Copyright | (c) 2013-2021 Brendan Hay |
---|---|
License | Mozilla Public License, v. 2.0. |
Maintainer | Brendan Hay <brendan.g.hay+amazonka@gmail.com> |
Stability | auto-generated |
Portability | non-portable (GHC extensions) |
Safe Haskell | None |
- Service Configuration
- Errors
- AlgorithmSpec
- ConnectionErrorCodeType
- ConnectionStateType
- CustomerMasterKeySpec
- DataKeyPairSpec
- DataKeySpec
- EncryptionAlgorithmSpec
- ExpirationModelType
- GrantOperation
- KeyManagerType
- KeySpec
- KeyState
- KeyUsageType
- MessageType
- MultiRegionKeyType
- OriginType
- SigningAlgorithmSpec
- WrappingKeySpec
- AliasListEntry
- CustomKeyStoresListEntry
- GrantConstraints
- GrantListEntry
- KeyListEntry
- KeyMetadata
- ListGrantsResponse
- MultiRegionConfiguration
- MultiRegionKey
- Tag
Synopsis
- defaultService :: Service
- _InvalidMarkerException :: AsError a => Getting (First ServiceError) a ServiceError
- _KMSInvalidStateException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidKeyUsageException :: AsError a => Getting (First ServiceError) a ServiceError
- _MalformedPolicyDocumentException :: AsError a => Getting (First ServiceError) a ServiceError
- _CustomKeyStoreNameInUseException :: AsError a => Getting (First ServiceError) a ServiceError
- _UnsupportedOperationException :: AsError a => Getting (First ServiceError) a ServiceError
- _DisabledException :: AsError a => Getting (First ServiceError) a ServiceError
- _KeyUnavailableException :: AsError a => Getting (First ServiceError) a ServiceError
- _IncorrectKeyMaterialException :: AsError a => Getting (First ServiceError) a ServiceError
- _KMSInternalException :: AsError a => Getting (First ServiceError) a ServiceError
- _TagException :: AsError a => Getting (First ServiceError) a ServiceError
- _CustomKeyStoreHasCMKsException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError
- _CloudHsmClusterNotRelatedException :: AsError a => Getting (First ServiceError) a ServiceError
- _IncorrectTrustAnchorException :: AsError a => Getting (First ServiceError) a ServiceError
- _CloudHsmClusterInvalidConfigurationException :: AsError a => Getting (First ServiceError) a ServiceError
- _CloudHsmClusterNotActiveException :: AsError a => Getting (First ServiceError) a ServiceError
- _CloudHsmClusterNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
- _NotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
- _KMSInvalidSignatureException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidAliasNameException :: AsError a => Getting (First ServiceError) a ServiceError
- _CustomKeyStoreNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
- _CustomKeyStoreInvalidStateException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidGrantIdException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidGrantTokenException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidArnException :: AsError a => Getting (First ServiceError) a ServiceError
- _DependencyTimeoutException :: AsError a => Getting (First ServiceError) a ServiceError
- _ExpiredImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidCiphertextException :: AsError a => Getting (First ServiceError) a ServiceError
- _CloudHsmClusterInUseException :: AsError a => Getting (First ServiceError) a ServiceError
- _IncorrectKeyException :: AsError a => Getting (First ServiceError) a ServiceError
- _AlreadyExistsException :: AsError a => Getting (First ServiceError) a ServiceError
- _LimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError
- newtype AlgorithmSpec where
- AlgorithmSpec' { }
- pattern AlgorithmSpec_RSAES_OAEP_SHA_1 :: AlgorithmSpec
- pattern AlgorithmSpec_RSAES_OAEP_SHA_256 :: AlgorithmSpec
- pattern AlgorithmSpec_RSAES_PKCS1_V1_5 :: AlgorithmSpec
- newtype ConnectionErrorCodeType where
- ConnectionErrorCodeType' { }
- pattern ConnectionErrorCodeType_CLUSTER_NOT_FOUND :: ConnectionErrorCodeType
- pattern ConnectionErrorCodeType_INSUFFICIENT_CLOUDHSM_HSMS :: ConnectionErrorCodeType
- pattern ConnectionErrorCodeType_INTERNAL_ERROR :: ConnectionErrorCodeType
- pattern ConnectionErrorCodeType_INVALID_CREDENTIALS :: ConnectionErrorCodeType
- pattern ConnectionErrorCodeType_NETWORK_ERRORS :: ConnectionErrorCodeType
- pattern ConnectionErrorCodeType_SUBNET_NOT_FOUND :: ConnectionErrorCodeType
- pattern ConnectionErrorCodeType_USER_LOCKED_OUT :: ConnectionErrorCodeType
- pattern ConnectionErrorCodeType_USER_LOGGED_IN :: ConnectionErrorCodeType
- pattern ConnectionErrorCodeType_USER_NOT_FOUND :: ConnectionErrorCodeType
- newtype ConnectionStateType where
- ConnectionStateType' { }
- pattern ConnectionStateType_CONNECTED :: ConnectionStateType
- pattern ConnectionStateType_CONNECTING :: ConnectionStateType
- pattern ConnectionStateType_DISCONNECTED :: ConnectionStateType
- pattern ConnectionStateType_DISCONNECTING :: ConnectionStateType
- pattern ConnectionStateType_FAILED :: ConnectionStateType
- newtype CustomerMasterKeySpec where
- CustomerMasterKeySpec' { }
- pattern CustomerMasterKeySpec_ECC_NIST_P256 :: CustomerMasterKeySpec
- pattern CustomerMasterKeySpec_ECC_NIST_P384 :: CustomerMasterKeySpec
- pattern CustomerMasterKeySpec_ECC_NIST_P521 :: CustomerMasterKeySpec
- pattern CustomerMasterKeySpec_ECC_SECG_P256K1 :: CustomerMasterKeySpec
- pattern CustomerMasterKeySpec_RSA_2048 :: CustomerMasterKeySpec
- pattern CustomerMasterKeySpec_RSA_3072 :: CustomerMasterKeySpec
- pattern CustomerMasterKeySpec_RSA_4096 :: CustomerMasterKeySpec
- pattern CustomerMasterKeySpec_SYMMETRIC_DEFAULT :: CustomerMasterKeySpec
- newtype DataKeyPairSpec where
- DataKeyPairSpec' { }
- pattern DataKeyPairSpec_ECC_NIST_P256 :: DataKeyPairSpec
- pattern DataKeyPairSpec_ECC_NIST_P384 :: DataKeyPairSpec
- pattern DataKeyPairSpec_ECC_NIST_P521 :: DataKeyPairSpec
- pattern DataKeyPairSpec_ECC_SECG_P256K1 :: DataKeyPairSpec
- pattern DataKeyPairSpec_RSA_2048 :: DataKeyPairSpec
- pattern DataKeyPairSpec_RSA_3072 :: DataKeyPairSpec
- pattern DataKeyPairSpec_RSA_4096 :: DataKeyPairSpec
- newtype DataKeySpec where
- DataKeySpec' { }
- pattern DataKeySpec_AES_128 :: DataKeySpec
- pattern DataKeySpec_AES_256 :: DataKeySpec
- newtype EncryptionAlgorithmSpec where
- newtype ExpirationModelType where
- newtype GrantOperation where
- GrantOperation' { }
- pattern GrantOperation_CreateGrant :: GrantOperation
- pattern GrantOperation_Decrypt :: GrantOperation
- pattern GrantOperation_DescribeKey :: GrantOperation
- pattern GrantOperation_Encrypt :: GrantOperation
- pattern GrantOperation_GenerateDataKey :: GrantOperation
- pattern GrantOperation_GenerateDataKeyPair :: GrantOperation
- pattern GrantOperation_GenerateDataKeyPairWithoutPlaintext :: GrantOperation
- pattern GrantOperation_GenerateDataKeyWithoutPlaintext :: GrantOperation
- pattern GrantOperation_GetPublicKey :: GrantOperation
- pattern GrantOperation_ReEncryptFrom :: GrantOperation
- pattern GrantOperation_ReEncryptTo :: GrantOperation
- pattern GrantOperation_RetireGrant :: GrantOperation
- pattern GrantOperation_Sign :: GrantOperation
- pattern GrantOperation_Verify :: GrantOperation
- newtype KeyManagerType where
- KeyManagerType' { }
- pattern KeyManagerType_AWS :: KeyManagerType
- pattern KeyManagerType_CUSTOMER :: KeyManagerType
- newtype KeySpec where
- KeySpec' {
- fromKeySpec :: Text
- pattern KeySpec_ECC_NIST_P256 :: KeySpec
- pattern KeySpec_ECC_NIST_P384 :: KeySpec
- pattern KeySpec_ECC_NIST_P521 :: KeySpec
- pattern KeySpec_ECC_SECG_P256K1 :: KeySpec
- pattern KeySpec_RSA_2048 :: KeySpec
- pattern KeySpec_RSA_3072 :: KeySpec
- pattern KeySpec_RSA_4096 :: KeySpec
- pattern KeySpec_SYMMETRIC_DEFAULT :: KeySpec
- KeySpec' {
- newtype KeyState where
- KeyState' {
- fromKeyState :: Text
- pattern KeyState_Creating :: KeyState
- pattern KeyState_Disabled :: KeyState
- pattern KeyState_Enabled :: KeyState
