GenerateDataKeyRequest

import type { GenerateDataKeyRequest } from "https://aws-api.deno.dev/v0.3/services/kms.ts?docs=full";

interface GenerateDataKeyRequest {

EncryptionContext?: {

[key: string]: string | null | undefined;

} | null;

GrantTokens?: string[] | null;

KeyId: string;

KeySpec?: DataKeySpec | null;

NumberOfBytes?: number | null;

}

§Properties

EncryptionContext?: {

[key: string]: string | null | undefined;

} | null

[src]

Specifies the encryption context that will be used when encrypting the data key.

An encryption context is a collection of non-secret key-value pairs that represents additional authenticated data. When you use an encryption context to encrypt data, you must specify the same (an exact case-sensitive match) encryption context to decrypt the data. An encryption context is optional when encrypting with a symmetric KMS key, but it is highly recommended.

For more information, see Encryption Context in the Key Management Service Developer Guide.

GrantTokens?: string[] | null

[src]

A list of grant tokens.

Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved eventual consistency. For more information, see Grant token and Using a grant token in the Key Management Service Developer Guide.

KeyId: string

[src]

Identifies the symmetric KMS key that encrypts the data key.

To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.

For example:

Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
Alias name: alias/ExampleAlias
Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias

To get the key ID and key ARN for a KMS key, use "ListKeys" or "DescribeKey". To get the alias name and alias ARN, use "ListAliases".

KeySpec?: DataKeySpec | null

[src]

Specifies the length of the data key. Use AES_128 to generate a 128-bit symmetric key, or AES_256 to generate a 256-bit symmetric key.

You must specify either the KeySpec or the NumberOfBytes parameter (but not both) in every GenerateDataKey request.

NumberOfBytes?: number | null

[src]

Specifies the length of the data key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For 128-bit (16-byte) and 256-bit (32-byte) data keys, use the KeySpec parameter.

You must specify either the KeySpec or the NumberOfBytes parameter (but not both) in every GenerateDataKey request.