crate::operation::PutKeyPolicy)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::PutKeyPolicy,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::PutKeyPolicyInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::PutKeyPolicyInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.PutKeyPolicy",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_put_key_policy(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::PutKeyPolicy::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"PutKeyPolicy",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`PutKeyPolicyInput`](crate::input::PutKeyPolicyInput).
pub fn builder() -> crate::input::put_key_policy_input::Builder {
crate::input::put_key_policy_input::Builder::default()
}
}
/// See [`ReEncryptInput`](crate::input::ReEncryptInput).
pub mod re_encrypt_input {
/// A builder for [`ReEncryptInput`](crate::input::ReEncryptInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) ciphertext_blob: std::option::Option<aws_smithy_types::Blob>,
pub(crate) source_encryption_context: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
pub(crate) source_key_id: std::option::Option<std::string::String>,
pub(crate) destination_key_id: std::option::Option<std::string::String>,
pub(crate) destination_encryption_context: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
pub(crate) source_encryption_algorithm:
std::option::Option<crate::model::EncryptionAlgorithmSpec>,
pub(crate) destination_encryption_algorithm:
std::option::Option<crate::model::EncryptionAlgorithmSpec>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// <p>Ciphertext of the data to reencrypt.</p>
pub fn ciphertext_blob(mut self, input: aws_smithy_types::Blob) -> Self {
self.ciphertext_blob = Some(input);
self
}
/// <p>Ciphertext of the data to reencrypt.</p>
pub fn set_ciphertext_blob(
mut self,
input: std::option::Option<aws_smithy_types::Blob>,
) -> Self {
self.ciphertext_blob = input;
self
}
/// Adds a key-value pair to `source_encryption_context`.
///
/// To override the contents of this collection use [`set_source_encryption_context`](Self::set_source_encryption_context).
///
/// <p>Specifies the encryption context to use to decrypt the ciphertext. Enter the same encryption context that was used to encrypt the ciphertext.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn source_encryption_context(
mut self,
k: impl Into<std::string::String>,
v: impl Into<std::string::String>,
) -> Self {
let mut hash_map = self.source_encryption_context.unwrap_or_default();
hash_map.insert(k.into(), v.into());
self.source_encryption_context = Some(hash_map);
self
}
/// <p>Specifies the encryption context to use to decrypt the ciphertext. Enter the same encryption context that was used to encrypt the ciphertext.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_source_encryption_context(
mut self,
input: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
) -> Self {
self.source_encryption_context = input;
self
}
/// <p>Specifies the KMS key that KMS will use to decrypt the ciphertext before it is re-encrypted.</p>
/// <p>Enter a key ID of the KMS key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>ReEncrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to the symmetric ciphertext blob. However, it is always recommended as a best practice. This practice ensures that you use the KMS key that you intend.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn source_key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.source_key_id = Some(input.into());
self
}
/// <p>Specifies the KMS key that KMS will use to decrypt the ciphertext before it is re-encrypted.</p>
/// <p>Enter a key ID of the KMS key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>ReEncrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to the symmetric ciphertext blob. However, it is always recommended as a best practice. This practice ensures that you use the KMS key that you intend.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_source_key_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.source_key_id = input;
self
}
/// <p>A unique identifier for the KMS key that is used to reencrypt the data. Specify a symmetric encryption KMS key or an asymmetric KMS key with a <code>KeyUsage</code> value of <code>ENCRYPT_DECRYPT</code>. To find the <code>KeyUsage</code> value of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn destination_key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.destination_key_id = Some(input.into());
self
}
/// <p>A unique identifier for the KMS key that is used to reencrypt the data. Specify a symmetric encryption KMS key or an asymmetric KMS key with a <code>KeyUsage</code> value of <code>ENCRYPT_DECRYPT</code>. To find the <code>KeyUsage</code> value of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_destination_key_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.destination_key_id = input;
self
}
/// Adds a key-value pair to `destination_encryption_context`.
///
/// To override the contents of this collection use [`set_destination_encryption_context`](Self::set_destination_encryption_context).
///
/// <p>Specifies that encryption context to use when the reencrypting the data.</p>
/// <p>A destination encryption context is valid only when the destination KMS key is a symmetric encryption KMS key. The standard ciphertext format for asymmetric KMS keys does not include fields for metadata.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn destination_encryption_context(
mut self,
k: impl Into<std::string::String>,
v: impl Into<std::string::String>,
) -> Self {
let mut hash_map = self.destination_encryption_context.unwrap_or_default();
hash_map.insert(k.into(), v.into());
self.destination_encryption_context = Some(hash_map);
self
}
/// <p>Specifies that encryption context to use when the reencrypting the data.</p>
/// <p>A destination encryption context is valid only when the destination KMS key is a symmetric encryption KMS key. The standard ciphertext format for asymmetric KMS keys does not include fields for metadata.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_destination_encryption_context(
mut self,
input: std::option::Option<
std::collections::HashMap<std::string::String, std::string::String>,
>,
) -> Self {
self.destination_encryption_context = input;
self
}
/// <p>Specifies the encryption algorithm that KMS will use to decrypt the ciphertext before it is reencrypted. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the algorithm used for symmetric encryption KMS keys.</p>
/// <p>Specify the same algorithm that was used to encrypt the ciphertext. If you specify a different algorithm, the decrypt attempt fails.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.</p>
pub fn source_encryption_algorithm(
mut self,
input: crate::model::EncryptionAlgorithmSpec,
) -> Self {
self.source_encryption_algorithm = Some(input);
self
}
/// <p>Specifies the encryption algorithm that KMS will use to decrypt the ciphertext before it is reencrypted. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the algorithm used for symmetric encryption KMS keys.</p>
/// <p>Specify the same algorithm that was used to encrypt the ciphertext. If you specify a different algorithm, the decrypt attempt fails.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.</p>
pub fn set_source_encryption_algorithm(
mut self,
input: std::option::Option<crate::model::EncryptionAlgorithmSpec>,
) -> Self {
self.source_encryption_algorithm = input;
self
}
/// <p>Specifies the encryption algorithm that KMS will use to reecrypt the data after it has decrypted it. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the encryption algorithm used for symmetric encryption KMS keys.</p>
/// <p>This parameter is required only when the destination KMS key is an asymmetric KMS key.</p>
pub fn destination_encryption_algorithm(
mut self,
input: crate::model::EncryptionAlgorithmSpec,
) -> Self {
self.destination_encryption_algorithm = Some(input);
self
}
/// <p>Specifies the encryption algorithm that KMS will use to reecrypt the data after it has decrypted it. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the encryption algorithm used for symmetric encryption KMS keys.</p>
/// <p>This parameter is required only when the destination KMS key is an asymmetric KMS key.</p>
pub fn set_destination_encryption_algorithm(
mut self,
input: std::option::Option<crate::model::EncryptionAlgorithmSpec>,
) -> Self {
self.destination_encryption_algorithm = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// Consumes the builder and constructs a [`ReEncryptInput`](crate::input::ReEncryptInput).
pub fn build(
self,
) -> Result<crate::input::ReEncryptInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::ReEncryptInput {
ciphertext_blob: self.ciphertext_blob,
source_encryption_context: self.source_encryption_context,
source_key_id: self.source_key_id,
destination_key_id: self.destination_key_id,
destination_encryption_context: self.destination_encryption_context,
source_encryption_algorithm: self.source_encryption_algorithm,
destination_encryption_algorithm: self.destination_encryption_algorithm,
grant_tokens: self.grant_tokens,
})
}
}
}
impl ReEncryptInput {
/// Consumes the builder and constructs an Operation<[`ReEncrypt`](crate::operation::ReEncrypt)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ReEncrypt,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ReEncryptInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ReEncryptInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ReEncrypt",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_re_encrypt(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op =
aws_smithy_http::operation::Operation::new(request, crate::operation::ReEncrypt::new())
.with_metadata(aws_smithy_http::operation::Metadata::new(
"ReEncrypt",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ReEncryptInput`](crate::input::ReEncryptInput).
pub fn builder() -> crate::input::re_encrypt_input::Builder {
crate::input::re_encrypt_input::Builder::default()
}
}
/// See [`ReplicateKeyInput`](crate::input::ReplicateKeyInput).
pub mod replicate_key_input {
/// A builder for [`ReplicateKeyInput`](crate::input::ReplicateKeyInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) replica_region: std::option::Option<std::string::String>,
pub(crate) policy: std::option::Option<std::string::String>,
pub(crate) bypass_policy_lockout_safety_check: std::option::Option<bool>,
pub(crate) description: std::option::Option<std::string::String>,
pub(crate) tags: std::option::Option<std::vec::Vec<crate::model::Tag>>,
}
impl Builder {
/// <p>Identifies the multi-Region primary key that is being replicated. To determine whether a KMS key is a multi-Region primary key, use the <code>DescribeKey</code> operation to check the value of the <code>MultiRegionKeyType</code> property.</p>
/// <p>Specify the key ID or key ARN of a multi-Region primary key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the multi-Region primary key that is being replicated. To determine whether a KMS key is a multi-Region primary key, use the <code>DescribeKey</code> operation to check the value of the <code>MultiRegionKeyType</code> property.</p>
/// <p>Specify the key ID or key ARN of a multi-Region primary key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>The Region ID of the Amazon Web Services Region for this replica key. </p>
/// <p>Enter the Region ID, such as <code>us-east-1</code> or <code>ap-southeast-2</code>. For a list of Amazon Web Services Regions in which KMS is supported, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">KMS service endpoints</a> in the <i>Amazon Web Services General Reference</i>.</p> <note>
/// <p>HMAC KMS keys are not supported in all Amazon Web Services Regions. If you try to replicate an HMAC KMS key in an Amazon Web Services Region in which HMAC keys are not supported, the <code>ReplicateKey</code> operation returns an <code>UnsupportedOperationException</code>. For a list of Regions in which HMAC KMS keys are supported, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>The replica must be in a different Amazon Web Services Region than its primary key and other replicas of that primary key, but in the same Amazon Web Services partition. KMS must be available in the replica Region. If the Region is not enabled by default, the Amazon Web Services account must be enabled in the Region. For information about Amazon Web Services partitions, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs)</a> in the <i>Amazon Web Services General Reference</i>. For information about enabling and disabling Regions, see <a href="https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable">Enabling a Region</a> and <a href="https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable">Disabling a Region</a> in the <i>Amazon Web Services General Reference</i>.</p>
pub fn replica_region(mut self, input: impl Into<std::string::String>) -> Self {
self.replica_region = Some(input.into());
self
}
/// <p>The Region ID of the Amazon Web Services Region for this replica key. </p>
/// <p>Enter the Region ID, such as <code>us-east-1</code> or <code>ap-southeast-2</code>. For a list of Amazon Web Services Regions in which KMS is supported, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">KMS service endpoints</a> in the <i>Amazon Web Services General Reference</i>.</p> <note>
/// <p>HMAC KMS keys are not supported in all Amazon Web Services Regions. If you try to replicate an HMAC KMS key in an Amazon Web Services Region in which HMAC keys are not supported, the <code>ReplicateKey</code> operation returns an <code>UnsupportedOperationException</code>. For a list of Regions in which HMAC KMS keys are supported, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>The replica must be in a different Amazon Web Services Region than its primary key and other replicas of that primary key, but in the same Amazon Web Services partition. KMS must be available in the replica Region. If the Region is not enabled by default, the Amazon Web Services account must be enabled in the Region. For information about Amazon Web Services partitions, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs)</a> in the <i>Amazon Web Services General Reference</i>. For information about enabling and disabling Regions, see <a href="https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable">Enabling a Region</a> and <a href="https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable">Disabling a Region</a> in the <i>Amazon Web Services General Reference</i>.</p>
pub fn set_replica_region(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.replica_region = input;
self
}
/// <p>The key policy to attach to the KMS key. This parameter is optional. If you do not provide a key policy, KMS attaches the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">default key policy</a> to the KMS key.</p>
/// <p>The key policy is not a shared property of multi-Region keys. You can specify the same key policy or a different key policy for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
/// <p>If you provide a key policy, it must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must give the caller <code>kms:PutKeyPolicy</code> permission on the replica key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i> <i>Key Management Service Developer Guide</i> </i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p> </li>
/// </ul>
/// <p>A key policy document can include only the following characters:</p>
/// <ul>
/// <li> <p>Printable ASCII characters from the space character (<code>\u0020</code>) through the end of the ASCII character range.</p> </li>
/// <li> <p>Printable characters in the Basic Latin and Latin-1 Supplement character set (through <code>\u00FF</code>).</p> </li>
/// <li> <p>The tab (<code>\u0009</code>), line feed (<code>\u000A</code>), and carriage return (<code>\u000D</code>) special characters</p> </li>
/// </ul>
/// <p>For information about key policies, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">Key policies in KMS</a> in the <i>Key Management Service Developer Guide</i>. For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
pub fn policy(mut self, input: impl Into<std::string::String>) -> Self {
self.policy = Some(input.into());
self
}
/// <p>The key policy to attach to the KMS key. This parameter is optional. If you do not provide a key policy, KMS attaches the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">default key policy</a> to the KMS key.</p>
/// <p>The key policy is not a shared property of multi-Region keys. You can specify the same key policy or a different key policy for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
/// <p>If you provide a key policy, it must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must give the caller <code>kms:PutKeyPolicy</code> permission on the replica key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i> <i>Key Management Service Developer Guide</i> </i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p> </li>
/// </ul>
/// <p>A key policy document can include only the following characters:</p>
/// <ul>
/// <li> <p>Printable ASCII characters from the space character (<code>\u0020</code>) through the end of the ASCII character range.</p> </li>
/// <li> <p>Printable characters in the Basic Latin and Latin-1 Supplement character set (through <code>\u00FF</code>).</p> </li>
/// <li> <p>The tab (<code>\u0009</code>), line feed (<code>\u000A</code>), and carriage return (<code>\u000D</code>) special characters</p> </li>
/// </ul>
/// <p>For information about key policies, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">Key policies in KMS</a> in the <i>Key Management Service Developer Guide</i>. For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
pub fn set_policy(mut self, input: std::option::Option<std::string::String>) -> Self {
self.policy = input;
self
}
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i>Key Management Service Developer Guide</i>.</p>
/// </important>
/// <p>Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
pub fn bypass_policy_lockout_safety_check(mut self, input: bool) -> Self {
self.bypass_policy_lockout_safety_check = Some(input);
self
}
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i>Key Management Service Developer Guide</i>.</p>
/// </important>
/// <p>Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
pub fn set_bypass_policy_lockout_safety_check(
mut self,
input: std::option::Option<bool>,
) -> Self {
self.bypass_policy_lockout_safety_check = input;
self
}
/// <p>A description of the KMS key. The default value is an empty string (no description).</p>
/// <p>The description is not a shared property of multi-Region keys. You can specify the same description or a different description for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
pub fn description(mut self, input: impl Into<std::string::String>) -> Self {
self.description = Some(input.into());
self
}
/// <p>A description of the KMS key. The default value is an empty string (no description).</p>
/// <p>The description is not a shared property of multi-Region keys. You can specify the same description or a different description for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
pub fn set_description(mut self, input: std::option::Option<std::string::String>) -> Self {
self.description = input;
self
}
/// Appends an item to `tags`.
///
/// To override the contents of this collection use [`set_tags`](Self::set_tags).
///
/// <p>Assigns one or more tags to the replica key. Use this parameter to tag the KMS key when it is created. To tag an existing KMS key, use the <code>TagResource</code> operation.</p> <note>
/// <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>To use this parameter, you must have <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:TagResource</a> permission in an IAM policy.</p>
/// <p>Tags are not a shared property of multi-Region keys. You can specify the same tags or different tags for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
/// <p>Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
/// <p>When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">Tagging Keys</a>.</p>
pub fn tags(mut self, input: crate::model::Tag) -> Self {
let mut v = self.tags.unwrap_or_default();
v.push(input);
self.tags = Some(v);
self
}
/// <p>Assigns one or more tags to the replica key. Use this parameter to tag the KMS key when it is created. To tag an existing KMS key, use the <code>TagResource</code> operation.</p> <note>
/// <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>To use this parameter, you must have <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:TagResource</a> permission in an IAM policy.</p>
/// <p>Tags are not a shared property of multi-Region keys. You can specify the same tags or different tags for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
/// <p>Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
/// <p>When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">Tagging Keys</a>.</p>
pub fn set_tags(
mut self,
input: std::option::Option<std::vec::Vec<crate::model::Tag>>,
) -> Self {
self.tags = input;
self
}
/// Consumes the builder and constructs a [`ReplicateKeyInput`](crate::input::ReplicateKeyInput).
pub fn build(
self,
) -> Result<crate::input::ReplicateKeyInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::ReplicateKeyInput {
key_id: self.key_id,
replica_region: self.replica_region,
policy: self.policy,
bypass_policy_lockout_safety_check: self
.bypass_policy_lockout_safety_check
.unwrap_or_default(),
description: self.description,
tags: self.tags,
})
}
}
}
impl ReplicateKeyInput {
/// Consumes the builder and constructs an Operation<[`ReplicateKey`](crate::operation::ReplicateKey)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ReplicateKey,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ReplicateKeyInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ReplicateKeyInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ReplicateKey",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_replicate_key(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::ReplicateKey::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"ReplicateKey",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ReplicateKeyInput`](crate::input::ReplicateKeyInput).
pub fn builder() -> crate::input::replicate_key_input::Builder {
crate::input::replicate_key_input::Builder::default()
}
}
/// See [`RetireGrantInput`](crate::input::RetireGrantInput).
pub mod retire_grant_input {
/// A builder for [`RetireGrantInput`](crate::input::RetireGrantInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) grant_token: std::option::Option<std::string::String>,
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) grant_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Identifies the grant to be retired. You can use a grant token to identify a new grant even before it has achieved eventual consistency.</p>
/// <p>Only the <code>CreateGrant</code> operation returns a grant token. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-eventual-consistency">Eventual consistency</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_token(mut self, input: impl Into<std::string::String>) -> Self {
self.grant_token = Some(input.into());
self
}
/// <p>Identifies the grant to be retired. You can use a grant token to identify a new grant even before it has achieved eventual consistency.</p>
/// <p>Only the <code>CreateGrant</code> operation returns a grant token. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-eventual-consistency">Eventual consistency</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_token(mut self, input: std::option::Option<std::string::String>) -> Self {
self.grant_token = input;
self
}
/// <p>The key ARN KMS key associated with the grant. To find the key ARN, use the <code>ListKeys</code> operation.</p>
/// <p>For example: <code>arn:aws:kms:us-east-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>The key ARN KMS key associated with the grant. To find the key ARN, use the <code>ListKeys</code> operation.</p>
/// <p>For example: <code>arn:aws:kms:us-east-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Identifies the grant to retire. To get the grant ID, use <code>CreateGrant</code>, <code>ListGrants</code>, or <code>ListRetirableGrants</code>.</p>
/// <ul>
/// <li> <p>Grant ID Example - 0123456789012345678901234567890123456789012345678901234567890123</p> </li>
/// </ul>
pub fn grant_id(mut self, input: impl Into<std::string::String>) -> Self {
self.grant_id = Some(input.into());
self
}
/// <p>Identifies the grant to retire. To get the grant ID, use <code>CreateGrant</code>, <code>ListGrants</code>, or <code>ListRetirableGrants</code>.</p>
/// <ul>
/// <li> <p>Grant ID Example - 0123456789012345678901234567890123456789012345678901234567890123</p> </li>
/// </ul>
pub fn set_grant_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.grant_id = input;
self
}
/// Consumes the builder and constructs a [`RetireGrantInput`](crate::input::RetireGrantInput).
pub fn build(
self,
) -> Result<crate::input::RetireGrantInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::RetireGrantInput {
grant_token: self.grant_token,
key_id: self.key_id,
grant_id: self.grant_id,
})
}
}
}
impl RetireGrantInput {
/// Consumes the builder and constructs an Operation<[`RetireGrant`](crate::operation::RetireGrant)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::RetireGrant,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::RetireGrantInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::RetireGrantInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.RetireGrant",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_retire_grant(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::RetireGrant::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"RetireGrant",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`RetireGrantInput`](crate::input::RetireGrantInput).
pub fn builder() -> crate::input::retire_grant_input::Builder {
crate::input::retire_grant_input::Builder::default()
}
}
/// See [`RevokeGrantInput`](crate::input::RevokeGrantInput).
pub mod revoke_grant_input {
/// A builder for [`RevokeGrantInput`](crate::input::RevokeGrantInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) grant_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>A unique identifier for the KMS key associated with the grant. To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>A unique identifier for the KMS key associated with the grant. To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Identifies the grant to revoke. To get the grant ID, use <code>CreateGrant</code>, <code>ListGrants</code>, or <code>ListRetirableGrants</code>.</p>
pub fn grant_id(mut self, input: impl Into<std::string::String>) -> Self {
self.grant_id = Some(input.into());
self
}
/// <p>Identifies the grant to revoke. To get the grant ID, use <code>CreateGrant</code>, <code>ListGrants</code>, or <code>ListRetirableGrants</code>.</p>
pub fn set_grant_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.grant_id = input;
self
}
/// Consumes the builder and constructs a [`RevokeGrantInput`](crate::input::RevokeGrantInput).
pub fn build(
self,
) -> Result<crate::input::RevokeGrantInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::RevokeGrantInput {
key_id: self.key_id,
grant_id: self.grant_id,
})
}
}
}
impl RevokeGrantInput {
/// Consumes the builder and constructs an Operation<[`RevokeGrant`](crate::operation::RevokeGrant)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::RevokeGrant,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::RevokeGrantInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::RevokeGrantInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.RevokeGrant",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_revoke_grant(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::RevokeGrant::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"RevokeGrant",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`RevokeGrantInput`](crate::input::RevokeGrantInput).
pub fn builder() -> crate::input::revoke_grant_input::Builder {
crate::input::revoke_grant_input::Builder::default()
}
}
/// See [`ScheduleKeyDeletionInput`](crate::input::ScheduleKeyDeletionInput).
pub mod schedule_key_deletion_input {
/// A builder for [`ScheduleKeyDeletionInput`](crate::input::ScheduleKeyDeletionInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) pending_window_in_days: std::option::Option<i32>,
}
impl Builder {
/// <p>The unique identifier of the KMS key to delete.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>The unique identifier of the KMS key to delete.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>The waiting period, specified in number of days. After the waiting period ends, KMS deletes the KMS key.</p>
/// <p>If the KMS key is a multi-Region primary key with replica keys, the waiting period begins when the last of its replica keys is deleted. Otherwise, the waiting period begins immediately.</p>
/// <p>This value is optional. If you include a value, it must be between 7 and 30, inclusive. If you do not include a value, it defaults to 30.</p>
pub fn pending_window_in_days(mut self, input: i32) -> Self {
self.pending_window_in_days = Some(input);
self
}
/// <p>The waiting period, specified in number of days. After the waiting period ends, KMS deletes the KMS key.</p>
/// <p>If the KMS key is a multi-Region primary key with replica keys, the waiting period begins when the last of its replica keys is deleted. Otherwise, the waiting period begins immediately.</p>
/// <p>This value is optional. If you include a value, it must be between 7 and 30, inclusive. If you do not include a value, it defaults to 30.</p>
pub fn set_pending_window_in_days(mut self, input: std::option::Option<i32>) -> Self {
self.pending_window_in_days = input;
self
}
/// Consumes the builder and constructs a [`ScheduleKeyDeletionInput`](crate::input::ScheduleKeyDeletionInput).
pub fn build(
self,
) -> Result<
crate::input::ScheduleKeyDeletionInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::ScheduleKeyDeletionInput {
key_id: self.key_id,
pending_window_in_days: self.pending_window_in_days,
})
}
}
}
impl ScheduleKeyDeletionInput {
/// Consumes the builder and constructs an Operation<[`ScheduleKeyDeletion`](crate::operation::ScheduleKeyDeletion)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::ScheduleKeyDeletion,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::ScheduleKeyDeletionInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::ScheduleKeyDeletionInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.ScheduleKeyDeletion",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_schedule_key_deletion(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::ScheduleKeyDeletion::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"ScheduleKeyDeletion",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`ScheduleKeyDeletionInput`](crate::input::ScheduleKeyDeletionInput).