- pattern KeyState_PendingDeletion :: KeyState
- pattern KeyState_PendingImport :: KeyState
- pattern KeyState_PendingReplicaDeletion :: KeyState
- pattern KeyState_Unavailable :: KeyState
- pattern KeyState_Updating :: KeyState
- KeyState' {
- newtype KeyUsageType where
- KeyUsageType' { }
- pattern KeyUsageType_ENCRYPT_DECRYPT :: KeyUsageType
- pattern KeyUsageType_SIGN_VERIFY :: KeyUsageType
- newtype MessageType where
- MessageType' { }
- pattern MessageType_DIGEST :: MessageType
- pattern MessageType_RAW :: MessageType
- newtype MultiRegionKeyType where
- newtype OriginType where
- OriginType' { }
- pattern OriginType_AWS_CLOUDHSM :: OriginType
- pattern OriginType_AWS_KMS :: OriginType
- pattern OriginType_EXTERNAL :: OriginType
- newtype SigningAlgorithmSpec where
- SigningAlgorithmSpec' { }
- pattern SigningAlgorithmSpec_ECDSA_SHA_256 :: SigningAlgorithmSpec
- pattern SigningAlgorithmSpec_ECDSA_SHA_384 :: SigningAlgorithmSpec
- pattern SigningAlgorithmSpec_ECDSA_SHA_512 :: SigningAlgorithmSpec
- pattern SigningAlgorithmSpec_RSASSA_PKCS1_V1_5_SHA_256 :: SigningAlgorithmSpec
- pattern SigningAlgorithmSpec_RSASSA_PKCS1_V1_5_SHA_384 :: SigningAlgorithmSpec
- pattern SigningAlgorithmSpec_RSASSA_PKCS1_V1_5_SHA_512 :: SigningAlgorithmSpec
- pattern SigningAlgorithmSpec_RSASSA_PSS_SHA_256 :: SigningAlgorithmSpec
- pattern SigningAlgorithmSpec_RSASSA_PSS_SHA_384 :: SigningAlgorithmSpec
- pattern SigningAlgorithmSpec_RSASSA_PSS_SHA_512 :: SigningAlgorithmSpec
- newtype WrappingKeySpec where
- WrappingKeySpec' { }
- pattern WrappingKeySpec_RSA_2048 :: WrappingKeySpec
- data AliasListEntry = AliasListEntry' {}
- newAliasListEntry :: AliasListEntry
- aliasListEntry_targetKeyId :: Lens' AliasListEntry (Maybe Text)
- aliasListEntry_aliasName :: Lens' AliasListEntry (Maybe Text)
- aliasListEntry_creationDate :: Lens' AliasListEntry (Maybe UTCTime)
- aliasListEntry_lastUpdatedDate :: Lens' AliasListEntry (Maybe UTCTime)
- aliasListEntry_aliasArn :: Lens' AliasListEntry (Maybe Text)
- data CustomKeyStoresListEntry = CustomKeyStoresListEntry' {}
- newCustomKeyStoresListEntry :: CustomKeyStoresListEntry
- customKeyStoresListEntry_customKeyStoreName :: Lens' CustomKeyStoresListEntry (Maybe Text)
- customKeyStoresListEntry_trustAnchorCertificate :: Lens' CustomKeyStoresListEntry (Maybe Text)
- customKeyStoresListEntry_connectionErrorCode :: Lens' CustomKeyStoresListEntry (Maybe ConnectionErrorCodeType)
- customKeyStoresListEntry_creationDate :: Lens' CustomKeyStoresListEntry (Maybe UTCTime)
- customKeyStoresListEntry_cloudHsmClusterId :: Lens' CustomKeyStoresListEntry (Maybe Text)
- customKeyStoresListEntry_customKeyStoreId :: Lens' CustomKeyStoresListEntry (Maybe Text)
- customKeyStoresListEntry_connectionState :: Lens' CustomKeyStoresListEntry (Maybe ConnectionStateType)
- data GrantConstraints = GrantConstraints' {}
- newGrantConstraints :: GrantConstraints
- grantConstraints_encryptionContextEquals :: Lens' GrantConstraints (Maybe (HashMap Text Text))
- grantConstraints_encryptionContextSubset :: Lens' GrantConstraints (Maybe (HashMap Text Text))
- data GrantListEntry = GrantListEntry' {}
- newGrantListEntry :: GrantListEntry
- grantListEntry_keyId :: Lens' GrantListEntry (Maybe Text)
- grantListEntry_retiringPrincipal :: Lens' GrantListEntry (Maybe Text)
- grantListEntry_issuingAccount :: Lens' GrantListEntry (Maybe Text)
- grantListEntry_grantId :: Lens' GrantListEntry (Maybe Text)
- grantListEntry_constraints :: Lens' GrantListEntry (Maybe GrantConstraints)
- grantListEntry_granteePrincipal :: Lens' GrantListEntry (Maybe Text)
- grantListEntry_name :: Lens' GrantListEntry (Maybe Text)
- grantListEntry_creationDate :: Lens' GrantListEntry (Maybe UTCTime)
- grantListEntry_operations :: Lens' GrantListEntry (Maybe [GrantOperation])
- data KeyListEntry = KeyListEntry' {}
- newKeyListEntry :: KeyListEntry
- keyListEntry_keyId :: Lens' KeyListEntry (Maybe Text)
- keyListEntry_keyArn :: Lens' KeyListEntry (Maybe Text)
- data KeyMetadata = KeyMetadata' {
- origin :: Maybe OriginType
- expirationModel :: Maybe ExpirationModelType
- keyManager :: Maybe KeyManagerType
- keySpec :: Maybe KeySpec
- customerMasterKeySpec :: Maybe CustomerMasterKeySpec
- enabled :: Maybe Bool
- validTo :: Maybe POSIX
- arn :: Maybe Text
- keyState :: Maybe KeyState
- encryptionAlgorithms :: Maybe [EncryptionAlgorithmSpec]
- aWSAccountId :: Maybe Text
- signingAlgorithms :: Maybe [SigningAlgorithmSpec]
- pendingDeletionWindowInDays :: Maybe Natural
- keyUsage :: Maybe KeyUsageType
- creationDate :: Maybe POSIX
- deletionDate :: Maybe POSIX
- cloudHsmClusterId :: Maybe Text
- description :: Maybe Text
- customKeyStoreId :: Maybe Text
- multiRegion :: Maybe Bool
- multiRegionConfiguration :: Maybe MultiRegionConfiguration
- keyId :: Text
- newKeyMetadata :: Text -> KeyMetadata
- keyMetadata_origin :: Lens' KeyMetadata (Maybe OriginType)
- keyMetadata_expirationModel :: Lens' KeyMetadata (Maybe ExpirationModelType)
- keyMetadata_keyManager :: Lens' KeyMetadata (Maybe KeyManagerType)
- keyMetadata_keySpec :: Lens' KeyMetadata (Maybe KeySpec)
- keyMetadata_customerMasterKeySpec :: Lens' KeyMetadata (Maybe CustomerMasterKeySpec)
- keyMetadata_enabled :: Lens' KeyMetadata (Maybe Bool)
- keyMetadata_validTo :: Lens' KeyMetadata (Maybe UTCTime)
- keyMetadata_arn :: Lens' KeyMetadata (Maybe Text)
- keyMetadata_keyState :: Lens' KeyMetadata (Maybe KeyState)
- keyMetadata_encryptionAlgorithms :: Lens' KeyMetadata (Maybe [EncryptionAlgorithmSpec])
- keyMetadata_aWSAccountId :: Lens' KeyMetadata (Maybe Text)
- keyMetadata_signingAlgorithms :: Lens' KeyMetadata (Maybe [SigningAlgorithmSpec])
- keyMetadata_pendingDeletionWindowInDays :: Lens' KeyMetadata (Maybe Natural)
- keyMetadata_keyUsage :: Lens' KeyMetadata (Maybe KeyUsageType)
- keyMetadata_creationDate :: Lens' KeyMetadata (Maybe UTCTime)
- keyMetadata_deletionDate :: Lens' KeyMetadata (Maybe UTCTime)
- keyMetadata_cloudHsmClusterId :: Lens' KeyMetadata (Maybe Text)
- keyMetadata_description :: Lens' KeyMetadata (Maybe Text)
- keyMetadata_customKeyStoreId :: Lens' KeyMetadata (Maybe Text)
- keyMetadata_multiRegion :: Lens' KeyMetadata (Maybe Bool)
- keyMetadata_multiRegionConfiguration :: Lens' KeyMetadata (Maybe MultiRegionConfiguration)
- keyMetadata_keyId :: Lens' KeyMetadata Text
- data ListGrantsResponse = ListGrantsResponse' {
- truncated :: Maybe Bool
- grants :: Maybe [GrantListEntry]
- nextMarker :: Maybe Text
- newListGrantsResponse :: ListGrantsResponse
- listGrantsResponse_truncated :: Lens' ListGrantsResponse (Maybe Bool)
- listGrantsResponse_grants :: Lens' ListGrantsResponse (Maybe [GrantListEntry])
- listGrantsResponse_nextMarker :: Lens' ListGrantsResponse (Maybe Text)
- data MultiRegionConfiguration = MultiRegionConfiguration' {}
- newMultiRegionConfiguration :: MultiRegionConfiguration
- multiRegionConfiguration_primaryKey :: Lens' MultiRegionConfiguration (Maybe MultiRegionKey)
- multiRegionConfiguration_replicaKeys :: Lens' MultiRegionConfiguration (Maybe [MultiRegionKey])
- multiRegionConfiguration_multiRegionKeyType :: Lens' MultiRegionConfiguration (Maybe MultiRegionKeyType)
- data MultiRegionKey = MultiRegionKey' {}
- newMultiRegionKey :: MultiRegionKey
- multiRegionKey_arn :: Lens' MultiRegionKey (Maybe Text)
- multiRegionKey_region :: Lens' MultiRegionKey (Maybe Text)
- data Tag = Tag' {}
- newTag :: Text -> Text -> Tag
- tag_tagKey :: Lens' Tag Text
- tag_tagValue :: Lens' Tag Text
Service Configuration
defaultService :: Service Source #
API version 2014-11-01
of the Amazon Key Management Service SDK configuration.
Errors
_InvalidMarkerException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the marker that specifies where pagination should next begin is not valid.
