const (
    // AlgorithmSpecRsaesPkcs1V15 is a AlgorithmSpec enum value
    AlgorithmSpecRsaesPkcs1V15 = "RSAES_PKCS1_V1_5"

    // AlgorithmSpecRsaesOaepSha1 is a AlgorithmSpec enum value
    AlgorithmSpecRsaesOaepSha1 = "RSAES_OAEP_SHA_1"

    // AlgorithmSpecRsaesOaepSha256 is a AlgorithmSpec enum value
    AlgorithmSpecRsaesOaepSha256 = "RSAES_OAEP_SHA_256"

    // AlgorithmSpecRsaAesKeyWrapSha1 is a AlgorithmSpec enum value
    AlgorithmSpecRsaAesKeyWrapSha1 = "RSA_AES_KEY_WRAP_SHA_1"

    // AlgorithmSpecRsaAesKeyWrapSha256 is a AlgorithmSpec enum value
    AlgorithmSpecRsaAesKeyWrapSha256 = "RSA_AES_KEY_WRAP_SHA_256"

    // AlgorithmSpecSm2pke is a AlgorithmSpec enum value
    AlgorithmSpecSm2pke = "SM2PKE"
)

const (
    // ConnectionErrorCodeTypeInvalidCredentials is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeInvalidCredentials = "INVALID_CREDENTIALS"

    // ConnectionErrorCodeTypeClusterNotFound is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeClusterNotFound = "CLUSTER_NOT_FOUND"

    // ConnectionErrorCodeTypeNetworkErrors is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeNetworkErrors = "NETWORK_ERRORS"

    // ConnectionErrorCodeTypeInternalError is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeInternalError = "INTERNAL_ERROR"

    // ConnectionErrorCodeTypeInsufficientCloudhsmHsms is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeInsufficientCloudhsmHsms = "INSUFFICIENT_CLOUDHSM_HSMS"

    // ConnectionErrorCodeTypeUserLockedOut is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeUserLockedOut = "USER_LOCKED_OUT"

    // ConnectionErrorCodeTypeUserNotFound is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeUserNotFound = "USER_NOT_FOUND"

    // ConnectionErrorCodeTypeUserLoggedIn is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeUserLoggedIn = "USER_LOGGED_IN"

    // ConnectionErrorCodeTypeSubnetNotFound is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeSubnetNotFound = "SUBNET_NOT_FOUND"

    // ConnectionErrorCodeTypeInsufficientFreeAddressesInSubnet is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeInsufficientFreeAddressesInSubnet = "INSUFFICIENT_FREE_ADDRESSES_IN_SUBNET"

    // ConnectionErrorCodeTypeXksProxyAccessDenied is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeXksProxyAccessDenied = "XKS_PROXY_ACCESS_DENIED"

    // ConnectionErrorCodeTypeXksProxyNotReachable is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeXksProxyNotReachable = "XKS_PROXY_NOT_REACHABLE"

    // ConnectionErrorCodeTypeXksVpcEndpointServiceNotFound is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeXksVpcEndpointServiceNotFound = "XKS_VPC_ENDPOINT_SERVICE_NOT_FOUND"

    // ConnectionErrorCodeTypeXksProxyInvalidResponse is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeXksProxyInvalidResponse = "XKS_PROXY_INVALID_RESPONSE"

    // ConnectionErrorCodeTypeXksProxyInvalidConfiguration is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeXksProxyInvalidConfiguration = "XKS_PROXY_INVALID_CONFIGURATION"

    // ConnectionErrorCodeTypeXksVpcEndpointServiceInvalidConfiguration is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeXksVpcEndpointServiceInvalidConfiguration = "XKS_VPC_ENDPOINT_SERVICE_INVALID_CONFIGURATION"

    // ConnectionErrorCodeTypeXksProxyTimedOut is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeXksProxyTimedOut = "XKS_PROXY_TIMED_OUT"

    // ConnectionErrorCodeTypeXksProxyInvalidTlsConfiguration is a ConnectionErrorCodeType enum value
    ConnectionErrorCodeTypeXksProxyInvalidTlsConfiguration = "XKS_PROXY_INVALID_TLS_CONFIGURATION"
)

const (
    // ConnectionStateTypeConnected is a ConnectionStateType enum value
    ConnectionStateTypeConnected = "CONNECTED"

    // ConnectionStateTypeConnecting is a ConnectionStateType enum value
    ConnectionStateTypeConnecting = "CONNECTING"

    // ConnectionStateTypeFailed is a ConnectionStateType enum value
    ConnectionStateTypeFailed = "FAILED"

    // ConnectionStateTypeDisconnected is a ConnectionStateType enum value
    ConnectionStateTypeDisconnected = "DISCONNECTED"

    // ConnectionStateTypeDisconnecting is a ConnectionStateType enum value
    ConnectionStateTypeDisconnecting = "DISCONNECTING"
)

const (
    // CustomKeyStoreTypeAwsCloudhsm is a CustomKeyStoreType enum value
    CustomKeyStoreTypeAwsCloudhsm = "AWS_CLOUDHSM"

    // CustomKeyStoreTypeExternalKeyStore is a CustomKeyStoreType enum value
    CustomKeyStoreTypeExternalKeyStore = "EXTERNAL_KEY_STORE"
)

const (
    // CustomerMasterKeySpecRsa2048 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecRsa2048 = "RSA_2048"

    // CustomerMasterKeySpecRsa3072 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecRsa3072 = "RSA_3072"

    // CustomerMasterKeySpecRsa4096 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecRsa4096 = "RSA_4096"

    // CustomerMasterKeySpecEccNistP256 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecEccNistP256 = "ECC_NIST_P256"

    // CustomerMasterKeySpecEccNistP384 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecEccNistP384 = "ECC_NIST_P384"

    // CustomerMasterKeySpecEccNistP521 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecEccNistP521 = "ECC_NIST_P521"

    // CustomerMasterKeySpecEccSecgP256k1 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecEccSecgP256k1 = "ECC_SECG_P256K1"

    // CustomerMasterKeySpecSymmetricDefault is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecSymmetricDefault = "SYMMETRIC_DEFAULT"

    // CustomerMasterKeySpecHmac224 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecHmac224 = "HMAC_224"

    // CustomerMasterKeySpecHmac256 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecHmac256 = "HMAC_256"

    // CustomerMasterKeySpecHmac384 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecHmac384 = "HMAC_384"

    // CustomerMasterKeySpecHmac512 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecHmac512 = "HMAC_512"

    // CustomerMasterKeySpecSm2 is a CustomerMasterKeySpec enum value
    CustomerMasterKeySpecSm2 = "SM2"
)

const (
    // DataKeyPairSpecRsa2048 is a DataKeyPairSpec enum value
    DataKeyPairSpecRsa2048 = "RSA_2048"

    // DataKeyPairSpecRsa3072 is a DataKeyPairSpec enum value
    DataKeyPairSpecRsa3072 = "RSA_3072"

    // DataKeyPairSpecRsa4096 is a DataKeyPairSpec enum value
    DataKeyPairSpecRsa4096 = "RSA_4096"

    // DataKeyPairSpecEccNistP256 is a DataKeyPairSpec enum value
    DataKeyPairSpecEccNistP256 = "ECC_NIST_P256"

    // DataKeyPairSpecEccNistP384 is a DataKeyPairSpec enum value
    DataKeyPairSpecEccNistP384 = "ECC_NIST_P384"

    // DataKeyPairSpecEccNistP521 is a DataKeyPairSpec enum value
    DataKeyPairSpecEccNistP521 = "ECC_NIST_P521"

    // DataKeyPairSpecEccSecgP256k1 is a DataKeyPairSpec enum value
    DataKeyPairSpecEccSecgP256k1 = "ECC_SECG_P256K1"

    // DataKeyPairSpecSm2 is a DataKeyPairSpec enum value
    DataKeyPairSpecSm2 = "SM2"
)

const (
    // DataKeySpecAes256 is a DataKeySpec enum value
    DataKeySpecAes256 = "AES_256"

    // DataKeySpecAes128 is a DataKeySpec enum value
    DataKeySpecAes128 = "AES_128"
)

const (
    // EncryptionAlgorithmSpecSymmetricDefault is a EncryptionAlgorithmSpec enum value
    EncryptionAlgorithmSpecSymmetricDefault = "SYMMETRIC_DEFAULT"

    // EncryptionAlgorithmSpecRsaesOaepSha1 is a EncryptionAlgorithmSpec enum value
    EncryptionAlgorithmSpecRsaesOaepSha1 = "RSAES_OAEP_SHA_1"

    // EncryptionAlgorithmSpecRsaesOaepSha256 is a EncryptionAlgorithmSpec enum value
    EncryptionAlgorithmSpecRsaesOaepSha256 = "RSAES_OAEP_SHA_256"

    // EncryptionAlgorithmSpecSm2pke is a EncryptionAlgorithmSpec enum value
    EncryptionAlgorithmSpecSm2pke = "SM2PKE"
)

const (
    // ExpirationModelTypeKeyMaterialExpires is a ExpirationModelType enum value
    ExpirationModelTypeKeyMaterialExpires = "KEY_MATERIAL_EXPIRES"

    // ExpirationModelTypeKeyMaterialDoesNotExpire is a ExpirationModelType enum value
    ExpirationModelTypeKeyMaterialDoesNotExpire = "KEY_MATERIAL_DOES_NOT_EXPIRE"
)

const (
    // GrantOperationDecrypt is a GrantOperation enum value
    GrantOperationDecrypt = "Decrypt"

    // GrantOperationEncrypt is a GrantOperation enum value
    GrantOperationEncrypt = "Encrypt"

    // GrantOperationGenerateDataKey is a GrantOperation enum value
    GrantOperationGenerateDataKey = "GenerateDataKey"

    // GrantOperationGenerateDataKeyWithoutPlaintext is a GrantOperation enum value
    GrantOperationGenerateDataKeyWithoutPlaintext = "GenerateDataKeyWithoutPlaintext"

    // GrantOperationReEncryptFrom is a GrantOperation enum value
    GrantOperationReEncryptFrom = "ReEncryptFrom"

    // GrantOperationReEncryptTo is a GrantOperation enum value
    GrantOperationReEncryptTo = "ReEncryptTo"

    // GrantOperationSign is a GrantOperation enum value
    GrantOperationSign = "Sign"

    // GrantOperationVerify is a GrantOperation enum value
    GrantOperationVerify = "Verify"

    // GrantOperationGetPublicKey is a GrantOperation enum value
    GrantOperationGetPublicKey = "GetPublicKey"

    // GrantOperationCreateGrant is a GrantOperation enum value
    GrantOperationCreateGrant = "CreateGrant"

    // GrantOperationRetireGrant is a GrantOperation enum value
    GrantOperationRetireGrant = "RetireGrant"

    // GrantOperationDescribeKey is a GrantOperation enum value
    GrantOperationDescribeKey = "DescribeKey"

    // GrantOperationGenerateDataKeyPair is a GrantOperation enum value
    GrantOperationGenerateDataKeyPair = "GenerateDataKeyPair"

    // GrantOperationGenerateDataKeyPairWithoutPlaintext is a GrantOperation enum value
    GrantOperationGenerateDataKeyPairWithoutPlaintext = "GenerateDataKeyPairWithoutPlaintext"

    // GrantOperationGenerateMac is a GrantOperation enum value
    GrantOperationGenerateMac = "GenerateMac"

    // GrantOperationVerifyMac is a GrantOperation enum value
    GrantOperationVerifyMac = "VerifyMac"

    // GrantOperationDeriveSharedSecret is a GrantOperation enum value
    GrantOperationDeriveSharedSecret = "DeriveSharedSecret"
)

const (
    // KeyManagerTypeAws is a KeyManagerType enum value
    KeyManagerTypeAws = "AWS"

    // KeyManagerTypeCustomer is a KeyManagerType enum value
    KeyManagerTypeCustomer = "CUSTOMER"
)

const (
    // KeySpecRsa2048 is a KeySpec enum value
    KeySpecRsa2048 = "RSA_2048"

    // KeySpecRsa3072 is a KeySpec enum value
    KeySpecRsa3072 = "RSA_3072"

    // KeySpecRsa4096 is a KeySpec enum value
    KeySpecRsa4096 = "RSA_4096"

    // KeySpecEccNistP256 is a KeySpec enum value
    KeySpecEccNistP256 = "ECC_NIST_P256"

    // KeySpecEccNistP384 is a KeySpec enum value
    KeySpecEccNistP384 = "ECC_NIST_P384"

    // KeySpecEccNistP521 is a KeySpec enum value
    KeySpecEccNistP521 = "ECC_NIST_P521"

    // KeySpecEccSecgP256k1 is a KeySpec enum value
    KeySpecEccSecgP256k1 = "ECC_SECG_P256K1"

    // KeySpecSymmetricDefault is a KeySpec enum value
    KeySpecSymmetricDefault = "SYMMETRIC_DEFAULT"

    // KeySpecHmac224 is a KeySpec enum value
    KeySpecHmac224 = "HMAC_224"

    // KeySpecHmac256 is a KeySpec enum value
    KeySpecHmac256 = "HMAC_256"

    // KeySpecHmac384 is a KeySpec enum value
    KeySpecHmac384 = "HMAC_384"

    // KeySpecHmac512 is a KeySpec enum value
    KeySpecHmac512 = "HMAC_512"

    // KeySpecSm2 is a KeySpec enum value
    KeySpecSm2 = "SM2"
)

const (
    // KeyStateCreating is a KeyState enum value
    KeyStateCreating = "Creating"

    // KeyStateEnabled is a KeyState enum value
    KeyStateEnabled = "Enabled"

    // KeyStateDisabled is a KeyState enum value
    KeyStateDisabled = "Disabled"

    // KeyStatePendingDeletion is a KeyState enum value
    KeyStatePendingDeletion = "PendingDeletion"

    // KeyStatePendingImport is a KeyState enum value
    KeyStatePendingImport = "PendingImport"

    // KeyStatePendingReplicaDeletion is a KeyState enum value
    KeyStatePendingReplicaDeletion = "PendingReplicaDeletion"

    // KeyStateUnavailable is a KeyState enum value
    KeyStateUnavailable = "Unavailable"

    // KeyStateUpdating is a KeyState enum value
    KeyStateUpdating = "Updating"
)

const (
    // KeyUsageTypeSignVerify is a KeyUsageType enum value
    KeyUsageTypeSignVerify = "SIGN_VERIFY"

