Copyright	(c) 2013-2021 Brendan Hay
License	Mozilla Public License, v. 2.0.
Maintainer	Brendan Hay <brendan.g.hay+amazonka@gmail.com>
Stability	auto-generated
Portability	non-portable (GHC extensions)
Safe Haskell	None

Amazonka.Route53.CreateKeySigningKey

Contents

Creating a Request
Request Lenses
Destructuring the Response
Response Lenses

Description

Creates a new key-signing key (KSK) associated with a hosted zone. You can only have two KSKs per hosted zone.

Synopsis

data CreateKeySigningKey = CreateKeySigningKey' {
- callerReference :: Text
- hostedZoneId :: ResourceId
- keyManagementServiceArn :: Text
- name :: Text
- status :: Text
}
newCreateKeySigningKey :: Text -> ResourceId -> Text -> Text -> Text -> CreateKeySigningKey
createKeySigningKey_callerReference :: Lens' CreateKeySigningKey Text
createKeySigningKey_hostedZoneId :: Lens' CreateKeySigningKey ResourceId
createKeySigningKey_keyManagementServiceArn :: Lens' CreateKeySigningKey Text
createKeySigningKey_name :: Lens' CreateKeySigningKey Text
createKeySigningKey_status :: Lens' CreateKeySigningKey Text
data CreateKeySigningKeyResponse = CreateKeySigningKeyResponse' {
- httpStatus :: Int
- changeInfo :: ChangeInfo
- keySigningKey :: KeySigningKey
- location :: Text
}
newCreateKeySigningKeyResponse :: Int -> ChangeInfo -> KeySigningKey -> Text -> CreateKeySigningKeyResponse
createKeySigningKeyResponse_httpStatus :: Lens' CreateKeySigningKeyResponse Int
createKeySigningKeyResponse_changeInfo :: Lens' CreateKeySigningKeyResponse ChangeInfo
createKeySigningKeyResponse_keySigningKey :: Lens' CreateKeySigningKeyResponse KeySigningKey
createKeySigningKeyResponse_location :: Lens' CreateKeySigningKeyResponse Text

Creating a Request

data CreateKeySigningKey Source #

See: newCreateKeySigningKey smart constructor.

Constructors

CreateKeySigningKey'

Fields

callerReference :: Text
A unique string that identifies the request.
hostedZoneId :: ResourceId
The unique string (ID) used to identify a hosted zone.
keyManagementServiceArn :: Text
The Amazon resource name (ARN) for a customer managed customer master key (CMK) in Key Management Service (KMS). The KeyManagementServiceArn must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of KeyManagementServiceArn that grants the correct permissions for DNSSEC, scroll down to Example.
You must configure the customer managed CMK as follows:
Status
Enabled
Key spec
ECC_NIST_P256
Key usage
Sign and verify
Key policy
The key policy must give permission for the following actions:
- DescribeKey
- GetPublicKey
- Sign
The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:
- "Service": "dnssec-route53.amazonaws.com"
For more information about working with a customer managed CMK in KMS, see Key Management Service concepts.
name :: Text
A string used to identify a key-signing key (KSK). Name can include numbers, letters, and underscores (_). Name must be unique for each key-signing key in the same hosted zone.
status :: Text
A string specifying the initial status of the key-signing key (KSK). You can set the value to ACTIVE or INACTIVE.