_KMSInvalidStateException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the state of the specified resource is not valid for this request.
For more information about how key state affects the use of a KMS key, see Key state: Effect on your KMS key in the /Key Management Service Developer Guide/ .
_InvalidKeyUsageException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected for one of the following reasons:
- The
KeyUsage
value of the KMS key is incompatible with the API operation. - The encryption algorithm or signing algorithm specified for the
operation is incompatible with the type of key material in the KMS
key
(KeySpec
).
For encrypting, decrypting, re-encrypting, and generating data keys, the
KeyUsage
must be ENCRYPT_DECRYPT
. For signing and verifying, the
KeyUsage
must be SIGN_VERIFY
. To find the KeyUsage
of a KMS key,
use the DescribeKey operation.
To find the encryption or signing algorithms supported for a particular KMS key, use the DescribeKey operation.
_MalformedPolicyDocumentException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified policy is not syntactically or semantically correct.
_CustomKeyStoreNameInUseException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified custom key store name is already assigned to another custom key store in the account. Try again with a custom key store name that is unique in the account.
_UnsupportedOperationException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because a specified parameter is not supported or a specified resource is not valid for this operation.
_DisabledException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified KMS key is not enabled.
_KeyUnavailableException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified KMS key was not available. You can retry the request.
_IncorrectKeyMaterialException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the key material in the request is, expired, invalid, or is not the same key material that was previously imported into this KMS key.
_KMSInternalException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because an internal exception occurred. The request can be retried.
_TagException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because one or more tags are not valid.
_CustomKeyStoreHasCMKsException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the custom key store contains KMS keys. After verifying that you do not need to use the KMS keys, use the ScheduleKeyDeletion operation to delete the KMS keys. After they are deleted, you can delete the custom key store.
_InvalidImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the provided import token is invalid or is associated with a different KMS key.
_CloudHsmClusterNotRelatedException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified CloudHSM cluster has a different cluster certificate than the original cluster. You cannot use the operation to specify an unrelated cluster.
Specify a cluster that shares a backup history with the original cluster. This includes clusters that were created from a backup of the current cluster, and clusters that were created from the same backup that produced the current cluster.
Clusters that share a backup history have the same cluster certificate. To view the cluster certificate of a cluster, use the DescribeClusters operation.
_IncorrectTrustAnchorException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the trust anchor certificate in the request is not the trust anchor certificate for the specified CloudHSM cluster.
When you
initialize the cluster,
you create the trust anchor certificate and save it in the
customerCA.crt
file.
_CloudHsmClusterInvalidConfigurationException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the associated CloudHSM cluster did not meet the configuration requirements for a custom key store.
- The cluster must be configured with private subnets in at least two different Availability Zones in the Region.
- The security group for the cluster (cloudhsm-cluster-<cluster-id>-sg) must include inbound rules and outbound rules that allow TCP traffic on ports 2223-2225. The Source in the inbound rules and the Destination in the outbound rules must match the security group ID. These rules are set by default when you create the cluster. Do not delete or change them. To get information about a particular security group, use the DescribeSecurityGroups operation.
The cluster must contain at least as many HSMs as the operation requires. To add HSMs, use the CloudHSM CreateHsm operation.
For the CreateCustomKeyStore, UpdateCustomKeyStore, and CreateKey operations, the CloudHSM cluster must have at least two active HSMs, each in a different Availability Zone. For the ConnectCustomKeyStore operation, the CloudHSM must contain at least one active HSM.
For information about the requirements for an CloudHSM cluster that is associated with a custom key store, see Assemble the Prerequisites in the Key Management Service Developer Guide. For information about creating a private subnet for an CloudHSM cluster, see Create a Private Subnet in the CloudHSM User Guide. For information about cluster security groups, see Configure a Default Security Group in the /CloudHSM User Guide/ .
_CloudHsmClusterNotActiveException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the CloudHSM cluster that is associated with the custom key store is not active. Initialize and activate the cluster and try the command again. For detailed instructions, see Getting Started in the CloudHSM User Guide.
_CloudHsmClusterNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because KMS cannot find the CloudHSM cluster with the specified cluster ID. Retry the request with a different cluster ID.
_NotFoundException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified entity or resource could not be found.
_KMSInvalidSignatureException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the signature verification failed. Signature verification fails when it cannot confirm that signature was produced by signing the specified message with the specified KMS key and signing algorithm.
_InvalidAliasNameException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified alias name is not valid.
_CustomKeyStoreNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because KMS cannot find a custom key store with the specified key store name or ID.
_CustomKeyStoreInvalidStateException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because of the ConnectionState
of the custom
key store. To get the ConnectionState
of a custom key store, use the
DescribeCustomKeyStores operation.
This exception is thrown under the following conditions:
- You requested the CreateKey or GenerateRandom operation in a custom
key store that is not connected. These operations are valid only
when the custom key store
ConnectionState
isCONNECTED
. - You requested the UpdateCustomKeyStore or DeleteCustomKeyStore
operation on a custom key store that is not disconnected. This
operation is valid only when the custom key store
ConnectionState
isDISCONNECTED
. - You requested the ConnectCustomKeyStore operation on a custom key
store with a
ConnectionState
ofDISCONNECTING
orFAILED
. This operation is valid for all otherConnectionState
values.
_InvalidGrantIdException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified GrantId
is not valid.
_InvalidGrantTokenException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified grant token is not valid.
_InvalidArnException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because a specified ARN, or an ARN in a key policy, is not valid.
_DependencyTimeoutException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The system timed out while trying to fulfill the request. The request can be retried.
_ExpiredImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified import token is expired. Use GetParametersForImport to get a new import token and public key, use the new public key to encrypt the key material, and then try the request again.
_InvalidCiphertextException :: AsError a => Getting (First ServiceError) a ServiceError Source #
From the Decrypt or ReEncrypt operation, the request was rejected because the specified ciphertext, or additional authenticated data incorporated into the ciphertext, such as the encryption context, is corrupted, missing, or otherwise invalid.
From the ImportKeyMaterial operation, the request was rejected because KMS could not decrypt the encrypted (wrapped) key material.
_CloudHsmClusterInUseException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified CloudHSM cluster is already associated with a custom key store or it shares a backup history with a cluster that is associated with a custom key store. Each custom key store must be associated with a different CloudHSM cluster.
Clusters that share a backup history have the same cluster certificate. To view the cluster certificate of a cluster, use the DescribeClusters operation.
_IncorrectKeyException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because the specified KMS key cannot decrypt
the data. The KeyId
in a Decrypt request and the SourceKeyId
in a
ReEncrypt request must identify the same KMS key that was used to
encrypt the ciphertext.
_AlreadyExistsException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because it attempted to create a resource that already exists.
_LimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError Source #
The request was rejected because a quota was exceeded. For more information, see Quotas in the Key Management Service Developer Guide.
AlgorithmSpec
newtype AlgorithmSpec Source #
pattern AlgorithmSpec_RSAES_OAEP_SHA_1 :: AlgorithmSpec | |
pattern AlgorithmSpec_RSAES_OAEP_SHA_256 :: AlgorithmSpec | |
pattern AlgorithmSpec_RSAES_PKCS1_V1_5 :: AlgorithmSpec |
Instances
ConnectionErrorCodeType
newtype ConnectionErrorCodeType Source #
Instances
ConnectionStateType
newtype ConnectionStateType Source #
pattern ConnectionStateType_CONNECTED :: ConnectionStateType | |
pattern ConnectionStateType_CONNECTING :: ConnectionStateType | |
pattern ConnectionStateType_DISCONNECTED :: ConnectionStateType | |
pattern ConnectionStateType_DISCONNECTING :: ConnectionStateType | |
pattern ConnectionStateType_FAILED :: ConnectionStateType |
Instances
CustomerMasterKeySpec
newtype CustomerMasterKeySpec Source #
Instances
DataKeyPairSpec
newtype DataKeyPairSpec Source #
pattern DataKeyPairSpec_ECC_NIST_P256 :: DataKeyPairSpec | |
pattern DataKeyPairSpec_ECC_NIST_P384 :: DataKeyPairSpec | |
pattern DataKeyPairSpec_ECC_NIST_P521 :: DataKeyPairSpec | |
pattern DataKeyPairSpec_ECC_SECG_P256K1 :: DataKeyPairSpec | |
pattern DataKeyPairSpec_RSA_2048 :: DataKeyPairSpec | |
pattern DataKeyPairSpec_RSA_3072 :: DataKeyPairSpec | |
pattern DataKeyPairSpec_RSA_4096 :: DataKeyPairSpec |
Instances
DataKeySpec
newtype DataKeySpec Source #
pattern DataKeySpec_AES_128 :: DataKeySpec | |
pattern DataKeySpec_AES_256 :: DataKeySpec |
Instances
EncryptionAlgorithmSpec
newtype EncryptionAlgorithmSpec Source #
Instances
ExpirationModelType
newtype ExpirationModelType Source #
pattern ExpirationModelType_KEY_MATERIAL_DOES_NOT_EXPIRE :: ExpirationModelType | |
pattern ExpirationModelType_KEY_MATERIAL_EXPIRES :: ExpirationModelType |
Instances
GrantOperation
newtype GrantOperation Source #
pattern GrantOperation_CreateGrant :: GrantOperation | |
pattern GrantOperation_Decrypt :: GrantOperation | |
pattern GrantOperation_DescribeKey :: GrantOperation | |
pattern GrantOperation_Encrypt :: GrantOperation | |
pattern GrantOperation_GenerateDataKey :: GrantOperation | |
pattern GrantOperation_GenerateDataKeyPair :: GrantOperation | |
pattern GrantOperation_GenerateDataKeyPairWithoutPlaintext :: GrantOperation | |
pattern GrantOperation_GenerateDataKeyWithoutPlaintext :: GrantOperation | |
pattern GrantOperation_GetPublicKey :: GrantOperation | |
pattern GrantOperation_ReEncryptFrom :: GrantOperation | |
pattern GrantOperation_ReEncryptTo :: GrantOperation | |
pattern GrantOperation_RetireGrant :: GrantOperation | |
pattern GrantOperation_Sign :: GrantOperation | |
pattern GrantOperation_Verify :: GrantOperation |
Instances
KeyManagerType
newtype KeyManagerType Source #
pattern KeyManagerType_AWS :: KeyManagerType | |
pattern KeyManagerType_CUSTOMER :: KeyManagerType |
Instances
KeySpec
pattern KeySpec_ECC_NIST_P256 :: KeySpec | |
pattern KeySpec_ECC_NIST_P384 :: KeySpec | |
pattern KeySpec_ECC_NIST_P521 :: KeySpec | |
pattern KeySpec_ECC_SECG_P256K1 :: KeySpec | |
pattern KeySpec_RSA_2048 :: KeySpec | |
pattern KeySpec_RSA_3072 :: KeySpec | |
pattern KeySpec_RSA_4096 :: KeySpec | |
pattern KeySpec_SYMMETRIC_DEFAULT :: KeySpec |
Instances
KeyState
pattern KeyState_Creating :: KeyState | |
pattern KeyState_Disabled :: KeyState | |
pattern KeyState_Enabled :: KeyState | |
pattern KeyState_PendingDeletion :: KeyState | |
pattern KeyState_PendingImport :: KeyState | |
pattern KeyState_PendingReplicaDeletion :: KeyState | |
pattern KeyState_Unavailable :: KeyState | |
pattern KeyState_Updating :: KeyState |
Instances
KeyUsageType
newtype KeyUsageType Source #
pattern KeyUsageType_ENCRYPT_DECRYPT :: KeyUsageType | |
pattern KeyUsageType_SIGN_VERIFY :: KeyUsageType |
Instances
MessageType
newtype MessageType Source #
pattern MessageType_DIGEST :: MessageType | |
pattern MessageType_RAW :: MessageType |
Instances
MultiRegionKeyType
newtype MultiRegionKeyType Source #
pattern MultiRegionKeyType_PRIMARY :: MultiRegionKeyType | |
pattern MultiRegionKeyType_REPLICA :: MultiRegionKeyType |
Instances
OriginType
newtype OriginType Source #
pattern OriginType_AWS_CLOUDHSM :: OriginType | |
pattern OriginType_AWS_KMS :: OriginType | |
pattern OriginType_EXTERNAL :: OriginType |
Instances
SigningAlgorithmSpec
newtype SigningAlgorithmSpec Source #
Instances
WrappingKeySpec
newtype WrappingKeySpec Source #
pattern WrappingKeySpec_RSA_2048 :: WrappingKeySpec |
Instances
AliasListEntry
data AliasListEntry Source #
Contains information about an alias.
See: newAliasListEntry
smart constructor.
AliasListEntry' | |
|
Instances
newAliasListEntry :: AliasListEntry Source #
Create a value of AliasListEntry
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:targetKeyId:AliasListEntry'
, aliasListEntry_targetKeyId
- String that contains the key identifier of the KMS key associated with
the alias.
$sel:aliasName:AliasListEntry'
, aliasListEntry_aliasName
- String that contains the alias. This value begins with alias/
.
$sel:creationDate:AliasListEntry'
, aliasListEntry_creationDate
- Date and time that the alias was most recently created in the account
and Region. Formatted as Unix time.
$sel:lastUpdatedDate:AliasListEntry'
, aliasListEntry_lastUpdatedDate
- Date and time that the alias was most recently associated with a KMS key
in the account and Region. Formatted as Unix time.