    // KeyUsageTypeEncryptDecrypt is a KeyUsageType enum value
    KeyUsageTypeEncryptDecrypt = "ENCRYPT_DECRYPT"

    // KeyUsageTypeGenerateVerifyMac is a KeyUsageType enum value
    KeyUsageTypeGenerateVerifyMac = "GENERATE_VERIFY_MAC"

    // KeyUsageTypeKeyAgreement is a KeyUsageType enum value
    KeyUsageTypeKeyAgreement = "KEY_AGREEMENT"
)

const (
    // MacAlgorithmSpecHmacSha224 is a MacAlgorithmSpec enum value
    MacAlgorithmSpecHmacSha224 = "HMAC_SHA_224"

    // MacAlgorithmSpecHmacSha256 is a MacAlgorithmSpec enum value
    MacAlgorithmSpecHmacSha256 = "HMAC_SHA_256"

    // MacAlgorithmSpecHmacSha384 is a MacAlgorithmSpec enum value
    MacAlgorithmSpecHmacSha384 = "HMAC_SHA_384"

    // MacAlgorithmSpecHmacSha512 is a MacAlgorithmSpec enum value
    MacAlgorithmSpecHmacSha512 = "HMAC_SHA_512"
)

const (
    // MessageTypeRaw is a MessageType enum value
    MessageTypeRaw = "RAW"

    // MessageTypeDigest is a MessageType enum value
    MessageTypeDigest = "DIGEST"
)

const (
    // MultiRegionKeyTypePrimary is a MultiRegionKeyType enum value
    MultiRegionKeyTypePrimary = "PRIMARY"

    // MultiRegionKeyTypeReplica is a MultiRegionKeyType enum value
    MultiRegionKeyTypeReplica = "REPLICA"
)

const (
    // OriginTypeAwsKms is a OriginType enum value
    OriginTypeAwsKms = "AWS_KMS"

    // OriginTypeExternal is a OriginType enum value
    OriginTypeExternal = "EXTERNAL"

    // OriginTypeAwsCloudhsm is a OriginType enum value
    OriginTypeAwsCloudhsm = "AWS_CLOUDHSM"

    // OriginTypeExternalKeyStore is a OriginType enum value
    OriginTypeExternalKeyStore = "EXTERNAL_KEY_STORE"
)

const (
    // RotationTypeAutomatic is a RotationType enum value
    RotationTypeAutomatic = "AUTOMATIC"

    // RotationTypeOnDemand is a RotationType enum value
    RotationTypeOnDemand = "ON_DEMAND"
)

const (
    // SigningAlgorithmSpecRsassaPssSha256 is a SigningAlgorithmSpec enum value
    SigningAlgorithmSpecRsassaPssSha256 = "RSASSA_PSS_SHA_256"

    // SigningAlgorithmSpecRsassaPssSha384 is a SigningAlgorithmSpec enum value
    SigningAlgorithmSpecRsassaPssSha384 = "RSASSA_PSS_SHA_384"

    // SigningAlgorithmSpecRsassaPssSha512 is a SigningAlgorithmSpec enum value
    SigningAlgorithmSpecRsassaPssSha512 = "RSASSA_PSS_SHA_512"

    // SigningAlgorithmSpecRsassaPkcs1V15Sha256 is a SigningAlgorithmSpec enum value
    SigningAlgorithmSpecRsassaPkcs1V15Sha256 = "RSASSA_PKCS1_V1_5_SHA_256"

    // SigningAlgorithmSpecRsassaPkcs1V15Sha384 is a SigningAlgorithmSpec enum value
    SigningAlgorithmSpecRsassaPkcs1V15Sha384 = "RSASSA_PKCS1_V1_5_SHA_384"

    // SigningAlgorithmSpecRsassaPkcs1V15Sha512 is a SigningAlgorithmSpec enum value
    SigningAlgorithmSpecRsassaPkcs1V15Sha512 = "RSASSA_PKCS1_V1_5_SHA_512"

    // SigningAlgorithmSpecEcdsaSha256 is a SigningAlgorithmSpec enum value
    SigningAlgorithmSpecEcdsaSha256 = "ECDSA_SHA_256"

    // SigningAlgorithmSpecEcdsaSha384 is a SigningAlgorithmSpec enum value
    SigningAlgorithmSpecEcdsaSha384 = "ECDSA_SHA_384"

    // SigningAlgorithmSpecEcdsaSha512 is a SigningAlgorithmSpec enum value
    SigningAlgorithmSpecEcdsaSha512 = "ECDSA_SHA_512"

    // SigningAlgorithmSpecSm2dsa is a SigningAlgorithmSpec enum value
    SigningAlgorithmSpecSm2dsa = "SM2DSA"
)

const (
    // WrappingKeySpecRsa2048 is a WrappingKeySpec enum value
    WrappingKeySpecRsa2048 = "RSA_2048"

    // WrappingKeySpecRsa3072 is a WrappingKeySpec enum value
    WrappingKeySpecRsa3072 = "RSA_3072"

    // WrappingKeySpecRsa4096 is a WrappingKeySpec enum value
    WrappingKeySpecRsa4096 = "RSA_4096"

    // WrappingKeySpecSm2 is a WrappingKeySpec enum value
    WrappingKeySpecSm2 = "SM2"
)

const (
    // XksProxyConnectivityTypePublicEndpoint is a XksProxyConnectivityType enum value
    XksProxyConnectivityTypePublicEndpoint = "PUBLIC_ENDPOINT"

    // XksProxyConnectivityTypeVpcEndpointService is a XksProxyConnectivityType enum value
    XksProxyConnectivityTypeVpcEndpointService = "VPC_ENDPOINT_SERVICE"
)

const (

    // ErrCodeAlreadyExistsException for service response error code
    // "AlreadyExistsException".
    //
    // The request was rejected because it attempted to create a resource that already
    // exists.
    ErrCodeAlreadyExistsException = "AlreadyExistsException"

    // ErrCodeCloudHsmClusterInUseException for service response error code
    // "CloudHsmClusterInUseException".
    //
    // The request was rejected because the specified CloudHSM cluster is already
    // associated with an CloudHSM key store in the account, or it shares a backup
    // history with an CloudHSM key store in the account. Each CloudHSM key store
    // in the account must be associated with a different CloudHSM cluster.
    //
    // CloudHSM clusters that share a backup history have the same cluster certificate.
    // To view the cluster certificate of an CloudHSM cluster, use the DescribeClusters
    // (https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html)
    // operation.
    ErrCodeCloudHsmClusterInUseException = "CloudHsmClusterInUseException"

    // ErrCodeCloudHsmClusterInvalidConfigurationException for service response error code
    // "CloudHsmClusterInvalidConfigurationException".
    //
    // The request was rejected because the associated CloudHSM cluster did not
    // meet the configuration requirements for an CloudHSM key store.
    //
    //    * The CloudHSM cluster must be configured with private subnets in at least
    //    two different Availability Zones in the Region.
    //
    //    * The security group for the cluster (https://docs.aws.amazon.com/cloudhsm/latest/userguide/configure-sg.html)
    //    (cloudhsm-cluster-<cluster-id>-sg) must include inbound rules and outbound
    //    rules that allow TCP traffic on ports 2223-2225. The Source in the inbound
    //    rules and the Destination in the outbound rules must match the security
    //    group ID. These rules are set by default when you create the CloudHSM
    //    cluster. Do not delete or change them. To get information about a particular
    //    security group, use the DescribeSecurityGroups (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html)
    //    operation.
    //
    //    * The CloudHSM cluster must contain at least as many HSMs as the operation
    //    requires. To add HSMs, use the CloudHSM CreateHsm (https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html)
    //    operation. For the CreateCustomKeyStore, UpdateCustomKeyStore, and CreateKey
    //    operations, the CloudHSM cluster must have at least two active HSMs, each
    //    in a different Availability Zone. For the ConnectCustomKeyStore operation,
    //    the CloudHSM must contain at least one active HSM.
    //
    // For information about the requirements for an CloudHSM cluster that is associated
    // with an CloudHSM key store, see Assemble the Prerequisites (https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore)
    // in the Key Management Service Developer Guide. For information about creating
    // a private subnet for an CloudHSM cluster, see Create a Private Subnet (https://docs.aws.amazon.com/cloudhsm/latest/userguide/create-subnets.html)
    // in the CloudHSM User Guide. For information about cluster security groups,
    // see Configure a Default Security Group (https://docs.aws.amazon.com/cloudhsm/latest/userguide/configure-sg.html)
    // in the CloudHSM User Guide .
    ErrCodeCloudHsmClusterInvalidConfigurationException = "CloudHsmClusterInvalidConfigurationException"

    // ErrCodeCloudHsmClusterNotActiveException for service response error code
    // "CloudHsmClusterNotActiveException".
    //
    // The request was rejected because the CloudHSM cluster associated with the
    // CloudHSM key store is not active. Initialize and activate the cluster and
    // try the command again. For detailed instructions, see Getting Started (https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started.html)
    // in the CloudHSM User Guide.
    ErrCodeCloudHsmClusterNotActiveException = "CloudHsmClusterNotActiveException"

    // ErrCodeCloudHsmClusterNotFoundException for service response error code
    // "CloudHsmClusterNotFoundException".
    //
    // The request was rejected because KMS cannot find the CloudHSM cluster with
    // the specified cluster ID. Retry the request with a different cluster ID.
    ErrCodeCloudHsmClusterNotFoundException = "CloudHsmClusterNotFoundException"

    // ErrCodeCloudHsmClusterNotRelatedException for service response error code
    // "CloudHsmClusterNotRelatedException".
    //
    // The request was rejected because the specified CloudHSM cluster has a different
    // cluster certificate than the original cluster. You cannot use the operation
    // to specify an unrelated cluster for an CloudHSM key store.
    //
    // Specify an CloudHSM cluster that shares a backup history with the original
    // cluster. This includes clusters that were created from a backup of the current
    // cluster, and clusters that were created from the same backup that produced
    // the current cluster.
    //
    // CloudHSM clusters that share a backup history have the same cluster certificate.
    // To view the cluster certificate of an CloudHSM cluster, use the DescribeClusters
    // (https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html)
    // operation.
    ErrCodeCloudHsmClusterNotRelatedException = "CloudHsmClusterNotRelatedException"

    // ErrCodeConflictException for service response error code
    // "ConflictException".
    //
    // The request was rejected because an automatic rotation of this key is currently
    // in progress or scheduled to begin within the next 20 minutes.
    ErrCodeConflictException = "ConflictException"

    // ErrCodeCustomKeyStoreHasCMKsException for service response error code
    // "CustomKeyStoreHasCMKsException".
    //
    // The request was rejected because the custom key store contains KMS keys.
    // After verifying that you do not need to use the KMS keys, use the ScheduleKeyDeletion
    // operation to delete the KMS keys. After they are deleted, you can delete
    // the custom key store.
    ErrCodeCustomKeyStoreHasCMKsException = "CustomKeyStoreHasCMKsException"

    // ErrCodeCustomKeyStoreInvalidStateException for service response error code
    // "CustomKeyStoreInvalidStateException".
    //
    // The request was rejected because of the ConnectionState of the custom key
    // store. To get the ConnectionState of a custom key store, use the DescribeCustomKeyStores
    // operation.
    //
    // This exception is thrown under the following conditions:
    //
    //    * You requested the ConnectCustomKeyStore operation on a custom key store
    //    with a ConnectionState of DISCONNECTING or FAILED. This operation is valid
    //    for all other ConnectionState values. To reconnect a custom key store
    //    in a FAILED state, disconnect it (DisconnectCustomKeyStore), then connect
    //    it (ConnectCustomKeyStore).
    //
    //    * You requested the CreateKey operation in a custom key store that is
    //    not connected. This operations is valid only when the custom key store
    //    ConnectionState is CONNECTED.
    //
    //    * You requested the DisconnectCustomKeyStore operation on a custom key
    //    store with a ConnectionState of DISCONNECTING or DISCONNECTED. This operation
    //    is valid for all other ConnectionState values.
    //
    //    * You requested the UpdateCustomKeyStore or DeleteCustomKeyStore operation
    //    on a custom key store that is not disconnected. This operation is valid
    //    only when the custom key store ConnectionState is DISCONNECTED.
    //
    //    * You requested the GenerateRandom operation in an CloudHSM key store
    //    that is not connected. This operation is valid only when the CloudHSM
    //    key store ConnectionState is CONNECTED.
    ErrCodeCustomKeyStoreInvalidStateException = "CustomKeyStoreInvalidStateException"

    // ErrCodeCustomKeyStoreNameInUseException for service response error code
    // "CustomKeyStoreNameInUseException".
    //
    // The request was rejected because the specified custom key store name is already
    // assigned to another custom key store in the account. Try again with a custom
    // key store name that is unique in the account.
    ErrCodeCustomKeyStoreNameInUseException = "CustomKeyStoreNameInUseException"

    // ErrCodeCustomKeyStoreNotFoundException for service response error code
    // "CustomKeyStoreNotFoundException".
    //
    // The request was rejected because KMS cannot find a custom key store with
    // the specified key store name or ID.
    ErrCodeCustomKeyStoreNotFoundException = "CustomKeyStoreNotFoundException"

    // ErrCodeDependencyTimeoutException for service response error code
    // "DependencyTimeoutException".
    //
    // The system timed out while trying to fulfill the request. You can retry the
    // request.
    ErrCodeDependencyTimeoutException = "DependencyTimeoutException"

    // ErrCodeDisabledException for service response error code
    // "DisabledException".
    //
    // The request was rejected because the specified KMS key is not enabled.
    ErrCodeDisabledException = "DisabledException"

    // ErrCodeDryRunOperationException for service response error code
    // "DryRunOperationException".
    //
    // The request was rejected because the DryRun parameter was specified.
    ErrCodeDryRunOperationException = "DryRunOperationException"

    // ErrCodeExpiredImportTokenException for service response error code
    // "ExpiredImportTokenException".
    //
    // The request was rejected because the specified import token is expired. Use
    // GetParametersForImport to get a new import token and public key, use the
    // new public key to encrypt the key material, and then try the request again.
    ErrCodeExpiredImportTokenException = "ExpiredImportTokenException"