pub fn builder() -> crate::input::schedule_key_deletion_input::Builder {
crate::input::schedule_key_deletion_input::Builder::default()
}
}
/// See [`SignInput`](crate::input::SignInput).
pub mod sign_input {
/// A builder for [`SignInput`](crate::input::SignInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) message: std::option::Option<aws_smithy_types::Blob>,
pub(crate) message_type: std::option::Option<crate::model::MessageType>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
pub(crate) signing_algorithm: std::option::Option<crate::model::SigningAlgorithmSpec>,
}
impl Builder {
/// <p>Identifies an asymmetric KMS key. KMS uses the private key in the asymmetric KMS key to sign the message. The <code>KeyUsage</code> type of the KMS key must be <code>SIGN_VERIFY</code>. To find the <code>KeyUsage</code> of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies an asymmetric KMS key. KMS uses the private key in the asymmetric KMS key to sign the message. The <code>KeyUsage</code> type of the KMS key must be <code>SIGN_VERIFY</code>. To find the <code>KeyUsage</code> of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Specifies the message or message digest to sign. Messages can be 0-4096 bytes. To sign a larger message, provide the message digest.</p>
/// <p>If you provide a message, KMS generates a hash digest of the message and then signs it.</p>
pub fn message(mut self, input: aws_smithy_types::Blob) -> Self {
self.message = Some(input);
self
}
/// <p>Specifies the message or message digest to sign. Messages can be 0-4096 bytes. To sign a larger message, provide the message digest.</p>
/// <p>If you provide a message, KMS generates a hash digest of the message and then signs it.</p>
pub fn set_message(mut self, input: std::option::Option<aws_smithy_types::Blob>) -> Self {
self.message = input;
self
}
/// <p>Tells KMS whether the value of the <code>Message</code> parameter is a message or message digest. The default value, RAW, indicates a message. To indicate a message digest, enter <code>DIGEST</code>.</p>
pub fn message_type(mut self, input: crate::model::MessageType) -> Self {
self.message_type = Some(input);
self
}
/// <p>Tells KMS whether the value of the <code>Message</code> parameter is a message or message digest. The default value, RAW, indicates a message. To indicate a message digest, enter <code>DIGEST</code>.</p>
pub fn set_message_type(
mut self,
input: std::option::Option<crate::model::MessageType>,
) -> Self {
self.message_type = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// <p>Specifies the signing algorithm to use when signing the message. </p>
/// <p>Choose an algorithm that is compatible with the type and size of the specified asymmetric KMS key.</p>
pub fn signing_algorithm(mut self, input: crate::model::SigningAlgorithmSpec) -> Self {
self.signing_algorithm = Some(input);
self
}
/// <p>Specifies the signing algorithm to use when signing the message. </p>
/// <p>Choose an algorithm that is compatible with the type and size of the specified asymmetric KMS key.</p>
pub fn set_signing_algorithm(
mut self,
input: std::option::Option<crate::model::SigningAlgorithmSpec>,
) -> Self {
self.signing_algorithm = input;
self
}
/// Consumes the builder and constructs a [`SignInput`](crate::input::SignInput).
pub fn build(
self,
) -> Result<crate::input::SignInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::SignInput {
key_id: self.key_id,
message: self.message,
message_type: self.message_type,
grant_tokens: self.grant_tokens,
signing_algorithm: self.signing_algorithm,
})
}
}
impl std::fmt::Debug for Builder {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("Builder");
formatter.field("key_id", &self.key_id);
formatter.field("message", &"*** Sensitive Data Redacted ***");
formatter.field("message_type", &self.message_type);
formatter.field("grant_tokens", &self.grant_tokens);
formatter.field("signing_algorithm", &self.signing_algorithm);
formatter.finish()
}
}
}
impl SignInput {
/// Consumes the builder and constructs an Operation<[`Sign`](crate::operation::Sign)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::Sign,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::SignInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::SignInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.Sign",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_sign(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(request, crate::operation::Sign::new())
.with_metadata(aws_smithy_http::operation::Metadata::new("Sign", "kms"));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`SignInput`](crate::input::SignInput).
pub fn builder() -> crate::input::sign_input::Builder {
crate::input::sign_input::Builder::default()
}
}
/// See [`TagResourceInput`](crate::input::TagResourceInput).
pub mod tag_resource_input {
/// A builder for [`TagResourceInput`](crate::input::TagResourceInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) tags: std::option::Option<std::vec::Vec<crate::model::Tag>>,
}
impl Builder {
/// <p>Identifies a customer managed key in the account and Region.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies a customer managed key in the account and Region.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Appends an item to `tags`.
///
/// To override the contents of this collection use [`set_tags`](Self::set_tags).
///
/// <p>One or more tags. </p>
/// <p>Each tag consists of a tag key and a tag value. The tag value can be an empty (null) string. </p>
/// <p>You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
pub fn tags(mut self, input: crate::model::Tag) -> Self {
let mut v = self.tags.unwrap_or_default();
v.push(input);
self.tags = Some(v);
self
}
/// <p>One or more tags. </p>
/// <p>Each tag consists of a tag key and a tag value. The tag value can be an empty (null) string. </p>
/// <p>You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
pub fn set_tags(
mut self,
input: std::option::Option<std::vec::Vec<crate::model::Tag>>,
) -> Self {
self.tags = input;
self
}
/// Consumes the builder and constructs a [`TagResourceInput`](crate::input::TagResourceInput).
pub fn build(
self,
) -> Result<crate::input::TagResourceInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::TagResourceInput {
key_id: self.key_id,
tags: self.tags,
})
}
}
}
impl TagResourceInput {
/// Consumes the builder and constructs an Operation<[`TagResource`](crate::operation::TagResource)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::TagResource,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::TagResourceInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::TagResourceInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.TagResource",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_tag_resource(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::TagResource::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"TagResource",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`TagResourceInput`](crate::input::TagResourceInput).
pub fn builder() -> crate::input::tag_resource_input::Builder {
crate::input::tag_resource_input::Builder::default()
}
}
/// See [`UntagResourceInput`](crate::input::UntagResourceInput).
pub mod untag_resource_input {
/// A builder for [`UntagResourceInput`](crate::input::UntagResourceInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) tag_keys: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// <p>Identifies the KMS key from which you are removing tags.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the KMS key from which you are removing tags.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// Appends an item to `tag_keys`.
///
/// To override the contents of this collection use [`set_tag_keys`](Self::set_tag_keys).
///
/// <p>One or more tag keys. Specify only the tag keys, not the tag values.</p>
pub fn tag_keys(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.tag_keys.unwrap_or_default();
v.push(input.into());
self.tag_keys = Some(v);
self
}
/// <p>One or more tag keys. Specify only the tag keys, not the tag values.</p>
pub fn set_tag_keys(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.tag_keys = input;
self
}
/// Consumes the builder and constructs a [`UntagResourceInput`](crate::input::UntagResourceInput).
pub fn build(
self,
) -> Result<crate::input::UntagResourceInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::UntagResourceInput {
key_id: self.key_id,
tag_keys: self.tag_keys,
})
}
}
}
impl UntagResourceInput {
/// Consumes the builder and constructs an Operation<[`UntagResource`](crate::operation::UntagResource)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::UntagResource,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::UntagResourceInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::UntagResourceInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.UntagResource",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_untag_resource(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::UntagResource::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"UntagResource",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`UntagResourceInput`](crate::input::UntagResourceInput).
pub fn builder() -> crate::input::untag_resource_input::Builder {
crate::input::untag_resource_input::Builder::default()
}
}
/// See [`UpdateAliasInput`](crate::input::UpdateAliasInput).
pub mod update_alias_input {
/// A builder for [`UpdateAliasInput`](crate::input::UpdateAliasInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) alias_name: std::option::Option<std::string::String>,
pub(crate) target_key_id: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Identifies the alias that is changing its KMS key. This value must begin with <code>alias/</code> followed by the alias name, such as <code>alias/ExampleAlias</code>. You cannot use <code>UpdateAlias</code> to change the alias name.</p>
pub fn alias_name(mut self, input: impl Into<std::string::String>) -> Self {
self.alias_name = Some(input.into());
self
}
/// <p>Identifies the alias that is changing its KMS key. This value must begin with <code>alias/</code> followed by the alias name, such as <code>alias/ExampleAlias</code>. You cannot use <code>UpdateAlias</code> to change the alias name.</p>
pub fn set_alias_name(mut self, input: std::option::Option<std::string::String>) -> Self {
self.alias_name = input;
self
}
/// <p>Identifies the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a> to associate with the alias. You don't have permission to associate an alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a>.</p>
/// <p>The KMS key must be in the same Amazon Web Services account and Region as the alias. Also, the new target KMS key must be the same type as the current target KMS key (both symmetric or both asymmetric or both HMAC) and they must have the same key usage. </p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
/// <p>To verify that the alias is mapped to the correct KMS key, use <code>ListAliases</code>.</p>
pub fn target_key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.target_key_id = Some(input.into());
self
}
/// <p>Identifies the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a> to associate with the alias. You don't have permission to associate an alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a>.</p>
/// <p>The KMS key must be in the same Amazon Web Services account and Region as the alias. Also, the new target KMS key must be the same type as the current target KMS key (both symmetric or both asymmetric or both HMAC) and they must have the same key usage. </p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
/// <p>To verify that the alias is mapped to the correct KMS key, use <code>ListAliases</code>.</p>
pub fn set_target_key_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.target_key_id = input;
self
}
/// Consumes the builder and constructs a [`UpdateAliasInput`](crate::input::UpdateAliasInput).
pub fn build(
self,
) -> Result<crate::input::UpdateAliasInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::UpdateAliasInput {
alias_name: self.alias_name,
target_key_id: self.target_key_id,
})
}
}
}
impl UpdateAliasInput {
/// Consumes the builder and constructs an Operation<[`UpdateAlias`](crate::operation::UpdateAlias)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::UpdateAlias,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::UpdateAliasInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::UpdateAliasInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.UpdateAlias",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_update_alias(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::UpdateAlias::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"UpdateAlias",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`UpdateAliasInput`](crate::input::UpdateAliasInput).
pub fn builder() -> crate::input::update_alias_input::Builder {
crate::input::update_alias_input::Builder::default()
}
}
/// See [`UpdateCustomKeyStoreInput`](crate::input::UpdateCustomKeyStoreInput).
pub mod update_custom_key_store_input {
/// A builder for [`UpdateCustomKeyStoreInput`](crate::input::UpdateCustomKeyStoreInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default)]
pub struct Builder {
pub(crate) custom_key_store_id: std::option::Option<std::string::String>,
pub(crate) new_custom_key_store_name: std::option::Option<std::string::String>,
pub(crate) key_store_password: std::option::Option<std::string::String>,
pub(crate) cloud_hsm_cluster_id: std::option::Option<std::string::String>,
pub(crate) xks_proxy_uri_endpoint: std::option::Option<std::string::String>,
pub(crate) xks_proxy_uri_path: std::option::Option<std::string::String>,
pub(crate) xks_proxy_vpc_endpoint_service_name: std::option::Option<std::string::String>,
pub(crate) xks_proxy_authentication_credential:
std::option::Option<crate::model::XksProxyAuthenticationCredentialType>,
pub(crate) xks_proxy_connectivity:
std::option::Option<crate::model::XksProxyConnectivityType>,
}
impl Builder {
/// <p>Identifies the custom key store that you want to update. Enter the ID of the custom key store. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn custom_key_store_id(mut self, input: impl Into<std::string::String>) -> Self {
self.custom_key_store_id = Some(input.into());
self
}
/// <p>Identifies the custom key store that you want to update. Enter the ID of the custom key store. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn set_custom_key_store_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.custom_key_store_id = input;
self
}
/// <p>Changes the friendly name of the custom key store to the value that you specify. The custom key store name must be unique in the Amazon Web Services account.</p>
/// <p>To change this value, an CloudHSM key store must be disconnected. An external key store can be connected or disconnected.</p>
pub fn new_custom_key_store_name(mut self, input: impl Into<std::string::String>) -> Self {
self.new_custom_key_store_name = Some(input.into());
self
}
/// <p>Changes the friendly name of the custom key store to the value that you specify. The custom key store name must be unique in the Amazon Web Services account.</p>
/// <p>To change this value, an CloudHSM key store must be disconnected. An external key store can be connected or disconnected.</p>
pub fn set_new_custom_key_store_name(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.new_custom_key_store_name = input;
self
}
/// <p>Enter the current password of the <code>kmsuser</code> crypto user (CU) in the CloudHSM cluster that is associated with the custom key store. This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>This parameter tells KMS the current password of the <code>kmsuser</code> crypto user (CU). It does not set or change the password of any users in the CloudHSM cluster.</p>
/// <p>To change this value, the CloudHSM key store must be disconnected.</p>
pub fn key_store_password(mut self, input: impl Into<std::string::String>) -> Self {
self.key_store_password = Some(input.into());
self
}
/// <p>Enter the current password of the <code>kmsuser</code> crypto user (CU) in the CloudHSM cluster that is associated with the custom key store. This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>This parameter tells KMS the current password of the <code>kmsuser</code> crypto user (CU). It does not set or change the password of any users in the CloudHSM cluster.</p>
/// <p>To change this value, the CloudHSM key store must be disconnected.</p>
pub fn set_key_store_password(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.key_store_password = input;
self
}
/// <p>Associates the custom key store with a related CloudHSM cluster. This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the cluster ID of the cluster that you used to create the custom key store or a cluster that shares a backup history and has the same cluster certificate as the original cluster. You cannot use this parameter to associate a custom key store with an unrelated cluster. In addition, the replacement cluster must <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore">fulfill the requirements</a> for a cluster associated with a custom key store. To view the cluster certificate of a cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation.</p>
/// <p>To change this value, the CloudHSM key store must be disconnected.</p>
pub fn cloud_hsm_cluster_id(mut self, input: impl Into<std::string::String>) -> Self {
self.cloud_hsm_cluster_id = Some(input.into());
self
}
/// <p>Associates the custom key store with a related CloudHSM cluster. This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the cluster ID of the cluster that you used to create the custom key store or a cluster that shares a backup history and has the same cluster certificate as the original cluster. You cannot use this parameter to associate a custom key store with an unrelated cluster. In addition, the replacement cluster must <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore">fulfill the requirements</a> for a cluster associated with a custom key store. To view the cluster certificate of a cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation.</p>
/// <p>To change this value, the CloudHSM key store must be disconnected.</p>
pub fn set_cloud_hsm_cluster_id(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.cloud_hsm_cluster_id = input;
self
}
/// <p>Changes the URI endpoint that KMS uses to connect to your external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>For external key stores with an <code>XksProxyConnectivity</code> value of <code>PUBLIC_ENDPOINT</code>, the protocol must be HTTPS.</p>
/// <p>For external key stores with an <code>XksProxyConnectivity</code> value of <code>VPC_ENDPOINT_SERVICE</code>, specify <code>https://</code> followed by the private DNS name associated with the VPC endpoint service. Each external key store must use a different private DNS name.</p>
/// <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
pub fn xks_proxy_uri_endpoint(mut self, input: impl Into<std::string::String>) -> Self {
self.xks_proxy_uri_endpoint = Some(input.into());
self
}
/// <p>Changes the URI endpoint that KMS uses to connect to your external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>For external key stores with an <code>XksProxyConnectivity</code> value of <code>PUBLIC_ENDPOINT</code>, the protocol must be HTTPS.</p>
/// <p>For external key stores with an <code>XksProxyConnectivity</code> value of <code>VPC_ENDPOINT_SERVICE</code>, specify <code>https://</code> followed by the private DNS name associated with the VPC endpoint service. Each external key store must use a different private DNS name.</p>
/// <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
pub fn set_xks_proxy_uri_endpoint(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.xks_proxy_uri_endpoint = input;
self
}
/// <p>Changes the base path to the proxy APIs for this external key store. To find this value, see the documentation for your external key manager and external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The value must start with <code>/</code> and must end with <code>/kms/xks/v1</code>, where <code>v1</code> represents the version of the KMS external key store proxy API. You can include an optional prefix between the required elements such as <code>/<i>example</i>/kms/xks/v1</code>.</p>
/// <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p>
/// <p>You can change this value when the external key store is connected or disconnected.</p>
pub fn xks_proxy_uri_path(mut self, input: impl Into<std::string::String>) -> Self {
self.xks_proxy_uri_path = Some(input.into());
self
}
/// <p>Changes the base path to the proxy APIs for this external key store. To find this value, see the documentation for your external key manager and external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The value must start with <code>/</code> and must end with <code>/kms/xks/v1</code>, where <code>v1</code> represents the version of the KMS external key store proxy API. You can include an optional prefix between the required elements such as <code>/<i>example</i>/kms/xks/v1</code>.</p>
/// <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p>
/// <p>You can change this value when the external key store is connected or disconnected.</p>
pub fn set_xks_proxy_uri_path(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.xks_proxy_uri_path = input;
self
}
/// <p>Changes the name that KMS uses to identify the Amazon VPC endpoint service for your external key store proxy (XKS proxy). This parameter is valid when the <code>CustomKeyStoreType</code> is <code>EXTERNAL_KEY_STORE</code> and the <code>XksProxyConnectivity</code> is <code>VPC_ENDPOINT_SERVICE</code>.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
pub fn xks_proxy_vpc_endpoint_service_name(
mut self,
input: impl Into<std::string::String>,
) -> Self {
self.xks_proxy_vpc_endpoint_service_name = Some(input.into());
self
}
/// <p>Changes the name that KMS uses to identify the Amazon VPC endpoint service for your external key store proxy (XKS proxy). This parameter is valid when the <code>CustomKeyStoreType</code> is <code>EXTERNAL_KEY_STORE</code> and the <code>XksProxyConnectivity</code> is <code>VPC_ENDPOINT_SERVICE</code>.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
pub fn set_xks_proxy_vpc_endpoint_service_name(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.xks_proxy_vpc_endpoint_service_name = input;
self
}
/// <p>Changes the credentials that KMS uses to sign requests to the external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>You must specify both the <code>AccessKeyId</code> and <code>SecretAccessKey</code> value in the authentication credential, even if you are only updating one value.</p>
/// <p>This parameter doesn't establish or change your authentication credentials on the proxy. It just tells KMS the credential that you established with your external key store proxy. For example, if you rotate the credential on your external key store proxy, you can use this parameter to update the credential in KMS.</p>
/// <p>You can change this value when the external key store is connected or disconnected.</p>
pub fn xks_proxy_authentication_credential(
mut self,
input: crate::model::XksProxyAuthenticationCredentialType,
) -> Self {
self.xks_proxy_authentication_credential = Some(input);
self
}
/// <p>Changes the credentials that KMS uses to sign requests to the external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>You must specify both the <code>AccessKeyId</code> and <code>SecretAccessKey</code> value in the authentication credential, even if you are only updating one value.</p>
/// <p>This parameter doesn't establish or change your authentication credentials on the proxy. It just tells KMS the credential that you established with your external key store proxy. For example, if you rotate the credential on your external key store proxy, you can use this parameter to update the credential in KMS.</p>
/// <p>You can change this value when the external key store is connected or disconnected.</p>
pub fn set_xks_proxy_authentication_credential(
mut self,
input: std::option::Option<crate::model::XksProxyAuthenticationCredentialType>,
) -> Self {
self.xks_proxy_authentication_credential = input;
self
}
/// <p>Changes the connectivity setting for the external key store. To indicate that the external key store proxy uses a Amazon VPC endpoint service to communicate with KMS, specify <code>VPC_ENDPOINT_SERVICE</code>. Otherwise, specify <code>PUBLIC_ENDPOINT</code>.</p>
/// <p>If you change the <code>XksProxyConnectivity</code> to <code>VPC_ENDPOINT_SERVICE</code>, you must also change the <code>XksProxyUriEndpoint</code> and add an <code>XksProxyVpcEndpointServiceName</code> value. </p>
/// <p>If you change the <code>XksProxyConnectivity</code> to <code>PUBLIC_ENDPOINT</code>, you must also change the <code>XksProxyUriEndpoint</code> and specify a null or empty string for the <code>XksProxyVpcEndpointServiceName</code> value.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
pub fn xks_proxy_connectivity(
mut self,
input: crate::model::XksProxyConnectivityType,
) -> Self {
self.xks_proxy_connectivity = Some(input);
self
}
/// <p>Changes the connectivity setting for the external key store. To indicate that the external key store proxy uses a Amazon VPC endpoint service to communicate with KMS, specify <code>VPC_ENDPOINT_SERVICE</code>. Otherwise, specify <code>PUBLIC_ENDPOINT</code>.</p>
/// <p>If you change the <code>XksProxyConnectivity</code> to <code>VPC_ENDPOINT_SERVICE</code>, you must also change the <code>XksProxyUriEndpoint</code> and add an <code>XksProxyVpcEndpointServiceName</code> value. </p>
/// <p>If you change the <code>XksProxyConnectivity</code> to <code>PUBLIC_ENDPOINT</code>, you must also change the <code>XksProxyUriEndpoint</code> and specify a null or empty string for the <code>XksProxyVpcEndpointServiceName</code> value.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
pub fn set_xks_proxy_connectivity(
mut self,
input: std::option::Option<crate::model::XksProxyConnectivityType>,
) -> Self {
self.xks_proxy_connectivity = input;
self
}
/// Consumes the builder and constructs a [`UpdateCustomKeyStoreInput`](crate::input::UpdateCustomKeyStoreInput).
pub fn build(
self,
) -> Result<
crate::input::UpdateCustomKeyStoreInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::UpdateCustomKeyStoreInput {
custom_key_store_id: self.custom_key_store_id,
new_custom_key_store_name: self.new_custom_key_store_name,
key_store_password: self.key_store_password,
cloud_hsm_cluster_id: self.cloud_hsm_cluster_id,
xks_proxy_uri_endpoint: self.xks_proxy_uri_endpoint,
xks_proxy_uri_path: self.xks_proxy_uri_path,
xks_proxy_vpc_endpoint_service_name: self.xks_proxy_vpc_endpoint_service_name,
xks_proxy_authentication_credential: self.xks_proxy_authentication_credential,
xks_proxy_connectivity: self.xks_proxy_connectivity,
})
}
}
impl std::fmt::Debug for Builder {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("Builder");
formatter.field("custom_key_store_id", &self.custom_key_store_id);
formatter.field("new_custom_key_store_name", &self.new_custom_key_store_name);
formatter.field("key_store_password", &"*** Sensitive Data Redacted ***");
formatter.field("cloud_hsm_cluster_id", &self.cloud_hsm_cluster_id);
formatter.field("xks_proxy_uri_endpoint", &self.xks_proxy_uri_endpoint);
formatter.field("xks_proxy_uri_path", &self.xks_proxy_uri_path);
formatter.field(
"xks_proxy_vpc_endpoint_service_name",
&self.xks_proxy_vpc_endpoint_service_name,
);
formatter.field(
"xks_proxy_authentication_credential",
&self.xks_proxy_authentication_credential,
);
formatter.field("xks_proxy_connectivity", &self.xks_proxy_connectivity);
formatter.finish()
}
}
}
impl UpdateCustomKeyStoreInput {
/// Consumes the builder and constructs an Operation<[`UpdateCustomKeyStore`](crate::operation::UpdateCustomKeyStore)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::UpdateCustomKeyStore,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::UpdateCustomKeyStoreInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::UpdateCustomKeyStoreInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.UpdateCustomKeyStore",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_update_custom_key_store(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::UpdateCustomKeyStore::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"UpdateCustomKeyStore",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`UpdateCustomKeyStoreInput`](crate::input::UpdateCustomKeyStoreInput).