$sel:aliasArn:AliasListEntry'
, aliasListEntry_aliasArn
- String that contains the key ARN.
aliasListEntry_targetKeyId :: Lens' AliasListEntry (Maybe Text) Source #
String that contains the key identifier of the KMS key associated with the alias.
aliasListEntry_aliasName :: Lens' AliasListEntry (Maybe Text) Source #
String that contains the alias. This value begins with alias/
.
aliasListEntry_creationDate :: Lens' AliasListEntry (Maybe UTCTime) Source #
Date and time that the alias was most recently created in the account and Region. Formatted as Unix time.
aliasListEntry_lastUpdatedDate :: Lens' AliasListEntry (Maybe UTCTime) Source #
Date and time that the alias was most recently associated with a KMS key in the account and Region. Formatted as Unix time.
aliasListEntry_aliasArn :: Lens' AliasListEntry (Maybe Text) Source #
String that contains the key ARN.
CustomKeyStoresListEntry
data CustomKeyStoresListEntry Source #
Contains information about each custom key store in the custom key store list.
See: newCustomKeyStoresListEntry
smart constructor.
CustomKeyStoresListEntry' | |
|
Instances
newCustomKeyStoresListEntry :: CustomKeyStoresListEntry Source #
Create a value of CustomKeyStoresListEntry
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:customKeyStoreName:CustomKeyStoresListEntry'
, customKeyStoresListEntry_customKeyStoreName
- The user-specified friendly name for the custom key store.
$sel:trustAnchorCertificate:CustomKeyStoresListEntry'
, customKeyStoresListEntry_trustAnchorCertificate
- The trust anchor certificate of the associated CloudHSM cluster. When
you
initialize the cluster,
you create this certificate and save it in the customerCA.crt
file.
$sel:connectionErrorCode:CustomKeyStoresListEntry'
, customKeyStoresListEntry_connectionErrorCode
- Describes the connection error. This field appears in the response only
when the ConnectionState
is FAILED
. For help resolving these errors,
see
How to Fix a Connection Failure
in Key Management Service Developer Guide.
Valid values are:
CLUSTER_NOT_FOUND
- KMS cannot find the CloudHSM cluster with the specified cluster ID.INSUFFICIENT_CLOUDHSM_HSMS
- The associated CloudHSM cluster does not contain any active HSMs. To connect a custom key store to its CloudHSM cluster, the cluster must contain at least one active HSM.INTERNAL_ERROR
- KMS could not complete the request due to an internal error. Retry the request. ForConnectCustomKeyStore
requests, disconnect the custom key store before trying to connect again.INVALID_CREDENTIALS
- KMS does not have the correct password for thekmsuser
crypto user in the CloudHSM cluster. Before you can connect your custom key store to its CloudHSM cluster, you must change thekmsuser
account password and update the key store password value for the custom key store.NETWORK_ERRORS
- Network errors are preventing KMS from connecting to the custom key store.SUBNET_NOT_FOUND
- A subnet in the CloudHSM cluster configuration was deleted. If KMS cannot find all of the subnets in the cluster configuration, attempts to connect the custom key store to the CloudHSM cluster fail. To fix this error, create a cluster from a recent backup and associate it with your custom key store. (This process creates a new cluster configuration with a VPC and private subnets.) For details, see How to Fix a Connection Failure in the Key Management Service Developer Guide.USER_LOCKED_OUT
- Thekmsuser
CU account is locked out of the associated CloudHSM cluster due to too many failed password attempts. Before you can connect your custom key store to its CloudHSM cluster, you must change thekmsuser
account password and update the key store password value for the custom key store.USER_LOGGED_IN
- Thekmsuser
CU account is logged into the the associated CloudHSM cluster. This prevents KMS from rotating thekmsuser
account password and logging into the cluster. Before you can connect your custom key store to its CloudHSM cluster, you must log thekmsuser
CU out of the cluster. If you changed thekmsuser
password to log into the cluster, you must also and update the key store password value for the custom key store. For help, see How to Log Out and Reconnect in the Key Management Service Developer Guide.USER_NOT_FOUND
- KMS cannot find akmsuser
CU account in the associated CloudHSM cluster. Before you can connect your custom key store to its CloudHSM cluster, you must create akmsuser
CU account in the cluster, and then update the key store password value for the custom key store.
$sel:creationDate:CustomKeyStoresListEntry'
, customKeyStoresListEntry_creationDate
- The date and time when the custom key store was created.
$sel:cloudHsmClusterId:CustomKeyStoresListEntry'
, customKeyStoresListEntry_cloudHsmClusterId
- A unique identifier for the CloudHSM cluster that is associated with the
custom key store.
$sel:customKeyStoreId:CustomKeyStoresListEntry'
, customKeyStoresListEntry_customKeyStoreId
- A unique identifier for the custom key store.
$sel:connectionState:CustomKeyStoresListEntry'
, customKeyStoresListEntry_connectionState
- Indicates whether the custom key store is connected to its CloudHSM
cluster.
You can create and use KMS keys in your custom key stores only when its
connection state is CONNECTED
.
The value is DISCONNECTED
if the key store has never been connected or
you use the DisconnectCustomKeyStore operation to disconnect it. If the
value is CONNECTED
but you are having trouble using the custom key
store, make sure that its associated CloudHSM cluster is active and
contains at least one active HSM.
A value of FAILED
indicates that an attempt to connect was
unsuccessful. The ConnectionErrorCode
field in the response indicates
the cause of the failure. For help resolving a connection failure, see
Troubleshooting a Custom Key Store
in the Key Management Service Developer Guide.
customKeyStoresListEntry_customKeyStoreName :: Lens' CustomKeyStoresListEntry (Maybe Text) Source #
The user-specified friendly name for the custom key store.
customKeyStoresListEntry_trustAnchorCertificate :: Lens' CustomKeyStoresListEntry (Maybe Text) Source #
The trust anchor certificate of the associated CloudHSM cluster. When
you
initialize the cluster,
you create this certificate and save it in the customerCA.crt
file.
customKeyStoresListEntry_connectionErrorCode :: Lens' CustomKeyStoresListEntry (Maybe ConnectionErrorCodeType) Source #
Describes the connection error. This field appears in the response only
when the ConnectionState
is FAILED
. For help resolving these errors,
see
How to Fix a Connection Failure
in Key Management Service Developer Guide.
Valid values are:
CLUSTER_NOT_FOUND
- KMS cannot find the CloudHSM cluster with the specified cluster ID.INSUFFICIENT_CLOUDHSM_HSMS
- The associated CloudHSM cluster does not contain any active HSMs. To connect a custom key store to its CloudHSM cluster, the cluster must contain at least one active HSM.INTERNAL_ERROR
- KMS could not complete the request due to an internal error. Retry the request. ForConnectCustomKeyStore
requests, disconnect the custom key store before trying to connect again.INVALID_CREDENTIALS
- KMS does not have the correct password for thekmsuser
crypto user in the CloudHSM cluster. Before you can connect your custom key store to its CloudHSM cluster, you must change thekmsuser
account password and update the key store password value for the custom key store.NETWORK_ERRORS
- Network errors are preventing KMS from connecting to the custom key store.SUBNET_NOT_FOUND
- A subnet in the CloudHSM cluster configuration was deleted. If KMS cannot find all of the subnets in the cluster configuration, attempts to connect the custom key store to the CloudHSM cluster fail. To fix this error, create a cluster from a recent backup and associate it with your custom key store. (This process creates a new cluster configuration with a VPC and private subnets.) For details, see How to Fix a Connection Failure in the Key Management Service Developer Guide.USER_LOCKED_OUT
- Thekmsuser
CU account is locked out of the associated CloudHSM cluster due to too many failed password attempts. Before you can connect your custom key store to its CloudHSM cluster, you must change thekmsuser
account password and update the key store password value for the custom key store.USER_LOGGED_IN
- Thekmsuser
CU account is logged into the the associated CloudHSM cluster. This prevents KMS from rotating thekmsuser
account password and logging into the cluster. Before you can connect your custom key store to its CloudHSM cluster, you must log thekmsuser
CU out of the cluster. If you changed thekmsuser
password to log into the cluster, you must also and update the key store password value for the custom key store. For help, see How to Log Out and Reconnect in the Key Management Service Developer Guide.USER_NOT_FOUND
- KMS cannot find akmsuser
CU account in the associated CloudHSM cluster. Before you can connect your custom key store to its CloudHSM cluster, you must create akmsuser
CU account in the cluster, and then update the key store password value for the custom key store.
customKeyStoresListEntry_creationDate :: Lens' CustomKeyStoresListEntry (Maybe UTCTime) Source #
The date and time when the custom key store was created.
customKeyStoresListEntry_cloudHsmClusterId :: Lens' CustomKeyStoresListEntry (Maybe Text) Source #
A unique identifier for the CloudHSM cluster that is associated with the custom key store.
customKeyStoresListEntry_customKeyStoreId :: Lens' CustomKeyStoresListEntry (Maybe Text) Source #
A unique identifier for the custom key store.
customKeyStoresListEntry_connectionState :: Lens' CustomKeyStoresListEntry (Maybe ConnectionStateType) Source #
Indicates whether the custom key store is connected to its CloudHSM cluster.