    // ErrCodeIncorrectKeyException for service response error code
    // "IncorrectKeyException".
    //
    // The request was rejected because the specified KMS key cannot decrypt the
    // data. The KeyId in a Decrypt request and the SourceKeyId in a ReEncrypt request
    // must identify the same KMS key that was used to encrypt the ciphertext.
    ErrCodeIncorrectKeyException = "IncorrectKeyException"

    // ErrCodeIncorrectKeyMaterialException for service response error code
    // "IncorrectKeyMaterialException".
    //
    // The request was rejected because the key material in the request is, expired,
    // invalid, or is not the same key material that was previously imported into
    // this KMS key.
    ErrCodeIncorrectKeyMaterialException = "IncorrectKeyMaterialException"

    // ErrCodeIncorrectTrustAnchorException for service response error code
    // "IncorrectTrustAnchorException".
    //
    // The request was rejected because the trust anchor certificate in the request
    // to create an CloudHSM key store is not the trust anchor certificate for the
    // specified CloudHSM cluster.
    //
    // When you initialize the CloudHSM cluster (https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr),
    // you create the trust anchor certificate and save it in the customerCA.crt
    // file.
    ErrCodeIncorrectTrustAnchorException = "IncorrectTrustAnchorException"

    // ErrCodeInternalException for service response error code
    // "KMSInternalException".
    //
    // The request was rejected because an internal exception occurred. The request
    // can be retried.
    ErrCodeInternalException = "KMSInternalException"

    // ErrCodeInvalidAliasNameException for service response error code
    // "InvalidAliasNameException".
    //
    // The request was rejected because the specified alias name is not valid.
    ErrCodeInvalidAliasNameException = "InvalidAliasNameException"

    // ErrCodeInvalidArnException for service response error code
    // "InvalidArnException".
    //
    // The request was rejected because a specified ARN, or an ARN in a key policy,
    // is not valid.
    ErrCodeInvalidArnException = "InvalidArnException"

    // ErrCodeInvalidCiphertextException for service response error code
    // "InvalidCiphertextException".
    //
    // From the Decrypt or ReEncrypt operation, the request was rejected because
    // the specified ciphertext, or additional authenticated data incorporated into
    // the ciphertext, such as the encryption context, is corrupted, missing, or
    // otherwise invalid.
    //
    // From the ImportKeyMaterial operation, the request was rejected because KMS
    // could not decrypt the encrypted (wrapped) key material.
    ErrCodeInvalidCiphertextException = "InvalidCiphertextException"

    // ErrCodeInvalidGrantIdException for service response error code
    // "InvalidGrantIdException".
    //
    // The request was rejected because the specified GrantId is not valid.
    ErrCodeInvalidGrantIdException = "InvalidGrantIdException"

    // ErrCodeInvalidGrantTokenException for service response error code
    // "InvalidGrantTokenException".
    //
    // The request was rejected because the specified grant token is not valid.
    ErrCodeInvalidGrantTokenException = "InvalidGrantTokenException"

    // ErrCodeInvalidImportTokenException for service response error code
    // "InvalidImportTokenException".
    //
    // The request was rejected because the provided import token is invalid or
    // is associated with a different KMS key.
    ErrCodeInvalidImportTokenException = "InvalidImportTokenException"

    // ErrCodeInvalidKeyUsageException for service response error code
    // "InvalidKeyUsageException".
    //
    // The request was rejected for one of the following reasons:
    //
    //    * The KeyUsage value of the KMS key is incompatible with the API operation.
    //
    //    * The encryption algorithm or signing algorithm specified for the operation
    //    is incompatible with the type of key material in the KMS key (KeySpec).
    //
    // For encrypting, decrypting, re-encrypting, and generating data keys, the
    // KeyUsage must be ENCRYPT_DECRYPT. For signing and verifying messages, the
    // KeyUsage must be SIGN_VERIFY. For generating and verifying message authentication
    // codes (MACs), the KeyUsage must be GENERATE_VERIFY_MAC. For deriving key
    // agreement secrets, the KeyUsage must be KEY_AGREEMENT. To find the KeyUsage
    // of a KMS key, use the DescribeKey operation.
    //
    // To find the encryption or signing algorithms supported for a particular KMS
    // key, use the DescribeKey operation.
    ErrCodeInvalidKeyUsageException = "InvalidKeyUsageException"

    // ErrCodeInvalidMarkerException for service response error code
    // "InvalidMarkerException".
    //
    // The request was rejected because the marker that specifies where pagination
    // should next begin is not valid.
    ErrCodeInvalidMarkerException = "InvalidMarkerException"

    // ErrCodeInvalidStateException for service response error code
    // "KMSInvalidStateException".
    //
    // The request was rejected because the state of the specified resource is not
    // valid for this request.
    //
    // This exceptions means one of the following:
    //
    //    * The key state of the KMS key is not compatible with the operation. To
    //    find the key state, use the DescribeKey operation. For more information
    //    about which key states are compatible with each KMS operation, see Key
    //    states of KMS keys (https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html)
    //    in the Key Management Service Developer Guide .
    //
    //    * For cryptographic operations on KMS keys in custom key stores, this
    //    exception represents a general failure with many possible causes. To identify
    //    the cause, see the error message that accompanies the exception.
    ErrCodeInvalidStateException = "KMSInvalidStateException"

    // ErrCodeKMSInvalidMacException for service response error code
    // "KMSInvalidMacException".
    //
    // The request was rejected because the HMAC verification failed. HMAC verification
    // fails when the HMAC computed by using the specified message, HMAC KMS key,
    // and MAC algorithm does not match the HMAC specified in the request.
    ErrCodeKMSInvalidMacException = "KMSInvalidMacException"

    // ErrCodeKMSInvalidSignatureException for service response error code
    // "KMSInvalidSignatureException".
    //
    // The request was rejected because the signature verification failed. Signature
    // verification fails when it cannot confirm that signature was produced by
    // signing the specified message with the specified KMS key and signing algorithm.
    ErrCodeKMSInvalidSignatureException = "KMSInvalidSignatureException"

    // ErrCodeKeyUnavailableException for service response error code
    // "KeyUnavailableException".
    //
    // The request was rejected because the specified KMS key was not available.
    // You can retry the request.
    ErrCodeKeyUnavailableException = "KeyUnavailableException"

    // ErrCodeLimitExceededException for service response error code
    // "LimitExceededException".
    //
    // The request was rejected because a quota was exceeded. For more information,
    // see Quotas (https://docs.aws.amazon.com/kms/latest/developerguide/limits.html)
    // in the Key Management Service Developer Guide.
    ErrCodeLimitExceededException = "LimitExceededException"

    // ErrCodeMalformedPolicyDocumentException for service response error code
    // "MalformedPolicyDocumentException".
    //
    // The request was rejected because the specified policy is not syntactically
    // or semantically correct.
    ErrCodeMalformedPolicyDocumentException = "MalformedPolicyDocumentException"

    // ErrCodeNotFoundException for service response error code
    // "NotFoundException".
    //
    // The request was rejected because the specified entity or resource could not
    // be found.
    ErrCodeNotFoundException = "NotFoundException"

    // ErrCodeTagException for service response error code
    // "TagException".
    //
    // The request was rejected because one or more tags are not valid.
    ErrCodeTagException = "TagException"

    // ErrCodeUnsupportedOperationException for service response error code
    // "UnsupportedOperationException".
    //
    // The request was rejected because a specified parameter is not supported or
    // a specified resource is not valid for this operation.
    ErrCodeUnsupportedOperationException = "UnsupportedOperationException"

    // ErrCodeXksKeyAlreadyInUseException for service response error code
    // "XksKeyAlreadyInUseException".
    //
    // The request was rejected because the (XksKeyId) is already associated with
    // another KMS key in this external key store. Each KMS key in an external key
    // store must be associated with a different external key.
    ErrCodeXksKeyAlreadyInUseException = "XksKeyAlreadyInUseException"

    // ErrCodeXksKeyInvalidConfigurationException for service response error code
    // "XksKeyInvalidConfigurationException".
    //
    // The request was rejected because the external key specified by the XksKeyId
    // parameter did not meet the configuration requirements for an external key
    // store.
    //
    // The external key must be an AES-256 symmetric key that is enabled and performs
    // encryption and decryption.
    ErrCodeXksKeyInvalidConfigurationException = "XksKeyInvalidConfigurationException"

    // ErrCodeXksKeyNotFoundException for service response error code
    // "XksKeyNotFoundException".
    //
    // The request was rejected because the external key store proxy could not find
    // the external key. This exception is thrown when the value of the XksKeyId
    // parameter doesn't identify a key in the external key manager associated with
    // the external key proxy.
    //
    // Verify that the XksKeyId represents an existing key in the external key manager.
    // Use the key identifier that the external key store proxy uses to identify
    // the key. For details, see the documentation provided with your external key
    // store proxy or key manager.
    ErrCodeXksKeyNotFoundException = "XksKeyNotFoundException"

    // ErrCodeXksProxyIncorrectAuthenticationCredentialException for service response error code
    // "XksProxyIncorrectAuthenticationCredentialException".
    //
    // The request was rejected because the proxy credentials failed to authenticate
    // to the specified external key store proxy. The specified external key store
    // proxy rejected a status request from KMS due to invalid credentials. This
    // can indicate an error in the credentials or in the identification of the
    // external key store proxy.
    ErrCodeXksProxyIncorrectAuthenticationCredentialException = "XksProxyIncorrectAuthenticationCredentialException"

    // ErrCodeXksProxyInvalidConfigurationException for service response error code
    // "XksProxyInvalidConfigurationException".
    //
    // The request was rejected because the external key store proxy is not configured
    // correctly. To identify the cause, see the error message that accompanies
    // the exception.
    ErrCodeXksProxyInvalidConfigurationException = "XksProxyInvalidConfigurationException"

    // ErrCodeXksProxyInvalidResponseException for service response error code
    // "XksProxyInvalidResponseException".
    //
    //
    // KMS cannot interpret the response it received from the external key store
    // proxy. The problem might be a poorly constructed response, but it could also
    // be a transient network issue. If you see this error repeatedly, report it
    // to the proxy vendor.
    ErrCodeXksProxyInvalidResponseException = "XksProxyInvalidResponseException"

    // ErrCodeXksProxyUriEndpointInUseException for service response error code
    // "XksProxyUriEndpointInUseException".
    //
    // The request was rejected because the XksProxyUriEndpoint is already associated
    // with another external key store in this Amazon Web Services Region. To identify
    // the cause, see the error message that accompanies the exception.
    ErrCodeXksProxyUriEndpointInUseException = "XksProxyUriEndpointInUseException"

    // ErrCodeXksProxyUriInUseException for service response error code
    // "XksProxyUriInUseException".
    //
    // The request was rejected because the concatenation of the XksProxyUriEndpoint
    // and XksProxyUriPath is already associated with another external key store
    // in this Amazon Web Services Region. Each external key store in a Region must
    // use a unique external key store proxy API address.
    ErrCodeXksProxyUriInUseException = "XksProxyUriInUseException"

    // ErrCodeXksProxyUriUnreachableException for service response error code
    // "XksProxyUriUnreachableException".
    //
    // KMS was unable to reach the specified XksProxyUriPath. The path must be reachable
    // before you create the external key store or update its settings.
    //
    // This exception is also thrown when the external key store proxy response
    // to a GetHealthStatus request indicates that all external key manager instances
    // are unavailable.
    ErrCodeXksProxyUriUnreachableException = "XksProxyUriUnreachableException"

    // ErrCodeXksProxyVpcEndpointServiceInUseException for service response error code
    // "XksProxyVpcEndpointServiceInUseException".
    //
    // The request was rejected because the specified Amazon VPC endpoint service
    // is already associated with another external key store in this Amazon Web
    // Services Region. Each external key store in a Region must use a different
    // Amazon VPC endpoint service.
    ErrCodeXksProxyVpcEndpointServiceInUseException = "XksProxyVpcEndpointServiceInUseException"

    // ErrCodeXksProxyVpcEndpointServiceInvalidConfigurationException for service response error code
    // "XksProxyVpcEndpointServiceInvalidConfigurationException".
    //
    // The request was rejected because the Amazon VPC endpoint service configuration
    // does not fulfill the requirements for an external key store. To identify
    // the cause, see the error message that accompanies the exception and review
    // the requirements (https://docs.aws.amazon.com/kms/latest/developerguide/vpc-connectivity.html#xks-vpc-requirements)
    // for Amazon VPC endpoint service connectivity for an external key store.
    ErrCodeXksProxyVpcEndpointServiceInvalidConfigurationException = "XksProxyVpcEndpointServiceInvalidConfigurationException"

