| Copyright | (c) 2013-2018 Brendan Hay |
|---|---|
| License | Mozilla Public License, v. 2.0. |
| Maintainer | Brendan Hay <brendan.g.hay+amazonka@gmail.com> |
| Stability | auto-generated |
| Portability | non-portable (GHC extensions) |
| Safe Haskell | None |
| Language | Haskell2010 |
Network.AWS.KMS
Contents
- Service Configuration
- Errors
- InvalidMarkerException
- KMSInvalidStateException
- InvalidKeyUsageException
- MalformedPolicyDocumentException
- UnsupportedOperationException
- DisabledException
- KeyUnavailableException
- IncorrectKeyMaterialException
- KMSInternalException
- TagException
- InvalidImportTokenException
- NotFoundException
- InvalidAliasNameException
- InvalidGrantIdException
- InvalidGrantTokenException
- InvalidARNException
- DependencyTimeoutException
- ExpiredImportTokenException
- InvalidCiphertextException
- AlreadyExistsException
- LimitExceededException
- Waiters
- Operations
- Encrypt
- ListGrants (Paginated)
- DisableKeyRotation
- GenerateDataKeyWithoutPlaintext
- GetParametersForImport
- EnableKeyRotation
- CreateAlias
- CreateGrant
- ListAliases (Paginated)
- ListRetirableGrants
- GenerateRandom
- CreateKey
- DisableKey
- RetireGrant
- ListKeys (Paginated)
- ListResourceTags
- GetKeyRotationStatus
- GenerateDataKey
- DeleteAlias
- UpdateAlias
- DescribeKey
- CancelKeyDeletion
- Decrypt
- UpdateKeyDescription
- ReEncrypt
- TagResource
- ListKeyPolicies (Paginated)
- UntagResource
- ScheduleKeyDeletion
- PutKeyPolicy
- EnableKey
- RevokeGrant
- GetKeyPolicy
- ImportKeyMaterial
- DeleteImportedKeyMaterial
- Types
Description
AWS Key Management Service
AWS Key Management Service (AWS KMS) is an encryption and key management web service. This guide describes the AWS KMS operations that you can call programmatically. For general information about AWS KMS, see the AWS Key Management Service Developer Guide .
We recommend that you use the AWS SDKs to make programmatic API calls to AWS KMS.
Clients must support TLS (Transport Layer Security) 1.0. We recommend TLS 1.2. Clients must also support cipher suites with Perfect Forward Secrecy (PFS) such as Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems such as Java 7 and later support these modes.
Signing Requests
Requests must be signed by using an access key ID and a secret access key. We strongly recommend that you do not use your AWS account (root) access key ID and secret key for everyday work with AWS KMS. Instead, use the access key ID and secret access key for an IAM user, or you can use the AWS Security Token Service to generate temporary security credentials that you can use to sign requests.
All AWS KMS operations require Signature Version 4 .
Logging API Requests
AWS KMS supports AWS CloudTrail, a service that logs AWS API calls and related events for your AWS account and delivers them to an Amazon S3 bucket that you specify. By using the information collected by CloudTrail, you can determine what requests were made to AWS KMS, who made the request, when it was made, and so on. To learn more about CloudTrail, including how to turn it on and find your log files, see the AWS CloudTrail User Guide .
Additional Resources
For more information about credentials and request signing, see the following:
- AWS Security Credentials - This topic provides general information about the types of credentials used for accessing AWS.
- Temporary Security Credentials - This section of the IAM User Guide describes how to create and use temporary security credentials.
- Signature Version 4 Signing Process - This set of topics walks you through the process of signing a request using an access key ID and a secret access key.
Commonly Used APIs
Of the APIs discussed in this guide, the following will prove the most useful for most applications. You will likely perform actions other than these, such as creating keys and assigning policies, by using the console.