You can create and use KMS keys in your custom key stores only when its
connection state is CONNECTED
.
The value is DISCONNECTED
if the key store has never been connected or
you use the DisconnectCustomKeyStore operation to disconnect it. If the
value is CONNECTED
but you are having trouble using the custom key
store, make sure that its associated CloudHSM cluster is active and
contains at least one active HSM.
A value of FAILED
indicates that an attempt to connect was
unsuccessful. The ConnectionErrorCode
field in the response indicates
the cause of the failure. For help resolving a connection failure, see
Troubleshooting a Custom Key Store
in the Key Management Service Developer Guide.
GrantConstraints
data GrantConstraints Source #
Use this structure to allow cryptographic operations in the grant only when the operation request includes the specified encryption context.
KMS applies the grant constraints only to cryptographic operations that support an encryption context, that is, all cryptographic operations with a symmetric KMS key. Grant constraints are not applied to operations that do not support an encryption context, such as cryptographic operations with asymmetric KMS keys and management operations, such as DescribeKey or RetireGrant.
In a cryptographic operation, the encryption context in the decryption operation must be an exact, case-sensitive match for the keys and values in the encryption context of the encryption operation. Only the order of the pairs can vary.
However, in a grant constraint, the key in each key-value pair is not case sensitive, but the value is case sensitive.
To avoid confusion, do not use multiple encryption context pairs that
differ only by case. To require a fully case-sensitive encryption
context, use the kms:EncryptionContext:
and
kms:EncryptionContextKeys
conditions in an IAM or key policy. For
details, see
kms:EncryptionContext:
in the /Key Management Service Developer Guide/ .
See: newGrantConstraints
smart constructor.
GrantConstraints' | |
|
Instances
newGrantConstraints :: GrantConstraints Source #
Create a value of GrantConstraints
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:encryptionContextEquals:GrantConstraints'
, grantConstraints_encryptionContextEquals
- A list of key-value pairs that must match the encryption context in the
cryptographic operation
request. The grant allows the operation only when the encryption context
in the request is the same as the encryption context specified in this
constraint.
$sel:encryptionContextSubset:GrantConstraints'
, grantConstraints_encryptionContextSubset
- A list of key-value pairs that must be included in the encryption
context of the
cryptographic operation
request. The grant allows the cryptographic operation only when the
encryption context in the request includes the key-value pairs specified
in this constraint, although it can include additional key-value pairs.
grantConstraints_encryptionContextEquals :: Lens' GrantConstraints (Maybe (HashMap Text Text)) Source #
A list of key-value pairs that must match the encryption context in the cryptographic operation request. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint.
grantConstraints_encryptionContextSubset :: Lens' GrantConstraints (Maybe (HashMap Text Text)) Source #
A list of key-value pairs that must be included in the encryption context of the cryptographic operation request. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs.
GrantListEntry
data GrantListEntry Source #
Contains information about a grant.
See: newGrantListEntry
smart constructor.
GrantListEntry' | |
|
Instances
newGrantListEntry :: GrantListEntry Source #
Create a value of GrantListEntry
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:keyId:GrantListEntry'
, grantListEntry_keyId
- The unique identifier for the KMS key to which the grant applies.
$sel:retiringPrincipal:GrantListEntry'
, grantListEntry_retiringPrincipal
- The principal that can retire the grant.
$sel:issuingAccount:GrantListEntry'
, grantListEntry_issuingAccount
- The Amazon Web Services account under which the grant was issued.
$sel:grantId:GrantListEntry'
, grantListEntry_grantId
- The unique identifier for the grant.
$sel:constraints:GrantListEntry'
, grantListEntry_constraints
- A list of key-value pairs that must be present in the encryption context
of certain subsequent operations that the grant allows.
$sel:granteePrincipal:GrantListEntry'
, grantListEntry_granteePrincipal
- The identity that gets the permissions in the grant.
The GranteePrincipal
field in the ListGrants
response usually
contains the user or role designated as the grantee principal in the
grant. However, when the grantee principal in the grant is an Amazon Web
Services service, the GranteePrincipal
field contains the
service principal,
which might represent several different grantee principals.
$sel:name:GrantListEntry'
, grantListEntry_name
- The friendly name that identifies the grant. If a name was provided in
the CreateGrant request, that name is returned. Otherwise this value is
null.
$sel:creationDate:GrantListEntry'
, grantListEntry_creationDate
- The date and time when the grant was created.
$sel:operations:GrantListEntry'
, grantListEntry_operations
- The list of operations permitted by the grant.
grantListEntry_keyId :: Lens' GrantListEntry (Maybe Text) Source #
The unique identifier for the KMS key to which the grant applies.
grantListEntry_retiringPrincipal :: Lens' GrantListEntry (Maybe Text) Source #
The principal that can retire the grant.
grantListEntry_issuingAccount :: Lens' GrantListEntry (Maybe Text) Source #
The Amazon Web Services account under which the grant was issued.
grantListEntry_grantId :: Lens' GrantListEntry (Maybe Text) Source #
The unique identifier for the grant.
grantListEntry_constraints :: Lens' GrantListEntry (Maybe GrantConstraints) Source #
A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows.
grantListEntry_granteePrincipal :: Lens' GrantListEntry (Maybe Text) Source #
The identity that gets the permissions in the grant.
The GranteePrincipal
field in the ListGrants
response usually
contains the user or role designated as the grantee principal in the
grant. However, when the grantee principal in the grant is an Amazon Web
Services service, the GranteePrincipal
field contains the
service principal,
which might represent several different grantee principals.
grantListEntry_name :: Lens' GrantListEntry (Maybe Text) Source #
The friendly name that identifies the grant. If a name was provided in the CreateGrant request, that name is returned. Otherwise this value is null.
grantListEntry_creationDate :: Lens' GrantListEntry (Maybe UTCTime) Source #
The date and time when the grant was created.
grantListEntry_operations :: Lens' GrantListEntry (Maybe [GrantOperation]) Source #
The list of operations permitted by the grant.
KeyListEntry
data KeyListEntry Source #
Contains information about each entry in the key list.
See: newKeyListEntry
smart constructor.
Instances
newKeyListEntry :: KeyListEntry Source #
Create a value of KeyListEntry
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:keyId:KeyListEntry'
, keyListEntry_keyId
- Unique identifier of the key.
$sel:keyArn:KeyListEntry'
, keyListEntry_keyArn
- ARN of the key.
keyListEntry_keyId :: Lens' KeyListEntry (Maybe Text) Source #
Unique identifier of the key.
keyListEntry_keyArn :: Lens' KeyListEntry (Maybe Text) Source #
ARN of the key.
KeyMetadata
data KeyMetadata Source #
Contains metadata about a KMS key.
This data type is used as a response element for the CreateKey and DescribeKey operations.
See: newKeyMetadata
smart constructor.
KeyMetadata' | |
|
Instances
Create a value of KeyMetadata
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:origin:KeyMetadata'
, keyMetadata_origin
- The source of the key material for the KMS key. When this value is
AWS_KMS
, KMS created the key material. When this value is EXTERNAL
,
the key material was imported or the KMS key doesn't have any key
material. When this value is AWS_CLOUDHSM
, the key material was
created in the CloudHSM cluster associated with a custom key store.
$sel:expirationModel:KeyMetadata'
, keyMetadata_expirationModel
- Specifies whether the KMS key's key material expires. This value is
present only when Origin
is EXTERNAL
, otherwise this value is
omitted.
$sel:keyManager:KeyMetadata'
, keyMetadata_keyManager
- The manager of the KMS key. KMS keys in your Amazon Web Services account
are either customer managed or Amazon Web Services managed. For more
information about the difference, see
KMS keys
in the Key Management Service Developer Guide.
$sel:keySpec:KeyMetadata'
, keyMetadata_keySpec
- Describes the type of key material in the KMS key.
$sel:customerMasterKeySpec:KeyMetadata'
, keyMetadata_customerMasterKeySpec
- Instead, use the KeySpec
field.