    // ErrCodeXksProxyVpcEndpointServiceNotFoundException for service response error code
    // "XksProxyVpcEndpointServiceNotFoundException".
    //
    // The request was rejected because KMS could not find the specified VPC endpoint
    // service. Use DescribeCustomKeyStores to verify the VPC endpoint service name
    // for the external key store. Also, confirm that the Allow principals list
    // for the VPC endpoint service includes the KMS service principal for the Region,
    // such as cks.kms.us-east-1.amazonaws.com.
    ErrCodeXksProxyVpcEndpointServiceNotFoundException = "XksProxyVpcEndpointServiceNotFoundException"
)

const (
    ServiceName = "kms"       // Name of service.
    EndpointsID = ServiceName // ID to lookup a service endpoint with.
    ServiceID   = "KMS"       // ServiceID is a unique identifier of a specific service.
)

const (
    // KeyAgreementAlgorithmSpecEcdh is a KeyAgreementAlgorithmSpec enum value
    KeyAgreementAlgorithmSpecEcdh = "ECDH"
)

const (
    // KeyEncryptionMechanismRsaesOaepSha256 is a KeyEncryptionMechanism enum value
    KeyEncryptionMechanismRsaesOaepSha256 = "RSAES_OAEP_SHA_256"
)

func AlgorithmSpec_Values ¶

func AlgorithmSpec_Values() []string

AlgorithmSpec_Values returns all elements of the AlgorithmSpec enum

func ConnectionErrorCodeType_Values ¶

func ConnectionErrorCodeType_Values() []string

ConnectionErrorCodeType_Values returns all elements of the ConnectionErrorCodeType enum

func ConnectionStateType_Values ¶

func ConnectionStateType_Values() []string

ConnectionStateType_Values returns all elements of the ConnectionStateType enum

func CustomKeyStoreType_Values ¶

func CustomKeyStoreType_Values() []string

CustomKeyStoreType_Values returns all elements of the CustomKeyStoreType enum

func CustomerMasterKeySpec_Values ¶

func CustomerMasterKeySpec_Values() []string

CustomerMasterKeySpec_Values returns all elements of the CustomerMasterKeySpec enum

func DataKeyPairSpec_Values ¶

func DataKeyPairSpec_Values() []string

DataKeyPairSpec_Values returns all elements of the DataKeyPairSpec enum

func DataKeySpec_Values ¶

func DataKeySpec_Values() []string

DataKeySpec_Values returns all elements of the DataKeySpec enum

func EncryptionAlgorithmSpec_Values ¶

func EncryptionAlgorithmSpec_Values() []string

EncryptionAlgorithmSpec_Values returns all elements of the EncryptionAlgorithmSpec enum

func ExpirationModelType_Values ¶

func ExpirationModelType_Values() []string

ExpirationModelType_Values returns all elements of the ExpirationModelType enum

func GrantOperation_Values ¶

func GrantOperation_Values() []string

GrantOperation_Values returns all elements of the GrantOperation enum

func KeyAgreementAlgorithmSpec_Values ¶

func KeyAgreementAlgorithmSpec_Values() []string

KeyAgreementAlgorithmSpec_Values returns all elements of the KeyAgreementAlgorithmSpec enum

func KeyEncryptionMechanism_Values ¶

func KeyEncryptionMechanism_Values() []string

KeyEncryptionMechanism_Values returns all elements of the KeyEncryptionMechanism enum

func KeyManagerType_Values ¶

func KeyManagerType_Values() []string

KeyManagerType_Values returns all elements of the KeyManagerType enum

func KeySpec_Values ¶

func KeySpec_Values() []string

KeySpec_Values returns all elements of the KeySpec enum

func KeyState_Values ¶

func KeyState_Values() []string

KeyState_Values returns all elements of the KeyState enum

func KeyUsageType_Values ¶

func KeyUsageType_Values() []string

KeyUsageType_Values returns all elements of the KeyUsageType enum

func MacAlgorithmSpec_Values ¶

func MacAlgorithmSpec_Values() []string

MacAlgorithmSpec_Values returns all elements of the MacAlgorithmSpec enum

func MessageType_Values ¶

func MessageType_Values() []string

MessageType_Values returns all elements of the MessageType enum

func MultiRegionKeyType_Values ¶

func MultiRegionKeyType_Values() []string

MultiRegionKeyType_Values returns all elements of the MultiRegionKeyType enum

func OriginType_Values ¶

func OriginType_Values() []string

OriginType_Values returns all elements of the OriginType enum

func RotationType_Values ¶

func RotationType_Values() []string

RotationType_Values returns all elements of the RotationType enum

func SigningAlgorithmSpec_Values ¶

func SigningAlgorithmSpec_Values() []string

SigningAlgorithmSpec_Values returns all elements of the SigningAlgorithmSpec enum

func WrappingKeySpec_Values ¶

func WrappingKeySpec_Values() []string

WrappingKeySpec_Values returns all elements of the WrappingKeySpec enum

func XksProxyConnectivityType_Values ¶

func XksProxyConnectivityType_Values() []string

XksProxyConnectivityType_Values returns all elements of the XksProxyConnectivityType enum

type AliasListEntry ¶

type AliasListEntry struct {

    // String that contains the key ARN.
    AliasArn *string `min:"20" type:"string"`

    // String that contains the alias. This value begins with alias/.
    AliasName *string `min:"1" type:"string"`

    // Date and time that the alias was most recently created in the account and
    // Region. Formatted as Unix time.
    CreationDate *time.Time `type:"timestamp"`

    // Date and time that the alias was most recently associated with a KMS key
    // in the account and Region. Formatted as Unix time.
    LastUpdatedDate *time.Time `type:"timestamp"`

    // String that contains the key identifier of the KMS key associated with the
    // alias.
    TargetKeyId *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

Contains information about an alias.

func (AliasListEntry) GoString ¶

func (s AliasListEntry) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*AliasListEntry) SetAliasArn ¶

func (s *AliasListEntry) SetAliasArn(v string) *AliasListEntry

SetAliasArn sets the AliasArn field's value.

func (*AliasListEntry) SetAliasName ¶

func (s *AliasListEntry) SetAliasName(v string) *AliasListEntry

SetAliasName sets the AliasName field's value.

func (*AliasListEntry) SetCreationDate ¶

func (s *AliasListEntry) SetCreationDate(v time.Time) *AliasListEntry

SetCreationDate sets the CreationDate field's value.

func (*AliasListEntry) SetLastUpdatedDate ¶

func (s *AliasListEntry) SetLastUpdatedDate(v time.Time) *AliasListEntry

SetLastUpdatedDate sets the LastUpdatedDate field's value.

func (*AliasListEntry) SetTargetKeyId ¶

func (s *AliasListEntry) SetTargetKeyId(v string) *AliasListEntry

SetTargetKeyId sets the TargetKeyId field's value.

func (AliasListEntry) String ¶

func (s AliasListEntry) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type AlreadyExistsException ¶

type AlreadyExistsException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because it attempted to create a resource that already exists.

func (*AlreadyExistsException) Code ¶

func (s *AlreadyExistsException) Code() string

Code returns the exception type name.

func (*AlreadyExistsException) Error ¶

func (s *AlreadyExistsException) Error() string

func (AlreadyExistsException) GoString ¶

func (s AlreadyExistsException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*AlreadyExistsException) Message ¶

func (s *AlreadyExistsException) Message() string

Message returns the exception's message.

func (*AlreadyExistsException) OrigErr ¶

func (s *AlreadyExistsException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*AlreadyExistsException) RequestID ¶

func (s *AlreadyExistsException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*AlreadyExistsException) StatusCode ¶

func (s *AlreadyExistsException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (AlreadyExistsException) String ¶

func (s AlreadyExistsException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CancelKeyDeletionInput ¶

type CancelKeyDeletionInput struct {

    // Identifies the KMS key whose deletion is being canceled.
    //
    // Specify the key ID or key ARN of the KMS key.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (CancelKeyDeletionInput) GoString ¶

func (s CancelKeyDeletionInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CancelKeyDeletionInput) SetKeyId ¶

func (s *CancelKeyDeletionInput) SetKeyId(v string) *CancelKeyDeletionInput

SetKeyId sets the KeyId field's value.

func (CancelKeyDeletionInput) String ¶

func (s CancelKeyDeletionInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CancelKeyDeletionInput) Validate ¶

func (s *CancelKeyDeletionInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type CancelKeyDeletionOutput ¶

type CancelKeyDeletionOutput struct {

    // The Amazon Resource Name (key ARN (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
    // of the KMS key whose deletion is canceled.
    KeyId *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

func (CancelKeyDeletionOutput) GoString ¶

func (s CancelKeyDeletionOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CancelKeyDeletionOutput) SetKeyId ¶

func (s *CancelKeyDeletionOutput) SetKeyId(v string) *CancelKeyDeletionOutput

SetKeyId sets the KeyId field's value.

func (CancelKeyDeletionOutput) String ¶

func (s CancelKeyDeletionOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CloudHsmClusterInUseException ¶

type CloudHsmClusterInUseException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the specified CloudHSM cluster is already associated with an CloudHSM key store in the account, or it shares a backup history with an CloudHSM key store in the account. Each CloudHSM key store in the account must be associated with a different CloudHSM cluster.

CloudHSM clusters that share a backup history have the same cluster certificate. To view the cluster certificate of an CloudHSM cluster, use the DescribeClusters (https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html) operation.

func (*CloudHsmClusterInUseException) Code ¶

func (s *CloudHsmClusterInUseException) Code() string

Code returns the exception type name.

func (*CloudHsmClusterInUseException) Error ¶

func (s *CloudHsmClusterInUseException) Error() string

func (CloudHsmClusterInUseException) GoString ¶

func (s CloudHsmClusterInUseException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CloudHsmClusterInUseException) Message ¶

func (s *CloudHsmClusterInUseException) Message() string

Message returns the exception's message.

func (*CloudHsmClusterInUseException) OrigErr ¶

func (s *CloudHsmClusterInUseException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*CloudHsmClusterInUseException) RequestID ¶

func (s *CloudHsmClusterInUseException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*CloudHsmClusterInUseException) StatusCode ¶

func (s *CloudHsmClusterInUseException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (CloudHsmClusterInUseException) String ¶

func (s CloudHsmClusterInUseException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CloudHsmClusterInvalidConfigurationException ¶

type CloudHsmClusterInvalidConfigurationException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the associated CloudHSM cluster did not meet the configuration requirements for an CloudHSM key store.

• The CloudHSM cluster must be configured with private subnets in at least two different Availability Zones in the Region.

• The security group for the cluster (https://docs.aws.amazon.com/cloudhsm/latest/userguide/configure-sg.html) (cloudhsm-cluster-<cluster-id>-sg) must include inbound rules and outbound rules that allow TCP traffic on ports 2223-2225. The Source in the inbound rules and the Destination in the outbound rules must match the security group ID. These rules are set by default when you create the CloudHSM cluster. Do not delete or change them. To get information about a particular security group, use the DescribeSecurityGroups (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html) operation.

• The CloudHSM cluster must contain at least as many HSMs as the operation requires. To add HSMs, use the CloudHSM CreateHsm (https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html) operation. For the CreateCustomKeyStore, UpdateCustomKeyStore, and CreateKey operations, the CloudHSM cluster must have at least two active HSMs, each in a different Availability Zone. For the ConnectCustomKeyStore operation, the CloudHSM must contain at least one active HSM.

For information about the requirements for an CloudHSM cluster that is associated with an CloudHSM key store, see Assemble the Prerequisites (https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore) in the Key Management Service Developer Guide. For information about creating a private subnet for an CloudHSM cluster, see Create a Private Subnet (https://docs.aws.amazon.com/cloudhsm/latest/userguide/create-subnets.html) in the CloudHSM User Guide. For information about cluster security groups, see Configure a Default Security Group (https://docs.aws.amazon.com/cloudhsm/latest/userguide/configure-sg.html) in the CloudHSM User Guide .

func (*CloudHsmClusterInvalidConfigurationException) Code ¶

func (s *CloudHsmClusterInvalidConfigurationException) Code() string

Code returns the exception type name.

func (*CloudHsmClusterInvalidConfigurationException) Error ¶

func (s *CloudHsmClusterInvalidConfigurationException) Error() string

func (CloudHsmClusterInvalidConfigurationException) GoString ¶

func (s CloudHsmClusterInvalidConfigurationException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CloudHsmClusterInvalidConfigurationException) Message ¶

func (s *CloudHsmClusterInvalidConfigurationException) Message() string

Message returns the exception's message.

func (*CloudHsmClusterInvalidConfigurationException) OrigErr ¶

func (s *CloudHsmClusterInvalidConfigurationException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*CloudHsmClusterInvalidConfigurationException) RequestID ¶

func (s *CloudHsmClusterInvalidConfigurationException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*CloudHsmClusterInvalidConfigurationException) StatusCode ¶

func (s *CloudHsmClusterInvalidConfigurationException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (CloudHsmClusterInvalidConfigurationException) String ¶

func (s CloudHsmClusterInvalidConfigurationException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CloudHsmClusterNotActiveException ¶

type CloudHsmClusterNotActiveException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the CloudHSM cluster associated with the CloudHSM key store is not active. Initialize and activate the cluster and try the command again. For detailed instructions, see Getting Started (https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started.html) in the CloudHSM User Guide.

func (*CloudHsmClusterNotActiveException) Code ¶

func (s *CloudHsmClusterNotActiveException) Code() string

Code returns the exception type name.

func (*CloudHsmClusterNotActiveException) Error ¶

func (s *CloudHsmClusterNotActiveException) Error() string

func (CloudHsmClusterNotActiveException) GoString ¶

func (s CloudHsmClusterNotActiveException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CloudHsmClusterNotActiveException) Message ¶

func (s *CloudHsmClusterNotActiveException) Message() string

Message returns the exception's message.

func (*CloudHsmClusterNotActiveException) OrigErr ¶

func (s *CloudHsmClusterNotActiveException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*CloudHsmClusterNotActiveException) RequestID ¶

func (s *CloudHsmClusterNotActiveException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*CloudHsmClusterNotActiveException) StatusCode ¶

func (s *CloudHsmClusterNotActiveException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (CloudHsmClusterNotActiveException) String ¶

func (s CloudHsmClusterNotActiveException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CloudHsmClusterNotFoundException ¶

type CloudHsmClusterNotFoundException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because KMS cannot find the CloudHSM cluster with the specified cluster ID. Retry the request with a different cluster ID.

func (*CloudHsmClusterNotFoundException) Code ¶

func (s *CloudHsmClusterNotFoundException) Code() string

Code returns the exception type name.

func (*CloudHsmClusterNotFoundException) Error ¶

func (s *CloudHsmClusterNotFoundException) Error() string

func (CloudHsmClusterNotFoundException) GoString ¶

func (s CloudHsmClusterNotFoundException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CloudHsmClusterNotFoundException) Message ¶

func (s *CloudHsmClusterNotFoundException) Message() string

Message returns the exception's message.

func (*CloudHsmClusterNotFoundException) OrigErr ¶

func (s *CloudHsmClusterNotFoundException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*CloudHsmClusterNotFoundException) RequestID ¶

func (s *CloudHsmClusterNotFoundException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*CloudHsmClusterNotFoundException) StatusCode ¶

func (s *CloudHsmClusterNotFoundException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (CloudHsmClusterNotFoundException) String ¶

func (s CloudHsmClusterNotFoundException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CloudHsmClusterNotRelatedException ¶

type CloudHsmClusterNotRelatedException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the specified CloudHSM cluster has a different cluster certificate than the original cluster. You cannot use the operation to specify an unrelated cluster for an CloudHSM key store.

Specify an CloudHSM cluster that shares a backup history with the original cluster. This includes clusters that were created from a backup of the current cluster, and clusters that were created from the same backup that produced the current cluster.