pub fn builder() -> crate::input::update_custom_key_store_input::Builder {
crate::input::update_custom_key_store_input::Builder::default()
}
}
/// See [`UpdateKeyDescriptionInput`](crate::input::UpdateKeyDescriptionInput).
pub mod update_key_description_input {
/// A builder for [`UpdateKeyDescriptionInput`](crate::input::UpdateKeyDescriptionInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) description: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Updates the description of the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Updates the description of the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>New description for the KMS key.</p>
pub fn description(mut self, input: impl Into<std::string::String>) -> Self {
self.description = Some(input.into());
self
}
/// <p>New description for the KMS key.</p>
pub fn set_description(mut self, input: std::option::Option<std::string::String>) -> Self {
self.description = input;
self
}
/// Consumes the builder and constructs a [`UpdateKeyDescriptionInput`](crate::input::UpdateKeyDescriptionInput).
pub fn build(
self,
) -> Result<
crate::input::UpdateKeyDescriptionInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::UpdateKeyDescriptionInput {
key_id: self.key_id,
description: self.description,
})
}
}
}
impl UpdateKeyDescriptionInput {
/// Consumes the builder and constructs an Operation<[`UpdateKeyDescription`](crate::operation::UpdateKeyDescription)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::UpdateKeyDescription,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::UpdateKeyDescriptionInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::UpdateKeyDescriptionInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.UpdateKeyDescription",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_update_key_description(
&self,
)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::UpdateKeyDescription::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"UpdateKeyDescription",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`UpdateKeyDescriptionInput`](crate::input::UpdateKeyDescriptionInput).
pub fn builder() -> crate::input::update_key_description_input::Builder {
crate::input::update_key_description_input::Builder::default()
}
}
/// See [`UpdatePrimaryRegionInput`](crate::input::UpdatePrimaryRegionInput).
pub mod update_primary_region_input {
/// A builder for [`UpdatePrimaryRegionInput`](crate::input::UpdatePrimaryRegionInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default, std::fmt::Debug)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) primary_region: std::option::Option<std::string::String>,
}
impl Builder {
/// <p>Identifies the current primary key. When the operation completes, this KMS key will be a replica key.</p>
/// <p>Specify the key ID or key ARN of a multi-Region primary key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the current primary key. When the operation completes, this KMS key will be a replica key.</p>
/// <p>Specify the key ID or key ARN of a multi-Region primary key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>The Amazon Web Services Region of the new primary key. Enter the Region ID, such as <code>us-east-1</code> or <code>ap-southeast-2</code>. There must be an existing replica key in this Region. </p>
/// <p>When the operation completes, the multi-Region key in this Region will be the primary key.</p>
pub fn primary_region(mut self, input: impl Into<std::string::String>) -> Self {
self.primary_region = Some(input.into());
self
}
/// <p>The Amazon Web Services Region of the new primary key. Enter the Region ID, such as <code>us-east-1</code> or <code>ap-southeast-2</code>. There must be an existing replica key in this Region. </p>
/// <p>When the operation completes, the multi-Region key in this Region will be the primary key.</p>
pub fn set_primary_region(
mut self,
input: std::option::Option<std::string::String>,
) -> Self {
self.primary_region = input;
self
}
/// Consumes the builder and constructs a [`UpdatePrimaryRegionInput`](crate::input::UpdatePrimaryRegionInput).
pub fn build(
self,
) -> Result<
crate::input::UpdatePrimaryRegionInput,
aws_smithy_http::operation::error::BuildError,
> {
Ok(crate::input::UpdatePrimaryRegionInput {
key_id: self.key_id,
primary_region: self.primary_region,
})
}
}
}
impl UpdatePrimaryRegionInput {
/// Consumes the builder and constructs an Operation<[`UpdatePrimaryRegion`](crate::operation::UpdatePrimaryRegion)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::UpdatePrimaryRegion,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::UpdatePrimaryRegionInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::UpdatePrimaryRegionInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.UpdatePrimaryRegion",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_update_primary_region(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op = aws_smithy_http::operation::Operation::new(
request,
crate::operation::UpdatePrimaryRegion::new(),
)
.with_metadata(aws_smithy_http::operation::Metadata::new(
"UpdatePrimaryRegion",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`UpdatePrimaryRegionInput`](crate::input::UpdatePrimaryRegionInput).
pub fn builder() -> crate::input::update_primary_region_input::Builder {
crate::input::update_primary_region_input::Builder::default()
}
}
/// See [`VerifyInput`](crate::input::VerifyInput).
pub mod verify_input {
/// A builder for [`VerifyInput`](crate::input::VerifyInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default)]
pub struct Builder {
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) message: std::option::Option<aws_smithy_types::Blob>,
pub(crate) message_type: std::option::Option<crate::model::MessageType>,
pub(crate) signature: std::option::Option<aws_smithy_types::Blob>,
pub(crate) signing_algorithm: std::option::Option<crate::model::SigningAlgorithmSpec>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// <p>Identifies the asymmetric KMS key that will be used to verify the signature. This must be the same KMS key that was used to generate the signature. If you specify a different KMS key, the signature verification fails.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>Identifies the asymmetric KMS key that will be used to verify the signature. This must be the same KMS key that was used to generate the signature. If you specify a different KMS key, the signature verification fails.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>Specifies the message that was signed. You can submit a raw message of up to 4096 bytes, or a hash digest of the message. If you submit a digest, use the <code>MessageType</code> parameter with a value of <code>DIGEST</code>.</p>
/// <p>If the message specified here is different from the message that was signed, the signature verification fails. A message and its hash digest are considered to be the same message.</p>
pub fn message(mut self, input: aws_smithy_types::Blob) -> Self {
self.message = Some(input);
self
}
/// <p>Specifies the message that was signed. You can submit a raw message of up to 4096 bytes, or a hash digest of the message. If you submit a digest, use the <code>MessageType</code> parameter with a value of <code>DIGEST</code>.</p>
/// <p>If the message specified here is different from the message that was signed, the signature verification fails. A message and its hash digest are considered to be the same message.</p>
pub fn set_message(mut self, input: std::option::Option<aws_smithy_types::Blob>) -> Self {
self.message = input;
self
}
/// <p>Tells KMS whether the value of the <code>Message</code> parameter is a message or message digest. The default value, RAW, indicates a message. To indicate a message digest, enter <code>DIGEST</code>.</p> <important>
/// <p>Use the <code>DIGEST</code> value only when the value of the <code>Message</code> parameter is a message digest. If you use the <code>DIGEST</code> value with a raw message, the security of the verification operation can be compromised.</p>
/// </important>
pub fn message_type(mut self, input: crate::model::MessageType) -> Self {
self.message_type = Some(input);
self
}
/// <p>Tells KMS whether the value of the <code>Message</code> parameter is a message or message digest. The default value, RAW, indicates a message. To indicate a message digest, enter <code>DIGEST</code>.</p> <important>
/// <p>Use the <code>DIGEST</code> value only when the value of the <code>Message</code> parameter is a message digest. If you use the <code>DIGEST</code> value with a raw message, the security of the verification operation can be compromised.</p>
/// </important>
pub fn set_message_type(
mut self,
input: std::option::Option<crate::model::MessageType>,
) -> Self {
self.message_type = input;
self
}
/// <p>The signature that the <code>Sign</code> operation generated.</p>
pub fn signature(mut self, input: aws_smithy_types::Blob) -> Self {
self.signature = Some(input);
self
}
/// <p>The signature that the <code>Sign</code> operation generated.</p>
pub fn set_signature(mut self, input: std::option::Option<aws_smithy_types::Blob>) -> Self {
self.signature = input;
self
}
/// <p>The signing algorithm that was used to sign the message. If you submit a different algorithm, the signature verification fails.</p>
pub fn signing_algorithm(mut self, input: crate::model::SigningAlgorithmSpec) -> Self {
self.signing_algorithm = Some(input);
self
}
/// <p>The signing algorithm that was used to sign the message. If you submit a different algorithm, the signature verification fails.</p>
pub fn set_signing_algorithm(
mut self,
input: std::option::Option<crate::model::SigningAlgorithmSpec>,
) -> Self {
self.signing_algorithm = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// Consumes the builder and constructs a [`VerifyInput`](crate::input::VerifyInput).
pub fn build(
self,
) -> Result<crate::input::VerifyInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::VerifyInput {
key_id: self.key_id,
message: self.message,
message_type: self.message_type,
signature: self.signature,
signing_algorithm: self.signing_algorithm,
grant_tokens: self.grant_tokens,
})
}
}
impl std::fmt::Debug for Builder {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("Builder");
formatter.field("key_id", &self.key_id);
formatter.field("message", &"*** Sensitive Data Redacted ***");
formatter.field("message_type", &self.message_type);
formatter.field("signature", &self.signature);
formatter.field("signing_algorithm", &self.signing_algorithm);
formatter.field("grant_tokens", &self.grant_tokens);
formatter.finish()
}
}
}
impl VerifyInput {
/// Consumes the builder and constructs an Operation<[`Verify`](crate::operation::Verify)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::Verify,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::VerifyInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::VerifyInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.Verify",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_verify(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op =
aws_smithy_http::operation::Operation::new(request, crate::operation::Verify::new())
.with_metadata(aws_smithy_http::operation::Metadata::new("Verify", "kms"));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`VerifyInput`](crate::input::VerifyInput).
pub fn builder() -> crate::input::verify_input::Builder {
crate::input::verify_input::Builder::default()
}
}
/// See [`VerifyMacInput`](crate::input::VerifyMacInput).
pub mod verify_mac_input {
/// A builder for [`VerifyMacInput`](crate::input::VerifyMacInput).
#[derive(std::clone::Clone, std::cmp::PartialEq, std::default::Default)]
pub struct Builder {
pub(crate) message: std::option::Option<aws_smithy_types::Blob>,
pub(crate) key_id: std::option::Option<std::string::String>,
pub(crate) mac_algorithm: std::option::Option<crate::model::MacAlgorithmSpec>,
pub(crate) mac: std::option::Option<aws_smithy_types::Blob>,
pub(crate) grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl Builder {
/// <p>The message that will be used in the verification. Enter the same message that was used to generate the HMAC.</p>
/// <p> <code>GenerateMac</code> and <code>VerifyMac</code> do not provide special handling for message digests. If you generated an HMAC for a hash digest of a message, you must verify the HMAC for the same hash digest.</p>
pub fn message(mut self, input: aws_smithy_types::Blob) -> Self {
self.message = Some(input);
self
}
/// <p>The message that will be used in the verification. Enter the same message that was used to generate the HMAC.</p>
/// <p> <code>GenerateMac</code> and <code>VerifyMac</code> do not provide special handling for message digests. If you generated an HMAC for a hash digest of a message, you must verify the HMAC for the same hash digest.</p>
pub fn set_message(mut self, input: std::option::Option<aws_smithy_types::Blob>) -> Self {
self.message = input;
self
}
/// <p>The KMS key that will be used in the verification.</p>
/// <p>Enter a key ID of the KMS key that was used to generate the HMAC. If you identify a different KMS key, the <code>VerifyMac</code> operation fails.</p>
pub fn key_id(mut self, input: impl Into<std::string::String>) -> Self {
self.key_id = Some(input.into());
self
}
/// <p>The KMS key that will be used in the verification.</p>
/// <p>Enter a key ID of the KMS key that was used to generate the HMAC. If you identify a different KMS key, the <code>VerifyMac</code> operation fails.</p>
pub fn set_key_id(mut self, input: std::option::Option<std::string::String>) -> Self {
self.key_id = input;
self
}
/// <p>The MAC algorithm that will be used in the verification. Enter the same MAC algorithm that was used to compute the HMAC. This algorithm must be supported by the HMAC KMS key identified by the <code>KeyId</code> parameter.</p>
pub fn mac_algorithm(mut self, input: crate::model::MacAlgorithmSpec) -> Self {
self.mac_algorithm = Some(input);
self
}
/// <p>The MAC algorithm that will be used in the verification. Enter the same MAC algorithm that was used to compute the HMAC. This algorithm must be supported by the HMAC KMS key identified by the <code>KeyId</code> parameter.</p>
pub fn set_mac_algorithm(
mut self,
input: std::option::Option<crate::model::MacAlgorithmSpec>,
) -> Self {
self.mac_algorithm = input;
self
}
/// <p>The HMAC to verify. Enter the HMAC that was generated by the <code>GenerateMac</code> operation when you specified the same message, HMAC KMS key, and MAC algorithm as the values specified in this request.</p>
pub fn mac(mut self, input: aws_smithy_types::Blob) -> Self {
self.mac = Some(input);
self
}
/// <p>The HMAC to verify. Enter the HMAC that was generated by the <code>GenerateMac</code> operation when you specified the same message, HMAC KMS key, and MAC algorithm as the values specified in this request.</p>
pub fn set_mac(mut self, input: std::option::Option<aws_smithy_types::Blob>) -> Self {
self.mac = input;
self
}
/// Appends an item to `grant_tokens`.
///
/// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
///
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(mut self, input: impl Into<std::string::String>) -> Self {
let mut v = self.grant_tokens.unwrap_or_default();
v.push(input.into());
self.grant_tokens = Some(v);
self
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn set_grant_tokens(
mut self,
input: std::option::Option<std::vec::Vec<std::string::String>>,
) -> Self {
self.grant_tokens = input;
self
}
/// Consumes the builder and constructs a [`VerifyMacInput`](crate::input::VerifyMacInput).
pub fn build(
self,
) -> Result<crate::input::VerifyMacInput, aws_smithy_http::operation::error::BuildError>
{
Ok(crate::input::VerifyMacInput {
message: self.message,
key_id: self.key_id,
mac_algorithm: self.mac_algorithm,
mac: self.mac,
grant_tokens: self.grant_tokens,
})
}
}
impl std::fmt::Debug for Builder {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("Builder");
formatter.field("message", &"*** Sensitive Data Redacted ***");
formatter.field("key_id", &self.key_id);
formatter.field("mac_algorithm", &self.mac_algorithm);
formatter.field("mac", &self.mac);
formatter.field("grant_tokens", &self.grant_tokens);
formatter.finish()
}
}
}
impl VerifyMacInput {
/// Consumes the builder and constructs an Operation<[`VerifyMac`](crate::operation::VerifyMac)>
#[allow(unused_mut)]
#[allow(clippy::let_and_return)]
#[allow(clippy::needless_borrow)]
pub async fn make_operation(
&self,
_config: &crate::config::Config,
) -> std::result::Result<
aws_smithy_http::operation::Operation<
crate::operation::VerifyMac,
aws_http::retry::AwsResponseRetryClassifier,
>,
aws_smithy_http::operation::error::BuildError,
> {
let params_result = crate::endpoint::Params::builder()
.set_region(_config.region.as_ref().map(|r| r.as_ref().to_owned()))
.set_use_dual_stack(_config.use_dual_stack)
.set_use_fips(_config.use_fips)
.set_endpoint(_config.endpoint_url.clone())
.build()
.map_err(|err| {
aws_smithy_http::endpoint::ResolveEndpointError::from_source(
"could not construct endpoint parameters",
err,
)
});
let (endpoint_result, params) = match params_result {
Ok(params) => (
_config.endpoint_resolver.resolve_endpoint(¶ms),
Some(params),
),
Err(e) => (Err(e), None),
};
let mut request = {
fn uri_base(
_input: &crate::input::VerifyMacInput,
output: &mut String,
) -> Result<(), aws_smithy_http::operation::error::BuildError> {
write!(output, "/").expect("formatting should succeed");
Ok(())
}
#[allow(clippy::unnecessary_wraps)]
fn update_http_builder(
input: &crate::input::VerifyMacInput,
builder: http::request::Builder,
) -> std::result::Result<
http::request::Builder,
aws_smithy_http::operation::error::BuildError,
> {
let mut uri = String::new();
uri_base(input, &mut uri)?;
Ok(builder.method("POST").uri(uri))
}
let mut builder = update_http_builder(&self, http::request::Builder::new())?;
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::CONTENT_TYPE,
"application/x-amz-json-1.1",
);
builder = aws_smithy_http::header::set_request_header_if_absent(
builder,
http::header::HeaderName::from_static("x-amz-target"),
"TrentService.VerifyMac",
);
builder
};
let mut properties = aws_smithy_http::property_bag::SharedPropertyBag::new();
#[allow(clippy::useless_conversion)]
let body = aws_smithy_http::body::SdkBody::from(
crate::operation_ser::serialize_operation_crate_operation_verify_mac(&self)?,
);
if let Some(content_length) = body.content_length() {
request = aws_smithy_http::header::set_request_header_if_absent(
request,
http::header::CONTENT_LENGTH,
content_length,
);
}
let request = request.body(body).expect("should be valid request");
let mut request = aws_smithy_http::operation::Request::from_parts(request, properties);
request.properties_mut().insert(endpoint_result);
if let Some(params) = params {
request.properties_mut().insert(params);
}
request
.properties_mut()
.insert(aws_smithy_http::http_versions::DEFAULT_HTTP_VERSION_LIST.clone());
let mut user_agent = aws_http::user_agent::AwsUserAgent::new_from_environment(
aws_types::os_shim_internal::Env::real(),
crate::API_METADATA.clone(),
);
if let Some(app_name) = _config.app_name() {
user_agent = user_agent.with_app_name(app_name.clone());
}
request.properties_mut().insert(user_agent);
let mut signing_config = aws_sig_auth::signer::OperationSigningConfig::default_config();
request.properties_mut().insert(signing_config);
request
.properties_mut()
.insert(aws_types::SigningService::from_static(
_config.signing_service(),
));
if let Some(region) = &_config.region {
request
.properties_mut()
.insert(aws_types::region::SigningRegion::from(region.clone()));
}
if let Some(region) = &_config.region {
request.properties_mut().insert(region.clone());
}
aws_http::auth::set_credentials_cache(
&mut request.properties_mut(),
_config.credentials_cache.clone(),
);
let op =
aws_smithy_http::operation::Operation::new(request, crate::operation::VerifyMac::new())
.with_metadata(aws_smithy_http::operation::Metadata::new(
"VerifyMac",
"kms",
));
let op = op.with_retry_classifier(aws_http::retry::AwsResponseRetryClassifier::new());
Ok(op)
}
/// Creates a new builder-style object to manufacture [`VerifyMacInput`](crate::input::VerifyMacInput).