Instances

Instances details

Eq CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods (==) :: CreateKeySigningKey -> CreateKeySigningKey -> Bool # (/=) :: CreateKeySigningKey -> CreateKeySigningKey -> Bool #
Read CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods readsPrec :: Int -> ReadS CreateKeySigningKey # readList :: ReadS [CreateKeySigningKey] # readPrec :: ReadPrec CreateKeySigningKey # readListPrec :: ReadPrec [CreateKeySigningKey] #
Show CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods showsPrec :: Int -> CreateKeySigningKey -> ShowS # show :: CreateKeySigningKey -> String # showList :: [CreateKeySigningKey] -> ShowS #
Generic CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Associated Types type Rep CreateKeySigningKey :: Type -> Type # Methods from :: CreateKeySigningKey -> Rep CreateKeySigningKey x # to :: Rep CreateKeySigningKey x -> CreateKeySigningKey #
NFData CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods rnf :: CreateKeySigningKey -> () #
Hashable CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods hashWithSalt :: Int -> CreateKeySigningKey -> Int # hash :: CreateKeySigningKey -> Int #
AWSRequest CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Associated Types type AWSResponse CreateKeySigningKey # Methods request :: CreateKeySigningKey -> Request CreateKeySigningKey # response :: MonadResource m => Logger -> Service -> Proxy CreateKeySigningKey -> ClientResponse ClientBody -> m (Either Error (ClientResponse (AWSResponse CreateKeySigningKey))) #
ToHeaders CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods toHeaders :: CreateKeySigningKey -> [Header] #
ToPath CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods toPath :: CreateKeySigningKey -> ByteString #
ToQuery CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods toQuery :: CreateKeySigningKey -> QueryString #
ToElement CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods toElement :: CreateKeySigningKey -> Element #
ToXML CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods toXML :: CreateKeySigningKey -> XML #
type Rep CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey type Rep CreateKeySigningKey = D1 ('MetaData "CreateKeySigningKey" "Amazonka.Route53.CreateKeySigningKey" "libZSservicesZSamazonka-route53ZSamazonka-route53" 'False) (C1 ('MetaCons "CreateKeySigningKey'" 'PrefixI 'True) ((S1 ('MetaSel ('Just "callerReference") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :: S1 ('MetaSel ('Just "hostedZoneId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 ResourceId)) :: (S1 ('MetaSel ('Just "keyManagementServiceArn") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :: (S1 ('MetaSel ('Just "name") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :: S1 ('MetaSel ('Just "status") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text)))))
type AWSResponse CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey type AWSResponse CreateKeySigningKey = CreateKeySigningKeyResponse

newCreateKeySigningKey Source #

Arguments

:: Text	`$sel:callerReference:CreateKeySigningKey'`
-> ResourceId	`$sel:hostedZoneId:CreateKeySigningKey'`
-> Text	`$sel:keyManagementServiceArn:CreateKeySigningKey'`
-> Text	`$sel:name:CreateKeySigningKey'`
-> Text	`$sel:status:CreateKeySigningKey'`
-> CreateKeySigningKey

Create a value of CreateKeySigningKey with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:callerReference:CreateKeySigningKey', createKeySigningKey_callerReference - A unique string that identifies the request.

$sel:hostedZoneId:CreateKeySigningKey', createKeySigningKey_hostedZoneId - The unique string (ID) used to identify a hosted zone.

$sel:keyManagementServiceArn:CreateKeySigningKey', createKeySigningKey_keyManagementServiceArn - The Amazon resource name (ARN) for a customer managed customer master key (CMK) in Key Management Service (KMS). The KeyManagementServiceArn must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of KeyManagementServiceArn that grants the correct permissions for DNSSEC, scroll down to Example.

You must configure the customer managed CMK as follows:

Status

Enabled

Key spec

ECC_NIST_P256

Key usage

Sign and verify

Key policy

The key policy must give permission for the following actions:

DescribeKey
GetPublicKey
Sign

The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:

"Service": "dnssec-route53.amazonaws.com"

For more information about working with a customer managed CMK in KMS, see Key Management Service concepts.

$sel:name:CreateKeySigningKey', createKeySigningKey_name - A string used to identify a key-signing key (KSK). Name can include numbers, letters, and underscores (_). Name must be unique for each key-signing key in the same hosted zone.

$sel:status:CreateKeySigningKey', createKeySigningKey_status - A string specifying the initial status of the key-signing key (KSK). You can set the value to ACTIVE or INACTIVE.

Request Lenses

createKeySigningKey_callerReference :: Lens' CreateKeySigningKey Text Source #

A unique string that identifies the request.

createKeySigningKey_hostedZoneId :: Lens' CreateKeySigningKey ResourceId Source #

The unique string (ID) used to identify a hosted zone.

createKeySigningKey_keyManagementServiceArn :: Lens' CreateKeySigningKey Text Source #

The Amazon resource name (ARN) for a customer managed customer master key (CMK) in Key Management Service (KMS). The KeyManagementServiceArn must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of KeyManagementServiceArn that grants the correct permissions for DNSSEC, scroll down to Example.