CloudHSM clusters that share a backup history have the same cluster certificate. To view the cluster certificate of an CloudHSM cluster, use the DescribeClusters (https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html) operation.

func (*CloudHsmClusterNotRelatedException) Code ¶

func (s *CloudHsmClusterNotRelatedException) Code() string

Code returns the exception type name.

func (*CloudHsmClusterNotRelatedException) Error ¶

func (s *CloudHsmClusterNotRelatedException) Error() string

func (CloudHsmClusterNotRelatedException) GoString ¶

func (s CloudHsmClusterNotRelatedException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CloudHsmClusterNotRelatedException) Message ¶

func (s *CloudHsmClusterNotRelatedException) Message() string

Message returns the exception's message.

func (*CloudHsmClusterNotRelatedException) OrigErr ¶

func (s *CloudHsmClusterNotRelatedException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*CloudHsmClusterNotRelatedException) RequestID ¶

func (s *CloudHsmClusterNotRelatedException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*CloudHsmClusterNotRelatedException) StatusCode ¶

func (s *CloudHsmClusterNotRelatedException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (CloudHsmClusterNotRelatedException) String ¶

func (s CloudHsmClusterNotRelatedException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type ConflictException ¶

type ConflictException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because an automatic rotation of this key is currently in progress or scheduled to begin within the next 20 minutes.

func (*ConflictException) Code ¶

func (s *ConflictException) Code() string

Code returns the exception type name.

func (*ConflictException) Error ¶

func (s *ConflictException) Error() string

func (ConflictException) GoString ¶

func (s ConflictException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*ConflictException) Message ¶

func (s *ConflictException) Message() string

Message returns the exception's message.

func (*ConflictException) OrigErr ¶

func (s *ConflictException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*ConflictException) RequestID ¶

func (s *ConflictException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*ConflictException) StatusCode ¶

func (s *ConflictException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (ConflictException) String ¶

func (s ConflictException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type ConnectCustomKeyStoreInput ¶

type ConnectCustomKeyStoreInput struct {

    // Enter the key store ID of the custom key store that you want to connect.
    // To find the ID of a custom key store, use the DescribeCustomKeyStores operation.
    //
    // CustomKeyStoreId is a required field
    CustomKeyStoreId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (ConnectCustomKeyStoreInput) GoString ¶

func (s ConnectCustomKeyStoreInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*ConnectCustomKeyStoreInput) SetCustomKeyStoreId ¶

func (s *ConnectCustomKeyStoreInput) SetCustomKeyStoreId(v string) *ConnectCustomKeyStoreInput

SetCustomKeyStoreId sets the CustomKeyStoreId field's value.

func (ConnectCustomKeyStoreInput) String ¶

func (s ConnectCustomKeyStoreInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*ConnectCustomKeyStoreInput) Validate ¶

func (s *ConnectCustomKeyStoreInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type ConnectCustomKeyStoreOutput ¶

type ConnectCustomKeyStoreOutput struct {
    // contains filtered or unexported fields
}

func (ConnectCustomKeyStoreOutput) GoString ¶

func (s ConnectCustomKeyStoreOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (ConnectCustomKeyStoreOutput) String ¶

func (s ConnectCustomKeyStoreOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CreateAliasInput ¶

type CreateAliasInput struct {

    // Specifies the alias name. This value must begin with alias/ followed by a
    // name, such as alias/ExampleAlias.
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // The AliasName value must be string of 1-256 characters. It can contain only
    // alphanumeric characters, forward slashes (/), underscores (_), and dashes
    // (-). The alias name cannot begin with alias/aws/. The alias/aws/ prefix is
    // reserved for Amazon Web Services managed keys (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk).
    //
    // AliasName is a required field
    AliasName *string `min:"1" type:"string" required:"true"`

    // Associates the alias with the specified customer managed key (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk).
    // The KMS key must be in the same Amazon Web Services Region.
    //
    // A valid key ID is required. If you supply a null or empty string value, this
    // operation returns an error.
    //
    // For help finding the key ID and ARN, see Finding the Key ID and ARN (https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn)
    // in the Key Management Service Developer Guide .
    //
    // Specify the key ID or key ARN of the KMS key.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // TargetKeyId is a required field
    TargetKeyId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (CreateAliasInput) GoString ¶

func (s CreateAliasInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateAliasInput) SetAliasName ¶

func (s *CreateAliasInput) SetAliasName(v string) *CreateAliasInput

SetAliasName sets the AliasName field's value.

func (*CreateAliasInput) SetTargetKeyId ¶

func (s *CreateAliasInput) SetTargetKeyId(v string) *CreateAliasInput

SetTargetKeyId sets the TargetKeyId field's value.

func (CreateAliasInput) String ¶

func (s CreateAliasInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateAliasInput) Validate ¶

func (s *CreateAliasInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type CreateAliasOutput ¶

type CreateAliasOutput struct {
    // contains filtered or unexported fields
}

func (CreateAliasOutput) GoString ¶

func (s CreateAliasOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (CreateAliasOutput) String ¶

func (s CreateAliasOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CreateCustomKeyStoreInput ¶

type CreateCustomKeyStoreInput struct {

    // Identifies the CloudHSM cluster for an CloudHSM key store. This parameter
    // is required for custom key stores with CustomKeyStoreType of AWS_CLOUDHSM.
    //
    // Enter the cluster ID of any active CloudHSM cluster that is not already associated
    // with a custom key store. To find the cluster ID, use the DescribeClusters
    // (https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html)
    // operation.
    CloudHsmClusterId *string `min:"19" type:"string"`

    // Specifies a friendly name for the custom key store. The name must be unique
    // in your Amazon Web Services account and Region. This parameter is required
    // for all custom key stores.
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // CustomKeyStoreName is a required field
    CustomKeyStoreName *string `min:"1" type:"string" required:"true"`

    // Specifies the type of custom key store. The default value is AWS_CLOUDHSM.
    //
    // For a custom key store backed by an CloudHSM cluster, omit the parameter
    // or enter AWS_CLOUDHSM. For a custom key store backed by an external key manager
    // outside of Amazon Web Services, enter EXTERNAL_KEY_STORE. You cannot change
    // this property after the key store is created.
    CustomKeyStoreType *string `type:"string" enum:"CustomKeyStoreType"`

    // Specifies the kmsuser password for an CloudHSM key store. This parameter
    // is required for custom key stores with a CustomKeyStoreType of AWS_CLOUDHSM.
    //
    // Enter the password of the kmsuser crypto user (CU) account (https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser)
    // in the specified CloudHSM cluster. KMS logs into the cluster as this user
    // to manage key material on your behalf.
    //
    // The password must be a string of 7 to 32 characters. Its value is case sensitive.
    //
    // This parameter tells KMS the kmsuser account password; it does not change
    // the password in the CloudHSM cluster.
    //
    // KeyStorePassword is a sensitive parameter and its value will be
    // replaced with "sensitive" in string returned by CreateCustomKeyStoreInput's
    // String and GoString methods.
    KeyStorePassword *string `min:"7" type:"string" sensitive:"true"`

    // Specifies the certificate for an CloudHSM key store. This parameter is required
    // for custom key stores with a CustomKeyStoreType of AWS_CLOUDHSM.
    //
    // Enter the content of the trust anchor certificate for the CloudHSM cluster.
    // This is the content of the customerCA.crt file that you created when you
    // initialized the cluster (https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html).
    TrustAnchorCertificate *string `min:"1" type:"string"`

    // Specifies an authentication credential for the external key store proxy (XKS
    // proxy). This parameter is required for all custom key stores with a CustomKeyStoreType
    // of EXTERNAL_KEY_STORE.
    //
    // The XksProxyAuthenticationCredential has two required elements: RawSecretAccessKey,
    // a secret key, and AccessKeyId, a unique identifier for the RawSecretAccessKey.
    // For character requirements, see XksProxyAuthenticationCredentialType (kms/latest/APIReference/API_XksProxyAuthenticationCredentialType.html).
    //
    // KMS uses this authentication credential to sign requests to the external
    // key store proxy on your behalf. This credential is unrelated to Identity
    // and Access Management (IAM) and Amazon Web Services credentials.
    //
    // This parameter doesn't set or change the authentication credentials on the
    // XKS proxy. It just tells KMS the credential that you established on your
    // external key store proxy. If you rotate your proxy authentication credential,
    // use the UpdateCustomKeyStore operation to provide the new credential to KMS.
    XksProxyAuthenticationCredential *XksProxyAuthenticationCredentialType `type:"structure"`

    // Indicates how KMS communicates with the external key store proxy. This parameter
    // is required for custom key stores with a CustomKeyStoreType of EXTERNAL_KEY_STORE.
    //
    // If the external key store proxy uses a public endpoint, specify PUBLIC_ENDPOINT.
    // If the external key store proxy uses a Amazon VPC endpoint service for communication
    // with KMS, specify VPC_ENDPOINT_SERVICE. For help making this choice, see
    // Choosing a connectivity option (https://docs.aws.amazon.com/kms/latest/developerguide/plan-xks-keystore.html#choose-xks-connectivity)
    // in the Key Management Service Developer Guide.
    //
    // An Amazon VPC endpoint service keeps your communication with KMS in a private
    // address space entirely within Amazon Web Services, but it requires more configuration,
    // including establishing a Amazon VPC with multiple subnets, a VPC endpoint
    // service, a network load balancer, and a verified private DNS name. A public
    // endpoint is simpler to set up, but it might be slower and might not fulfill
    // your security requirements. You might consider testing with a public endpoint,
    // and then establishing a VPC endpoint service for production tasks. Note that
    // this choice does not determine the location of the external key store proxy.
    // Even if you choose a VPC endpoint service, the proxy can be hosted within
    // the VPC or outside of Amazon Web Services such as in your corporate data
    // center.
    XksProxyConnectivity *string `type:"string" enum:"XksProxyConnectivityType"`

    // Specifies the endpoint that KMS uses to send requests to the external key
    // store proxy (XKS proxy). This parameter is required for custom key stores
    // with a CustomKeyStoreType of EXTERNAL_KEY_STORE.
    //
    // The protocol must be HTTPS. KMS communicates on port 443. Do not specify
    // the port in the XksProxyUriEndpoint value.
    //
    // For external key stores with XksProxyConnectivity value of VPC_ENDPOINT_SERVICE,
    // specify https:// followed by the private DNS name of the VPC endpoint service.
    //
    // For external key stores with PUBLIC_ENDPOINT connectivity, this endpoint
    // must be reachable before you create the custom key store. KMS connects to
    // the external key store proxy while creating the custom key store. For external
    // key stores with VPC_ENDPOINT_SERVICE connectivity, KMS connects when you
    // call the ConnectCustomKeyStore operation.
    //
    // The value of this parameter must begin with https://. The remainder can contain
    // upper and lower case letters (A-Z and a-z), numbers (0-9), dots (.), and
    // hyphens (-). Additional slashes (/ and \) are not permitted.
    //
    // Uniqueness requirements:
    //
    //    * The combined XksProxyUriEndpoint and XksProxyUriPath values must be
    //    unique in the Amazon Web Services account and Region.
    //
    //    * An external key store with PUBLIC_ENDPOINT connectivity cannot use the
    //    same XksProxyUriEndpoint value as an external key store with VPC_ENDPOINT_SERVICE
    //    connectivity in this Amazon Web Services Region.
    //
    //    * Each external key store with VPC_ENDPOINT_SERVICE connectivity must
    //    have its own private DNS name. The XksProxyUriEndpoint value for external
    //    key stores with VPC_ENDPOINT_SERVICE connectivity (private DNS name) must
    //    be unique in the Amazon Web Services account and Region.
    XksProxyUriEndpoint *string `min:"10" type:"string"`

    // Specifies the base path to the proxy APIs for this external key store. To
    // find this value, see the documentation for your external key store proxy.
    // This parameter is required for all custom key stores with a CustomKeyStoreType
    // of EXTERNAL_KEY_STORE.
    //
    // The value must start with / and must end with /kms/xks/v1 where v1 represents
    // the version of the KMS external key store proxy API. This path can include
    // an optional prefix between the required elements such as /prefix/kms/xks/v1.
    //
    // Uniqueness requirements:
    //
    //    * The combined XksProxyUriEndpoint and XksProxyUriPath values must be
    //    unique in the Amazon Web Services account and Region.
    XksProxyUriPath *string `min:"10" type:"string"`

    // Specifies the name of the Amazon VPC endpoint service for interface endpoints
    // that is used to communicate with your external key store proxy (XKS proxy).
    // This parameter is required when the value of CustomKeyStoreType is EXTERNAL_KEY_STORE
    // and the value of XksProxyConnectivity is VPC_ENDPOINT_SERVICE.
    //
    // The Amazon VPC endpoint service must fulfill all requirements (https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keystore.html#xks-requirements)
    // for use with an external key store.
    //
    // Uniqueness requirements:
    //
    //    * External key stores with VPC_ENDPOINT_SERVICE connectivity can share
    //    an Amazon VPC, but each external key store must have its own VPC endpoint
    //    service and private DNS name.
    XksProxyVpcEndpointServiceName *string `min:"20" type:"string"`
    // contains filtered or unexported fields
}

func (CreateCustomKeyStoreInput) GoString ¶

func (s CreateCustomKeyStoreInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateCustomKeyStoreInput) SetCloudHsmClusterId ¶

func (s *CreateCustomKeyStoreInput) SetCloudHsmClusterId(v string) *CreateCustomKeyStoreInput

SetCloudHsmClusterId sets the CloudHsmClusterId field's value.

func (*CreateCustomKeyStoreInput) SetCustomKeyStoreName ¶

func (s *CreateCustomKeyStoreInput) SetCustomKeyStoreName(v string) *CreateCustomKeyStoreInput

SetCustomKeyStoreName sets the CustomKeyStoreName field's value.

func (*CreateCustomKeyStoreInput) SetCustomKeyStoreType ¶

func (s *CreateCustomKeyStoreInput) SetCustomKeyStoreType(v string) *CreateCustomKeyStoreInput

SetCustomKeyStoreType sets the CustomKeyStoreType field's value.

func (*CreateCustomKeyStoreInput) SetKeyStorePassword ¶

func (s *CreateCustomKeyStoreInput) SetKeyStorePassword(v string) *CreateCustomKeyStoreInput

SetKeyStorePassword sets the KeyStorePassword field's value.

func (*CreateCustomKeyStoreInput) SetTrustAnchorCertificate ¶

func (s *CreateCustomKeyStoreInput) SetTrustAnchorCertificate(v string) *CreateCustomKeyStoreInput

SetTrustAnchorCertificate sets the TrustAnchorCertificate field's value.

func (*CreateCustomKeyStoreInput) SetXksProxyAuthenticationCredential ¶

func (s *CreateCustomKeyStoreInput) SetXksProxyAuthenticationCredential(v *XksProxyAuthenticationCredentialType) *CreateCustomKeyStoreInput