The KeySpec
and CustomerMasterKeySpec
fields have the same value. We
recommend that you use the KeySpec
field in your code. However, to
avoid breaking changes, KMS will support both fields.
$sel:enabled:KeyMetadata'
, keyMetadata_enabled
- Specifies whether the KMS key is enabled. When KeyState
is Enabled
this value is true, otherwise it is false.
$sel:validTo:KeyMetadata'
, keyMetadata_validTo
- The time at which the imported key material expires. When the key
material expires, KMS deletes the key material and the KMS key becomes
unusable. This value is present only for KMS keys whose Origin
is
EXTERNAL
and whose ExpirationModel
is KEY_MATERIAL_EXPIRES
,
otherwise this value is omitted.
$sel:arn:KeyMetadata'
, keyMetadata_arn
- The Amazon Resource Name (ARN) of the KMS key. For examples, see
Key Management Service (KMS)
in the Example ARNs section of the /Amazon Web Services General
Reference/.
$sel:keyState:KeyMetadata'
, keyMetadata_keyState
- The current status of the KMS key.
For more information about how key state affects the use of a KMS key, see Key state: Effect on your KMS key in the Key Management Service Developer Guide.
$sel:encryptionAlgorithms:KeyMetadata'
, keyMetadata_encryptionAlgorithms
- The encryption algorithms that the KMS key supports. You cannot use the
KMS key with other encryption algorithms within KMS.
This value is present only when the KeyUsage
of the KMS key is
ENCRYPT_DECRYPT
.
$sel:aWSAccountId:KeyMetadata'
, keyMetadata_aWSAccountId
- The twelve-digit account ID of the Amazon Web Services account that owns
the KMS key.
$sel:signingAlgorithms:KeyMetadata'
, keyMetadata_signingAlgorithms
- The signing algorithms that the KMS key supports. You cannot use the KMS
key with other signing algorithms within KMS.
This field appears only when the KeyUsage
of the KMS key is
SIGN_VERIFY
.
$sel:pendingDeletionWindowInDays:KeyMetadata'
, keyMetadata_pendingDeletionWindowInDays
- The waiting period before the primary key in a multi-Region key is
deleted. This waiting period begins when the last of its replica keys is
deleted. This value is present only when the KeyState
of the KMS key
is PendingReplicaDeletion
. That indicates that the KMS key is the
primary key in a multi-Region key, it is scheduled for deletion, and it
still has existing replica keys.
When a single-Region KMS key or a multi-Region replica key is scheduled
for deletion, its deletion date is displayed in the DeletionDate
field. However, when the primary key in a multi-Region key is scheduled
for deletion, its waiting period doesn't begin until all of its replica
keys are deleted. This value displays that waiting period. When the last
replica key in the multi-Region key is deleted, the KeyState
of the
scheduled primary key changes from PendingReplicaDeletion
to
PendingDeletion
and the deletion date appears in the DeletionDate
field.
$sel:keyUsage:KeyMetadata'
, keyMetadata_keyUsage
- The
cryptographic operations
for which you can use the KMS key.
$sel:creationDate:KeyMetadata'
, keyMetadata_creationDate
- The date and time when the KMS key was created.
$sel:deletionDate:KeyMetadata'
, keyMetadata_deletionDate
- The date and time after which KMS deletes this KMS key. This value is
present only when the KMS key is scheduled for deletion, that is, when
its KeyState
is PendingDeletion
.
When the primary key in a multi-Region key is scheduled for deletion but
still has replica keys, its key state is PendingReplicaDeletion
and
the length of its waiting period is displayed in the
PendingDeletionWindowInDays
field.
$sel:cloudHsmClusterId:KeyMetadata'
, keyMetadata_cloudHsmClusterId
- The cluster ID of the CloudHSM cluster that contains the key material
for the KMS key. When you create a KMS key in a
custom key store,
KMS creates the key material for the KMS key in the associated CloudHSM
cluster. This value is present only when the KMS key is created in a
custom key store.
$sel:description:KeyMetadata'
, keyMetadata_description
- The description of the KMS key.
$sel:customKeyStoreId:KeyMetadata'
, keyMetadata_customKeyStoreId
- A unique identifier for the
custom key store
that contains the KMS key. This value is present only when the KMS key
is created in a custom key store.
$sel:multiRegion:KeyMetadata'
, keyMetadata_multiRegion
- Indicates whether the KMS key is a multi-Region (True
) or regional
(False
) key. This value is True
for multi-Region primary and replica
keys and False
for regional KMS keys.
For more information about multi-Region keys, see Using multi-Region keys in the Key Management Service Developer Guide.
$sel:multiRegionConfiguration:KeyMetadata'
, keyMetadata_multiRegionConfiguration
- Lists the primary and replica keys in same multi-Region key. This field
is present only when the value of the MultiRegion
field is True
.
For more information about any listed KMS key, use the DescribeKey operation.
MultiRegionKeyType
indicates whether the KMS key is aPRIMARY
orREPLICA
key.PrimaryKey
displays the key ARN and Region of the primary key. This field displays the current KMS key if it is the primary key.ReplicaKeys
displays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.
$sel:keyId:KeyMetadata'
, keyMetadata_keyId
- The globally unique identifier for the KMS key.
keyMetadata_origin :: Lens' KeyMetadata (Maybe OriginType) Source #
The source of the key material for the KMS key. When this value is
AWS_KMS
, KMS created the key material. When this value is EXTERNAL
,
the key material was imported or the KMS key doesn't have any key
material. When this value is AWS_CLOUDHSM
, the key material was
created in the CloudHSM cluster associated with a custom key store.
keyMetadata_expirationModel :: Lens' KeyMetadata (Maybe ExpirationModelType) Source #
Specifies whether the KMS key's key material expires. This value is
present only when Origin
is EXTERNAL
, otherwise this value is
omitted.
keyMetadata_keyManager :: Lens' KeyMetadata (Maybe KeyManagerType) Source #
The manager of the KMS key. KMS keys in your Amazon Web Services account are either customer managed or Amazon Web Services managed. For more information about the difference, see KMS keys in the Key Management Service Developer Guide.
keyMetadata_keySpec :: Lens' KeyMetadata (Maybe KeySpec) Source #
Describes the type of key material in the KMS key.
keyMetadata_customerMasterKeySpec :: Lens' KeyMetadata (Maybe CustomerMasterKeySpec) Source #
Instead, use the KeySpec
field.
The KeySpec
and CustomerMasterKeySpec
fields have the same value. We
recommend that you use the KeySpec
field in your code. However, to
avoid breaking changes, KMS will support both fields.
keyMetadata_enabled :: Lens' KeyMetadata (Maybe Bool) Source #
Specifies whether the KMS key is enabled. When KeyState
is Enabled
this value is true, otherwise it is false.
keyMetadata_validTo :: Lens' KeyMetadata (Maybe UTCTime) Source #
The time at which the imported key material expires. When the key
material expires, KMS deletes the key material and the KMS key becomes
unusable. This value is present only for KMS keys whose Origin
is
EXTERNAL
and whose ExpirationModel
is KEY_MATERIAL_EXPIRES
,
otherwise this value is omitted.
keyMetadata_arn :: Lens' KeyMetadata (Maybe Text) Source #
The Amazon Resource Name (ARN) of the KMS key. For examples, see Key Management Service (KMS) in the Example ARNs section of the /Amazon Web Services General Reference/.
keyMetadata_keyState :: Lens' KeyMetadata (Maybe KeyState) Source #
The current status of the KMS key.
For more information about how key state affects the use of a KMS key, see Key state: Effect on your KMS key in the Key Management Service Developer Guide.
keyMetadata_encryptionAlgorithms :: Lens' KeyMetadata (Maybe [EncryptionAlgorithmSpec]) Source #
The encryption algorithms that the KMS key supports. You cannot use the KMS key with other encryption algorithms within KMS.
This value is present only when the KeyUsage
of the KMS key is
ENCRYPT_DECRYPT
.
keyMetadata_aWSAccountId :: Lens' KeyMetadata (Maybe Text) Source #
The twelve-digit account ID of the Amazon Web Services account that owns the KMS key.
keyMetadata_signingAlgorithms :: Lens' KeyMetadata (Maybe [SigningAlgorithmSpec]) Source #
The signing algorithms that the KMS key supports. You cannot use the KMS key with other signing algorithms within KMS.