Synopsis
- kms :: Service
- _InvalidMarkerException :: AsError a => Getting (First ServiceError) a ServiceError
- _KMSInvalidStateException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidKeyUsageException :: AsError a => Getting (First ServiceError) a ServiceError
- _MalformedPolicyDocumentException :: AsError a => Getting (First ServiceError) a ServiceError
- _UnsupportedOperationException :: AsError a => Getting (First ServiceError) a ServiceError
- _DisabledException :: AsError a => Getting (First ServiceError) a ServiceError
- _KeyUnavailableException :: AsError a => Getting (First ServiceError) a ServiceError
- _IncorrectKeyMaterialException :: AsError a => Getting (First ServiceError) a ServiceError
- _KMSInternalException :: AsError a => Getting (First ServiceError) a ServiceError
- _TagException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError
- _NotFoundException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidAliasNameException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidGrantIdException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidGrantTokenException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidARNException :: AsError a => Getting (First ServiceError) a ServiceError
- _DependencyTimeoutException :: AsError a => Getting (First ServiceError) a ServiceError
- _ExpiredImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError
- _InvalidCiphertextException :: AsError a => Getting (First ServiceError) a ServiceError
- _AlreadyExistsException :: AsError a => Getting (First ServiceError) a ServiceError
- _LimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError
- module Network.AWS.KMS.Encrypt
- module Network.AWS.KMS.ListGrants
- module Network.AWS.KMS.DisableKeyRotation
- module Network.AWS.KMS.GenerateDataKeyWithoutPlaintext
- module Network.AWS.KMS.GetParametersForImport
- module Network.AWS.KMS.EnableKeyRotation
- module Network.AWS.KMS.CreateAlias
- module Network.AWS.KMS.CreateGrant
- module Network.AWS.KMS.ListAliases
- module Network.AWS.KMS.ListRetirableGrants
- module Network.AWS.KMS.GenerateRandom
- module Network.AWS.KMS.CreateKey
- module Network.AWS.KMS.DisableKey
- module Network.AWS.KMS.RetireGrant
- module Network.AWS.KMS.ListKeys
- module Network.AWS.KMS.ListResourceTags
- module Network.AWS.KMS.GetKeyRotationStatus
- module Network.AWS.KMS.GenerateDataKey
- module Network.AWS.KMS.DeleteAlias
- module Network.AWS.KMS.UpdateAlias
- module Network.AWS.KMS.DescribeKey
- module Network.AWS.KMS.CancelKeyDeletion
- module Network.AWS.KMS.Decrypt
- module Network.AWS.KMS.UpdateKeyDescription
- module Network.AWS.KMS.ReEncrypt
- module Network.AWS.KMS.TagResource
- module Network.AWS.KMS.ListKeyPolicies
- module Network.AWS.KMS.UntagResource
- module Network.AWS.KMS.ScheduleKeyDeletion
- module Network.AWS.KMS.PutKeyPolicy
- module Network.AWS.KMS.EnableKey
- module Network.AWS.KMS.RevokeGrant
- module Network.AWS.KMS.GetKeyPolicy
- module Network.AWS.KMS.ImportKeyMaterial
- module Network.AWS.KMS.DeleteImportedKeyMaterial
- data AlgorithmSpec
- data DataKeySpec
- data ExpirationModelType
- data GrantOperation
- data KeyManagerType
- data KeyState
- data KeyUsageType = EncryptDecrypt
- data OriginType
- data WrappingKeySpec = Rsa2048
- data AliasListEntry
- aliasListEntry :: AliasListEntry
- aleTargetKeyId :: Lens' AliasListEntry (Maybe Text)
- aleAliasName :: Lens' AliasListEntry (Maybe Text)
- aleAliasARN :: Lens' AliasListEntry (Maybe Text)
- data GrantConstraints
- grantConstraints :: GrantConstraints
- gcEncryptionContextEquals :: Lens' GrantConstraints (HashMap Text Text)
- gcEncryptionContextSubset :: Lens' GrantConstraints (HashMap Text Text)
- data GrantListEntry
- grantListEntry :: GrantListEntry
- gleKeyId :: Lens' GrantListEntry (Maybe Text)
- gleRetiringPrincipal :: Lens' GrantListEntry (Maybe Text)