SetXksProxyAuthenticationCredential sets the XksProxyAuthenticationCredential field's value.

func (*CreateCustomKeyStoreInput) SetXksProxyConnectivity ¶

func (s *CreateCustomKeyStoreInput) SetXksProxyConnectivity(v string) *CreateCustomKeyStoreInput

SetXksProxyConnectivity sets the XksProxyConnectivity field's value.

func (*CreateCustomKeyStoreInput) SetXksProxyUriEndpoint ¶

func (s *CreateCustomKeyStoreInput) SetXksProxyUriEndpoint(v string) *CreateCustomKeyStoreInput

SetXksProxyUriEndpoint sets the XksProxyUriEndpoint field's value.

func (*CreateCustomKeyStoreInput) SetXksProxyUriPath ¶

func (s *CreateCustomKeyStoreInput) SetXksProxyUriPath(v string) *CreateCustomKeyStoreInput

SetXksProxyUriPath sets the XksProxyUriPath field's value.

func (*CreateCustomKeyStoreInput) SetXksProxyVpcEndpointServiceName ¶

func (s *CreateCustomKeyStoreInput) SetXksProxyVpcEndpointServiceName(v string) *CreateCustomKeyStoreInput

SetXksProxyVpcEndpointServiceName sets the XksProxyVpcEndpointServiceName field's value.

func (CreateCustomKeyStoreInput) String ¶

func (s CreateCustomKeyStoreInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateCustomKeyStoreInput) Validate ¶

func (s *CreateCustomKeyStoreInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type CreateCustomKeyStoreOutput ¶

type CreateCustomKeyStoreOutput struct {

    // A unique identifier for the new custom key store.
    CustomKeyStoreId *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

func (CreateCustomKeyStoreOutput) GoString ¶

func (s CreateCustomKeyStoreOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateCustomKeyStoreOutput) SetCustomKeyStoreId ¶

func (s *CreateCustomKeyStoreOutput) SetCustomKeyStoreId(v string) *CreateCustomKeyStoreOutput

SetCustomKeyStoreId sets the CustomKeyStoreId field's value.

func (CreateCustomKeyStoreOutput) String ¶

func (s CreateCustomKeyStoreOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CreateGrantInput ¶

type CreateGrantInput struct {

    // Specifies a grant constraint.
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // KMS supports the EncryptionContextEquals and EncryptionContextSubset grant
    // constraints, which allow the permissions in the grant only when the encryption
    // context in the request matches (EncryptionContextEquals) or includes (EncryptionContextSubset)
    // the encryption context specified in the constraint.
    //
    // The encryption context grant constraints are supported only on grant operations
    // (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations)
    // that include an EncryptionContext parameter, such as cryptographic operations
    // on symmetric encryption KMS keys. Grants with grant constraints can include
    // the DescribeKey and RetireGrant operations, but the constraint doesn't apply
    // to these operations. If a grant with a grant constraint includes the CreateGrant
    // operation, the constraint requires that any grants created with the CreateGrant
    // permission have an equally strict or stricter encryption context constraint.
    //
    // You cannot use an encryption context grant constraint for cryptographic operations
    // with asymmetric KMS keys or HMAC KMS keys. Operations with these keys don't
    // support an encryption context.
    //
    // Each constraint value can include up to 8 encryption context pairs. The encryption
    // context value in each constraint cannot exceed 384 characters. For information
    // about grant constraints, see Using grant constraints (https://docs.aws.amazon.com/kms/latest/developerguide/create-grant-overview.html#grant-constraints)
    // in the Key Management Service Developer Guide. For more information about
    // encryption context, see Encryption context (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
    // in the Key Management Service Developer Guide .
    Constraints *GrantConstraints `type:"structure"`

    // Checks if your request will succeed. DryRun is an optional parameter.
    //
    // To learn more about how to use this parameter, see Testing your KMS API calls
    // (https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html)
    // in the Key Management Service Developer Guide.
    DryRun *bool `type:"boolean"`

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // The identity that gets the permissions specified in the grant.
    //
    // To specify the grantee principal, use the Amazon Resource Name (ARN) of an
    // Amazon Web Services principal. Valid principals include Amazon Web Services
    // accounts, IAM users, IAM roles, federated users, and assumed role users.
    // For help with the ARN syntax for a principal, see IAM ARNs (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns)
    // in the Identity and Access Management User Guide .
    //
    // GranteePrincipal is a required field
    GranteePrincipal *string `min:"1" type:"string" required:"true"`

    // Identifies the KMS key for the grant. The grant gives principals permission
    // to use this KMS key.
    //
    // Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different
    // Amazon Web Services account, you must use the key ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // A friendly name for the grant. Use this value to prevent the unintended creation
    // of duplicate grants when retrying this request.
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // When this value is absent, all CreateGrant requests result in a new grant
    // with a unique GrantId even if all the supplied parameters are identical.
    // This can result in unintended duplicates when you retry the CreateGrant request.
    //
    // When this value is present, you can retry a CreateGrant request with identical
    // parameters; if the grant already exists, the original GrantId is returned
    // without creating a new grant. Note that the returned grant token is unique
    // with every CreateGrant request, even when a duplicate GrantId is returned.
    // All grant tokens for the same grant ID can be used interchangeably.
    Name *string `min:"1" type:"string"`

    // A list of operations that the grant permits.
    //
    // This list must include only operations that are permitted in a grant. Also,
    // the operation must be supported on the KMS key. For example, you cannot create
    // a grant for a symmetric encryption KMS key that allows the Sign operation,
    // or a grant for an asymmetric KMS key that allows the GenerateDataKey operation.
    // If you try, KMS returns a ValidationError exception. For details, see Grant
    // operations (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations)
    // in the Key Management Service Developer Guide.
    //
    // Operations is a required field
    Operations []*string `type:"list" required:"true" enum:"GrantOperation"`

    // The principal that has permission to use the RetireGrant operation to retire
    // the grant.
    //
    // To specify the principal, use the Amazon Resource Name (ARN) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
    // of an Amazon Web Services principal. Valid principals include Amazon Web
    // Services accounts, IAM users, IAM roles, federated users, and assumed role
    // users. For help with the ARN syntax for a principal, see IAM ARNs (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns)
    // in the Identity and Access Management User Guide .
    //
    // The grant determines the retiring principal. Other principals might have
    // permission to retire the grant or revoke the grant. For details, see RevokeGrant
    // and Retiring and revoking grants (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#grant-delete)
    // in the Key Management Service Developer Guide.
    RetiringPrincipal *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

func (CreateGrantInput) GoString ¶

func (s CreateGrantInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateGrantInput) SetConstraints ¶

func (s *CreateGrantInput) SetConstraints(v *GrantConstraints) *CreateGrantInput

SetConstraints sets the Constraints field's value.

func (*CreateGrantInput) SetDryRun ¶

func (s *CreateGrantInput) SetDryRun(v bool) *CreateGrantInput

SetDryRun sets the DryRun field's value.

func (*CreateGrantInput) SetGrantTokens ¶

func (s *CreateGrantInput) SetGrantTokens(v []*string) *CreateGrantInput

SetGrantTokens sets the GrantTokens field's value.

func (*CreateGrantInput) SetGranteePrincipal ¶

func (s *CreateGrantInput) SetGranteePrincipal(v string) *CreateGrantInput

SetGranteePrincipal sets the GranteePrincipal field's value.

func (*CreateGrantInput) SetKeyId ¶

func (s *CreateGrantInput) SetKeyId(v string) *CreateGrantInput

SetKeyId sets the KeyId field's value.

func (*CreateGrantInput) SetName ¶

func (s *CreateGrantInput) SetName(v string) *CreateGrantInput

SetName sets the Name field's value.

func (*CreateGrantInput) SetOperations ¶

func (s *CreateGrantInput) SetOperations(v []*string) *CreateGrantInput

SetOperations sets the Operations field's value.

func (*CreateGrantInput) SetRetiringPrincipal ¶

func (s *CreateGrantInput) SetRetiringPrincipal(v string) *CreateGrantInput

SetRetiringPrincipal sets the RetiringPrincipal field's value.

func (CreateGrantInput) String ¶

func (s CreateGrantInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateGrantInput) Validate ¶

func (s *CreateGrantInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type CreateGrantOutput ¶

type CreateGrantOutput struct {

    // The unique identifier for the grant.
    //
    // You can use the GrantId in a ListGrants, RetireGrant, or RevokeGrant operation.
    GrantId *string `min:"1" type:"string"`

    // The grant token.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantToken *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

func (CreateGrantOutput) GoString ¶

func (s CreateGrantOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateGrantOutput) SetGrantId ¶

func (s *CreateGrantOutput) SetGrantId(v string) *CreateGrantOutput

SetGrantId sets the GrantId field's value.

func (*CreateGrantOutput) SetGrantToken ¶

func (s *CreateGrantOutput) SetGrantToken(v string) *CreateGrantOutput

SetGrantToken sets the GrantToken field's value.

func (CreateGrantOutput) String ¶

func (s CreateGrantOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CreateKeyInput ¶

type CreateKeyInput struct {

    // Skips ("bypasses") the key policy lockout safety check. The default value
    // is false.
    //
    // Setting this value to true increases the risk that the KMS key becomes unmanageable.
    // Do not set this value to true indiscriminately.
    //
    // For more information, see Default key policy (https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key)
    // in the Key Management Service Developer Guide.
    //
    // Use this parameter only when you intend to prevent the principal that is
    // making the request from making a subsequent PutKeyPolicy (https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html)
    // request on the KMS key.
    BypassPolicyLockoutSafetyCheck *bool `type:"boolean"`

    // Creates the KMS key in the specified custom key store (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html).
    // The ConnectionState of the custom key store must be CONNECTED. To find the
    // CustomKeyStoreID and ConnectionState use the DescribeCustomKeyStores operation.
    //
    // This parameter is valid only for symmetric encryption KMS keys in a single
    // Region. You cannot create any other type of KMS key in a custom key store.
    //
    // When you create a KMS key in an CloudHSM key store, KMS generates a non-exportable
    // 256-bit symmetric key in its associated CloudHSM cluster and associates it
    // with the KMS key. When you create a KMS key in an external key store, you
    // must use the XksKeyId parameter to specify an external key that serves as
    // key material for the KMS key.
    CustomKeyStoreId *string `min:"1" type:"string"`

    // Instead, use the KeySpec parameter.
    //
    // The KeySpec and CustomerMasterKeySpec parameters work the same way. Only
    // the names differ. We recommend that you use KeySpec parameter in your code.
    // However, to avoid breaking changes, KMS supports both parameters.
    //
    // Deprecated: This parameter has been deprecated. Instead, use the KeySpec parameter.
    CustomerMasterKeySpec *string `deprecated:"true" type:"string" enum:"CustomerMasterKeySpec"`

    // A description of the KMS key. Use a description that helps you decide whether
    // the KMS key is appropriate for a task. The default value is an empty string
    // (no description).
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // To set or change the description after the key is created, use UpdateKeyDescription.
    Description *string `type:"string"`

    // Specifies the type of KMS key to create. The default value, SYMMETRIC_DEFAULT,
    // creates a KMS key with a 256-bit AES-GCM key that is used for encryption
    // and decryption, except in China Regions, where it creates a 128-bit symmetric
    // key that uses SM4 encryption. For help choosing a key spec for your KMS key,
    // see Choosing a KMS key type (https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose)
    // in the Key Management Service Developer Guide .
    //
    // The KeySpec determines whether the KMS key contains a symmetric key or an
    // asymmetric key pair. It also determines the algorithms that the KMS key supports.
    // You can't change the KeySpec after the KMS key is created. To further restrict
    // the algorithms that can be used with the KMS key, use a condition key in
    // its key policy or IAM policy. For more information, see kms:EncryptionAlgorithm
    // (https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm),
    // kms:MacAlgorithm (https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm)
    // or kms:Signing Algorithm (https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm)
    // in the Key Management Service Developer Guide .
    //
    // Amazon Web Services services that are integrated with KMS (http://aws.amazon.com/kms/features/#AWS_Service_Integration)
    // use symmetric encryption KMS keys to protect your data. These services do
    // not support asymmetric KMS keys or HMAC KMS keys.
    //
    // KMS supports the following key specs for KMS keys:
    //
    //    * Symmetric encryption key (default) SYMMETRIC_DEFAULT
    //
    //    * HMAC keys (symmetric) HMAC_224 HMAC_256 HMAC_384 HMAC_512
    //
    //    * Asymmetric RSA key pairs (encryption and decryption -or- signing and
    //    verification) RSA_2048 RSA_3072 RSA_4096
    //
    //    * Asymmetric NIST-recommended elliptic curve key pairs (signing and verification
    //    -or- deriving shared secrets) ECC_NIST_P256 (secp256r1) ECC_NIST_P384
    //    (secp384r1) ECC_NIST_P521 (secp521r1)
    //
    //    * Other asymmetric elliptic curve key pairs (signing and verification)
    //    ECC_SECG_P256K1 (secp256k1), commonly used for cryptocurrencies.
    //
    //    * SM2 key pairs (encryption and decryption -or- signing and verification
    //    -or- deriving shared secrets) SM2 (China Regions only)
    KeySpec *string `type:"string" enum:"KeySpec"`

    // Determines the cryptographic operations (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
    // for which you can use the KMS key. The default value is ENCRYPT_DECRYPT.
    // This parameter is optional when you are creating a symmetric encryption KMS
    // key; otherwise, it is required. You can't change the KeyUsage value after
    // the KMS key is created.
    //
    // Select only one valid value.
    //
    //    * For symmetric encryption KMS keys, omit the parameter or specify ENCRYPT_DECRYPT.
    //
    //    * For HMAC KMS keys (symmetric), specify GENERATE_VERIFY_MAC.
    //
    //    * For asymmetric KMS keys with RSA key pairs, specify ENCRYPT_DECRYPT
    //    or SIGN_VERIFY.
    //
    //    * For asymmetric KMS keys with NIST-recommended elliptic curve key pairs,
    //    specify SIGN_VERIFY or KEY_AGREEMENT.
    //
    //    * For asymmetric KMS keys with ECC_SECG_P256K1 key pairs specify SIGN_VERIFY.
    //
    //    * For asymmetric KMS keys with SM2 key pairs (China Regions only), specify
    //    ENCRYPT_DECRYPT, SIGN_VERIFY, or KEY_AGREEMENT.
    KeyUsage *string `type:"string" enum:"KeyUsageType"`