pub fn builder() -> crate::input::verify_mac_input::Builder {
crate::input::verify_mac_input::Builder::default()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq)]
pub struct VerifyMacInput {
/// <p>The message that will be used in the verification. Enter the same message that was used to generate the HMAC.</p>
/// <p> <code>GenerateMac</code> and <code>VerifyMac</code> do not provide special handling for message digests. If you generated an HMAC for a hash digest of a message, you must verify the HMAC for the same hash digest.</p>
#[doc(hidden)]
pub message: std::option::Option<aws_smithy_types::Blob>,
/// <p>The KMS key that will be used in the verification.</p>
/// <p>Enter a key ID of the KMS key that was used to generate the HMAC. If you identify a different KMS key, the <code>VerifyMac</code> operation fails.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>The MAC algorithm that will be used in the verification. Enter the same MAC algorithm that was used to compute the HMAC. This algorithm must be supported by the HMAC KMS key identified by the <code>KeyId</code> parameter.</p>
#[doc(hidden)]
pub mac_algorithm: std::option::Option<crate::model::MacAlgorithmSpec>,
/// <p>The HMAC to verify. Enter the HMAC that was generated by the <code>GenerateMac</code> operation when you specified the same message, HMAC KMS key, and MAC algorithm as the values specified in this request.</p>
#[doc(hidden)]
pub mac: std::option::Option<aws_smithy_types::Blob>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl VerifyMacInput {
/// <p>The message that will be used in the verification. Enter the same message that was used to generate the HMAC.</p>
/// <p> <code>GenerateMac</code> and <code>VerifyMac</code> do not provide special handling for message digests. If you generated an HMAC for a hash digest of a message, you must verify the HMAC for the same hash digest.</p>
pub fn message(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.message.as_ref()
}
/// <p>The KMS key that will be used in the verification.</p>
/// <p>Enter a key ID of the KMS key that was used to generate the HMAC. If you identify a different KMS key, the <code>VerifyMac</code> operation fails.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>The MAC algorithm that will be used in the verification. Enter the same MAC algorithm that was used to compute the HMAC. This algorithm must be supported by the HMAC KMS key identified by the <code>KeyId</code> parameter.</p>
pub fn mac_algorithm(&self) -> std::option::Option<&crate::model::MacAlgorithmSpec> {
self.mac_algorithm.as_ref()
}
/// <p>The HMAC to verify. Enter the HMAC that was generated by the <code>GenerateMac</code> operation when you specified the same message, HMAC KMS key, and MAC algorithm as the values specified in this request.</p>
pub fn mac(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.mac.as_ref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
}
impl std::fmt::Debug for VerifyMacInput {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("VerifyMacInput");
formatter.field("message", &"*** Sensitive Data Redacted ***");
formatter.field("key_id", &self.key_id);
formatter.field("mac_algorithm", &self.mac_algorithm);
formatter.field("mac", &self.mac);
formatter.field("grant_tokens", &self.grant_tokens);
formatter.finish()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq)]
pub struct VerifyInput {
/// <p>Identifies the asymmetric KMS key that will be used to verify the signature. This must be the same KMS key that was used to generate the signature. If you specify a different KMS key, the signature verification fails.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Specifies the message that was signed. You can submit a raw message of up to 4096 bytes, or a hash digest of the message. If you submit a digest, use the <code>MessageType</code> parameter with a value of <code>DIGEST</code>.</p>
/// <p>If the message specified here is different from the message that was signed, the signature verification fails. A message and its hash digest are considered to be the same message.</p>
#[doc(hidden)]
pub message: std::option::Option<aws_smithy_types::Blob>,
/// <p>Tells KMS whether the value of the <code>Message</code> parameter is a message or message digest. The default value, RAW, indicates a message. To indicate a message digest, enter <code>DIGEST</code>.</p> <important>
/// <p>Use the <code>DIGEST</code> value only when the value of the <code>Message</code> parameter is a message digest. If you use the <code>DIGEST</code> value with a raw message, the security of the verification operation can be compromised.</p>
/// </important>
#[doc(hidden)]
pub message_type: std::option::Option<crate::model::MessageType>,
/// <p>The signature that the <code>Sign</code> operation generated.</p>
#[doc(hidden)]
pub signature: std::option::Option<aws_smithy_types::Blob>,
/// <p>The signing algorithm that was used to sign the message. If you submit a different algorithm, the signature verification fails.</p>
#[doc(hidden)]
pub signing_algorithm: std::option::Option<crate::model::SigningAlgorithmSpec>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl VerifyInput {
/// <p>Identifies the asymmetric KMS key that will be used to verify the signature. This must be the same KMS key that was used to generate the signature. If you specify a different KMS key, the signature verification fails.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Specifies the message that was signed. You can submit a raw message of up to 4096 bytes, or a hash digest of the message. If you submit a digest, use the <code>MessageType</code> parameter with a value of <code>DIGEST</code>.</p>
/// <p>If the message specified here is different from the message that was signed, the signature verification fails. A message and its hash digest are considered to be the same message.</p>
pub fn message(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.message.as_ref()
}
/// <p>Tells KMS whether the value of the <code>Message</code> parameter is a message or message digest. The default value, RAW, indicates a message. To indicate a message digest, enter <code>DIGEST</code>.</p> <important>
/// <p>Use the <code>DIGEST</code> value only when the value of the <code>Message</code> parameter is a message digest. If you use the <code>DIGEST</code> value with a raw message, the security of the verification operation can be compromised.</p>
/// </important>
pub fn message_type(&self) -> std::option::Option<&crate::model::MessageType> {
self.message_type.as_ref()
}
/// <p>The signature that the <code>Sign</code> operation generated.</p>
pub fn signature(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.signature.as_ref()
}
/// <p>The signing algorithm that was used to sign the message. If you submit a different algorithm, the signature verification fails.</p>
pub fn signing_algorithm(&self) -> std::option::Option<&crate::model::SigningAlgorithmSpec> {
self.signing_algorithm.as_ref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
}
impl std::fmt::Debug for VerifyInput {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("VerifyInput");
formatter.field("key_id", &self.key_id);
formatter.field("message", &"*** Sensitive Data Redacted ***");
formatter.field("message_type", &self.message_type);
formatter.field("signature", &self.signature);
formatter.field("signing_algorithm", &self.signing_algorithm);
formatter.field("grant_tokens", &self.grant_tokens);
formatter.finish()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct UpdatePrimaryRegionInput {
/// <p>Identifies the current primary key. When the operation completes, this KMS key will be a replica key.</p>
/// <p>Specify the key ID or key ARN of a multi-Region primary key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>The Amazon Web Services Region of the new primary key. Enter the Region ID, such as <code>us-east-1</code> or <code>ap-southeast-2</code>. There must be an existing replica key in this Region. </p>
/// <p>When the operation completes, the multi-Region key in this Region will be the primary key.</p>
#[doc(hidden)]
pub primary_region: std::option::Option<std::string::String>,
}
impl UpdatePrimaryRegionInput {
/// <p>Identifies the current primary key. When the operation completes, this KMS key will be a replica key.</p>
/// <p>Specify the key ID or key ARN of a multi-Region primary key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>The Amazon Web Services Region of the new primary key. Enter the Region ID, such as <code>us-east-1</code> or <code>ap-southeast-2</code>. There must be an existing replica key in this Region. </p>
/// <p>When the operation completes, the multi-Region key in this Region will be the primary key.</p>
pub fn primary_region(&self) -> std::option::Option<&str> {
self.primary_region.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct UpdateKeyDescriptionInput {
/// <p>Updates the description of the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>New description for the KMS key.</p>
#[doc(hidden)]
pub description: std::option::Option<std::string::String>,
}
impl UpdateKeyDescriptionInput {
/// <p>Updates the description of the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>New description for the KMS key.</p>
pub fn description(&self) -> std::option::Option<&str> {
self.description.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq)]
pub struct UpdateCustomKeyStoreInput {
/// <p>Identifies the custom key store that you want to update. Enter the ID of the custom key store. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
#[doc(hidden)]
pub custom_key_store_id: std::option::Option<std::string::String>,
/// <p>Changes the friendly name of the custom key store to the value that you specify. The custom key store name must be unique in the Amazon Web Services account.</p>
/// <p>To change this value, an CloudHSM key store must be disconnected. An external key store can be connected or disconnected.</p>
#[doc(hidden)]
pub new_custom_key_store_name: std::option::Option<std::string::String>,
/// <p>Enter the current password of the <code>kmsuser</code> crypto user (CU) in the CloudHSM cluster that is associated with the custom key store. This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>This parameter tells KMS the current password of the <code>kmsuser</code> crypto user (CU). It does not set or change the password of any users in the CloudHSM cluster.</p>
/// <p>To change this value, the CloudHSM key store must be disconnected.</p>
#[doc(hidden)]
pub key_store_password: std::option::Option<std::string::String>,
/// <p>Associates the custom key store with a related CloudHSM cluster. This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the cluster ID of the cluster that you used to create the custom key store or a cluster that shares a backup history and has the same cluster certificate as the original cluster. You cannot use this parameter to associate a custom key store with an unrelated cluster. In addition, the replacement cluster must <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore">fulfill the requirements</a> for a cluster associated with a custom key store. To view the cluster certificate of a cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation.</p>
/// <p>To change this value, the CloudHSM key store must be disconnected.</p>
#[doc(hidden)]
pub cloud_hsm_cluster_id: std::option::Option<std::string::String>,
/// <p>Changes the URI endpoint that KMS uses to connect to your external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>For external key stores with an <code>XksProxyConnectivity</code> value of <code>PUBLIC_ENDPOINT</code>, the protocol must be HTTPS.</p>
/// <p>For external key stores with an <code>XksProxyConnectivity</code> value of <code>VPC_ENDPOINT_SERVICE</code>, specify <code>https://</code> followed by the private DNS name associated with the VPC endpoint service. Each external key store must use a different private DNS name.</p>
/// <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
#[doc(hidden)]
pub xks_proxy_uri_endpoint: std::option::Option<std::string::String>,
/// <p>Changes the base path to the proxy APIs for this external key store. To find this value, see the documentation for your external key manager and external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The value must start with <code>/</code> and must end with <code>/kms/xks/v1</code>, where <code>v1</code> represents the version of the KMS external key store proxy API. You can include an optional prefix between the required elements such as <code>/<i>example</i>/kms/xks/v1</code>.</p>
/// <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p>
/// <p>You can change this value when the external key store is connected or disconnected.</p>
#[doc(hidden)]
pub xks_proxy_uri_path: std::option::Option<std::string::String>,
/// <p>Changes the name that KMS uses to identify the Amazon VPC endpoint service for your external key store proxy (XKS proxy). This parameter is valid when the <code>CustomKeyStoreType</code> is <code>EXTERNAL_KEY_STORE</code> and the <code>XksProxyConnectivity</code> is <code>VPC_ENDPOINT_SERVICE</code>.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
#[doc(hidden)]
pub xks_proxy_vpc_endpoint_service_name: std::option::Option<std::string::String>,
/// <p>Changes the credentials that KMS uses to sign requests to the external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>You must specify both the <code>AccessKeyId</code> and <code>SecretAccessKey</code> value in the authentication credential, even if you are only updating one value.</p>
/// <p>This parameter doesn't establish or change your authentication credentials on the proxy. It just tells KMS the credential that you established with your external key store proxy. For example, if you rotate the credential on your external key store proxy, you can use this parameter to update the credential in KMS.</p>
/// <p>You can change this value when the external key store is connected or disconnected.</p>
#[doc(hidden)]
pub xks_proxy_authentication_credential:
std::option::Option<crate::model::XksProxyAuthenticationCredentialType>,
/// <p>Changes the connectivity setting for the external key store. To indicate that the external key store proxy uses a Amazon VPC endpoint service to communicate with KMS, specify <code>VPC_ENDPOINT_SERVICE</code>. Otherwise, specify <code>PUBLIC_ENDPOINT</code>.</p>
/// <p>If you change the <code>XksProxyConnectivity</code> to <code>VPC_ENDPOINT_SERVICE</code>, you must also change the <code>XksProxyUriEndpoint</code> and add an <code>XksProxyVpcEndpointServiceName</code> value. </p>
/// <p>If you change the <code>XksProxyConnectivity</code> to <code>PUBLIC_ENDPOINT</code>, you must also change the <code>XksProxyUriEndpoint</code> and specify a null or empty string for the <code>XksProxyVpcEndpointServiceName</code> value.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
#[doc(hidden)]
pub xks_proxy_connectivity: std::option::Option<crate::model::XksProxyConnectivityType>,
}
impl UpdateCustomKeyStoreInput {
/// <p>Identifies the custom key store that you want to update. Enter the ID of the custom key store. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn custom_key_store_id(&self) -> std::option::Option<&str> {
self.custom_key_store_id.as_deref()
}
/// <p>Changes the friendly name of the custom key store to the value that you specify. The custom key store name must be unique in the Amazon Web Services account.</p>
/// <p>To change this value, an CloudHSM key store must be disconnected. An external key store can be connected or disconnected.</p>
pub fn new_custom_key_store_name(&self) -> std::option::Option<&str> {
self.new_custom_key_store_name.as_deref()
}
/// <p>Enter the current password of the <code>kmsuser</code> crypto user (CU) in the CloudHSM cluster that is associated with the custom key store. This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>This parameter tells KMS the current password of the <code>kmsuser</code> crypto user (CU). It does not set or change the password of any users in the CloudHSM cluster.</p>
/// <p>To change this value, the CloudHSM key store must be disconnected.</p>
pub fn key_store_password(&self) -> std::option::Option<&str> {
self.key_store_password.as_deref()
}
/// <p>Associates the custom key store with a related CloudHSM cluster. This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the cluster ID of the cluster that you used to create the custom key store or a cluster that shares a backup history and has the same cluster certificate as the original cluster. You cannot use this parameter to associate a custom key store with an unrelated cluster. In addition, the replacement cluster must <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore">fulfill the requirements</a> for a cluster associated with a custom key store. To view the cluster certificate of a cluster, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation.</p>
/// <p>To change this value, the CloudHSM key store must be disconnected.</p>
pub fn cloud_hsm_cluster_id(&self) -> std::option::Option<&str> {
self.cloud_hsm_cluster_id.as_deref()
}
/// <p>Changes the URI endpoint that KMS uses to connect to your external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>For external key stores with an <code>XksProxyConnectivity</code> value of <code>PUBLIC_ENDPOINT</code>, the protocol must be HTTPS.</p>
/// <p>For external key stores with an <code>XksProxyConnectivity</code> value of <code>VPC_ENDPOINT_SERVICE</code>, specify <code>https://</code> followed by the private DNS name associated with the VPC endpoint service. Each external key store must use a different private DNS name.</p>
/// <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
pub fn xks_proxy_uri_endpoint(&self) -> std::option::Option<&str> {
self.xks_proxy_uri_endpoint.as_deref()
}
/// <p>Changes the base path to the proxy APIs for this external key store. To find this value, see the documentation for your external key manager and external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The value must start with <code>/</code> and must end with <code>/kms/xks/v1</code>, where <code>v1</code> represents the version of the KMS external key store proxy API. You can include an optional prefix between the required elements such as <code>/<i>example</i>/kms/xks/v1</code>.</p>
/// <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p>
/// <p>You can change this value when the external key store is connected or disconnected.</p>
pub fn xks_proxy_uri_path(&self) -> std::option::Option<&str> {
self.xks_proxy_uri_path.as_deref()
}
/// <p>Changes the name that KMS uses to identify the Amazon VPC endpoint service for your external key store proxy (XKS proxy). This parameter is valid when the <code>CustomKeyStoreType</code> is <code>EXTERNAL_KEY_STORE</code> and the <code>XksProxyConnectivity</code> is <code>VPC_ENDPOINT_SERVICE</code>.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
pub fn xks_proxy_vpc_endpoint_service_name(&self) -> std::option::Option<&str> {
self.xks_proxy_vpc_endpoint_service_name.as_deref()
}
/// <p>Changes the credentials that KMS uses to sign requests to the external key store proxy (XKS proxy). This parameter is valid only for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>You must specify both the <code>AccessKeyId</code> and <code>SecretAccessKey</code> value in the authentication credential, even if you are only updating one value.</p>
/// <p>This parameter doesn't establish or change your authentication credentials on the proxy. It just tells KMS the credential that you established with your external key store proxy. For example, if you rotate the credential on your external key store proxy, you can use this parameter to update the credential in KMS.</p>
/// <p>You can change this value when the external key store is connected or disconnected.</p>
pub fn xks_proxy_authentication_credential(
&self,
) -> std::option::Option<&crate::model::XksProxyAuthenticationCredentialType> {
self.xks_proxy_authentication_credential.as_ref()
}
/// <p>Changes the connectivity setting for the external key store. To indicate that the external key store proxy uses a Amazon VPC endpoint service to communicate with KMS, specify <code>VPC_ENDPOINT_SERVICE</code>. Otherwise, specify <code>PUBLIC_ENDPOINT</code>.</p>
/// <p>If you change the <code>XksProxyConnectivity</code> to <code>VPC_ENDPOINT_SERVICE</code>, you must also change the <code>XksProxyUriEndpoint</code> and add an <code>XksProxyVpcEndpointServiceName</code> value. </p>
/// <p>If you change the <code>XksProxyConnectivity</code> to <code>PUBLIC_ENDPOINT</code>, you must also change the <code>XksProxyUriEndpoint</code> and specify a null or empty string for the <code>XksProxyVpcEndpointServiceName</code> value.</p>
/// <p>To change this value, the external key store must be disconnected.</p>
pub fn xks_proxy_connectivity(
&self,
) -> std::option::Option<&crate::model::XksProxyConnectivityType> {
self.xks_proxy_connectivity.as_ref()
}
}
impl std::fmt::Debug for UpdateCustomKeyStoreInput {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("UpdateCustomKeyStoreInput");
formatter.field("custom_key_store_id", &self.custom_key_store_id);
formatter.field("new_custom_key_store_name", &self.new_custom_key_store_name);
formatter.field("key_store_password", &"*** Sensitive Data Redacted ***");
formatter.field("cloud_hsm_cluster_id", &self.cloud_hsm_cluster_id);
formatter.field("xks_proxy_uri_endpoint", &self.xks_proxy_uri_endpoint);
formatter.field("xks_proxy_uri_path", &self.xks_proxy_uri_path);
formatter.field(
"xks_proxy_vpc_endpoint_service_name",
&self.xks_proxy_vpc_endpoint_service_name,
);
formatter.field(
"xks_proxy_authentication_credential",
&self.xks_proxy_authentication_credential,
);
formatter.field("xks_proxy_connectivity", &self.xks_proxy_connectivity);
formatter.finish()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct UpdateAliasInput {
/// <p>Identifies the alias that is changing its KMS key. This value must begin with <code>alias/</code> followed by the alias name, such as <code>alias/ExampleAlias</code>. You cannot use <code>UpdateAlias</code> to change the alias name.</p>
#[doc(hidden)]
pub alias_name: std::option::Option<std::string::String>,
/// <p>Identifies the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a> to associate with the alias. You don't have permission to associate an alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a>.</p>
/// <p>The KMS key must be in the same Amazon Web Services account and Region as the alias. Also, the new target KMS key must be the same type as the current target KMS key (both symmetric or both asymmetric or both HMAC) and they must have the same key usage. </p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
/// <p>To verify that the alias is mapped to the correct KMS key, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub target_key_id: std::option::Option<std::string::String>,
}
impl UpdateAliasInput {
/// <p>Identifies the alias that is changing its KMS key. This value must begin with <code>alias/</code> followed by the alias name, such as <code>alias/ExampleAlias</code>. You cannot use <code>UpdateAlias</code> to change the alias name.</p>
pub fn alias_name(&self) -> std::option::Option<&str> {
self.alias_name.as_deref()
}
/// <p>Identifies the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a> to associate with the alias. You don't have permission to associate an alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed key</a>.</p>
/// <p>The KMS key must be in the same Amazon Web Services account and Region as the alias. Also, the new target KMS key must be the same type as the current target KMS key (both symmetric or both asymmetric or both HMAC) and they must have the same key usage. </p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
/// <p>To verify that the alias is mapped to the correct KMS key, use <code>ListAliases</code>.</p>
pub fn target_key_id(&self) -> std::option::Option<&str> {
self.target_key_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct UntagResourceInput {
/// <p>Identifies the KMS key from which you are removing tags.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>One or more tag keys. Specify only the tag keys, not the tag values.</p>
#[doc(hidden)]
pub tag_keys: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl UntagResourceInput {
/// <p>Identifies the KMS key from which you are removing tags.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>One or more tag keys. Specify only the tag keys, not the tag values.</p>
pub fn tag_keys(&self) -> std::option::Option<&[std::string::String]> {
self.tag_keys.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct TagResourceInput {
/// <p>Identifies a customer managed key in the account and Region.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>One or more tags. </p>
/// <p>Each tag consists of a tag key and a tag value. The tag value can be an empty (null) string. </p>
/// <p>You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
#[doc(hidden)]
pub tags: std::option::Option<std::vec::Vec<crate::model::Tag>>,
}
impl TagResourceInput {
/// <p>Identifies a customer managed key in the account and Region.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>One or more tags. </p>
/// <p>Each tag consists of a tag key and a tag value. The tag value can be an empty (null) string. </p>
/// <p>You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
pub fn tags(&self) -> std::option::Option<&[crate::model::Tag]> {
self.tags.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq)]
pub struct SignInput {
/// <p>Identifies an asymmetric KMS key. KMS uses the private key in the asymmetric KMS key to sign the message. The <code>KeyUsage</code> type of the KMS key must be <code>SIGN_VERIFY</code>. To find the <code>KeyUsage</code> of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Specifies the message or message digest to sign. Messages can be 0-4096 bytes. To sign a larger message, provide the message digest.</p>
/// <p>If you provide a message, KMS generates a hash digest of the message and then signs it.</p>
#[doc(hidden)]
pub message: std::option::Option<aws_smithy_types::Blob>,
/// <p>Tells KMS whether the value of the <code>Message</code> parameter is a message or message digest. The default value, RAW, indicates a message. To indicate a message digest, enter <code>DIGEST</code>.</p>
#[doc(hidden)]
pub message_type: std::option::Option<crate::model::MessageType>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
/// <p>Specifies the signing algorithm to use when signing the message. </p>
/// <p>Choose an algorithm that is compatible with the type and size of the specified asymmetric KMS key.</p>
#[doc(hidden)]
pub signing_algorithm: std::option::Option<crate::model::SigningAlgorithmSpec>,
}
impl SignInput {
/// <p>Identifies an asymmetric KMS key. KMS uses the private key in the asymmetric KMS key to sign the message. The <code>KeyUsage</code> type of the KMS key must be <code>SIGN_VERIFY</code>. To find the <code>KeyUsage</code> of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Specifies the message or message digest to sign. Messages can be 0-4096 bytes. To sign a larger message, provide the message digest.</p>
/// <p>If you provide a message, KMS generates a hash digest of the message and then signs it.</p>
pub fn message(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.message.as_ref()
}
/// <p>Tells KMS whether the value of the <code>Message</code> parameter is a message or message digest. The default value, RAW, indicates a message. To indicate a message digest, enter <code>DIGEST</code>.</p>
pub fn message_type(&self) -> std::option::Option<&crate::model::MessageType> {
self.message_type.as_ref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
/// <p>Specifies the signing algorithm to use when signing the message. </p>
/// <p>Choose an algorithm that is compatible with the type and size of the specified asymmetric KMS key.</p>
pub fn signing_algorithm(&self) -> std::option::Option<&crate::model::SigningAlgorithmSpec> {
self.signing_algorithm.as_ref()
}
}
impl std::fmt::Debug for SignInput {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("SignInput");
formatter.field("key_id", &self.key_id);
formatter.field("message", &"*** Sensitive Data Redacted ***");
formatter.field("message_type", &self.message_type);
formatter.field("grant_tokens", &self.grant_tokens);
formatter.field("signing_algorithm", &self.signing_algorithm);
formatter.finish()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ScheduleKeyDeletionInput {
/// <p>The unique identifier of the KMS key to delete.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>The waiting period, specified in number of days. After the waiting period ends, KMS deletes the KMS key.</p>
/// <p>If the KMS key is a multi-Region primary key with replica keys, the waiting period begins when the last of its replica keys is deleted. Otherwise, the waiting period begins immediately.</p>
/// <p>This value is optional. If you include a value, it must be between 7 and 30, inclusive. If you do not include a value, it defaults to 30.</p>
#[doc(hidden)]
pub pending_window_in_days: std::option::Option<i32>,
}
impl ScheduleKeyDeletionInput {
/// <p>The unique identifier of the KMS key to delete.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>The waiting period, specified in number of days. After the waiting period ends, KMS deletes the KMS key.</p>
/// <p>If the KMS key is a multi-Region primary key with replica keys, the waiting period begins when the last of its replica keys is deleted. Otherwise, the waiting period begins immediately.</p>
/// <p>This value is optional. If you include a value, it must be between 7 and 30, inclusive. If you do not include a value, it defaults to 30.</p>
pub fn pending_window_in_days(&self) -> std::option::Option<i32> {
self.pending_window_in_days
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct RevokeGrantInput {
/// <p>A unique identifier for the KMS key associated with the grant. To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Identifies the grant to revoke. To get the grant ID, use <code>CreateGrant</code>, <code>ListGrants</code>, or <code>ListRetirableGrants</code>.</p>
#[doc(hidden)]
pub grant_id: std::option::Option<std::string::String>,
}
impl RevokeGrantInput {
/// <p>A unique identifier for the KMS key associated with the grant. To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Identifies the grant to revoke. To get the grant ID, use <code>CreateGrant</code>, <code>ListGrants</code>, or <code>ListRetirableGrants</code>.</p>
pub fn grant_id(&self) -> std::option::Option<&str> {
self.grant_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct RetireGrantInput {
/// <p>Identifies the grant to be retired. You can use a grant token to identify a new grant even before it has achieved eventual consistency.</p>
/// <p>Only the <code>CreateGrant</code> operation returns a grant token. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-eventual-consistency">Eventual consistency</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_token: std::option::Option<std::string::String>,
/// <p>The key ARN KMS key associated with the grant. To find the key ARN, use the <code>ListKeys</code> operation.</p>
/// <p>For example: <code>arn:aws:kms:us-east-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Identifies the grant to retire. To get the grant ID, use <code>CreateGrant</code>, <code>ListGrants</code>, or <code>ListRetirableGrants</code>.</p>
/// <ul>
/// <li> <p>Grant ID Example - 0123456789012345678901234567890123456789012345678901234567890123</p> </li>
/// </ul>
#[doc(hidden)]
pub grant_id: std::option::Option<std::string::String>,
}
impl RetireGrantInput {
/// <p>Identifies the grant to be retired. You can use a grant token to identify a new grant even before it has achieved eventual consistency.</p>
/// <p>Only the <code>CreateGrant</code> operation returns a grant token. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-eventual-consistency">Eventual consistency</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_token(&self) -> std::option::Option<&str> {
self.grant_token.as_deref()
}
/// <p>The key ARN KMS key associated with the grant. To find the key ARN, use the <code>ListKeys</code> operation.</p>
/// <p>For example: <code>arn:aws:kms:us-east-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Identifies the grant to retire. To get the grant ID, use <code>CreateGrant</code>, <code>ListGrants</code>, or <code>ListRetirableGrants</code>.</p>