This field appears only when the KeyUsage
of the KMS key is
SIGN_VERIFY
.
keyMetadata_pendingDeletionWindowInDays :: Lens' KeyMetadata (Maybe Natural) Source #
The waiting period before the primary key in a multi-Region key is
deleted. This waiting period begins when the last of its replica keys is
deleted. This value is present only when the KeyState
of the KMS key
is PendingReplicaDeletion
. That indicates that the KMS key is the
primary key in a multi-Region key, it is scheduled for deletion, and it
still has existing replica keys.
When a single-Region KMS key or a multi-Region replica key is scheduled
for deletion, its deletion date is displayed in the DeletionDate
field. However, when the primary key in a multi-Region key is scheduled
for deletion, its waiting period doesn't begin until all of its replica
keys are deleted. This value displays that waiting period. When the last
replica key in the multi-Region key is deleted, the KeyState
of the
scheduled primary key changes from PendingReplicaDeletion
to
PendingDeletion
and the deletion date appears in the DeletionDate
field.
keyMetadata_keyUsage :: Lens' KeyMetadata (Maybe KeyUsageType) Source #
The cryptographic operations for which you can use the KMS key.
keyMetadata_creationDate :: Lens' KeyMetadata (Maybe UTCTime) Source #
The date and time when the KMS key was created.
keyMetadata_deletionDate :: Lens' KeyMetadata (Maybe UTCTime) Source #
The date and time after which KMS deletes this KMS key. This value is
present only when the KMS key is scheduled for deletion, that is, when
its KeyState
is PendingDeletion
.
When the primary key in a multi-Region key is scheduled for deletion but
still has replica keys, its key state is PendingReplicaDeletion
and
the length of its waiting period is displayed in the
PendingDeletionWindowInDays
field.
keyMetadata_cloudHsmClusterId :: Lens' KeyMetadata (Maybe Text) Source #
The cluster ID of the CloudHSM cluster that contains the key material for the KMS key. When you create a KMS key in a custom key store, KMS creates the key material for the KMS key in the associated CloudHSM cluster. This value is present only when the KMS key is created in a custom key store.
keyMetadata_description :: Lens' KeyMetadata (Maybe Text) Source #
The description of the KMS key.
keyMetadata_customKeyStoreId :: Lens' KeyMetadata (Maybe Text) Source #
A unique identifier for the custom key store that contains the KMS key. This value is present only when the KMS key is created in a custom key store.
keyMetadata_multiRegion :: Lens' KeyMetadata (Maybe Bool) Source #
Indicates whether the KMS key is a multi-Region (True
) or regional
(False
) key. This value is True
for multi-Region primary and replica
keys and False
for regional KMS keys.
For more information about multi-Region keys, see Using multi-Region keys in the Key Management Service Developer Guide.
keyMetadata_multiRegionConfiguration :: Lens' KeyMetadata (Maybe MultiRegionConfiguration) Source #
Lists the primary and replica keys in same multi-Region key. This field
is present only when the value of the MultiRegion
field is True
.
For more information about any listed KMS key, use the DescribeKey operation.
MultiRegionKeyType
indicates whether the KMS key is aPRIMARY
orREPLICA
key.PrimaryKey
displays the key ARN and Region of the primary key. This field displays the current KMS key if it is the primary key.ReplicaKeys
displays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.
keyMetadata_keyId :: Lens' KeyMetadata Text Source #
The globally unique identifier for the KMS key.
ListGrantsResponse
data ListGrantsResponse Source #
See: newListGrantsResponse
smart constructor.
ListGrantsResponse' | |
|
Instances
newListGrantsResponse :: ListGrantsResponse Source #
Create a value of ListGrantsResponse
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:truncated:ListGrantsResponse'
, listGrantsResponse_truncated
- A flag that indicates whether there are more items in the list. When
this value is true, the list in this response is truncated. To get more
items, pass the value of the NextMarker
element in thisresponse to the
Marker
parameter in a subsequent request.
$sel:grants:ListGrantsResponse'
, listGrantsResponse_grants
- A list of grants.
$sel:nextMarker:ListGrantsResponse'
, listGrantsResponse_nextMarker
- When Truncated
is true, this element is present and contains the value
to use for the Marker
parameter in a subsequent request.
listGrantsResponse_truncated :: Lens' ListGrantsResponse (Maybe Bool) Source #
A flag that indicates whether there are more items in the list. When
this value is true, the list in this response is truncated. To get more
items, pass the value of the NextMarker
element in thisresponse to the
Marker
parameter in a subsequent request.
listGrantsResponse_grants :: Lens' ListGrantsResponse (Maybe [GrantListEntry]) Source #
A list of grants.
listGrantsResponse_nextMarker :: Lens' ListGrantsResponse (Maybe Text) Source #
When Truncated
is true, this element is present and contains the value
to use for the Marker
parameter in a subsequent request.
MultiRegionConfiguration
data MultiRegionConfiguration Source #
Describes the configuration of this multi-Region key. This field appears only when the KMS key is a primary or replica of a multi-Region key.
For more information about any listed KMS key, use the DescribeKey operation.
See: newMultiRegionConfiguration
smart constructor.
MultiRegionConfiguration' | |
|
Instances
newMultiRegionConfiguration :: MultiRegionConfiguration Source #
Create a value of MultiRegionConfiguration
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:primaryKey:MultiRegionConfiguration'
, multiRegionConfiguration_primaryKey
- Displays the key ARN and Region of the primary key. This field includes
the current KMS key if it is the primary key.
$sel:replicaKeys:MultiRegionConfiguration'
, multiRegionConfiguration_replicaKeys
- displays the key ARNs and Regions of all replica keys. This field
includes the current KMS key if it is a replica key.
$sel:multiRegionKeyType:MultiRegionConfiguration'
, multiRegionConfiguration_multiRegionKeyType
- Indicates whether the KMS key is a PRIMARY
or REPLICA
key.
multiRegionConfiguration_primaryKey :: Lens' MultiRegionConfiguration (Maybe MultiRegionKey) Source #
Displays the key ARN and Region of the primary key. This field includes the current KMS key if it is the primary key.
multiRegionConfiguration_replicaKeys :: Lens' MultiRegionConfiguration (Maybe [MultiRegionKey]) Source #
displays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.
multiRegionConfiguration_multiRegionKeyType :: Lens' MultiRegionConfiguration (Maybe MultiRegionKeyType) Source #
Indicates whether the KMS key is a PRIMARY
or REPLICA
key.
MultiRegionKey
data MultiRegionKey Source #
Describes the primary or replica key in a multi-Region key.
See: newMultiRegionKey
smart constructor.
Instances
newMultiRegionKey :: MultiRegionKey Source #
Create a value of MultiRegionKey
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:arn:MultiRegionKey'
, multiRegionKey_arn
- Displays the key ARN of a primary or replica key of a multi-Region key.
$sel:region:MultiRegionKey'
, multiRegionKey_region
- Displays the Amazon Web Services Region of a primary or replica key in a
multi-Region key.
multiRegionKey_arn :: Lens' MultiRegionKey (Maybe Text) Source #
Displays the key ARN of a primary or replica key of a multi-Region key.
multiRegionKey_region :: Lens' MultiRegionKey (Maybe Text) Source #
Displays the Amazon Web Services Region of a primary or replica key in a multi-Region key.
Tag
A key-value pair. A tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
For information about the rules that apply to tag keys and tag values, see User-Defined Tag Restrictions in the Amazon Web Services Billing and Cost Management User Guide.
See: newTag
smart constructor.
Instances
Eq Tag Source # | |
Read Tag Source # | |
Show Tag Source # | |
Generic Tag Source # | |
NFData Tag Source # | |
Defined in Amazonka.KMS.Types.Tag | |
Hashable Tag Source # | |
Defined in Amazonka.KMS.Types.Tag | |
ToJSON Tag Source # | |
Defined in Amazonka.KMS.Types.Tag | |
FromJSON Tag Source # | |
type Rep Tag Source # | |
Defined in Amazonka.KMS.Types.Tag type Rep Tag = D1 ('MetaData "Tag" "Amazonka.KMS.Types.Tag" "libZSservicesZSamazonka-kmsZSamazonka-kms" 'False) (C1 ('MetaCons "Tag'" 'PrefixI 'True) (S1 ('MetaSel ('Just "tagKey") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :*: S1 ('MetaSel ('Just "tagValue") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text))) |
Create a value of Tag
with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:tagKey:Tag'
, tag_tagKey
- The key of the tag.
$sel:tagValue:Tag'
, tag_tagValue
- The value of the tag.