- gleIssuingAccount :: Lens' GrantListEntry (Maybe Text)
- gleGrantId :: Lens' GrantListEntry (Maybe Text)
- gleConstraints :: Lens' GrantListEntry (Maybe GrantConstraints)
- gleGranteePrincipal :: Lens' GrantListEntry (Maybe Text)
- gleName :: Lens' GrantListEntry (Maybe Text)
- gleCreationDate :: Lens' GrantListEntry (Maybe UTCTime)
- gleOperations :: Lens' GrantListEntry [GrantOperation]
- data KeyListEntry
- keyListEntry :: KeyListEntry
- kleKeyId :: Lens' KeyListEntry (Maybe Text)
- kleKeyARN :: Lens' KeyListEntry (Maybe Text)
- data KeyMetadata
- keyMetadata :: Text -> KeyMetadata
- kmOrigin :: Lens' KeyMetadata (Maybe OriginType)
- kmExpirationModel :: Lens' KeyMetadata (Maybe ExpirationModelType)
- kmKeyManager :: Lens' KeyMetadata (Maybe KeyManagerType)
- kmEnabled :: Lens' KeyMetadata (Maybe Bool)
- kmValidTo :: Lens' KeyMetadata (Maybe UTCTime)
- kmARN :: Lens' KeyMetadata (Maybe Text)
- kmKeyState :: Lens' KeyMetadata (Maybe KeyState)
- kmAWSAccountId :: Lens' KeyMetadata (Maybe Text)
- kmKeyUsage :: Lens' KeyMetadata (Maybe KeyUsageType)
- kmCreationDate :: Lens' KeyMetadata (Maybe UTCTime)
- kmDeletionDate :: Lens' KeyMetadata (Maybe UTCTime)
- kmDescription :: Lens' KeyMetadata (Maybe Text)
- kmKeyId :: Lens' KeyMetadata Text
- data ListGrantsResponse
- listGrantsResponse :: ListGrantsResponse
- lgTruncated :: Lens' ListGrantsResponse (Maybe Bool)
- lgGrants :: Lens' ListGrantsResponse [GrantListEntry]
- lgNextMarker :: Lens' ListGrantsResponse (Maybe Text)
- data Tag
- tag :: Text -> Text -> Tag
- tagTagKey :: Lens' Tag Text
- tagTagValue :: Lens' Tag Text
Service Configuration
Errors
Error matchers are designed for use with the functions provided by
Control.Exception.Lens.
This allows catching (and rethrowing) service specific errors returned
by KMS.
InvalidMarkerException
_InvalidMarkerException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the marker that specifies where pagination should next begin is not valid.
KMSInvalidStateException
_KMSInvalidStateException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the state of the specified resource is not valid for this request.
For more information about how key state affects the use of a CMK, see How Key State Affects Use of a Customer Master Key in the AWS Key Management Service Developer Guide .
InvalidKeyUsageException
_InvalidKeyUsageException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the specified KeySpec value is not valid.
MalformedPolicyDocumentException
_MalformedPolicyDocumentException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the specified policy is not syntactically or semantically correct.
UnsupportedOperationException
_UnsupportedOperationException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because a specified parameter is not supported or a specified resource is not valid for this operation.
DisabledException
_DisabledException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the specified CMK is not enabled.
KeyUnavailableException
_KeyUnavailableException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the specified CMK was not available. The request can be retried.
IncorrectKeyMaterialException
_IncorrectKeyMaterialException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the provided key material is invalid or is not the same key material that was previously imported into this customer master key (CMK).
KMSInternalException
_KMSInternalException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because an internal exception occurred. The request can be retried.
TagException
_TagException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because one or more tags are not valid.
InvalidImportTokenException
_InvalidImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the provided import token is invalid or is associated with a different customer master key (CMK).