/// <ul>
/// <li> <p>Grant ID Example - 0123456789012345678901234567890123456789012345678901234567890123</p> </li>
/// </ul>
pub fn grant_id(&self) -> std::option::Option<&str> {
self.grant_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ReplicateKeyInput {
/// <p>Identifies the multi-Region primary key that is being replicated. To determine whether a KMS key is a multi-Region primary key, use the <code>DescribeKey</code> operation to check the value of the <code>MultiRegionKeyType</code> property.</p>
/// <p>Specify the key ID or key ARN of a multi-Region primary key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>The Region ID of the Amazon Web Services Region for this replica key. </p>
/// <p>Enter the Region ID, such as <code>us-east-1</code> or <code>ap-southeast-2</code>. For a list of Amazon Web Services Regions in which KMS is supported, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">KMS service endpoints</a> in the <i>Amazon Web Services General Reference</i>.</p> <note>
/// <p>HMAC KMS keys are not supported in all Amazon Web Services Regions. If you try to replicate an HMAC KMS key in an Amazon Web Services Region in which HMAC keys are not supported, the <code>ReplicateKey</code> operation returns an <code>UnsupportedOperationException</code>. For a list of Regions in which HMAC KMS keys are supported, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>The replica must be in a different Amazon Web Services Region than its primary key and other replicas of that primary key, but in the same Amazon Web Services partition. KMS must be available in the replica Region. If the Region is not enabled by default, the Amazon Web Services account must be enabled in the Region. For information about Amazon Web Services partitions, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs)</a> in the <i>Amazon Web Services General Reference</i>. For information about enabling and disabling Regions, see <a href="https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable">Enabling a Region</a> and <a href="https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable">Disabling a Region</a> in the <i>Amazon Web Services General Reference</i>.</p>
#[doc(hidden)]
pub replica_region: std::option::Option<std::string::String>,
/// <p>The key policy to attach to the KMS key. This parameter is optional. If you do not provide a key policy, KMS attaches the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">default key policy</a> to the KMS key.</p>
/// <p>The key policy is not a shared property of multi-Region keys. You can specify the same key policy or a different key policy for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
/// <p>If you provide a key policy, it must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must give the caller <code>kms:PutKeyPolicy</code> permission on the replica key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i> <i>Key Management Service Developer Guide</i> </i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p> </li>
/// </ul>
/// <p>A key policy document can include only the following characters:</p>
/// <ul>
/// <li> <p>Printable ASCII characters from the space character (<code>\u0020</code>) through the end of the ASCII character range.</p> </li>
/// <li> <p>Printable characters in the Basic Latin and Latin-1 Supplement character set (through <code>\u00FF</code>).</p> </li>
/// <li> <p>The tab (<code>\u0009</code>), line feed (<code>\u000A</code>), and carriage return (<code>\u000D</code>) special characters</p> </li>
/// </ul>
/// <p>For information about key policies, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">Key policies in KMS</a> in the <i>Key Management Service Developer Guide</i>. For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
#[doc(hidden)]
pub policy: std::option::Option<std::string::String>,
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i>Key Management Service Developer Guide</i>.</p>
/// </important>
/// <p>Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
#[doc(hidden)]
pub bypass_policy_lockout_safety_check: bool,
/// <p>A description of the KMS key. The default value is an empty string (no description).</p>
/// <p>The description is not a shared property of multi-Region keys. You can specify the same description or a different description for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
#[doc(hidden)]
pub description: std::option::Option<std::string::String>,
/// <p>Assigns one or more tags to the replica key. Use this parameter to tag the KMS key when it is created. To tag an existing KMS key, use the <code>TagResource</code> operation.</p> <note>
/// <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>To use this parameter, you must have <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:TagResource</a> permission in an IAM policy.</p>
/// <p>Tags are not a shared property of multi-Region keys. You can specify the same tags or different tags for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
/// <p>Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
/// <p>When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">Tagging Keys</a>.</p>
#[doc(hidden)]
pub tags: std::option::Option<std::vec::Vec<crate::model::Tag>>,
}
impl ReplicateKeyInput {
/// <p>Identifies the multi-Region primary key that is being replicated. To determine whether a KMS key is a multi-Region primary key, use the <code>DescribeKey</code> operation to check the value of the <code>MultiRegionKeyType</code> property.</p>
/// <p>Specify the key ID or key ARN of a multi-Region primary key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>The Region ID of the Amazon Web Services Region for this replica key. </p>
/// <p>Enter the Region ID, such as <code>us-east-1</code> or <code>ap-southeast-2</code>. For a list of Amazon Web Services Regions in which KMS is supported, see <a href="https://docs.aws.amazon.com/general/latest/gr/kms.html#kms_region">KMS service endpoints</a> in the <i>Amazon Web Services General Reference</i>.</p> <note>
/// <p>HMAC KMS keys are not supported in all Amazon Web Services Regions. If you try to replicate an HMAC KMS key in an Amazon Web Services Region in which HMAC keys are not supported, the <code>ReplicateKey</code> operation returns an <code>UnsupportedOperationException</code>. For a list of Regions in which HMAC KMS keys are supported, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>The replica must be in a different Amazon Web Services Region than its primary key and other replicas of that primary key, but in the same Amazon Web Services partition. KMS must be available in the replica Region. If the Region is not enabled by default, the Amazon Web Services account must be enabled in the Region. For information about Amazon Web Services partitions, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs)</a> in the <i>Amazon Web Services General Reference</i>. For information about enabling and disabling Regions, see <a href="https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable">Enabling a Region</a> and <a href="https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-disable">Disabling a Region</a> in the <i>Amazon Web Services General Reference</i>.</p>
pub fn replica_region(&self) -> std::option::Option<&str> {
self.replica_region.as_deref()
}
/// <p>The key policy to attach to the KMS key. This parameter is optional. If you do not provide a key policy, KMS attaches the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">default key policy</a> to the KMS key.</p>
/// <p>The key policy is not a shared property of multi-Region keys. You can specify the same key policy or a different key policy for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
/// <p>If you provide a key policy, it must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must give the caller <code>kms:PutKeyPolicy</code> permission on the replica key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i> <i>Key Management Service Developer Guide</i> </i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p> </li>
/// </ul>
/// <p>A key policy document can include only the following characters:</p>
/// <ul>
/// <li> <p>Printable ASCII characters from the space character (<code>\u0020</code>) through the end of the ASCII character range.</p> </li>
/// <li> <p>Printable characters in the Basic Latin and Latin-1 Supplement character set (through <code>\u00FF</code>).</p> </li>
/// <li> <p>The tab (<code>\u0009</code>), line feed (<code>\u000A</code>), and carriage return (<code>\u000D</code>) special characters</p> </li>
/// </ul>
/// <p>For information about key policies, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">Key policies in KMS</a> in the <i>Key Management Service Developer Guide</i>. For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
pub fn policy(&self) -> std::option::Option<&str> {
self.policy.as_deref()
}
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i>Key Management Service Developer Guide</i>.</p>
/// </important>
/// <p>Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
pub fn bypass_policy_lockout_safety_check(&self) -> bool {
self.bypass_policy_lockout_safety_check
}
/// <p>A description of the KMS key. The default value is an empty string (no description).</p>
/// <p>The description is not a shared property of multi-Region keys. You can specify the same description or a different description for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
pub fn description(&self) -> std::option::Option<&str> {
self.description.as_deref()
}
/// <p>Assigns one or more tags to the replica key. Use this parameter to tag the KMS key when it is created. To tag an existing KMS key, use the <code>TagResource</code> operation.</p> <note>
/// <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>To use this parameter, you must have <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:TagResource</a> permission in an IAM policy.</p>
/// <p>Tags are not a shared property of multi-Region keys. You can specify the same tags or different tags for each key in a set of related multi-Region keys. KMS does not synchronize this property.</p>
/// <p>Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
/// <p>When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">Tagging Keys</a>.</p>
pub fn tags(&self) -> std::option::Option<&[crate::model::Tag]> {
self.tags.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ReEncryptInput {
/// <p>Ciphertext of the data to reencrypt.</p>
#[doc(hidden)]
pub ciphertext_blob: std::option::Option<aws_smithy_types::Blob>,
/// <p>Specifies the encryption context to use to decrypt the ciphertext. Enter the same encryption context that was used to encrypt the ciphertext.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub source_encryption_context:
std::option::Option<std::collections::HashMap<std::string::String, std::string::String>>,
/// <p>Specifies the KMS key that KMS will use to decrypt the ciphertext before it is re-encrypted.</p>
/// <p>Enter a key ID of the KMS key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>ReEncrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to the symmetric ciphertext blob. However, it is always recommended as a best practice. This practice ensures that you use the KMS key that you intend.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub source_key_id: std::option::Option<std::string::String>,
/// <p>A unique identifier for the KMS key that is used to reencrypt the data. Specify a symmetric encryption KMS key or an asymmetric KMS key with a <code>KeyUsage</code> value of <code>ENCRYPT_DECRYPT</code>. To find the <code>KeyUsage</code> value of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub destination_key_id: std::option::Option<std::string::String>,
/// <p>Specifies that encryption context to use when the reencrypting the data.</p>
/// <p>A destination encryption context is valid only when the destination KMS key is a symmetric encryption KMS key. The standard ciphertext format for asymmetric KMS keys does not include fields for metadata.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub destination_encryption_context:
std::option::Option<std::collections::HashMap<std::string::String, std::string::String>>,
/// <p>Specifies the encryption algorithm that KMS will use to decrypt the ciphertext before it is reencrypted. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the algorithm used for symmetric encryption KMS keys.</p>
/// <p>Specify the same algorithm that was used to encrypt the ciphertext. If you specify a different algorithm, the decrypt attempt fails.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.</p>
#[doc(hidden)]
pub source_encryption_algorithm: std::option::Option<crate::model::EncryptionAlgorithmSpec>,
/// <p>Specifies the encryption algorithm that KMS will use to reecrypt the data after it has decrypted it. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the encryption algorithm used for symmetric encryption KMS keys.</p>
/// <p>This parameter is required only when the destination KMS key is an asymmetric KMS key.</p>
#[doc(hidden)]
pub destination_encryption_algorithm:
std::option::Option<crate::model::EncryptionAlgorithmSpec>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl ReEncryptInput {
/// <p>Ciphertext of the data to reencrypt.</p>
pub fn ciphertext_blob(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.ciphertext_blob.as_ref()
}
/// <p>Specifies the encryption context to use to decrypt the ciphertext. Enter the same encryption context that was used to encrypt the ciphertext.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn source_encryption_context(
&self,
) -> std::option::Option<&std::collections::HashMap<std::string::String, std::string::String>>
{
self.source_encryption_context.as_ref()
}
/// <p>Specifies the KMS key that KMS will use to decrypt the ciphertext before it is re-encrypted.</p>
/// <p>Enter a key ID of the KMS key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>ReEncrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to the symmetric ciphertext blob. However, it is always recommended as a best practice. This practice ensures that you use the KMS key that you intend.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn source_key_id(&self) -> std::option::Option<&str> {
self.source_key_id.as_deref()
}
/// <p>A unique identifier for the KMS key that is used to reencrypt the data. Specify a symmetric encryption KMS key or an asymmetric KMS key with a <code>KeyUsage</code> value of <code>ENCRYPT_DECRYPT</code>. To find the <code>KeyUsage</code> value of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn destination_key_id(&self) -> std::option::Option<&str> {
self.destination_key_id.as_deref()
}
/// <p>Specifies that encryption context to use when the reencrypting the data.</p>
/// <p>A destination encryption context is valid only when the destination KMS key is a symmetric encryption KMS key. The standard ciphertext format for asymmetric KMS keys does not include fields for metadata.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn destination_encryption_context(
&self,
) -> std::option::Option<&std::collections::HashMap<std::string::String, std::string::String>>
{
self.destination_encryption_context.as_ref()
}
/// <p>Specifies the encryption algorithm that KMS will use to decrypt the ciphertext before it is reencrypted. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the algorithm used for symmetric encryption KMS keys.</p>
/// <p>Specify the same algorithm that was used to encrypt the ciphertext. If you specify a different algorithm, the decrypt attempt fails.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.</p>
pub fn source_encryption_algorithm(
&self,
) -> std::option::Option<&crate::model::EncryptionAlgorithmSpec> {
self.source_encryption_algorithm.as_ref()
}
/// <p>Specifies the encryption algorithm that KMS will use to reecrypt the data after it has decrypted it. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the encryption algorithm used for symmetric encryption KMS keys.</p>
/// <p>This parameter is required only when the destination KMS key is an asymmetric KMS key.</p>
pub fn destination_encryption_algorithm(
&self,
) -> std::option::Option<&crate::model::EncryptionAlgorithmSpec> {
self.destination_encryption_algorithm.as_ref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct PutKeyPolicyInput {
/// <p>Sets the key policy on the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>The name of the key policy. The only valid value is <code>default</code>.</p>
#[doc(hidden)]
pub policy_name: std::option::Option<std::string::String>,
/// <p>The key policy to attach to the KMS key.</p>
/// <p>The key policy must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must allow the principal that is making the <code>PutKeyPolicy</code> request to make a subsequent <code>PutKeyPolicy</code> request on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i>Key Management Service Developer Guide</i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i>Amazon Web Services Identity and Access Management User Guide</i>.</p> </li>
/// </ul>
/// <p>A key policy document can include only the following characters:</p>
/// <ul>
/// <li> <p>Printable ASCII characters from the space character (<code>\u0020</code>) through the end of the ASCII character range.</p> </li>
/// <li> <p>Printable characters in the Basic Latin and Latin-1 Supplement character set (through <code>\u00FF</code>).</p> </li>
/// <li> <p>The tab (<code>\u0009</code>), line feed (<code>\u000A</code>), and carriage return (<code>\u000D</code>) special characters</p> </li>
/// </ul>
/// <p>For information about key policies, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">Key policies in KMS</a> in the <i>Key Management Service Developer Guide</i>.For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
#[doc(hidden)]
pub policy: std::option::Option<std::string::String>,
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i>Key Management Service Developer Guide</i>.</p>
/// </important>
/// <p>Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
#[doc(hidden)]
pub bypass_policy_lockout_safety_check: bool,
}
impl PutKeyPolicyInput {
/// <p>Sets the key policy on the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>The name of the key policy. The only valid value is <code>default</code>.</p>
pub fn policy_name(&self) -> std::option::Option<&str> {
self.policy_name.as_deref()
}
/// <p>The key policy to attach to the KMS key.</p>
/// <p>The key policy must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must allow the principal that is making the <code>PutKeyPolicy</code> request to make a subsequent <code>PutKeyPolicy</code> request on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i>Key Management Service Developer Guide</i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i>Amazon Web Services Identity and Access Management User Guide</i>.</p> </li>
/// </ul>
/// <p>A key policy document can include only the following characters:</p>
/// <ul>
/// <li> <p>Printable ASCII characters from the space character (<code>\u0020</code>) through the end of the ASCII character range.</p> </li>
/// <li> <p>Printable characters in the Basic Latin and Latin-1 Supplement character set (through <code>\u00FF</code>).</p> </li>
/// <li> <p>The tab (<code>\u0009</code>), line feed (<code>\u000A</code>), and carriage return (<code>\u000D</code>) special characters</p> </li>
/// </ul>
/// <p>For information about key policies, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html">Key policies in KMS</a> in the <i>Key Management Service Developer Guide</i>.For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
pub fn policy(&self) -> std::option::Option<&str> {
self.policy.as_deref()
}
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i>Key Management Service Developer Guide</i>.</p>
/// </important>
/// <p>Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
pub fn bypass_policy_lockout_safety_check(&self) -> bool {
self.bypass_policy_lockout_safety_check
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ListRetirableGrantsInput {
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
#[doc(hidden)]
pub limit: std::option::Option<i32>,
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
#[doc(hidden)]
pub marker: std::option::Option<std::string::String>,
/// <p>The retiring principal for which to list grants. Enter a principal in your Amazon Web Services account.</p>
/// <p>To specify the retiring principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
#[doc(hidden)]
pub retiring_principal: std::option::Option<std::string::String>,
}
impl ListRetirableGrantsInput {
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn limit(&self) -> std::option::Option<i32> {
self.limit
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(&self) -> std::option::Option<&str> {
self.marker.as_deref()
}
/// <p>The retiring principal for which to list grants. Enter a principal in your Amazon Web Services account.</p>
/// <p>To specify the retiring principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
pub fn retiring_principal(&self) -> std::option::Option<&str> {
self.retiring_principal.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ListResourceTagsInput {
/// <p>Gets tags on the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 50, inclusive. If you do not include a value, it defaults to 50.</p>
#[doc(hidden)]
pub limit: std::option::Option<i32>,
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
/// <p>Do not attempt to construct this value. Use only the value of <code>NextMarker</code> from the truncated response you just received.</p>
#[doc(hidden)]
pub marker: std::option::Option<std::string::String>,
}
impl ListResourceTagsInput {
/// <p>Gets tags on the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 50, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn limit(&self) -> std::option::Option<i32> {
self.limit
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
/// <p>Do not attempt to construct this value. Use only the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(&self) -> std::option::Option<&str> {
self.marker.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ListKeysInput {
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100.</p>
#[doc(hidden)]
pub limit: std::option::Option<i32>,
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
#[doc(hidden)]
pub marker: std::option::Option<std::string::String>,
}
impl ListKeysInput {
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100.</p>
pub fn limit(&self) -> std::option::Option<i32> {
self.limit
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(&self) -> std::option::Option<&str> {
self.marker.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ListKeyPoliciesInput {
/// <p>Gets the names of key policies for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100.</p>
/// <p>Only one policy can be attached to a key.</p>
#[doc(hidden)]
pub limit: std::option::Option<i32>,
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
#[doc(hidden)]
pub marker: std::option::Option<std::string::String>,
}
impl ListKeyPoliciesInput {
/// <p>Gets the names of key policies for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100.</p>
/// <p>Only one policy can be attached to a key.</p>
pub fn limit(&self) -> std::option::Option<i32> {
self.limit
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(&self) -> std::option::Option<&str> {
self.marker.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ListGrantsInput {
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
#[doc(hidden)]
pub limit: std::option::Option<i32>,
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
#[doc(hidden)]
pub marker: std::option::Option<std::string::String>,
/// <p>Returns only grants for the specified KMS key. This parameter is required.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Returns only the grant with the specified grant ID. The grant ID uniquely identifies the grant. </p>
#[doc(hidden)]
pub grant_id: std::option::Option<std::string::String>,
/// <p>Returns only grants where the specified principal is the grantee principal for the grant.</p>
#[doc(hidden)]
pub grantee_principal: std::option::Option<std::string::String>,
}
impl ListGrantsInput {
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn limit(&self) -> std::option::Option<i32> {
self.limit
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(&self) -> std::option::Option<&str> {
self.marker.as_deref()
}
/// <p>Returns only grants for the specified KMS key. This parameter is required.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Returns only the grant with the specified grant ID. The grant ID uniquely identifies the grant. </p>
pub fn grant_id(&self) -> std::option::Option<&str> {
self.grant_id.as_deref()
}
/// <p>Returns only grants where the specified principal is the grantee principal for the grant.</p>
pub fn grantee_principal(&self) -> std::option::Option<&str> {
self.grantee_principal.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ListAliasesInput {
/// <p>Lists only aliases that are associated with the specified KMS key. Enter a KMS key in your Amazon Web Services account. </p>
/// <p>This parameter is optional. If you omit it, <code>ListAliases</code> returns all aliases in the account and Region.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
#[doc(hidden)]
pub limit: std::option::Option<i32>,
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
#[doc(hidden)]
pub marker: std::option::Option<std::string::String>,
}
impl ListAliasesInput {
/// <p>Lists only aliases that are associated with the specified KMS key. Enter a KMS key in your Amazon Web Services account. </p>
/// <p>This parameter is optional. If you omit it, <code>ListAliases</code> returns all aliases in the account and Region.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
/// <p>This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.</p>
pub fn limit(&self) -> std::option::Option<i32> {
self.limit
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(&self) -> std::option::Option<&str> {
self.marker.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ImportKeyMaterialInput {
/// <p>The identifier of the symmetric encryption KMS key that receives the imported key material. This must be the same KMS key specified in the <code>KeyID</code> parameter of the corresponding <code>GetParametersForImport</code> request. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>. You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, a KMS key in a custom key store, or on a KMS key in a different Amazon Web Services account</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>The import token that you received in the response to a previous <code>GetParametersForImport</code> request. It must be from the same response that contained the public key that you used to encrypt the key material.</p>
#[doc(hidden)]
pub import_token: std::option::Option<aws_smithy_types::Blob>,
/// <p>The encrypted key material to import. The key material must be encrypted with the public wrapping key that <code>GetParametersForImport</code> returned, using the wrapping algorithm that you specified in the same <code>GetParametersForImport</code> request.</p>
#[doc(hidden)]
pub encrypted_key_material: std::option::Option<aws_smithy_types::Blob>,
/// <p>The date and time when the imported key material expires. This parameter is required when the value of the <code>ExpirationModel</code> parameter is <code>KEY_MATERIAL_EXPIRES</code>. Otherwise it is not valid.</p>
/// <p>The value of this parameter must be a future date and time. The maximum value is 365 days from the request date.</p>
/// <p>When the key material expires, KMS deletes the key material from the KMS key. Without its key material, the KMS key is unusable. To use the KMS key in cryptographic operations, you must reimport the same key material.</p>
/// <p>You cannot change the <code>ExpirationModel</code> or <code>ValidTo</code> values for the current import after the request completes. To change either value, you must delete (<code>DeleteImportedKeyMaterial</code>) and reimport the key material.</p>
#[doc(hidden)]
pub valid_to: std::option::Option<aws_smithy_types::DateTime>,
/// <p>Specifies whether the key material expires. The default is <code>KEY_MATERIAL_EXPIRES</code>.</p>
/// <p>When the value of <code>ExpirationModel</code> is <code>KEY_MATERIAL_EXPIRES</code>, you must specify a value for the <code>ValidTo</code> parameter. When value is <code>KEY_MATERIAL_DOES_NOT_EXPIRE</code>, you must omit the <code>ValidTo</code> parameter.</p>
/// <p>You cannot change the <code>ExpirationModel</code> or <code>ValidTo</code> values for the current import after the request completes. To change either value, you must delete (<code>DeleteImportedKeyMaterial</code>) and reimport the key material.</p>
#[doc(hidden)]
pub expiration_model: std::option::Option<crate::model::ExpirationModelType>,
}
impl ImportKeyMaterialInput {
/// <p>The identifier of the symmetric encryption KMS key that receives the imported key material. This must be the same KMS key specified in the <code>KeyID</code> parameter of the corresponding <code>GetParametersForImport</code> request. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>. You cannot perform this operation on an asymmetric KMS key, an HMAC KMS key, a KMS key in a custom key store, or on a KMS key in a different Amazon Web Services account</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>The import token that you received in the response to a previous <code>GetParametersForImport</code> request. It must be from the same response that contained the public key that you used to encrypt the key material.</p>
pub fn import_token(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.import_token.as_ref()
}
/// <p>The encrypted key material to import. The key material must be encrypted with the public wrapping key that <code>GetParametersForImport</code> returned, using the wrapping algorithm that you specified in the same <code>GetParametersForImport</code> request.</p>
pub fn encrypted_key_material(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.encrypted_key_material.as_ref()
}
/// <p>The date and time when the imported key material expires. This parameter is required when the value of the <code>ExpirationModel</code> parameter is <code>KEY_MATERIAL_EXPIRES</code>. Otherwise it is not valid.</p>
/// <p>The value of this parameter must be a future date and time. The maximum value is 365 days from the request date.</p>
/// <p>When the key material expires, KMS deletes the key material from the KMS key. Without its key material, the KMS key is unusable. To use the KMS key in cryptographic operations, you must reimport the same key material.</p>
/// <p>You cannot change the <code>ExpirationModel</code> or <code>ValidTo</code> values for the current import after the request completes. To change either value, you must delete (<code>DeleteImportedKeyMaterial</code>) and reimport the key material.</p>
pub fn valid_to(&self) -> std::option::Option<&aws_smithy_types::DateTime> {
self.valid_to.as_ref()
}
/// <p>Specifies whether the key material expires. The default is <code>KEY_MATERIAL_EXPIRES</code>.</p>
/// <p>When the value of <code>ExpirationModel</code> is <code>KEY_MATERIAL_EXPIRES</code>, you must specify a value for the <code>ValidTo</code> parameter. When value is <code>KEY_MATERIAL_DOES_NOT_EXPIRE</code>, you must omit the <code>ValidTo</code> parameter.</p>
/// <p>You cannot change the <code>ExpirationModel</code> or <code>ValidTo</code> values for the current import after the request completes. To change either value, you must delete (<code>DeleteImportedKeyMaterial</code>) and reimport the key material.</p>
pub fn expiration_model(&self) -> std::option::Option<&crate::model::ExpirationModelType> {
self.expiration_model.as_ref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct GetPublicKeyInput {
/// <p>Identifies the asymmetric KMS key that includes the public key.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl GetPublicKeyInput {
/// <p>Identifies the asymmetric KMS key that includes the public key.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct GetParametersForImportInput {
/// <p>The identifier of the symmetric encryption KMS key into which you will import key material. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>The algorithm you will use to encrypt the key material before importing it with <code>ImportKeyMaterial</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-encrypt-key-material.html">Encrypt the Key Material</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub wrapping_algorithm: std::option::Option<crate::model::AlgorithmSpec>,