    // Creates a multi-Region primary key that you can replicate into other Amazon
    // Web Services Regions. You cannot change this value after you create the KMS
    // key.
    //
    // For a multi-Region key, set this parameter to True. For a single-Region KMS
    // key, omit this parameter or set it to False. The default value is False.
    //
    // This operation supports multi-Region keys, an KMS feature that lets you create
    // multiple interoperable KMS keys in different Amazon Web Services Regions.
    // Because these KMS keys have the same key ID, key material, and other metadata,
    // you can use them interchangeably to encrypt data in one Amazon Web Services
    // Region and decrypt it in a different Amazon Web Services Region without re-encrypting
    // the data or making a cross-Region call. For more information about multi-Region
    // keys, see Multi-Region keys in KMS (https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html)
    // in the Key Management Service Developer Guide.
    //
    // This value creates a primary key, not a replica. To create a replica key,
    // use the ReplicateKey operation.
    //
    // You can create a symmetric or asymmetric multi-Region key, and you can create
    // a multi-Region key with imported key material. However, you cannot create
    // a multi-Region key in a custom key store.
    MultiRegion *bool `type:"boolean"`

    // The source of the key material for the KMS key. You cannot change the origin
    // after you create the KMS key. The default is AWS_KMS, which means that KMS
    // creates the key material.
    //
    // To create a KMS key with no key material (https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html)
    // (for imported key material), set this value to EXTERNAL. For more information
    // about importing key material into KMS, see Importing Key Material (https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html)
    // in the Key Management Service Developer Guide. The EXTERNAL origin value
    // is valid only for symmetric KMS keys.
    //
    // To create a KMS key in an CloudHSM key store (https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html)
    // and create its key material in the associated CloudHSM cluster, set this
    // value to AWS_CLOUDHSM. You must also use the CustomKeyStoreId parameter to
    // identify the CloudHSM key store. The KeySpec value must be SYMMETRIC_DEFAULT.
    //
    // To create a KMS key in an external key store (https://docs.aws.amazon.com/kms/latest/developerguide/create-xks-keys.html),
    // set this value to EXTERNAL_KEY_STORE. You must also use the CustomKeyStoreId
    // parameter to identify the external key store and the XksKeyId parameter to
    // identify the associated external key. The KeySpec value must be SYMMETRIC_DEFAULT.
    Origin *string `type:"string" enum:"OriginType"`

    // The key policy to attach to the KMS key.
    //
    // If you provide a key policy, it must meet the following criteria:
    //
    //    * The key policy must allow the calling principal to make a subsequent
    //    PutKeyPolicy request on the KMS key. This reduces the risk that the KMS
    //    key becomes unmanageable. For more information, see Default key policy
    //    (https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key)
    //    in the Key Management Service Developer Guide. (To omit this condition,
    //    set BypassPolicyLockoutSafetyCheck to true.)
    //
    //    * Each statement in the key policy must contain one or more principals.
    //    The principals in the key policy must exist and be visible to KMS. When
    //    you create a new Amazon Web Services principal, you might need to enforce
    //    a delay before including the new principal in a key policy because the
    //    new principal might not be immediately visible to KMS. For more information,
    //    see Changes that I make are not always immediately visible (https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency)
    //    in the Amazon Web Services Identity and Access Management User Guide.
    //
    // If you do not provide a key policy, KMS attaches a default key policy to
    // the KMS key. For more information, see Default key policy (https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default)
    // in the Key Management Service Developer Guide.
    //
    // The key policy size quota is 32 kilobytes (32768 bytes).
    //
    // For help writing and formatting a JSON policy document, see the IAM JSON
    // Policy Reference (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html)
    // in the Identity and Access Management User Guide .
    Policy *string `min:"1" type:"string"`

    // Assigns one or more tags to the KMS key. Use this parameter to tag the KMS
    // key when it is created. To tag an existing KMS key, use the TagResource operation.
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // Tagging or untagging a KMS key can allow or deny permission to the KMS key.
    // For details, see ABAC for KMS (https://docs.aws.amazon.com/kms/latest/developerguide/abac.html)
    // in the Key Management Service Developer Guide.
    //
    // To use this parameter, you must have kms:TagResource (https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html)
    // permission in an IAM policy.
    //
    // Each tag consists of a tag key and a tag value. Both the tag key and the
    // tag value are required, but the tag value can be an empty (null) string.
    // You cannot have more than one tag on a KMS key with the same tag key. If
    // you specify an existing tag key with a different tag value, KMS replaces
    // the current tag value with the specified one.
    //
    // When you add tags to an Amazon Web Services resource, Amazon Web Services
    // generates a cost allocation report with usage and costs aggregated by tags.
    // Tags can also be used to control access to a KMS key. For details, see Tagging
    // Keys (https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html).
    Tags []*Tag `type:"list"`

    // Identifies the external key (https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key)
    // that serves as key material for the KMS key in an external key store (https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html).
    // Specify the ID that the external key store proxy (https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy)
    // uses to refer to the external key. For help, see the documentation for your
    // external key store proxy.
    //
    // This parameter is required for a KMS key with an Origin value of EXTERNAL_KEY_STORE.
    // It is not valid for KMS keys with any other Origin value.
    //
    // The external key must be an existing 256-bit AES symmetric encryption key
    // hosted outside of Amazon Web Services in an external key manager associated
    // with the external key store specified by the CustomKeyStoreId parameter.
    // This key must be enabled and configured to perform encryption and decryption.
    // Each KMS key in an external key store must use a different external key.
    // For details, see Requirements for a KMS key in an external key store (https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements)
    // in the Key Management Service Developer Guide.
    //
    // Each KMS key in an external key store is associated two backing keys. One
    // is key material that KMS generates. The other is the external key specified
    // by this parameter. When you use the KMS key in an external key store to encrypt
    // data, the encryption operation is performed first by KMS using the KMS key
    // material, and then by the external key manager using the specified external
    // key, a process known as double encryption. For details, see Double encryption
    // (https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption)
    // in the Key Management Service Developer Guide.
    XksKeyId *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

func (CreateKeyInput) GoString ¶

func (s CreateKeyInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateKeyInput) SetBypassPolicyLockoutSafetyCheck ¶

func (s *CreateKeyInput) SetBypassPolicyLockoutSafetyCheck(v bool) *CreateKeyInput

SetBypassPolicyLockoutSafetyCheck sets the BypassPolicyLockoutSafetyCheck field's value.

func (*CreateKeyInput) SetCustomKeyStoreId ¶

func (s *CreateKeyInput) SetCustomKeyStoreId(v string) *CreateKeyInput

SetCustomKeyStoreId sets the CustomKeyStoreId field's value.

func (*CreateKeyInput) SetCustomerMasterKeySpec ¶

func (s *CreateKeyInput) SetCustomerMasterKeySpec(v string) *CreateKeyInput

SetCustomerMasterKeySpec sets the CustomerMasterKeySpec field's value.

func (*CreateKeyInput) SetDescription ¶

func (s *CreateKeyInput) SetDescription(v string) *CreateKeyInput

SetDescription sets the Description field's value.

func (*CreateKeyInput) SetKeySpec ¶

func (s *CreateKeyInput) SetKeySpec(v string) *CreateKeyInput

SetKeySpec sets the KeySpec field's value.

func (*CreateKeyInput) SetKeyUsage ¶

func (s *CreateKeyInput) SetKeyUsage(v string) *CreateKeyInput

SetKeyUsage sets the KeyUsage field's value.

func (*CreateKeyInput) SetMultiRegion ¶

func (s *CreateKeyInput) SetMultiRegion(v bool) *CreateKeyInput

SetMultiRegion sets the MultiRegion field's value.

func (*CreateKeyInput) SetOrigin ¶

func (s *CreateKeyInput) SetOrigin(v string) *CreateKeyInput

SetOrigin sets the Origin field's value.

func (*CreateKeyInput) SetPolicy ¶

func (s *CreateKeyInput) SetPolicy(v string) *CreateKeyInput

SetPolicy sets the Policy field's value.

func (*CreateKeyInput) SetTags ¶

func (s *CreateKeyInput) SetTags(v []*Tag) *CreateKeyInput

SetTags sets the Tags field's value.

func (*CreateKeyInput) SetXksKeyId ¶

func (s *CreateKeyInput) SetXksKeyId(v string) *CreateKeyInput

SetXksKeyId sets the XksKeyId field's value.

func (CreateKeyInput) String ¶

func (s CreateKeyInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateKeyInput) Validate ¶

func (s *CreateKeyInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type CreateKeyOutput ¶

type CreateKeyOutput struct {

    // Metadata associated with the KMS key.
    KeyMetadata *KeyMetadata `type:"structure"`
    // contains filtered or unexported fields
}

func (CreateKeyOutput) GoString ¶

func (s CreateKeyOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CreateKeyOutput) SetKeyMetadata ¶

func (s *CreateKeyOutput) SetKeyMetadata(v *KeyMetadata) *CreateKeyOutput

SetKeyMetadata sets the KeyMetadata field's value.

func (CreateKeyOutput) String ¶

func (s CreateKeyOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CustomKeyStoreHasCMKsException ¶

type CustomKeyStoreHasCMKsException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the custom key store contains KMS keys. After verifying that you do not need to use the KMS keys, use the ScheduleKeyDeletion operation to delete the KMS keys. After they are deleted, you can delete the custom key store.

func (*CustomKeyStoreHasCMKsException) Code ¶

func (s *CustomKeyStoreHasCMKsException) Code() string

Code returns the exception type name.

func (*CustomKeyStoreHasCMKsException) Error ¶

func (s *CustomKeyStoreHasCMKsException) Error() string

func (CustomKeyStoreHasCMKsException) GoString ¶

func (s CustomKeyStoreHasCMKsException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CustomKeyStoreHasCMKsException) Message ¶

func (s *CustomKeyStoreHasCMKsException) Message() string

Message returns the exception's message.

func (*CustomKeyStoreHasCMKsException) OrigErr ¶

func (s *CustomKeyStoreHasCMKsException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*CustomKeyStoreHasCMKsException) RequestID ¶

func (s *CustomKeyStoreHasCMKsException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*CustomKeyStoreHasCMKsException) StatusCode ¶

func (s *CustomKeyStoreHasCMKsException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (CustomKeyStoreHasCMKsException) String ¶

func (s CustomKeyStoreHasCMKsException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CustomKeyStoreInvalidStateException ¶

type CustomKeyStoreInvalidStateException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because of the ConnectionState of the custom key store. To get the ConnectionState of a custom key store, use the DescribeCustomKeyStores operation.

This exception is thrown under the following conditions:

• You requested the ConnectCustomKeyStore operation on a custom key store with a ConnectionState of DISCONNECTING or FAILED. This operation is valid for all other ConnectionState values. To reconnect a custom key store in a FAILED state, disconnect it (DisconnectCustomKeyStore), then connect it (ConnectCustomKeyStore).

• You requested the CreateKey operation in a custom key store that is not connected. This operations is valid only when the custom key store ConnectionState is CONNECTED.

• You requested the DisconnectCustomKeyStore operation on a custom key store with a ConnectionState of DISCONNECTING or DISCONNECTED. This operation is valid for all other ConnectionState values.

• You requested the UpdateCustomKeyStore or DeleteCustomKeyStore operation on a custom key store that is not disconnected. This operation is valid only when the custom key store ConnectionState is DISCONNECTED.

• You requested the GenerateRandom operation in an CloudHSM key store that is not connected. This operation is valid only when the CloudHSM key store ConnectionState is CONNECTED.

func (*CustomKeyStoreInvalidStateException) Code ¶

func (s *CustomKeyStoreInvalidStateException) Code() string

Code returns the exception type name.

func (*CustomKeyStoreInvalidStateException) Error ¶

func (s *CustomKeyStoreInvalidStateException) Error() string

func (CustomKeyStoreInvalidStateException) GoString ¶

func (s CustomKeyStoreInvalidStateException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CustomKeyStoreInvalidStateException) Message ¶

func (s *CustomKeyStoreInvalidStateException) Message() string

Message returns the exception's message.

func (*CustomKeyStoreInvalidStateException) OrigErr ¶

func (s *CustomKeyStoreInvalidStateException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*CustomKeyStoreInvalidStateException) RequestID ¶

func (s *CustomKeyStoreInvalidStateException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*CustomKeyStoreInvalidStateException) StatusCode ¶

func (s *CustomKeyStoreInvalidStateException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (CustomKeyStoreInvalidStateException) String ¶

func (s CustomKeyStoreInvalidStateException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CustomKeyStoreNameInUseException ¶

type CustomKeyStoreNameInUseException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the specified custom key store name is already assigned to another custom key store in the account. Try again with a custom key store name that is unique in the account.

func (*CustomKeyStoreNameInUseException) Code ¶

func (s *CustomKeyStoreNameInUseException) Code() string

Code returns the exception type name.

func (*CustomKeyStoreNameInUseException) Error ¶

func (s *CustomKeyStoreNameInUseException) Error() string

func (CustomKeyStoreNameInUseException) GoString ¶

func (s CustomKeyStoreNameInUseException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CustomKeyStoreNameInUseException) Message ¶

func (s *CustomKeyStoreNameInUseException) Message() string

Message returns the exception's message.

func (*CustomKeyStoreNameInUseException) OrigErr ¶

func (s *CustomKeyStoreNameInUseException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*CustomKeyStoreNameInUseException) RequestID ¶

func (s *CustomKeyStoreNameInUseException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*CustomKeyStoreNameInUseException) StatusCode ¶

func (s *CustomKeyStoreNameInUseException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (CustomKeyStoreNameInUseException) String ¶

func (s CustomKeyStoreNameInUseException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CustomKeyStoreNotFoundException ¶

type CustomKeyStoreNotFoundException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because KMS cannot find a custom key store with the specified key store name or ID.

func (*CustomKeyStoreNotFoundException) Code ¶

func (s *CustomKeyStoreNotFoundException) Code() string

Code returns the exception type name.

func (*CustomKeyStoreNotFoundException) Error ¶

func (s *CustomKeyStoreNotFoundException) Error() string

func (CustomKeyStoreNotFoundException) GoString ¶

func (s CustomKeyStoreNotFoundException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CustomKeyStoreNotFoundException) Message ¶

func (s *CustomKeyStoreNotFoundException) Message() string

Message returns the exception's message.