NotFoundException
_NotFoundException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the specified entity or resource could not be found.
InvalidAliasNameException
_InvalidAliasNameException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the specified alias name is not valid.
InvalidGrantIdException
_InvalidGrantIdException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the specified GrantId is not valid.
InvalidGrantTokenException
_InvalidGrantTokenException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the specified grant token is not valid.
InvalidARNException
_InvalidARNException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because a specified ARN was not valid.
DependencyTimeoutException
_DependencyTimeoutException :: AsError a => Getting (First ServiceError) a ServiceError #
The system timed out while trying to fulfill the request. The request can be retried.
ExpiredImportTokenException
_ExpiredImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the provided import token is expired. Use GetParametersForImport to get a new import token and public key, use the new public key to encrypt the key material, and then try the request again.
InvalidCiphertextException
_InvalidCiphertextException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because the specified ciphertext, or additional authenticated data incorporated into the ciphertext, such as the encryption context, is corrupted, missing, or otherwise invalid.
AlreadyExistsException
_AlreadyExistsException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because it attempted to create a resource that already exists.
LimitExceededException
_LimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError #
The request was rejected because a limit was exceeded. For more information, see Limits in the AWS Key Management Service Developer Guide .
Waiters
Waiters poll by repeatedly sending a request until some remote success condition
configured by the Wait specification is fulfilled. The Wait specification
determines how many attempts should be made, in addition to delay and retry strategies.
Operations
Some AWS operations return results that are incomplete and require subsequent
requests in order to obtain the entire result set. The process of sending
subsequent requests to continue where a previous request left off is called
pagination. For example, the ListObjects operation of Amazon S3 returns up to
1000 objects at a time, and you must send subsequent requests with the
appropriate Marker in order to retrieve the next page of results.
Operations that have an AWSPager instance can transparently perform subsequent
requests, correctly setting Markers and other request facets to iterate through
the entire result set of a truncated API operation. Operations which support
this have an additional note in the documentation.
Many operations have the ability to filter results on the server side. See the individual operation parameters for details.
Encrypt
module Network.AWS.KMS.Encrypt
ListGrants (Paginated)
module Network.AWS.KMS.ListGrants
DisableKeyRotation
GenerateDataKeyWithoutPlaintext
GetParametersForImport
EnableKeyRotation
CreateAlias
module Network.AWS.KMS.CreateAlias
CreateGrant
module Network.AWS.KMS.CreateGrant
ListAliases (Paginated)
module Network.AWS.KMS.ListAliases
ListRetirableGrants
GenerateRandom
CreateKey
module Network.AWS.KMS.CreateKey
DisableKey
module Network.AWS.KMS.DisableKey
RetireGrant
module Network.AWS.KMS.RetireGrant
ListKeys (Paginated)
module Network.AWS.KMS.ListKeys
ListResourceTags
GetKeyRotationStatus
GenerateDataKey
DeleteAlias
module Network.AWS.KMS.DeleteAlias
UpdateAlias
module Network.AWS.KMS.UpdateAlias
DescribeKey
module Network.AWS.KMS.DescribeKey
CancelKeyDeletion
Decrypt
module Network.AWS.KMS.Decrypt
UpdateKeyDescription
ReEncrypt