/// <p>The type of wrapping key (public key) to return in the response. Only 2048-bit RSA public keys are supported.</p>
#[doc(hidden)]
pub wrapping_key_spec: std::option::Option<crate::model::WrappingKeySpec>,
}
impl GetParametersForImportInput {
/// <p>The identifier of the symmetric encryption KMS key into which you will import key material. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>The algorithm you will use to encrypt the key material before importing it with <code>ImportKeyMaterial</code>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-encrypt-key-material.html">Encrypt the Key Material</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn wrapping_algorithm(&self) -> std::option::Option<&crate::model::AlgorithmSpec> {
self.wrapping_algorithm.as_ref()
}
/// <p>The type of wrapping key (public key) to return in the response. Only 2048-bit RSA public keys are supported.</p>
pub fn wrapping_key_spec(&self) -> std::option::Option<&crate::model::WrappingKeySpec> {
self.wrapping_key_spec.as_ref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct GetKeyRotationStatusInput {
/// <p>Gets the rotation status for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
}
impl GetKeyRotationStatusInput {
/// <p>Gets the rotation status for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct GetKeyPolicyInput {
/// <p>Gets the key policy for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Specifies the name of the key policy. The only valid name is <code>default</code>. To get the names of key policies, use <code>ListKeyPolicies</code>.</p>
#[doc(hidden)]
pub policy_name: std::option::Option<std::string::String>,
}
impl GetKeyPolicyInput {
/// <p>Gets the key policy for the specified KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Specifies the name of the key policy. The only valid name is <code>default</code>. To get the names of key policies, use <code>ListKeyPolicies</code>.</p>
pub fn policy_name(&self) -> std::option::Option<&str> {
self.policy_name.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct GenerateRandomInput {
/// <p>The length of the random byte string. This parameter is required.</p>
#[doc(hidden)]
pub number_of_bytes: std::option::Option<i32>,
/// <p>Generates the random byte string in the CloudHSM cluster that is associated with the specified CloudHSM key store. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
/// <p>External key store IDs are not valid for this parameter. If you specify the ID of an external key store, <code>GenerateRandom</code> throws an <code>UnsupportedOperationException</code>.</p>
#[doc(hidden)]
pub custom_key_store_id: std::option::Option<std::string::String>,
}
impl GenerateRandomInput {
/// <p>The length of the random byte string. This parameter is required.</p>
pub fn number_of_bytes(&self) -> std::option::Option<i32> {
self.number_of_bytes
}
/// <p>Generates the random byte string in the CloudHSM cluster that is associated with the specified CloudHSM key store. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
/// <p>External key store IDs are not valid for this parameter. If you specify the ID of an external key store, <code>GenerateRandom</code> throws an <code>UnsupportedOperationException</code>.</p>
pub fn custom_key_store_id(&self) -> std::option::Option<&str> {
self.custom_key_store_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq)]
pub struct GenerateMacInput {
/// <p>The message to be hashed. Specify a message of up to 4,096 bytes. </p>
/// <p> <code>GenerateMac</code> and <code>VerifyMac</code> do not provide special handling for message digests. If you generate an HMAC for a hash digest of a message, you must verify the HMAC of the same hash digest.</p>
#[doc(hidden)]
pub message: std::option::Option<aws_smithy_types::Blob>,
/// <p>The HMAC KMS key to use in the operation. The MAC algorithm computes the HMAC for the message and the key as described in <a href="https://datatracker.ietf.org/doc/html/rfc2104">RFC 2104</a>.</p>
/// <p>To identify an HMAC KMS key, use the <code>DescribeKey</code> operation and see the <code>KeySpec</code> field in the response.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>The MAC algorithm used in the operation.</p>
/// <p> The algorithm must be compatible with the HMAC KMS key that you specify. To find the MAC algorithms that your HMAC KMS key supports, use the <code>DescribeKey</code> operation and see the <code>MacAlgorithms</code> field in the <code>DescribeKey</code> response.</p>
#[doc(hidden)]
pub mac_algorithm: std::option::Option<crate::model::MacAlgorithmSpec>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl GenerateMacInput {
/// <p>The message to be hashed. Specify a message of up to 4,096 bytes. </p>
/// <p> <code>GenerateMac</code> and <code>VerifyMac</code> do not provide special handling for message digests. If you generate an HMAC for a hash digest of a message, you must verify the HMAC of the same hash digest.</p>
pub fn message(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.message.as_ref()
}
/// <p>The HMAC KMS key to use in the operation. The MAC algorithm computes the HMAC for the message and the key as described in <a href="https://datatracker.ietf.org/doc/html/rfc2104">RFC 2104</a>.</p>
/// <p>To identify an HMAC KMS key, use the <code>DescribeKey</code> operation and see the <code>KeySpec</code> field in the response.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>The MAC algorithm used in the operation.</p>
/// <p> The algorithm must be compatible with the HMAC KMS key that you specify. To find the MAC algorithms that your HMAC KMS key supports, use the <code>DescribeKey</code> operation and see the <code>MacAlgorithms</code> field in the <code>DescribeKey</code> response.</p>
pub fn mac_algorithm(&self) -> std::option::Option<&crate::model::MacAlgorithmSpec> {
self.mac_algorithm.as_ref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
}
impl std::fmt::Debug for GenerateMacInput {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("GenerateMacInput");
formatter.field("message", &"*** Sensitive Data Redacted ***");
formatter.field("key_id", &self.key_id);
formatter.field("mac_algorithm", &self.mac_algorithm);
formatter.field("grant_tokens", &self.grant_tokens);
formatter.finish()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct GenerateDataKeyWithoutPlaintextInput {
/// <p>Specifies the symmetric encryption KMS key that encrypts the data key. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Specifies the encryption context that will be used when encrypting the data key.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub encryption_context:
std::option::Option<std::collections::HashMap<std::string::String, std::string::String>>,
/// <p>The length of the data key. Use <code>AES_128</code> to generate a 128-bit symmetric key, or <code>AES_256</code> to generate a 256-bit symmetric key.</p>
#[doc(hidden)]
pub key_spec: std::option::Option<crate::model::DataKeySpec>,
/// <p>The length of the data key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For common key lengths (128-bit and 256-bit symmetric keys), we recommend that you use the <code>KeySpec</code> field instead of this one.</p>
#[doc(hidden)]
pub number_of_bytes: std::option::Option<i32>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl GenerateDataKeyWithoutPlaintextInput {
/// <p>Specifies the symmetric encryption KMS key that encrypts the data key. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Specifies the encryption context that will be used when encrypting the data key.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
&self,
) -> std::option::Option<&std::collections::HashMap<std::string::String, std::string::String>>
{
self.encryption_context.as_ref()
}
/// <p>The length of the data key. Use <code>AES_128</code> to generate a 128-bit symmetric key, or <code>AES_256</code> to generate a 256-bit symmetric key.</p>
pub fn key_spec(&self) -> std::option::Option<&crate::model::DataKeySpec> {
self.key_spec.as_ref()
}
/// <p>The length of the data key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For common key lengths (128-bit and 256-bit symmetric keys), we recommend that you use the <code>KeySpec</code> field instead of this one.</p>
pub fn number_of_bytes(&self) -> std::option::Option<i32> {
self.number_of_bytes
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct GenerateDataKeyPairWithoutPlaintextInput {
/// <p>Specifies the encryption context that will be used when encrypting the private key in the data key pair.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub encryption_context:
std::option::Option<std::collections::HashMap<std::string::String, std::string::String>>,
/// <p>Specifies the symmetric encryption KMS key that encrypts the private key in the data key pair. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation. </p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Determines the type of data key pair that is generated.</p>
/// <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), and the rule that permits you to use ECC KMS keys only to sign and verify, are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
#[doc(hidden)]
pub key_pair_spec: std::option::Option<crate::model::DataKeyPairSpec>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl GenerateDataKeyPairWithoutPlaintextInput {
/// <p>Specifies the encryption context that will be used when encrypting the private key in the data key pair.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
&self,
) -> std::option::Option<&std::collections::HashMap<std::string::String, std::string::String>>
{
self.encryption_context.as_ref()
}
/// <p>Specifies the symmetric encryption KMS key that encrypts the private key in the data key pair. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation. </p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Determines the type of data key pair that is generated.</p>
/// <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), and the rule that permits you to use ECC KMS keys only to sign and verify, are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
pub fn key_pair_spec(&self) -> std::option::Option<&crate::model::DataKeyPairSpec> {
self.key_pair_spec.as_ref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct GenerateDataKeyPairInput {
/// <p>Specifies the encryption context that will be used when encrypting the private key in the data key pair.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub encryption_context:
std::option::Option<std::collections::HashMap<std::string::String, std::string::String>>,
/// <p>Specifies the symmetric encryption KMS key that encrypts the private key in the data key pair. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Determines the type of data key pair that is generated. </p>
/// <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), and the rule that permits you to use ECC KMS keys only to sign and verify, are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
#[doc(hidden)]
pub key_pair_spec: std::option::Option<crate::model::DataKeyPairSpec>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl GenerateDataKeyPairInput {
/// <p>Specifies the encryption context that will be used when encrypting the private key in the data key pair.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
&self,
) -> std::option::Option<&std::collections::HashMap<std::string::String, std::string::String>>
{
self.encryption_context.as_ref()
}
/// <p>Specifies the symmetric encryption KMS key that encrypts the private key in the data key pair. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Determines the type of data key pair that is generated. </p>
/// <p>The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to encrypt and decrypt or to sign and verify (but not both), and the rule that permits you to use ECC KMS keys only to sign and verify, are not effective on data key pairs, which are used outside of KMS. The SM2 key spec is only available in China Regions.</p>
pub fn key_pair_spec(&self) -> std::option::Option<&crate::model::DataKeyPairSpec> {
self.key_pair_spec.as_ref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct GenerateDataKeyInput {
/// <p>Specifies the symmetric encryption KMS key that encrypts the data key. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Specifies the encryption context that will be used when encrypting the data key.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub encryption_context:
std::option::Option<std::collections::HashMap<std::string::String, std::string::String>>,
/// <p>Specifies the length of the data key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For 128-bit (16-byte) and 256-bit (32-byte) data keys, use the <code>KeySpec</code> parameter.</p>
/// <p>You must specify either the <code>KeySpec</code> or the <code>NumberOfBytes</code> parameter (but not both) in every <code>GenerateDataKey</code> request.</p>
#[doc(hidden)]
pub number_of_bytes: std::option::Option<i32>,
/// <p>Specifies the length of the data key. Use <code>AES_128</code> to generate a 128-bit symmetric key, or <code>AES_256</code> to generate a 256-bit symmetric key.</p>
/// <p>You must specify either the <code>KeySpec</code> or the <code>NumberOfBytes</code> parameter (but not both) in every <code>GenerateDataKey</code> request.</p>
#[doc(hidden)]
pub key_spec: std::option::Option<crate::model::DataKeySpec>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl GenerateDataKeyInput {
/// <p>Specifies the symmetric encryption KMS key that encrypts the data key. You cannot specify an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Specifies the encryption context that will be used when encrypting the data key.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
&self,
) -> std::option::Option<&std::collections::HashMap<std::string::String, std::string::String>>
{
self.encryption_context.as_ref()
}
/// <p>Specifies the length of the data key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For 128-bit (16-byte) and 256-bit (32-byte) data keys, use the <code>KeySpec</code> parameter.</p>
/// <p>You must specify either the <code>KeySpec</code> or the <code>NumberOfBytes</code> parameter (but not both) in every <code>GenerateDataKey</code> request.</p>
pub fn number_of_bytes(&self) -> std::option::Option<i32> {
self.number_of_bytes
}
/// <p>Specifies the length of the data key. Use <code>AES_128</code> to generate a 128-bit symmetric key, or <code>AES_256</code> to generate a 256-bit symmetric key.</p>
/// <p>You must specify either the <code>KeySpec</code> or the <code>NumberOfBytes</code> parameter (but not both) in every <code>GenerateDataKey</code> request.</p>
pub fn key_spec(&self) -> std::option::Option<&crate::model::DataKeySpec> {
self.key_spec.as_ref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq)]
pub struct EncryptInput {
/// <p>Identifies the KMS key to use in the encryption operation. The KMS key must have a <code>KeyUsage</code> of <code>ENCRYPT_DECRYPT</code>. To find the <code>KeyUsage</code> of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Data to be encrypted.</p>
#[doc(hidden)]
pub plaintext: std::option::Option<aws_smithy_types::Blob>,
/// <p>Specifies the encryption context that will be used to encrypt the data. An encryption context is valid only for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> with a symmetric encryption KMS key. The standard asymmetric encryption algorithms and HMAC algorithms that KMS uses do not support an encryption context. </p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub encryption_context:
std::option::Option<std::collections::HashMap<std::string::String, std::string::String>>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
/// <p>Specifies the encryption algorithm that KMS will use to encrypt the plaintext message. The algorithm must be compatible with the KMS key that you specify.</p>
/// <p>This parameter is required only for asymmetric KMS keys. The default value, <code>SYMMETRIC_DEFAULT</code>, is the algorithm used for symmetric encryption KMS keys. If you are using an asymmetric KMS key, we recommend RSAES_OAEP_SHA_256.</p>
/// <p>The SM2PKE algorithm is only available in China Regions.</p>
#[doc(hidden)]
pub encryption_algorithm: std::option::Option<crate::model::EncryptionAlgorithmSpec>,
}
impl EncryptInput {
/// <p>Identifies the KMS key to use in the encryption operation. The KMS key must have a <code>KeyUsage</code> of <code>ENCRYPT_DECRYPT</code>. To find the <code>KeyUsage</code> of a KMS key, use the <code>DescribeKey</code> operation.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Data to be encrypted.</p>
pub fn plaintext(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.plaintext.as_ref()
}
/// <p>Specifies the encryption context that will be used to encrypt the data. An encryption context is valid only for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> with a symmetric encryption KMS key. The standard asymmetric encryption algorithms and HMAC algorithms that KMS uses do not support an encryption context. </p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
&self,
) -> std::option::Option<&std::collections::HashMap<std::string::String, std::string::String>>
{
self.encryption_context.as_ref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
/// <p>Specifies the encryption algorithm that KMS will use to encrypt the plaintext message. The algorithm must be compatible with the KMS key that you specify.</p>
/// <p>This parameter is required only for asymmetric KMS keys. The default value, <code>SYMMETRIC_DEFAULT</code>, is the algorithm used for symmetric encryption KMS keys. If you are using an asymmetric KMS key, we recommend RSAES_OAEP_SHA_256.</p>
/// <p>The SM2PKE algorithm is only available in China Regions.</p>
pub fn encryption_algorithm(
&self,
) -> std::option::Option<&crate::model::EncryptionAlgorithmSpec> {
self.encryption_algorithm.as_ref()
}
}
impl std::fmt::Debug for EncryptInput {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("EncryptInput");
formatter.field("key_id", &self.key_id);
formatter.field("plaintext", &"*** Sensitive Data Redacted ***");
formatter.field("encryption_context", &self.encryption_context);
formatter.field("grant_tokens", &self.grant_tokens);
formatter.field("encryption_algorithm", &self.encryption_algorithm);
formatter.finish()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct EnableKeyRotationInput {
/// <p>Identifies a symmetric encryption KMS key. You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
}
impl EnableKeyRotationInput {
/// <p>Identifies a symmetric encryption KMS key. You cannot enable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. To enable or disable automatic rotation of a set of related <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate">multi-Region keys</a>, set the property on the primary key.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct EnableKeyInput {
/// <p>Identifies the KMS key to enable.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
}
impl EnableKeyInput {
/// <p>Identifies the KMS key to enable.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct DisconnectCustomKeyStoreInput {
/// <p>Enter the ID of the custom key store you want to disconnect. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
#[doc(hidden)]
pub custom_key_store_id: std::option::Option<std::string::String>,
}
impl DisconnectCustomKeyStoreInput {
/// <p>Enter the ID of the custom key store you want to disconnect. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn custom_key_store_id(&self) -> std::option::Option<&str> {
self.custom_key_store_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct DisableKeyRotationInput {
/// <p>Identifies a symmetric encryption KMS key. You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
}
impl DisableKeyRotationInput {
/// <p>Identifies a symmetric encryption KMS key. You cannot enable or disable automatic rotation of <a href="https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks">asymmetric KMS keys</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html">HMAC KMS keys</a>, KMS keys with <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">imported key material</a>, or KMS keys in a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct DisableKeyInput {
/// <p>Identifies the KMS key to disable.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
}
impl DisableKeyInput {
/// <p>Identifies the KMS key to disable.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct DescribeKeyInput {
/// <p>Describes the specified KMS key. </p>
/// <p>If you specify a predefined Amazon Web Services alias (an Amazon Web Services alias with no key ID), KMS associates the alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html##aws-managed-cmk">Amazon Web Services managed key</a> and returns its <code>KeyId</code> and <code>Arn</code> in the response.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
}
impl DescribeKeyInput {
/// <p>Describes the specified KMS key. </p>
/// <p>If you specify a predefined Amazon Web Services alias (an Amazon Web Services alias with no key ID), KMS associates the alias with an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html##aws-managed-cmk">Amazon Web Services managed key</a> and returns its <code>KeyId</code> and <code>Arn</code> in the response.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>A list of grant tokens.</p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct DescribeCustomKeyStoresInput {
/// <p>Gets only information about the specified custom key store. Enter the key store ID.</p>
/// <p>By default, this operation gets information about all custom key stores in the account and Region. To limit the output to a particular custom key store, provide either the <code>CustomKeyStoreId</code> or <code>CustomKeyStoreName</code> parameter, but not both.</p>
#[doc(hidden)]
pub custom_key_store_id: std::option::Option<std::string::String>,
/// <p>Gets only information about the specified custom key store. Enter the friendly name of the custom key store.</p>
/// <p>By default, this operation gets information about all custom key stores in the account and Region. To limit the output to a particular custom key store, provide either the <code>CustomKeyStoreId</code> or <code>CustomKeyStoreName</code> parameter, but not both.</p>
#[doc(hidden)]
pub custom_key_store_name: std::option::Option<std::string::String>,
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
#[doc(hidden)]
pub limit: std::option::Option<i32>,
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
#[doc(hidden)]
pub marker: std::option::Option<std::string::String>,
}
impl DescribeCustomKeyStoresInput {
/// <p>Gets only information about the specified custom key store. Enter the key store ID.</p>
/// <p>By default, this operation gets information about all custom key stores in the account and Region. To limit the output to a particular custom key store, provide either the <code>CustomKeyStoreId</code> or <code>CustomKeyStoreName</code> parameter, but not both.</p>
pub fn custom_key_store_id(&self) -> std::option::Option<&str> {
self.custom_key_store_id.as_deref()
}
/// <p>Gets only information about the specified custom key store. Enter the friendly name of the custom key store.</p>
/// <p>By default, this operation gets information about all custom key stores in the account and Region. To limit the output to a particular custom key store, provide either the <code>CustomKeyStoreId</code> or <code>CustomKeyStoreName</code> parameter, but not both.</p>
pub fn custom_key_store_name(&self) -> std::option::Option<&str> {
self.custom_key_store_name.as_deref()
}
/// <p>Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer.</p>
pub fn limit(&self) -> std::option::Option<i32> {
self.limit
}
/// <p>Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <code>NextMarker</code> from the truncated response you just received.</p>
pub fn marker(&self) -> std::option::Option<&str> {
self.marker.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct DeleteImportedKeyMaterialInput {
/// <p>Identifies the KMS key from which you are deleting imported key material. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
}
impl DeleteImportedKeyMaterialInput {
/// <p>Identifies the KMS key from which you are deleting imported key material. The <code>Origin</code> of the KMS key must be <code>EXTERNAL</code>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct DeleteCustomKeyStoreInput {
/// <p>Enter the ID of the custom key store you want to delete. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
#[doc(hidden)]
pub custom_key_store_id: std::option::Option<std::string::String>,
}
impl DeleteCustomKeyStoreInput {
/// <p>Enter the ID of the custom key store you want to delete. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn custom_key_store_id(&self) -> std::option::Option<&str> {
self.custom_key_store_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct DeleteAliasInput {
/// <p>The alias to be deleted. The alias name must begin with <code>alias/</code> followed by the alias name, such as <code>alias/ExampleAlias</code>.</p>
#[doc(hidden)]
pub alias_name: std::option::Option<std::string::String>,
}
impl DeleteAliasInput {
/// <p>The alias to be deleted. The alias name must begin with <code>alias/</code> followed by the alias name, such as <code>alias/ExampleAlias</code>.</p>
pub fn alias_name(&self) -> std::option::Option<&str> {
self.alias_name.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct DecryptInput {
/// <p>Ciphertext to be decrypted. The blob includes metadata.</p>
#[doc(hidden)]
pub ciphertext_blob: std::option::Option<aws_smithy_types::Blob>,
/// <p>Specifies the encryption context to use when decrypting the data. An encryption context is valid only for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> with a symmetric encryption KMS key. The standard asymmetric encryption algorithms and HMAC algorithms that KMS uses do not support an encryption context.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub encryption_context:
std::option::Option<std::collections::HashMap<std::string::String, std::string::String>>,
/// <p>A list of grant tokens. </p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
/// <p>Specifies the KMS key that KMS uses to decrypt the ciphertext.</p>
/// <p>Enter a key ID of the KMS key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>Decrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to the symmetric ciphertext blob. However, it is always recommended as a best practice. This practice ensures that you use the KMS key that you intend.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>Specifies the encryption algorithm that will be used to decrypt the ciphertext. Specify the same algorithm that was used to encrypt the data. If you specify a different algorithm, the <code>Decrypt</code> operation fails.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the only supported algorithm that is valid for symmetric encryption KMS keys.</p>
#[doc(hidden)]
pub encryption_algorithm: std::option::Option<crate::model::EncryptionAlgorithmSpec>,
}
impl DecryptInput {
/// <p>Ciphertext to be decrypted. The blob includes metadata.</p>
pub fn ciphertext_blob(&self) -> std::option::Option<&aws_smithy_types::Blob> {
self.ciphertext_blob.as_ref()
}
/// <p>Specifies the encryption context to use when decrypting the data. An encryption context is valid only for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> with a symmetric encryption KMS key. The standard asymmetric encryption algorithms and HMAC algorithms that KMS uses do not support an encryption context.</p>
/// <p>An <i>encryption context</i> is a collection of non-secret key-value pairs that represent additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is supported only on operations with symmetric encryption KMS keys. On operations with symmetric encryption KMS keys, an encryption context is optional, but it is strongly recommended.</p>
/// <p>For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn encryption_context(
&self,
) -> std::option::Option<&std::collections::HashMap<std::string::String, std::string::String>>
{
self.encryption_context.as_ref()
}
/// <p>A list of grant tokens. </p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
/// <p>Specifies the KMS key that KMS uses to decrypt the ciphertext.</p>
/// <p>Enter a key ID of the KMS key that was used to encrypt the ciphertext. If you identify a different KMS key, the <code>Decrypt</code> operation throws an <code>IncorrectKeyException</code>.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. If you used a symmetric encryption KMS key, KMS can get the KMS key from metadata that it adds to the symmetric ciphertext blob. However, it is always recommended as a best practice. This practice ensures that you use the KMS key that you intend.</p>
/// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li>
/// <li> <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>Specifies the encryption algorithm that will be used to decrypt the ciphertext. Specify the same algorithm that was used to encrypt the data. If you specify a different algorithm, the <code>Decrypt</code> operation fails.</p>
/// <p>This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. The default value, <code>SYMMETRIC_DEFAULT</code>, represents the only supported algorithm that is valid for symmetric encryption KMS keys.</p>
pub fn encryption_algorithm(
&self,
) -> std::option::Option<&crate::model::EncryptionAlgorithmSpec> {
self.encryption_algorithm.as_ref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct CreateKeyInput {
/// <p>The key policy to attach to the KMS key.</p>
/// <p>If you provide a key policy, it must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must allow the principal that is making the <code>CreateKey</code> request to make a subsequent <code>PutKeyPolicy</code> request on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i> <i>Key Management Service Developer Guide</i> </i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i>Amazon Web Services Identity and Access Management User Guide</i>.</p> </li>
/// </ul>
/// <p>If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">Default Key Policy</a> in the <i>Key Management Service Developer Guide</i>. </p>
/// <p>The key policy size quota is 32 kilobytes (32768 bytes).</p>
/// <p>For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
#[doc(hidden)]
pub policy: std::option::Option<std::string::String>,
/// <p>A description of the KMS key.</p>
/// <p>Use a description that helps you decide whether the KMS key is appropriate for a task. The default value is an empty string (no description).</p>
/// <p>To set or change the description after the key is created, use <code>UpdateKeyDescription</code>.</p>
#[doc(hidden)]
pub description: std::option::Option<std::string::String>,
/// <p>Determines the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> for which you can use the KMS key. The default value is <code>ENCRYPT_DECRYPT</code>. This parameter is optional when you are creating a symmetric encryption KMS key; otherwise, it is required. You can't change the <code>KeyUsage</code> value after the KMS key is created.</p>
/// <p>Select only one valid value.</p>
/// <ul>
/// <li> <p>For symmetric encryption KMS keys, omit the parameter or specify <code>ENCRYPT_DECRYPT</code>.</p> </li>
/// <li> <p>For HMAC KMS keys (symmetric), specify <code>GENERATE_VERIFY_MAC</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with RSA key material, specify <code>ENCRYPT_DECRYPT</code> or <code>SIGN_VERIFY</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with ECC key material, specify <code>SIGN_VERIFY</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with SM2 key material (China Regions only), specify <code>ENCRYPT_DECRYPT</code> or <code>SIGN_VERIFY</code>.</p> </li>
/// </ul>
#[doc(hidden)]
pub key_usage: std::option::Option<crate::model::KeyUsageType>,
/// <p>Instead, use the <code>KeySpec</code> parameter.</p>
/// <p>The <code>KeySpec</code> and <code>CustomerMasterKeySpec</code> parameters work the same way. Only the names differ. We recommend that you use <code>KeySpec</code> parameter in your code. However, to avoid breaking changes, KMS supports both parameters.</p>
#[deprecated(note = "This parameter has been deprecated. Instead, use the KeySpec parameter.")]