You must configure the customer managed CMK as follows:

Status

Enabled

Key spec

ECC_NIST_P256

Key usage

Sign and verify

Key policy

The key policy must give permission for the following actions:

DescribeKey
GetPublicKey
Sign

The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:

"Service": "dnssec-route53.amazonaws.com"

For more information about working with a customer managed CMK in KMS, see Key Management Service concepts.

createKeySigningKey_name :: Lens' CreateKeySigningKey Text Source #

A string used to identify a key-signing key (KSK). Name can include numbers, letters, and underscores (_). Name must be unique for each key-signing key in the same hosted zone.

createKeySigningKey_status :: Lens' CreateKeySigningKey Text Source #

A string specifying the initial status of the key-signing key (KSK). You can set the value to ACTIVE or INACTIVE.

Destructuring the Response

data CreateKeySigningKeyResponse Source #

See: newCreateKeySigningKeyResponse smart constructor.

Constructors

CreateKeySigningKeyResponse'
Fields httpStatus :: Int The response's http status code. changeInfo :: ChangeInfo keySigningKey :: KeySigningKey The key-signing key (KSK) that the request creates. location :: Text The unique URL representing the new key-signing key (KSK).

Instances

Instances details

Eq CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods (==) :: CreateKeySigningKeyResponse -> CreateKeySigningKeyResponse -> Bool # (/=) :: CreateKeySigningKeyResponse -> CreateKeySigningKeyResponse -> Bool #
Read CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods readsPrec :: Int -> ReadS CreateKeySigningKeyResponse # readList :: ReadS [CreateKeySigningKeyResponse] # readPrec :: ReadPrec CreateKeySigningKeyResponse # readListPrec :: ReadPrec [CreateKeySigningKeyResponse] #
Show CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods showsPrec :: Int -> CreateKeySigningKeyResponse -> ShowS # show :: CreateKeySigningKeyResponse -> String # showList :: [CreateKeySigningKeyResponse] -> ShowS #
Generic CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Associated Types type Rep CreateKeySigningKeyResponse :: Type -> Type # Methods from :: CreateKeySigningKeyResponse -> Rep CreateKeySigningKeyResponse x # to :: Rep CreateKeySigningKeyResponse x -> CreateKeySigningKeyResponse #
NFData CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods rnf :: CreateKeySigningKeyResponse -> () #
type Rep CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey type Rep CreateKeySigningKeyResponse = D1 ('MetaData "CreateKeySigningKeyResponse" "Amazonka.Route53.CreateKeySigningKey" "libZSservicesZSamazonka-route53ZSamazonka-route53" 'False) (C1 ('MetaCons "CreateKeySigningKeyResponse'" 'PrefixI 'True) ((S1 ('MetaSel ('Just "httpStatus") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Int) :: S1 ('MetaSel ('Just "changeInfo") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 ChangeInfo)) :: (S1 ('MetaSel ('Just "keySigningKey") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 KeySigningKey) :*: S1 ('MetaSel ('Just "location") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text))))

newCreateKeySigningKeyResponse Source #

Arguments

:: Int	`$sel:httpStatus:CreateKeySigningKeyResponse'`
-> ChangeInfo	`$sel:changeInfo:CreateKeySigningKeyResponse'`
-> KeySigningKey	`$sel:keySigningKey:CreateKeySigningKeyResponse'`
-> Text	`$sel:location:CreateKeySigningKeyResponse'`
-> CreateKeySigningKeyResponse

Create a value of CreateKeySigningKeyResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:httpStatus:CreateKeySigningKeyResponse', createKeySigningKeyResponse_httpStatus - The response's http status code.

$sel:changeInfo:CreateKeySigningKeyResponse', createKeySigningKeyResponse_changeInfo - Undocumented member.

$sel:keySigningKey:CreateKeySigningKeyResponse', createKeySigningKeyResponse_keySigningKey - The key-signing key (KSK) that the request creates.

$sel:location:CreateKeySigningKeyResponse', createKeySigningKeyResponse_location - The unique URL representing the new key-signing key (KSK).

Response Lenses

createKeySigningKeyResponse_httpStatus :: Lens' CreateKeySigningKeyResponse Int Source #

The response's http status code.

createKeySigningKeyResponse_changeInfo :: Lens' CreateKeySigningKeyResponse ChangeInfo Source #

Undocumented member.

createKeySigningKeyResponse_keySigningKey :: Lens' CreateKeySigningKeyResponse KeySigningKey Source #

The key-signing key (KSK) that the request creates.

createKeySigningKeyResponse_location :: Lens' CreateKeySigningKeyResponse Text Source #

The unique URL representing the new key-signing key (KSK).