module Network.AWS.KMS.ReEncrypt
TagResource
module Network.AWS.KMS.TagResource
ListKeyPolicies (Paginated)
UntagResource
ScheduleKeyDeletion
PutKeyPolicy
module Network.AWS.KMS.PutKeyPolicy
EnableKey
module Network.AWS.KMS.EnableKey
RevokeGrant
module Network.AWS.KMS.RevokeGrant
GetKeyPolicy
module Network.AWS.KMS.GetKeyPolicy
ImportKeyMaterial
DeleteImportedKeyMaterial
Types
AlgorithmSpec
data AlgorithmSpec #
Constructors
| RsaesOaepSha1 | |
| RsaesOaepSha256 | |
| RsaesPKCS1V15 |
Instances
DataKeySpec
data DataKeySpec #
Instances
ExpirationModelType
data ExpirationModelType #
Constructors
| KeyMaterialDoesNotExpire | |
| KeyMaterialExpires |
Instances
GrantOperation
data GrantOperation #
Constructors
| CreateGrant | |
| Decrypt | |
| DescribeKey | |
| Encrypt | |
| GenerateDataKey | |
| GenerateDataKeyWithoutPlaintext | |
| ReEncryptFrom | |
| ReEncryptTo | |
| RetireGrant |
Instances
KeyManagerType
data KeyManagerType #
Instances
KeyState
Constructors
| Disabled | |
| Enabled | |
| PendingDeletion | |
| PendingImport |
Instances
| Bounded KeyState # | |
| Enum KeyState # | |
Defined in Network.AWS.KMS.Types.Sum | |
| Eq KeyState # | |
| Data KeyState # | |
Defined in Network.AWS.KMS.Types.Sum Methods gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> KeyState -> c KeyState # gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c KeyState # toConstr :: KeyState -> Constr # dataTypeOf :: KeyState -> DataType # dataCast1 :: Typeable t => (forall d. Data d => c (t d)) -> Maybe (c KeyState) # dataCast2 :: Typeable t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c KeyState) # gmapT :: (forall b. Data b => b -> b) -> KeyState -> KeyState # gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> KeyState -> r # gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> KeyState -> r # gmapQ :: (forall d. Data d => d -> u) -> KeyState -> [u] # gmapQi :: Int -> (forall d. Data d => d -> u) -> KeyState -> u # gmapM :: Monad m => (forall d. Data d => d -> m d) -> KeyState -> m KeyState # gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> KeyState -> m KeyState # gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> KeyState -> m KeyState # | |
| Ord KeyState # | |
Defined in Network.AWS.KMS.Types.Sum | |
| Read KeyState # | |
| Show KeyState # | |
| Generic KeyState # | |
| Hashable KeyState # | |
Defined in Network.AWS.KMS.Types.Sum | |
| FromJSON KeyState # | |
| ToHeader KeyState # | |
Defined in Network.AWS.KMS.Types.Sum Methods toHeader :: HeaderName -> KeyState -> [Header] # | |
| ToQuery KeyState # | |
Defined in Network.AWS.KMS.Types.Sum Methods toQuery :: KeyState -> QueryString # | |
| ToByteString KeyState # | |
Defined in Network.AWS.KMS.Types.Sum Methods toBS :: KeyState -> ByteString # | |
| FromText KeyState # | |
Defined in Network.AWS.KMS.Types.Sum | |
| ToText KeyState # | |
Defined in Network.AWS.KMS.Types.Sum | |
| NFData KeyState # | |
Defined in Network.AWS.KMS.Types.Sum | |
| type Rep KeyState # | |
Defined in Network.AWS.KMS.Types.Sum type Rep KeyState = D1 (MetaData "KeyState" "Network.AWS.KMS.Types.Sum" "amazonka-kms-1.6.0-J0DpkKKCQ2By8yYSyE2w7" False) ((C1 (MetaCons "Disabled" PrefixI False) (U1 :: * -> *) :+: C1 (MetaCons "Enabled" PrefixI False) (U1 :: * -> *)) :+: (C1 (MetaCons "PendingDeletion" PrefixI False) (U1 :: * -> *) :+: C1 (MetaCons "PendingImport" PrefixI False) (U1 :: * -> *))) | |
KeyUsageType
data KeyUsageType #
Constructors
| EncryptDecrypt |
Instances
OriginType
data OriginType #
Instances
WrappingKeySpec
data WrappingKeySpec #
Constructors
| Rsa2048 |
Instances
AliasListEntry
data AliasListEntry #
Contains information about an alias.
See: aliasListEntry smart constructor.
Instances
aliasListEntry :: AliasListEntry #
Creates a value of AliasListEntry with the minimum fields required to make a request.