#[doc(hidden)]
pub customer_master_key_spec: std::option::Option<crate::model::CustomerMasterKeySpec>,
/// <p>Specifies the type of KMS key to create. The default value, <code>SYMMETRIC_DEFAULT</code>, creates a KMS key with a 256-bit AES-GCM key that is used for encryption and decryption, except in China Regions, where it creates a 128-bit symmetric key that uses SM4 encryption. For help choosing a key spec for your KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose">Choosing a KMS key type</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// <p>The <code>KeySpec</code> determines whether the KMS key contains a symmetric key or an asymmetric key pair. It also determines the algorithms that the KMS key supports. You can't change the <code>KeySpec</code> after the KMS key is created. To further restrict the algorithms that can be used with the KMS key, use a condition key in its key policy or IAM policy. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm">kms:EncryptionAlgorithm</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm">kms:MacAlgorithm</a> or <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm">kms:Signing Algorithm</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p> <important>
/// <p> <a href="http://aws.amazon.com/kms/features/#AWS_Service_Integration">Amazon Web Services services that are integrated with KMS</a> use symmetric encryption KMS keys to protect your data. These services do not support asymmetric KMS keys or HMAC KMS keys.</p>
/// </important>
/// <p>KMS supports the following key specs for KMS keys:</p>
/// <ul>
/// <li> <p>Symmetric encryption key (default)</p>
/// <ul>
/// <li> <p> <code>SYMMETRIC_DEFAULT</code> </p> </li>
/// </ul> </li>
/// <li> <p>HMAC keys (symmetric)</p>
/// <ul>
/// <li> <p> <code>HMAC_224</code> </p> </li>
/// <li> <p> <code>HMAC_256</code> </p> </li>
/// <li> <p> <code>HMAC_384</code> </p> </li>
/// <li> <p> <code>HMAC_512</code> </p> </li>
/// </ul> </li>
/// <li> <p>Asymmetric RSA key pairs</p>
/// <ul>
/// <li> <p> <code>RSA_2048</code> </p> </li>
/// <li> <p> <code>RSA_3072</code> </p> </li>
/// <li> <p> <code>RSA_4096</code> </p> </li>
/// </ul> </li>
/// <li> <p>Asymmetric NIST-recommended elliptic curve key pairs</p>
/// <ul>
/// <li> <p> <code>ECC_NIST_P256</code> (secp256r1)</p> </li>
/// <li> <p> <code>ECC_NIST_P384</code> (secp384r1)</p> </li>
/// <li> <p> <code>ECC_NIST_P521</code> (secp521r1)</p> </li>
/// </ul> </li>
/// <li> <p>Other asymmetric elliptic curve key pairs</p>
/// <ul>
/// <li> <p> <code>ECC_SECG_P256K1</code> (secp256k1), commonly used for cryptocurrencies.</p> </li>
/// </ul> </li>
/// <li> <p>SM2 key pairs (China Regions only)</p>
/// <ul>
/// <li> <p> <code>SM2</code> </p> </li>
/// </ul> </li>
/// </ul>
#[doc(hidden)]
pub key_spec: std::option::Option<crate::model::KeySpec>,
/// <p>The source of the key material for the KMS key. You cannot change the origin after you create the KMS key. The default is <code>AWS_KMS</code>, which means that KMS creates the key material.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html">create a KMS key with no key material</a> (for imported key material), set this value to <code>EXTERNAL</code>. For more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the <i>Key Management Service Developer Guide</i>. The <code>EXTERNAL</code> origin value is valid only for symmetric KMS keys.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html">create a KMS key in an CloudHSM key store</a> and create its key material in the associated CloudHSM cluster, set this value to <code>AWS_CLOUDHSM</code>. You must also use the <code>CustomKeyStoreId</code> parameter to identify the CloudHSM key store. The <code>KeySpec</code> value must be <code>SYMMETRIC_DEFAULT</code>.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html">create a KMS key in an external key store</a>, set this value to <code>EXTERNAL_KEY_STORE</code>. You must also use the <code>CustomKeyStoreId</code> parameter to identify the external key store and the <code>XksKeyId</code> parameter to identify the associated external key. The <code>KeySpec</code> value must be <code>SYMMETRIC_DEFAULT</code>.</p>
#[doc(hidden)]
pub origin: std::option::Option<crate::model::OriginType>,
/// <p>Creates the KMS key in the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The <code>ConnectionState</code> of the custom key store must be <code>CONNECTED</code>. To find the CustomKeyStoreID and ConnectionState use the <code>DescribeCustomKeyStores</code> operation.</p>
/// <p>This parameter is valid only for symmetric encryption KMS keys in a single Region. You cannot create any other type of KMS key in a custom key store.</p>
/// <p>When you create a KMS key in an CloudHSM key store, KMS generates a non-exportable 256-bit symmetric key in its associated CloudHSM cluster and associates it with the KMS key. When you create a KMS key in an external key store, you must use the <code>XksKeyId</code> parameter to specify an external key that serves as key material for the KMS key.</p>
#[doc(hidden)]
pub custom_key_store_id: std::option::Option<std::string::String>,
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// </important>
/// <p>Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
#[doc(hidden)]
pub bypass_policy_lockout_safety_check: bool,
/// <p>Assigns one or more tags to the KMS key. Use this parameter to tag the KMS key when it is created. To tag an existing KMS key, use the <code>TagResource</code> operation.</p> <note>
/// <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>To use this parameter, you must have <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:TagResource</a> permission in an IAM policy.</p>
/// <p>Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
/// <p>When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">Tagging Keys</a>.</p>
#[doc(hidden)]
pub tags: std::option::Option<std::vec::Vec<crate::model::Tag>>,
/// <p>Creates a multi-Region primary key that you can replicate into other Amazon Web Services Regions. You cannot change this value after you create the KMS key. </p>
/// <p>For a multi-Region key, set this parameter to <code>True</code>. For a single-Region KMS key, omit this parameter or set it to <code>False</code>. The default value is <code>False</code>.</p>
/// <p>This operation supports <i>multi-Region keys</i>, an KMS feature that lets you create multiple interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>This value creates a <i>primary key</i>, not a replica. To create a <i>replica key</i>, use the <code>ReplicateKey</code> operation. </p>
/// <p>You can create a symmetric or asymmetric multi-Region key, and you can create a multi-Region key with imported key material. However, you cannot create a multi-Region key in a custom key store.</p>
#[doc(hidden)]
pub multi_region: std::option::Option<bool>,
/// <p>Identifies the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key">external key</a> that serves as key material for the KMS key in an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html">external key store</a>. Specify the ID that the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy">external key store proxy</a> uses to refer to the external key. For help, see the documentation for your external key store proxy.</p>
/// <p>This parameter is required for a KMS key with an <code>Origin</code> value of <code>EXTERNAL_KEY_STORE</code>. It is not valid for KMS keys with any other <code>Origin</code> value.</p>
/// <p>The external key must be an existing 256-bit AES symmetric encryption key hosted outside of Amazon Web Services in an external key manager associated with the external key store specified by the <code>CustomKeyStoreId</code> parameter. This key must be enabled and configured to perform encryption and decryption. Each KMS key in an external key store must use a different external key. For details, see <a href="https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements">Requirements for a KMS key in an external key store</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>Each KMS key in an external key store is associated two backing keys. One is key material that KMS generates. The other is the external key specified by this parameter. When you use the KMS key in an external key store to encrypt data, the encryption operation is performed first by KMS using the KMS key material, and then by the external key manager using the specified external key, a process known as <i>double encryption</i>. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption">Double encryption</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub xks_key_id: std::option::Option<std::string::String>,
}
impl CreateKeyInput {
/// <p>The key policy to attach to the KMS key.</p>
/// <p>If you provide a key policy, it must meet the following criteria:</p>
/// <ul>
/// <li> <p>If you don't set <code>BypassPolicyLockoutSafetyCheck</code> to true, the key policy must allow the principal that is making the <code>CreateKey</code> request to make a subsequent <code>PutKeyPolicy</code> request on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section of the <i> <i>Key Management Service Developer Guide</i> </i>.</p> </li>
/// <li> <p>Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to KMS. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency">Changes that I make are not always immediately visible</a> in the <i>Amazon Web Services Identity and Access Management User Guide</i>.</p> </li>
/// </ul>
/// <p>If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default">Default Key Policy</a> in the <i>Key Management Service Developer Guide</i>. </p>
/// <p>The key policy size quota is 32 kilobytes (32768 bytes).</p>
/// <p>For help writing and formatting a JSON policy document, see the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON Policy Reference</a> in the <i> <i>Identity and Access Management User Guide</i> </i>.</p>
pub fn policy(&self) -> std::option::Option<&str> {
self.policy.as_deref()
}
/// <p>A description of the KMS key.</p>
/// <p>Use a description that helps you decide whether the KMS key is appropriate for a task. The default value is an empty string (no description).</p>
/// <p>To set or change the description after the key is created, use <code>UpdateKeyDescription</code>.</p>
pub fn description(&self) -> std::option::Option<&str> {
self.description.as_deref()
}
/// <p>Determines the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations">cryptographic operations</a> for which you can use the KMS key. The default value is <code>ENCRYPT_DECRYPT</code>. This parameter is optional when you are creating a symmetric encryption KMS key; otherwise, it is required. You can't change the <code>KeyUsage</code> value after the KMS key is created.</p>
/// <p>Select only one valid value.</p>
/// <ul>
/// <li> <p>For symmetric encryption KMS keys, omit the parameter or specify <code>ENCRYPT_DECRYPT</code>.</p> </li>
/// <li> <p>For HMAC KMS keys (symmetric), specify <code>GENERATE_VERIFY_MAC</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with RSA key material, specify <code>ENCRYPT_DECRYPT</code> or <code>SIGN_VERIFY</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with ECC key material, specify <code>SIGN_VERIFY</code>.</p> </li>
/// <li> <p>For asymmetric KMS keys with SM2 key material (China Regions only), specify <code>ENCRYPT_DECRYPT</code> or <code>SIGN_VERIFY</code>.</p> </li>
/// </ul>
pub fn key_usage(&self) -> std::option::Option<&crate::model::KeyUsageType> {
self.key_usage.as_ref()
}
/// <p>Instead, use the <code>KeySpec</code> parameter.</p>
/// <p>The <code>KeySpec</code> and <code>CustomerMasterKeySpec</code> parameters work the same way. Only the names differ. We recommend that you use <code>KeySpec</code> parameter in your code. However, to avoid breaking changes, KMS supports both parameters.</p>
#[deprecated(note = "This parameter has been deprecated. Instead, use the KeySpec parameter.")]
pub fn customer_master_key_spec(
&self,
) -> std::option::Option<&crate::model::CustomerMasterKeySpec> {
self.customer_master_key_spec.as_ref()
}
/// <p>Specifies the type of KMS key to create. The default value, <code>SYMMETRIC_DEFAULT</code>, creates a KMS key with a 256-bit AES-GCM key that is used for encryption and decryption, except in China Regions, where it creates a 128-bit symmetric key that uses SM4 encryption. For help choosing a key spec for your KMS key, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose">Choosing a KMS key type</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// <p>The <code>KeySpec</code> determines whether the KMS key contains a symmetric key or an asymmetric key pair. It also determines the algorithms that the KMS key supports. You can't change the <code>KeySpec</code> after the KMS key is created. To further restrict the algorithms that can be used with the KMS key, use a condition key in its key policy or IAM policy. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm">kms:EncryptionAlgorithm</a>, <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm">kms:MacAlgorithm</a> or <a href="https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm">kms:Signing Algorithm</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p> <important>
/// <p> <a href="http://aws.amazon.com/kms/features/#AWS_Service_Integration">Amazon Web Services services that are integrated with KMS</a> use symmetric encryption KMS keys to protect your data. These services do not support asymmetric KMS keys or HMAC KMS keys.</p>
/// </important>
/// <p>KMS supports the following key specs for KMS keys:</p>
/// <ul>
/// <li> <p>Symmetric encryption key (default)</p>
/// <ul>
/// <li> <p> <code>SYMMETRIC_DEFAULT</code> </p> </li>
/// </ul> </li>
/// <li> <p>HMAC keys (symmetric)</p>
/// <ul>
/// <li> <p> <code>HMAC_224</code> </p> </li>
/// <li> <p> <code>HMAC_256</code> </p> </li>
/// <li> <p> <code>HMAC_384</code> </p> </li>
/// <li> <p> <code>HMAC_512</code> </p> </li>
/// </ul> </li>
/// <li> <p>Asymmetric RSA key pairs</p>
/// <ul>
/// <li> <p> <code>RSA_2048</code> </p> </li>
/// <li> <p> <code>RSA_3072</code> </p> </li>
/// <li> <p> <code>RSA_4096</code> </p> </li>
/// </ul> </li>
/// <li> <p>Asymmetric NIST-recommended elliptic curve key pairs</p>
/// <ul>
/// <li> <p> <code>ECC_NIST_P256</code> (secp256r1)</p> </li>
/// <li> <p> <code>ECC_NIST_P384</code> (secp384r1)</p> </li>
/// <li> <p> <code>ECC_NIST_P521</code> (secp521r1)</p> </li>
/// </ul> </li>
/// <li> <p>Other asymmetric elliptic curve key pairs</p>
/// <ul>
/// <li> <p> <code>ECC_SECG_P256K1</code> (secp256k1), commonly used for cryptocurrencies.</p> </li>
/// </ul> </li>
/// <li> <p>SM2 key pairs (China Regions only)</p>
/// <ul>
/// <li> <p> <code>SM2</code> </p> </li>
/// </ul> </li>
/// </ul>
pub fn key_spec(&self) -> std::option::Option<&crate::model::KeySpec> {
self.key_spec.as_ref()
}
/// <p>The source of the key material for the KMS key. You cannot change the origin after you create the KMS key. The default is <code>AWS_KMS</code>, which means that KMS creates the key material.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html">create a KMS key with no key material</a> (for imported key material), set this value to <code>EXTERNAL</code>. For more information about importing key material into KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html">Importing Key Material</a> in the <i>Key Management Service Developer Guide</i>. The <code>EXTERNAL</code> origin value is valid only for symmetric KMS keys.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html">create a KMS key in an CloudHSM key store</a> and create its key material in the associated CloudHSM cluster, set this value to <code>AWS_CLOUDHSM</code>. You must also use the <code>CustomKeyStoreId</code> parameter to identify the CloudHSM key store. The <code>KeySpec</code> value must be <code>SYMMETRIC_DEFAULT</code>.</p>
/// <p>To <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html">create a KMS key in an external key store</a>, set this value to <code>EXTERNAL_KEY_STORE</code>. You must also use the <code>CustomKeyStoreId</code> parameter to identify the external key store and the <code>XksKeyId</code> parameter to identify the associated external key. The <code>KeySpec</code> value must be <code>SYMMETRIC_DEFAULT</code>.</p>
pub fn origin(&self) -> std::option::Option<&crate::model::OriginType> {
self.origin.as_ref()
}
/// <p>Creates the KMS key in the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html">custom key store</a>. The <code>ConnectionState</code> of the custom key store must be <code>CONNECTED</code>. To find the CustomKeyStoreID and ConnectionState use the <code>DescribeCustomKeyStores</code> operation.</p>
/// <p>This parameter is valid only for symmetric encryption KMS keys in a single Region. You cannot create any other type of KMS key in a custom key store.</p>
/// <p>When you create a KMS key in an CloudHSM key store, KMS generates a non-exportable 256-bit symmetric key in its associated CloudHSM cluster and associates it with the KMS key. When you create a KMS key in an external key store, you must use the <code>XksKeyId</code> parameter to specify an external key that serves as key material for the KMS key.</p>
pub fn custom_key_store_id(&self) -> std::option::Option<&str> {
self.custom_key_store_id.as_deref()
}
/// <p>A flag to indicate whether to bypass the key policy lockout safety check.</p> <important>
/// <p>Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.</p>
/// <p>For more information, refer to the scenario in the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam">Default Key Policy</a> section in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// </important>
/// <p>Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent <code>PutKeyPolicy</code> request on the KMS key.</p>
/// <p>The default value is false.</p>
pub fn bypass_policy_lockout_safety_check(&self) -> bool {
self.bypass_policy_lockout_safety_check
}
/// <p>Assigns one or more tags to the KMS key. Use this parameter to tag the KMS key when it is created. To tag an existing KMS key, use the <code>TagResource</code> operation.</p> <note>
/// <p>Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/abac.html">ABAC for KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// </note>
/// <p>To use this parameter, you must have <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:TagResource</a> permission in an IAM policy.</p>
/// <p>Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.</p>
/// <p>When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html">Tagging Keys</a>.</p>
pub fn tags(&self) -> std::option::Option<&[crate::model::Tag]> {
self.tags.as_deref()
}
/// <p>Creates a multi-Region primary key that you can replicate into other Amazon Web Services Regions. You cannot change this value after you create the KMS key. </p>
/// <p>For a multi-Region key, set this parameter to <code>True</code>. For a single-Region KMS key, omit this parameter or set it to <code>False</code>. The default value is <code>False</code>.</p>
/// <p>This operation supports <i>multi-Region keys</i>, an KMS feature that lets you create multiple interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html">Multi-Region keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>This value creates a <i>primary key</i>, not a replica. To create a <i>replica key</i>, use the <code>ReplicateKey</code> operation. </p>
/// <p>You can create a symmetric or asymmetric multi-Region key, and you can create a multi-Region key with imported key material. However, you cannot create a multi-Region key in a custom key store.</p>
pub fn multi_region(&self) -> std::option::Option<bool> {
self.multi_region
}
/// <p>Identifies the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key">external key</a> that serves as key material for the KMS key in an <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html">external key store</a>. Specify the ID that the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy">external key store proxy</a> uses to refer to the external key. For help, see the documentation for your external key store proxy.</p>
/// <p>This parameter is required for a KMS key with an <code>Origin</code> value of <code>EXTERNAL_KEY_STORE</code>. It is not valid for KMS keys with any other <code>Origin</code> value.</p>
/// <p>The external key must be an existing 256-bit AES symmetric encryption key hosted outside of Amazon Web Services in an external key manager associated with the external key store specified by the <code>CustomKeyStoreId</code> parameter. This key must be enabled and configured to perform encryption and decryption. Each KMS key in an external key store must use a different external key. For details, see <a href="https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements">Requirements for a KMS key in an external key store</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>Each KMS key in an external key store is associated two backing keys. One is key material that KMS generates. The other is the external key specified by this parameter. When you use the KMS key in an external key store to encrypt data, the encryption operation is performed first by KMS using the KMS key material, and then by the external key manager using the specified external key, a process known as <i>double encryption</i>. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption">Double encryption</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn xks_key_id(&self) -> std::option::Option<&str> {
self.xks_key_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct CreateGrantInput {
/// <p>Identifies the KMS key for the grant. The grant gives principals permission to use this KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
/// <p>The identity that gets the permissions specified in the grant.</p>
/// <p>To specify the principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, IAM roles, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
#[doc(hidden)]
pub grantee_principal: std::option::Option<std::string::String>,
/// <p>The principal that has permission to use the <code>RetireGrant</code> operation to retire the grant. </p>
/// <p>To specify the principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
/// <p>The grant determines the retiring principal. Other principals might have permission to retire the grant or revoke the grant. For details, see <code>RevokeGrant</code> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete">Retiring and revoking grants</a> in the <i>Key Management Service Developer Guide</i>. </p>
#[doc(hidden)]
pub retiring_principal: std::option::Option<std::string::String>,
/// <p>A list of operations that the grant permits. </p>
/// <p>This list must include only operations that are permitted in a grant. Also, the operation must be supported on the KMS key. For example, you cannot create a grant for a symmetric encryption KMS key that allows the <code>Sign</code> operation, or a grant for an asymmetric KMS key that allows the <code>GenerateDataKey</code> operation. If you try, KMS returns a <code>ValidationError</code> exception. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">Grant operations</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub operations: std::option::Option<std::vec::Vec<crate::model::GrantOperation>>,
/// <p>Specifies a grant constraint. </p>
/// <p>KMS supports the <code>EncryptionContextEquals</code> and <code>EncryptionContextSubset</code> grant constraints. Each constraint value can include up to 8 encryption context pairs. The encryption context value in each constraint cannot exceed 384 characters. For information about grant constraints, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-grant-overview.html#grant-constraints">Using grant constraints</a> in the <i>Key Management Service Developer Guide</i>. For more information about encryption context, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i> <i>Key Management Service Developer Guide</i> </i>. </p>
/// <p>The encryption context grant constraints allow the permissions in the grant only when the encryption context in the request matches (<code>EncryptionContextEquals</code>) or includes (<code>EncryptionContextSubset</code>) the encryption context specified in this structure. </p>
/// <p>The encryption context grant constraints are supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">grant operations</a> that include an <code>EncryptionContext</code> parameter, such as cryptographic operations on symmetric encryption KMS keys. Grants with grant constraints can include the <code>DescribeKey</code> and <code>RetireGrant</code> operations, but the constraint doesn't apply to these operations. If a grant with a grant constraint includes the <code>CreateGrant</code> operation, the constraint requires that any grants created with the <code>CreateGrant</code> permission have an equally strict or stricter encryption context constraint.</p>
/// <p>You cannot use an encryption context grant constraint for cryptographic operations with asymmetric KMS keys or HMAC KMS keys. These keys don't support an encryption context. </p>
/// <p></p>
#[doc(hidden)]
pub constraints: std::option::Option<crate::model::GrantConstraints>,
/// <p>A list of grant tokens. </p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
#[doc(hidden)]
pub grant_tokens: std::option::Option<std::vec::Vec<std::string::String>>,
/// <p>A friendly name for the grant. Use this value to prevent the unintended creation of duplicate grants when retrying this request.</p>
/// <p>When this value is absent, all <code>CreateGrant</code> requests result in a new grant with a unique <code>GrantId</code> even if all the supplied parameters are identical. This can result in unintended duplicates when you retry the <code>CreateGrant</code> request.</p>
/// <p>When this value is present, you can retry a <code>CreateGrant</code> request with identical parameters; if the grant already exists, the original <code>GrantId</code> is returned without creating a new grant. Note that the returned grant token is unique with every <code>CreateGrant</code> request, even when a duplicate <code>GrantId</code> is returned. All grant tokens for the same grant ID can be used interchangeably.</p>
#[doc(hidden)]
pub name: std::option::Option<std::string::String>,
}
impl CreateGrantInput {
/// <p>Identifies the KMS key for the grant. The grant gives principals permission to use this KMS key.</p>
/// <p>Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
/// <p>The identity that gets the permissions specified in the grant.</p>
/// <p>To specify the principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, IAM roles, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
pub fn grantee_principal(&self) -> std::option::Option<&str> {
self.grantee_principal.as_deref()
}
/// <p>The principal that has permission to use the <code>RetireGrant</code> operation to retire the grant. </p>