Use one of the following lenses to modify other fields as desired:
aleTargetKeyId- String that contains the key identifier referred to by the alias.aleAliasName- String that contains the alias.aleAliasARN- String that contains the key ARN.
aleTargetKeyId :: Lens' AliasListEntry (Maybe Text) #
String that contains the key identifier referred to by the alias.
aleAliasName :: Lens' AliasListEntry (Maybe Text) #
String that contains the alias.
aleAliasARN :: Lens' AliasListEntry (Maybe Text) #
String that contains the key ARN.
GrantConstraints
data GrantConstraints #
A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see Encryption Context in the AWS Key Management Service Developer Guide .
Grant constraints apply only to operations that accept encryption context as input. For example, the DescribeKey DescribeKey operation does so regardless of the grant constraints. In constrast, the Encrypt Encrypt operation does so only when the encryption context of the Encrypt operation satisfies the grant constraints.
See: grantConstraints smart constructor.
Instances
grantConstraints :: GrantConstraints #
Creates a value of GrantConstraints with the minimum fields required to make a request.
Use one of the following lenses to modify other fields as desired:
gcEncryptionContextEquals- A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows. When certain subsequent operations allowed by the grant include encryption context that matches this list, the grant allows the operation. Otherwise, the grant does not allow the operation.gcEncryptionContextSubset- A list of key-value pairs, all of which must be present in the encryption context of certain subsequent operations that the grant allows. When certain subsequent operations allowed by the grant include encryption context that matches this list or is a superset of this list, the grant allows the operation. Otherwise, the grant does not allow the operation.
gcEncryptionContextEquals :: Lens' GrantConstraints (HashMap Text Text) #
A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows. When certain subsequent operations allowed by the grant include encryption context that matches this list, the grant allows the operation. Otherwise, the grant does not allow the operation.
gcEncryptionContextSubset :: Lens' GrantConstraints (HashMap Text Text) #
A list of key-value pairs, all of which must be present in the encryption context of certain subsequent operations that the grant allows. When certain subsequent operations allowed by the grant include encryption context that matches this list or is a superset of this list, the grant allows the operation. Otherwise, the grant does not allow the operation.
GrantListEntry
data GrantListEntry #
Contains information about an entry in a list of grants.
See: grantListEntry smart constructor.
Instances
grantListEntry :: GrantListEntry #
Creates a value of GrantListEntry with the minimum fields required to make a request.
Use one of the following lenses to modify other fields as desired:
gleKeyId- The unique identifier for the customer master key (CMK) to which the grant applies.gleRetiringPrincipal- The principal that can retire the grant.gleIssuingAccount- The AWS account under which the grant was issued.gleGrantId- The unique identifier for the grant.gleConstraints- A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows.gleGranteePrincipal- The principal that receives the grant's permissions.gleName- The friendly name that identifies the grant. If a name was provided in theCreateGrantrequest, that name is returned. Otherwise this value is null.gleCreationDate- The date and time when the grant was created.gleOperations- The list of operations permitted by the grant.
gleKeyId :: Lens' GrantListEntry (Maybe Text) #
The unique identifier for the customer master key (CMK) to which the grant applies.
gleRetiringPrincipal :: Lens' GrantListEntry (Maybe Text) #
The principal that can retire the grant.
gleIssuingAccount :: Lens' GrantListEntry (Maybe Text) #
The AWS account under which the grant was issued.
gleGrantId :: Lens' GrantListEntry (Maybe Text) #
The unique identifier for the grant.
gleConstraints :: Lens' GrantListEntry (Maybe GrantConstraints) #
A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows.
gleGranteePrincipal :: Lens' GrantListEntry (Maybe Text) #
The principal that receives the grant's permissions.
gleName :: Lens' GrantListEntry (Maybe Text) #
The friendly name that identifies the grant. If a name was provided in the CreateGrant request, that name is returned. Otherwise this value is null.
gleCreationDate :: Lens' GrantListEntry (Maybe UTCTime) #
The date and time when the grant was created.
gleOperations :: Lens' GrantListEntry [GrantOperation] #
The list of operations permitted by the grant.