/// <p>To specify the principal, use the <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Name (ARN)</a> of an Amazon Web Services principal. Valid Amazon Web Services principals include Amazon Web Services accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam">Amazon Web Services Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>Amazon Web Services General Reference</i>.</p>
/// <p>The grant determines the retiring principal. Other principals might have permission to retire the grant or revoke the grant. For details, see <code>RevokeGrant</code> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete">Retiring and revoking grants</a> in the <i>Key Management Service Developer Guide</i>. </p>
pub fn retiring_principal(&self) -> std::option::Option<&str> {
self.retiring_principal.as_deref()
}
/// <p>A list of operations that the grant permits. </p>
/// <p>This list must include only operations that are permitted in a grant. Also, the operation must be supported on the KMS key. For example, you cannot create a grant for a symmetric encryption KMS key that allows the <code>Sign</code> operation, or a grant for an asymmetric KMS key that allows the <code>GenerateDataKey</code> operation. If you try, KMS returns a <code>ValidationError</code> exception. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">Grant operations</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn operations(&self) -> std::option::Option<&[crate::model::GrantOperation]> {
self.operations.as_deref()
}
/// <p>Specifies a grant constraint. </p>
/// <p>KMS supports the <code>EncryptionContextEquals</code> and <code>EncryptionContextSubset</code> grant constraints. Each constraint value can include up to 8 encryption context pairs. The encryption context value in each constraint cannot exceed 384 characters. For information about grant constraints, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-grant-overview.html#grant-constraints">Using grant constraints</a> in the <i>Key Management Service Developer Guide</i>. For more information about encryption context, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context">Encryption context</a> in the <i> <i>Key Management Service Developer Guide</i> </i>. </p>
/// <p>The encryption context grant constraints allow the permissions in the grant only when the encryption context in the request matches (<code>EncryptionContextEquals</code>) or includes (<code>EncryptionContextSubset</code>) the encryption context specified in this structure. </p>
/// <p>The encryption context grant constraints are supported only on <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations">grant operations</a> that include an <code>EncryptionContext</code> parameter, such as cryptographic operations on symmetric encryption KMS keys. Grants with grant constraints can include the <code>DescribeKey</code> and <code>RetireGrant</code> operations, but the constraint doesn't apply to these operations. If a grant with a grant constraint includes the <code>CreateGrant</code> operation, the constraint requires that any grants created with the <code>CreateGrant</code> permission have an equally strict or stricter encryption context constraint.</p>
/// <p>You cannot use an encryption context grant constraint for cryptographic operations with asymmetric KMS keys or HMAC KMS keys. These keys don't support an encryption context. </p>
/// <p></p>
pub fn constraints(&self) -> std::option::Option<&crate::model::GrantConstraints> {
self.constraints.as_ref()
}
/// <p>A list of grant tokens. </p>
/// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
pub fn grant_tokens(&self) -> std::option::Option<&[std::string::String]> {
self.grant_tokens.as_deref()
}
/// <p>A friendly name for the grant. Use this value to prevent the unintended creation of duplicate grants when retrying this request.</p>
/// <p>When this value is absent, all <code>CreateGrant</code> requests result in a new grant with a unique <code>GrantId</code> even if all the supplied parameters are identical. This can result in unintended duplicates when you retry the <code>CreateGrant</code> request.</p>
/// <p>When this value is present, you can retry a <code>CreateGrant</code> request with identical parameters; if the grant already exists, the original <code>GrantId</code> is returned without creating a new grant. Note that the returned grant token is unique with every <code>CreateGrant</code> request, even when a duplicate <code>GrantId</code> is returned. All grant tokens for the same grant ID can be used interchangeably.</p>
pub fn name(&self) -> std::option::Option<&str> {
self.name.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq)]
pub struct CreateCustomKeyStoreInput {
/// <p>Specifies a friendly name for the custom key store. The name must be unique in your Amazon Web Services account and Region. This parameter is required for all custom key stores.</p>
#[doc(hidden)]
pub custom_key_store_name: std::option::Option<std::string::String>,
/// <p>Identifies the CloudHSM cluster for an CloudHSM key store. This parameter is required for custom key stores with <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the cluster ID of any active CloudHSM cluster that is not already associated with a custom key store. To find the cluster ID, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation.</p>
#[doc(hidden)]
pub cloud_hsm_cluster_id: std::option::Option<std::string::String>,
/// <p>Specifies the certificate for an CloudHSM key store. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the content of the trust anchor certificate for the CloudHSM cluster. This is the content of the <code>customerCA.crt</code> file that you created when you <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html">initialized the cluster</a>.</p>
#[doc(hidden)]
pub trust_anchor_certificate: std::option::Option<std::string::String>,
/// <p>Specifies the <code>kmsuser</code> password for an CloudHSM key store. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the password of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser"> <code>kmsuser</code> crypto user (CU) account</a> in the specified CloudHSM cluster. KMS logs into the cluster as this user to manage key material on your behalf.</p>
/// <p>The password must be a string of 7 to 32 characters. Its value is case sensitive.</p>
/// <p>This parameter tells KMS the <code>kmsuser</code> account password; it does not change the password in the CloudHSM cluster.</p>
#[doc(hidden)]
pub key_store_password: std::option::Option<std::string::String>,
/// <p>Specifies the type of custom key store. The default value is <code>AWS_CLOUDHSM</code>.</p>
/// <p>For a custom key store backed by an CloudHSM cluster, omit the parameter or enter <code>AWS_CLOUDHSM</code>. For a custom key store backed by an external key manager outside of Amazon Web Services, enter <code>EXTERNAL_KEY_STORE</code>. You cannot change this property after the key store is created.</p>
#[doc(hidden)]
pub custom_key_store_type: std::option::Option<crate::model::CustomKeyStoreType>,
/// <p>Specifies the endpoint that KMS uses to send requests to the external key store proxy (XKS proxy). This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The protocol must be HTTPS. KMS communicates on port 443. Do not specify the port in the <code>XksProxyUriEndpoint</code> value.</p>
/// <p>For external key stores with <code>XksProxyConnectivity</code> value of <code>VPC_ENDPOINT_SERVICE</code>, specify <code>https://</code> followed by the private DNS name of the VPC endpoint service.</p>
/// <p>For external key stores with <code>PUBLIC_ENDPOINT</code> connectivity, this endpoint must be reachable before you create the custom key store. KMS connects to the external key store proxy while creating the custom key store. For external key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity, KMS connects when you call the <code>ConnectCustomKeyStore</code> operation.</p>
/// <p>The value of this parameter must begin with <code>https://</code>. The remainder can contain upper and lower case letters (A-Z and a-z), numbers (0-9), dots (<code>.</code>), and hyphens (<code>-</code>). Additional slashes (<code>/</code> and <code>\</code>) are not permitted.</p>
/// <p> <b>Uniqueness requirements: </b> </p>
/// <ul>
/// <li> <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p> </li>
/// <li> <p>An external key store with <code>PUBLIC_ENDPOINT</code> connectivity cannot use the same <code>XksProxyUriEndpoint</code> value as an external key store with <code>VPC_ENDPOINT_SERVICE</code> connectivity in the same Amazon Web Services Region.</p> </li>
/// <li> <p>Each external key store with <code>VPC_ENDPOINT_SERVICE</code> connectivity must have its own private DNS name. The <code>XksProxyUriEndpoint</code> value for external key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity (private DNS name) must be unique in the Amazon Web Services account and Region.</p> </li>
/// </ul>
#[doc(hidden)]
pub xks_proxy_uri_endpoint: std::option::Option<std::string::String>,
/// <p>Specifies the base path to the proxy APIs for this external key store. To find this value, see the documentation for your external key store proxy. This parameter is required for all custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The value must start with <code>/</code> and must end with <code>/kms/xks/v1</code> where <code>v1</code> represents the version of the KMS external key store proxy API. This path can include an optional prefix between the required elements such as <code>/<i>prefix</i>/kms/xks/v1</code>.</p>
/// <p> <b>Uniqueness requirements: </b> </p>
/// <ul>
/// <li> <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p> </li>
/// </ul>
#[doc(hidden)]
pub xks_proxy_uri_path: std::option::Option<std::string::String>,
/// <p>Specifies the name of the Amazon VPC endpoint service for interface endpoints that is used to communicate with your external key store proxy (XKS proxy). This parameter is required when the value of <code>CustomKeyStoreType</code> is <code>EXTERNAL_KEY_STORE</code> and the value of <code>XksProxyConnectivity</code> is <code>VPC_ENDPOINT_SERVICE</code>.</p>
/// <p>The Amazon VPC endpoint service must <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keystore.html#xks-requirements">fulfill all requirements</a> for use with an external key store. </p>
/// <p> <b>Uniqueness requirements:</b> </p>
/// <ul>
/// <li> <p>External key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity can share an Amazon VPC, but each external key store must have its own VPC endpoint service and private DNS name.</p> </li>
/// </ul>
#[doc(hidden)]
pub xks_proxy_vpc_endpoint_service_name: std::option::Option<std::string::String>,
/// <p>Specifies an authentication credential for the external key store proxy (XKS proxy). This parameter is required for all custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The <code>XksProxyAuthenticationCredential</code> has two required elements: <code>RawSecretAccessKey</code>, a secret key, and <code>AccessKeyId</code>, a unique identifier for the <code>RawSecretAccessKey</code>. For character requirements, see <a href="kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html">XksProxyAuthenticationCredentialType</a>.</p>
/// <p>KMS uses this authentication credential to sign requests to the external key store proxy on your behalf. This credential is unrelated to Identity and Access Management (IAM) and Amazon Web Services credentials.</p>
/// <p>This parameter doesn't set or change the authentication credentials on the XKS proxy. It just tells KMS the credential that you established on your external key store proxy. If you rotate your proxy authentication credential, use the <code>UpdateCustomKeyStore</code> operation to provide the new credential to KMS.</p>
#[doc(hidden)]
pub xks_proxy_authentication_credential:
std::option::Option<crate::model::XksProxyAuthenticationCredentialType>,
/// <p>Indicates how KMS communicates with the external key store proxy. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>If the external key store proxy uses a public endpoint, specify <code>PUBLIC_ENDPOINT</code>. If the external key store proxy uses a Amazon VPC endpoint service for communication with KMS, specify <code>VPC_ENDPOINT_SERVICE</code>. For help making this choice, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity">Choosing a connectivity option</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>An Amazon VPC endpoint service keeps your communication with KMS in a private address space entirely within Amazon Web Services, but it requires more configuration, including establishing a Amazon VPC with multiple subnets, a VPC endpoint service, a network load balancer, and a verified private DNS name. A public endpoint is simpler to set up, but it might be slower and might not fulfill your security requirements. You might consider testing with a public endpoint, and then establishing a VPC endpoint service for production tasks. Note that this choice does not determine the location of the external key store proxy. Even if you choose a VPC endpoint service, the proxy can be hosted within the VPC or outside of Amazon Web Services such as in your corporate data center.</p>
#[doc(hidden)]
pub xks_proxy_connectivity: std::option::Option<crate::model::XksProxyConnectivityType>,
}
impl CreateCustomKeyStoreInput {
/// <p>Specifies a friendly name for the custom key store. The name must be unique in your Amazon Web Services account and Region. This parameter is required for all custom key stores.</p>
pub fn custom_key_store_name(&self) -> std::option::Option<&str> {
self.custom_key_store_name.as_deref()
}
/// <p>Identifies the CloudHSM cluster for an CloudHSM key store. This parameter is required for custom key stores with <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the cluster ID of any active CloudHSM cluster that is not already associated with a custom key store. To find the cluster ID, use the <a href="https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html">DescribeClusters</a> operation.</p>
pub fn cloud_hsm_cluster_id(&self) -> std::option::Option<&str> {
self.cloud_hsm_cluster_id.as_deref()
}
/// <p>Specifies the certificate for an CloudHSM key store. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the content of the trust anchor certificate for the CloudHSM cluster. This is the content of the <code>customerCA.crt</code> file that you created when you <a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html">initialized the cluster</a>.</p>
pub fn trust_anchor_certificate(&self) -> std::option::Option<&str> {
self.trust_anchor_certificate.as_deref()
}
/// <p>Specifies the <code>kmsuser</code> password for an CloudHSM key store. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>AWS_CLOUDHSM</code>.</p>
/// <p>Enter the password of the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser"> <code>kmsuser</code> crypto user (CU) account</a> in the specified CloudHSM cluster. KMS logs into the cluster as this user to manage key material on your behalf.</p>
/// <p>The password must be a string of 7 to 32 characters. Its value is case sensitive.</p>
/// <p>This parameter tells KMS the <code>kmsuser</code> account password; it does not change the password in the CloudHSM cluster.</p>
pub fn key_store_password(&self) -> std::option::Option<&str> {
self.key_store_password.as_deref()
}
/// <p>Specifies the type of custom key store. The default value is <code>AWS_CLOUDHSM</code>.</p>
/// <p>For a custom key store backed by an CloudHSM cluster, omit the parameter or enter <code>AWS_CLOUDHSM</code>. For a custom key store backed by an external key manager outside of Amazon Web Services, enter <code>EXTERNAL_KEY_STORE</code>. You cannot change this property after the key store is created.</p>
pub fn custom_key_store_type(&self) -> std::option::Option<&crate::model::CustomKeyStoreType> {
self.custom_key_store_type.as_ref()
}
/// <p>Specifies the endpoint that KMS uses to send requests to the external key store proxy (XKS proxy). This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The protocol must be HTTPS. KMS communicates on port 443. Do not specify the port in the <code>XksProxyUriEndpoint</code> value.</p>
/// <p>For external key stores with <code>XksProxyConnectivity</code> value of <code>VPC_ENDPOINT_SERVICE</code>, specify <code>https://</code> followed by the private DNS name of the VPC endpoint service.</p>
/// <p>For external key stores with <code>PUBLIC_ENDPOINT</code> connectivity, this endpoint must be reachable before you create the custom key store. KMS connects to the external key store proxy while creating the custom key store. For external key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity, KMS connects when you call the <code>ConnectCustomKeyStore</code> operation.</p>
/// <p>The value of this parameter must begin with <code>https://</code>. The remainder can contain upper and lower case letters (A-Z and a-z), numbers (0-9), dots (<code>.</code>), and hyphens (<code>-</code>). Additional slashes (<code>/</code> and <code>\</code>) are not permitted.</p>
/// <p> <b>Uniqueness requirements: </b> </p>
/// <ul>
/// <li> <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p> </li>
/// <li> <p>An external key store with <code>PUBLIC_ENDPOINT</code> connectivity cannot use the same <code>XksProxyUriEndpoint</code> value as an external key store with <code>VPC_ENDPOINT_SERVICE</code> connectivity in the same Amazon Web Services Region.</p> </li>
/// <li> <p>Each external key store with <code>VPC_ENDPOINT_SERVICE</code> connectivity must have its own private DNS name. The <code>XksProxyUriEndpoint</code> value for external key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity (private DNS name) must be unique in the Amazon Web Services account and Region.</p> </li>
/// </ul>
pub fn xks_proxy_uri_endpoint(&self) -> std::option::Option<&str> {
self.xks_proxy_uri_endpoint.as_deref()
}
/// <p>Specifies the base path to the proxy APIs for this external key store. To find this value, see the documentation for your external key store proxy. This parameter is required for all custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The value must start with <code>/</code> and must end with <code>/kms/xks/v1</code> where <code>v1</code> represents the version of the KMS external key store proxy API. This path can include an optional prefix between the required elements such as <code>/<i>prefix</i>/kms/xks/v1</code>.</p>
/// <p> <b>Uniqueness requirements: </b> </p>
/// <ul>
/// <li> <p>The combined <code>XksProxyUriEndpoint</code> and <code>XksProxyUriPath</code> values must be unique in the Amazon Web Services account and Region.</p> </li>
/// </ul>
pub fn xks_proxy_uri_path(&self) -> std::option::Option<&str> {
self.xks_proxy_uri_path.as_deref()
}
/// <p>Specifies the name of the Amazon VPC endpoint service for interface endpoints that is used to communicate with your external key store proxy (XKS proxy). This parameter is required when the value of <code>CustomKeyStoreType</code> is <code>EXTERNAL_KEY_STORE</code> and the value of <code>XksProxyConnectivity</code> is <code>VPC_ENDPOINT_SERVICE</code>.</p>
/// <p>The Amazon VPC endpoint service must <a href="https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keystore.html#xks-requirements">fulfill all requirements</a> for use with an external key store. </p>
/// <p> <b>Uniqueness requirements:</b> </p>
/// <ul>
/// <li> <p>External key stores with <code>VPC_ENDPOINT_SERVICE</code> connectivity can share an Amazon VPC, but each external key store must have its own VPC endpoint service and private DNS name.</p> </li>
/// </ul>
pub fn xks_proxy_vpc_endpoint_service_name(&self) -> std::option::Option<&str> {
self.xks_proxy_vpc_endpoint_service_name.as_deref()
}
/// <p>Specifies an authentication credential for the external key store proxy (XKS proxy). This parameter is required for all custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>The <code>XksProxyAuthenticationCredential</code> has two required elements: <code>RawSecretAccessKey</code>, a secret key, and <code>AccessKeyId</code>, a unique identifier for the <code>RawSecretAccessKey</code>. For character requirements, see <a href="kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html">XksProxyAuthenticationCredentialType</a>.</p>
/// <p>KMS uses this authentication credential to sign requests to the external key store proxy on your behalf. This credential is unrelated to Identity and Access Management (IAM) and Amazon Web Services credentials.</p>
/// <p>This parameter doesn't set or change the authentication credentials on the XKS proxy. It just tells KMS the credential that you established on your external key store proxy. If you rotate your proxy authentication credential, use the <code>UpdateCustomKeyStore</code> operation to provide the new credential to KMS.</p>
pub fn xks_proxy_authentication_credential(
&self,
) -> std::option::Option<&crate::model::XksProxyAuthenticationCredentialType> {
self.xks_proxy_authentication_credential.as_ref()
}
/// <p>Indicates how KMS communicates with the external key store proxy. This parameter is required for custom key stores with a <code>CustomKeyStoreType</code> of <code>EXTERNAL_KEY_STORE</code>.</p>
/// <p>If the external key store proxy uses a public endpoint, specify <code>PUBLIC_ENDPOINT</code>. If the external key store proxy uses a Amazon VPC endpoint service for communication with KMS, specify <code>VPC_ENDPOINT_SERVICE</code>. For help making this choice, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity">Choosing a connectivity option</a> in the <i>Key Management Service Developer Guide</i>.</p>
/// <p>An Amazon VPC endpoint service keeps your communication with KMS in a private address space entirely within Amazon Web Services, but it requires more configuration, including establishing a Amazon VPC with multiple subnets, a VPC endpoint service, a network load balancer, and a verified private DNS name. A public endpoint is simpler to set up, but it might be slower and might not fulfill your security requirements. You might consider testing with a public endpoint, and then establishing a VPC endpoint service for production tasks. Note that this choice does not determine the location of the external key store proxy. Even if you choose a VPC endpoint service, the proxy can be hosted within the VPC or outside of Amazon Web Services such as in your corporate data center.</p>
pub fn xks_proxy_connectivity(
&self,
) -> std::option::Option<&crate::model::XksProxyConnectivityType> {
self.xks_proxy_connectivity.as_ref()
}
}
impl std::fmt::Debug for CreateCustomKeyStoreInput {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let mut formatter = f.debug_struct("CreateCustomKeyStoreInput");
formatter.field("custom_key_store_name", &self.custom_key_store_name);
formatter.field("cloud_hsm_cluster_id", &self.cloud_hsm_cluster_id);
formatter.field("trust_anchor_certificate", &self.trust_anchor_certificate);
formatter.field("key_store_password", &"*** Sensitive Data Redacted ***");
formatter.field("custom_key_store_type", &self.custom_key_store_type);
formatter.field("xks_proxy_uri_endpoint", &self.xks_proxy_uri_endpoint);
formatter.field("xks_proxy_uri_path", &self.xks_proxy_uri_path);
formatter.field(
"xks_proxy_vpc_endpoint_service_name",
&self.xks_proxy_vpc_endpoint_service_name,
);
formatter.field(
"xks_proxy_authentication_credential",
&self.xks_proxy_authentication_credential,
);
formatter.field("xks_proxy_connectivity", &self.xks_proxy_connectivity);
formatter.finish()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct CreateAliasInput {
/// <p>Specifies the alias name. This value must begin with <code>alias/</code> followed by a name, such as <code>alias/ExampleAlias</code>. </p>
/// <p>The <code>AliasName</code> value must be string of 1-256 characters. It can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). The alias name cannot begin with <code>alias/aws/</code>. The <code>alias/aws/</code> prefix is reserved for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed keys</a>.</p>
#[doc(hidden)]
pub alias_name: std::option::Option<std::string::String>,
/// <p>Associates the alias with the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>. The KMS key must be in the same Amazon Web Services Region. </p>
/// <p>A valid key ID is required. If you supply a null or empty string value, this operation returns an error.</p>
/// <p>For help finding the key ID and ARN, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn">Finding the Key ID and ARN</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub target_key_id: std::option::Option<std::string::String>,
}
impl CreateAliasInput {
/// <p>Specifies the alias name. This value must begin with <code>alias/</code> followed by a name, such as <code>alias/ExampleAlias</code>. </p>
/// <p>The <code>AliasName</code> value must be string of 1-256 characters. It can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). The alias name cannot begin with <code>alias/aws/</code>. The <code>alias/aws/</code> prefix is reserved for <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk">Amazon Web Services managed keys</a>.</p>
pub fn alias_name(&self) -> std::option::Option<&str> {
self.alias_name.as_deref()
}
/// <p>Associates the alias with the specified <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk">customer managed key</a>. The KMS key must be in the same Amazon Web Services Region. </p>
/// <p>A valid key ID is required. If you supply a null or empty string value, this operation returns an error.</p>
/// <p>For help finding the key ID and ARN, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn">Finding the Key ID and ARN</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn target_key_id(&self) -> std::option::Option<&str> {
self.target_key_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct ConnectCustomKeyStoreInput {
/// <p>Enter the key store ID of the custom key store that you want to connect. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
#[doc(hidden)]
pub custom_key_store_id: std::option::Option<std::string::String>,
}
impl ConnectCustomKeyStoreInput {
/// <p>Enter the key store ID of the custom key store that you want to connect. To find the ID of a custom key store, use the <code>DescribeCustomKeyStores</code> operation.</p>
pub fn custom_key_store_id(&self) -> std::option::Option<&str> {
self.custom_key_store_id.as_deref()
}
}
#[allow(missing_docs)] // documentation missing in model
#[non_exhaustive]
#[derive(std::clone::Clone, std::cmp::PartialEq, std::fmt::Debug)]
pub struct CancelKeyDeletionInput {
/// <p>Identifies the KMS key whose deletion is being canceled.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
#[doc(hidden)]
pub key_id: std::option::Option<std::string::String>,
}
impl CancelKeyDeletionInput {
/// <p>Identifies the KMS key whose deletion is being canceled.</p>
/// <p>Specify the key ID or key ARN of the KMS key.</p>
/// <p>For example:</p>
/// <ul>
/// <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li>
/// </ul>
/// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>.</p>
pub fn key_id(&self) -> std::option::Option<&str> {
self.key_id.as_deref()
}
}