KeyListEntry
data KeyListEntry #
Contains information about each entry in the key list.
See: keyListEntry smart constructor.
Instances
keyListEntry :: KeyListEntry #
Creates a value of KeyListEntry with the minimum fields required to make a request.
Use one of the following lenses to modify other fields as desired:
KeyMetadata
data KeyMetadata #
Contains metadata about a customer master key (CMK).
This data type is used as a response element for the CreateKey and DescribeKey operations.
See: keyMetadata smart constructor.
Instances
Arguments
| :: Text | |
| -> KeyMetadata |
Creates a value of KeyMetadata with the minimum fields required to make a request.
Use one of the following lenses to modify other fields as desired:
kmOrigin- The source of the CMK's key material. When this value isAWS_KMS, AWS KMS created the key material. When this value isEXTERNAL, the key material was imported from your existing key management infrastructure or the CMK lacks key material.kmExpirationModel- Specifies whether the CMK's key material expires. This value is present only whenOriginisEXTERNAL, otherwise this value is omitted.kmKeyManager- The CMK's manager. CMKs are either customer-managed or AWS-managed. For more information about the difference, see Customer Master Keys in the AWS Key Management Service Developer Guide .kmEnabled- Specifies whether the CMK is enabled. WhenKeyStateisEnabledthis value is true, otherwise it is false.kmValidTo- The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. This value is present only for CMKs whoseOriginisEXTERNALand whoseExpirationModelisKEY_MATERIAL_EXPIRES, otherwise this value is omitted.kmARN- The Amazon Resource Name (ARN) of the CMK. For examples, see AWS Key Management Service (AWS KMS) in the Example ARNs section of the AWS General Reference .kmKeyState- The state of the CMK. For more information about how key state affects the use of a CMK, see How Key State Affects the Use of a Customer Master Key in the AWS Key Management Service Developer Guide .kmAWSAccountId- The twelve-digit account ID of the AWS account that owns the CMK.kmKeyUsage- The cryptographic operations for which you can use the CMK. Currently the only allowed value isENCRYPT_DECRYPT, which means you can use the CMK for theEncryptandDecryptoperations.kmCreationDate- The date and time when the CMK was created.kmDeletionDate- The date and time after which AWS KMS deletes the CMK. This value is present only whenKeyStateisPendingDeletion, otherwise this value is omitted.kmDescription- The description of the CMK.kmKeyId- The globally unique identifier for the CMK.
kmOrigin :: Lens' KeyMetadata (Maybe OriginType) #
The source of the CMK's key material. When this value is AWS_KMS , AWS KMS created the key material. When this value is EXTERNAL , the key material was imported from your existing key management infrastructure or the CMK lacks key material.
kmExpirationModel :: Lens' KeyMetadata (Maybe ExpirationModelType) #
Specifies whether the CMK's key material expires. This value is present only when Origin is EXTERNAL , otherwise this value is omitted.
kmKeyManager :: Lens' KeyMetadata (Maybe KeyManagerType) #
The CMK's manager. CMKs are either customer-managed or AWS-managed. For more information about the difference, see Customer Master Keys in the AWS Key Management Service Developer Guide .
kmEnabled :: Lens' KeyMetadata (Maybe Bool) #
Specifies whether the CMK is enabled. When KeyState is Enabled this value is true, otherwise it is false.
kmValidTo :: Lens' KeyMetadata (Maybe UTCTime) #
The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. This value is present only for CMKs whose Origin is EXTERNAL and whose ExpirationModel is KEY_MATERIAL_EXPIRES , otherwise this value is omitted.
kmARN :: Lens' KeyMetadata (Maybe Text) #
The Amazon Resource Name (ARN) of the CMK. For examples, see AWS Key Management Service (AWS KMS) in the Example ARNs section of the AWS General Reference .
kmKeyState :: Lens' KeyMetadata (Maybe KeyState) #
The state of the CMK. For more information about how key state affects the use of a CMK, see How Key State Affects the Use of a Customer Master Key in the AWS Key Management Service Developer Guide .
kmAWSAccountId :: Lens' KeyMetadata (Maybe Text) #
The twelve-digit account ID of the AWS account that owns the CMK.
kmCreationDate :: Lens' KeyMetadata (Maybe UTCTime) #
The date and time when the CMK was created.
kmDeletionDate :: Lens' KeyMetadata (Maybe UTCTime) #
The date and time after which AWS KMS deletes the CMK. This value is present only when KeyState is PendingDeletion , otherwise this value is omitted.
kmDescription :: Lens' KeyMetadata (Maybe Text) #
The description of the CMK.
kmKeyId :: Lens' KeyMetadata Text #
The globally unique identifier for the CMK.
ListGrantsResponse
data ListGrantsResponse #
See: listGrantsResponse smart constructor.
Instances
listGrantsResponse :: ListGrantsResponse #
Creates a value of ListGrantsResponse with the minimum fields required to make a request.
Use one of the following lenses to modify other fields as desired:
lgTruncated- A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of theNextMarkerelement in this response to theMarkerparameter in a subsequent request.lgGrants- A list of grants.lgNextMarker- WhenTruncatedis true, this element is present and contains the value to use for theMarkerparameter in a subsequent request.
lgTruncated :: Lens' ListGrantsResponse (Maybe Bool) #
A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the NextMarker element in this response to the Marker parameter in a subsequent request.
lgGrants :: Lens' ListGrantsResponse [GrantListEntry] #
A list of grants.
lgNextMarker :: Lens' ListGrantsResponse (Maybe Text) #
When Truncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent request.
Tag
A key-value pair. A tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
For information about the rules that apply to tag keys and tag values, see User-Defined Tag Restrictions in the AWS Billing and Cost Management User Guide .
See: tag smart constructor.
Instances
| Eq Tag # | |
| Data Tag # | |
Defined in Network.AWS.KMS.Types.Product Methods gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> Tag -> c Tag # gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c Tag # dataTypeOf :: Tag -> DataType # dataCast1 :: Typeable t => (forall d. Data d => c (t d)) -> Maybe (c Tag) # dataCast2 :: Typeable t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c Tag) # gmapT :: (forall b. Data b => b -> b) -> Tag -> Tag # gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> Tag -> r # gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> Tag -> r # gmapQ :: (forall d. Data d => d -> u) -> Tag -> [u] # gmapQi :: Int -> (forall d. Data d => d -> u) -> Tag -> u # gmapM :: Monad m => (forall d. Data d => d -> m d) -> Tag -> m Tag # gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> Tag -> m Tag # gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> Tag -> m Tag # | |
| Read Tag # | |
| Show Tag # | |
| Generic Tag # | |
| Hashable Tag # | |
Defined in Network.AWS.KMS.Types.Product | |
| ToJSON Tag # | |
Defined in Network.AWS.KMS.Types.Product | |
| FromJSON Tag # | |
| NFData Tag # | |
Defined in Network.AWS.KMS.Types.Product | |
| type Rep Tag # | |
Defined in Network.AWS.KMS.Types.Product type Rep Tag = D1 (MetaData "Tag" "Network.AWS.KMS.Types.Product" "amazonka-kms-1.6.0-J0DpkKKCQ2By8yYSyE2w7" False) (C1 (MetaCons "Tag'" PrefixI True) (S1 (MetaSel (Just "_tagTagKey") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text) :*: S1 (MetaSel (Just "_tagTagValue") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text))) | |
Creates a value of Tag with the minimum fields required to make a request.
Use one of the following lenses to modify other fields as desired:
tagTagKey- The key of the tag.tagTagValue- The value of the tag.
tagTagValue :: Lens' Tag Text #
The value of the tag.