func (*CustomKeyStoreNotFoundException) OrigErr ¶

func (s *CustomKeyStoreNotFoundException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*CustomKeyStoreNotFoundException) RequestID ¶

func (s *CustomKeyStoreNotFoundException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*CustomKeyStoreNotFoundException) StatusCode ¶

func (s *CustomKeyStoreNotFoundException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (CustomKeyStoreNotFoundException) String ¶

func (s CustomKeyStoreNotFoundException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type CustomKeyStoresListEntry ¶

type CustomKeyStoresListEntry struct {

    // A unique identifier for the CloudHSM cluster that is associated with an CloudHSM
    // key store. This field appears only when the CustomKeyStoreType is AWS_CLOUDHSM.
    CloudHsmClusterId *string `min:"19" type:"string"`

    // Describes the connection error. This field appears in the response only when
    // the ConnectionState is FAILED.
    //
    // Many failures can be resolved by updating the properties of the custom key
    // store. To update a custom key store, disconnect it (DisconnectCustomKeyStore),
    // correct the errors (UpdateCustomKeyStore), and try to connect again (ConnectCustomKeyStore).
    // For additional help resolving these errors, see How to Fix a Connection Failure
    // (https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-failed)
    // in Key Management Service Developer Guide.
    //
    // All custom key stores:
    //
    //    * INTERNAL_ERROR — KMS could not complete the request due to an internal
    //    error. Retry the request. For ConnectCustomKeyStore requests, disconnect
    //    the custom key store before trying to connect again.
    //
    //    * NETWORK_ERRORS — Network errors are preventing KMS from connecting
    //    the custom key store to its backing key store.
    //
    // CloudHSM key stores:
    //
    //    * CLUSTER_NOT_FOUND — KMS cannot find the CloudHSM cluster with the
    //    specified cluster ID.
    //
    //    * INSUFFICIENT_CLOUDHSM_HSMS — The associated CloudHSM cluster does
    //    not contain any active HSMs. To connect a custom key store to its CloudHSM
    //    cluster, the cluster must contain at least one active HSM.
    //
    //    * INSUFFICIENT_FREE_ADDRESSES_IN_SUBNET — At least one private subnet
    //    associated with the CloudHSM cluster doesn't have any available IP addresses.
    //    A CloudHSM key store connection requires one free IP address in each of
    //    the associated private subnets, although two are preferable. For details,
    //    see How to Fix a Connection Failure (https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-failed)
    //    in the Key Management Service Developer Guide.
    //
    //    * INVALID_CREDENTIALS — The KeyStorePassword for the custom key store
    //    doesn't match the current password of the kmsuser crypto user in the CloudHSM
    //    cluster. Before you can connect your custom key store to its CloudHSM
    //    cluster, you must change the kmsuser account password and update the KeyStorePassword
    //    value for the custom key store.
    //
    //    * SUBNET_NOT_FOUND — A subnet in the CloudHSM cluster configuration
    //    was deleted. If KMS cannot find all of the subnets in the cluster configuration,
    //    attempts to connect the custom key store to the CloudHSM cluster fail.
    //    To fix this error, create a cluster from a recent backup and associate
    //    it with your custom key store. (This process creates a new cluster configuration
    //    with a VPC and private subnets.) For details, see How to Fix a Connection
    //    Failure (https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-failed)
    //    in the Key Management Service Developer Guide.
    //
    //    * USER_LOCKED_OUT — The kmsuser CU account is locked out of the associated
    //    CloudHSM cluster due to too many failed password attempts. Before you
    //    can connect your custom key store to its CloudHSM cluster, you must change
    //    the kmsuser account password and update the key store password value for
    //    the custom key store.
    //
    //    * USER_LOGGED_IN — The kmsuser CU account is logged into the associated
    //    CloudHSM cluster. This prevents KMS from rotating the kmsuser account
    //    password and logging into the cluster. Before you can connect your custom
    //    key store to its CloudHSM cluster, you must log the kmsuser CU out of
    //    the cluster. If you changed the kmsuser password to log into the cluster,
    //    you must also and update the key store password value for the custom key
    //    store. For help, see How to Log Out and Reconnect (https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#login-kmsuser-2)
    //    in the Key Management Service Developer Guide.
    //
    //    * USER_NOT_FOUND — KMS cannot find a kmsuser CU account in the associated
    //    CloudHSM cluster. Before you can connect your custom key store to its
    //    CloudHSM cluster, you must create a kmsuser CU account in the cluster,
    //    and then update the key store password value for the custom key store.
    //
    // External key stores:
    //
    //    * INVALID_CREDENTIALS — One or both of the XksProxyAuthenticationCredential
    //    values is not valid on the specified external key store proxy.
    //
    //    * XKS_PROXY_ACCESS_DENIED — KMS requests are denied access to the external
    //    key store proxy. If the external key store proxy has authorization rules,
    //    verify that they permit KMS to communicate with the proxy on your behalf.
    //
    //    * XKS_PROXY_INVALID_CONFIGURATION — A configuration error is preventing
    //    the external key store from connecting to its proxy. Verify the value
    //    of the XksProxyUriPath.
    //
    //    * XKS_PROXY_INVALID_RESPONSE — KMS cannot interpret the response from
    //    the external key store proxy. If you see this connection error code repeatedly,
    //    notify your external key store proxy vendor.
    //
    //    * XKS_PROXY_INVALID_TLS_CONFIGURATION — KMS cannot connect to the external
    //    key store proxy because the TLS configuration is invalid. Verify that
    //    the XKS proxy supports TLS 1.2 or 1.3. Also, verify that the TLS certificate
    //    is not expired, and that it matches the hostname in the XksProxyUriEndpoint
    //    value, and that it is signed by a certificate authority included in the
    //    Trusted Certificate Authorities (https://github.com/aws/aws-kms-xksproxy-api-spec/blob/main/TrustedCertificateAuthorities)
    //    list.
    //
    //    * XKS_PROXY_NOT_REACHABLE — KMS can't communicate with your external
    //    key store proxy. Verify that the XksProxyUriEndpoint and XksProxyUriPath
    //    are correct. Use the tools for your external key store proxy to verify
    //    that the proxy is active and available on its network. Also, verify that
    //    your external key manager instances are operating properly. Connection
    //    attempts fail with this connection error code if the proxy reports that
    //    all external key manager instances are unavailable.
    //
    //    * XKS_PROXY_TIMED_OUT — KMS can connect to the external key store proxy,
    //    but the proxy does not respond to KMS in the time allotted. If you see
    //    this connection error code repeatedly, notify your external key store
    //    proxy vendor.
    //
    //    * XKS_VPC_ENDPOINT_SERVICE_INVALID_CONFIGURATION — The Amazon VPC endpoint
    //    service configuration doesn't conform to the requirements for an KMS external
    //    key store. The VPC endpoint service must be an endpoint service for interface
    //    endpoints in the caller's Amazon Web Services account. It must have a
    //    network load balancer (NLB) connected to at least two subnets, each in
    //    a different Availability Zone. The Allow principals list must include
    //    the KMS service principal for the Region, cks.kms.<region>.amazonaws.com,
    //    such as cks.kms.us-east-1.amazonaws.com. It must not require acceptance
    //    (https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html)
    //    of connection requests. It must have a private DNS name. The private DNS
    //    name for an external key store with VPC_ENDPOINT_SERVICE connectivity
    //    must be unique in its Amazon Web Services Region. The domain of the private
    //    DNS name must have a verification status (https://docs.aws.amazon.com/vpc/latest/privatelink/verify-domains.html)
    //    of verified. The TLS certificate (https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html)
    //    specifies the private DNS hostname at which the endpoint is reachable.
    //
    //    * XKS_VPC_ENDPOINT_SERVICE_NOT_FOUND — KMS can't find the VPC endpoint
    //    service that it uses to communicate with the external key store proxy.
    //    Verify that the XksProxyVpcEndpointServiceName is correct and the KMS
    //    service principal has service consumer permissions on the Amazon VPC endpoint
    //    service.
    ConnectionErrorCode *string `type:"string" enum:"ConnectionErrorCodeType"`

    // Indicates whether the custom key store is connected to its backing key store.
    // For an CloudHSM key store, the ConnectionState indicates whether it is connected
    // to its CloudHSM cluster. For an external key store, the ConnectionState indicates
    // whether it is connected to the external key store proxy that communicates
    // with your external key manager.
    //
    // You can create and use KMS keys in your custom key stores only when its ConnectionState
    // is CONNECTED.
    //
    // The ConnectionState value is DISCONNECTED only if the key store has never
    // been connected or you use the DisconnectCustomKeyStore operation to disconnect
    // it. If the value is CONNECTED but you are having trouble using the custom
    // key store, make sure that the backing key store is reachable and active.
    // For an CloudHSM key store, verify that its associated CloudHSM cluster is
    // active and contains at least one active HSM. For an external key store, verify
    // that the external key store proxy and external key manager are connected
    // and enabled.
    //
    // A value of FAILED indicates that an attempt to connect was unsuccessful.
    // The ConnectionErrorCode field in the response indicates the cause of the
    // failure. For help resolving a connection failure, see Troubleshooting a custom
    // key store (https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html)
    // in the Key Management Service Developer Guide.
    ConnectionState *string `type:"string" enum:"ConnectionStateType"`

    // The date and time when the custom key store was created.
    CreationDate *time.Time `type:"timestamp"`

    // A unique identifier for the custom key store.
    CustomKeyStoreId *string `min:"1" type:"string"`

    // The user-specified friendly name for the custom key store.
    CustomKeyStoreName *string `min:"1" type:"string"`

    // Indicates the type of the custom key store. AWS_CLOUDHSM indicates a custom
    // key store backed by an CloudHSM cluster. EXTERNAL_KEY_STORE indicates a custom
    // key store backed by an external key store proxy and external key manager
    // outside of Amazon Web Services.
    CustomKeyStoreType *string `type:"string" enum:"CustomKeyStoreType"`

    // The trust anchor certificate of the CloudHSM cluster associated with an CloudHSM
    // key store. When you initialize the cluster (https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr),
    // you create this certificate and save it in the customerCA.crt file.
    //
    // This field appears only when the CustomKeyStoreType is AWS_CLOUDHSM.
    TrustAnchorCertificate *string `min:"1" type:"string"`

    // Configuration settings for the external key store proxy (XKS proxy). The
    // external key store proxy translates KMS requests into a format that your
    // external key manager can understand. The proxy configuration includes connection
    // information that KMS requires.
    //
    // This field appears only when the CustomKeyStoreType is EXTERNAL_KEY_STORE.
    XksProxyConfiguration *XksProxyConfigurationType `type:"structure"`
    // contains filtered or unexported fields
}

Contains information about each custom key store in the custom key store list.

func (CustomKeyStoresListEntry) GoString ¶

func (s CustomKeyStoresListEntry) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*CustomKeyStoresListEntry) SetCloudHsmClusterId ¶

func (s *CustomKeyStoresListEntry) SetCloudHsmClusterId(v string) *CustomKeyStoresListEntry

SetCloudHsmClusterId sets the CloudHsmClusterId field's value.

func (*CustomKeyStoresListEntry) SetConnectionErrorCode ¶

func (s *CustomKeyStoresListEntry) SetConnectionErrorCode(v string) *CustomKeyStoresListEntry

SetConnectionErrorCode sets the ConnectionErrorCode field's value.

func (*CustomKeyStoresListEntry) SetConnectionState ¶

func (s *CustomKeyStoresListEntry) SetConnectionState(v string) *CustomKeyStoresListEntry

SetConnectionState sets the ConnectionState field's value.

func (*CustomKeyStoresListEntry) SetCreationDate ¶

func (s *CustomKeyStoresListEntry) SetCreationDate(v time.Time) *CustomKeyStoresListEntry

SetCreationDate sets the CreationDate field's value.

func (*CustomKeyStoresListEntry) SetCustomKeyStoreId ¶

func (s *CustomKeyStoresListEntry) SetCustomKeyStoreId(v string) *CustomKeyStoresListEntry

SetCustomKeyStoreId sets the CustomKeyStoreId field's value.

func (*CustomKeyStoresListEntry) SetCustomKeyStoreName ¶

func (s *CustomKeyStoresListEntry) SetCustomKeyStoreName(v string) *CustomKeyStoresListEntry

SetCustomKeyStoreName sets the CustomKeyStoreName field's value.

func (*CustomKeyStoresListEntry) SetCustomKeyStoreType ¶

func (s *CustomKeyStoresListEntry) SetCustomKeyStoreType(v string) *CustomKeyStoresListEntry

SetCustomKeyStoreType sets the CustomKeyStoreType field's value.

func (*CustomKeyStoresListEntry) SetTrustAnchorCertificate ¶

func (s *CustomKeyStoresListEntry) SetTrustAnchorCertificate(v string) *CustomKeyStoresListEntry

SetTrustAnchorCertificate sets the TrustAnchorCertificate field's value.

func (*CustomKeyStoresListEntry) SetXksProxyConfiguration ¶

func (s *CustomKeyStoresListEntry) SetXksProxyConfiguration(v *XksProxyConfigurationType) *CustomKeyStoresListEntry

SetXksProxyConfiguration sets the XksProxyConfiguration field's value.

func (CustomKeyStoresListEntry) String ¶

func (s CustomKeyStoresListEntry) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DecryptInput ¶

type DecryptInput struct {

    // Ciphertext to be decrypted. The blob includes metadata.
    // CiphertextBlob is automatically base64 encoded/decoded by the SDK.
    //
    // CiphertextBlob is a required field
    CiphertextBlob []byte `min:"1" type:"blob" required:"true"`

    // Checks if your request will succeed. DryRun is an optional parameter.
    //
    // To learn more about how to use this parameter, see Testing your KMS API calls
    // (https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html)
    // in the Key Management Service Developer Guide.
    DryRun *bool `type:"boolean"`

    // Specifies the encryption algorithm that will be used to decrypt the ciphertext.
    // Specify the same algorithm that was used to encrypt the data. If you specify
    // a different algorithm, the Decrypt operation fails.
    //
    // This parameter is required only when the ciphertext was encrypted under an
    // asymmetric KMS key. The default value, SYMMETRIC_DEFAULT, represents the
    // only supported algorithm that is valid for symmetric encryption KMS keys.
    EncryptionAlgorithm *string `type:"string" enum:"EncryptionAlgorithmSpec"`

    // Specifies the encryption context to use when decrypting the data. An encryption
    // context is valid only for cryptographic operations (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
    // with a symmetric encryption KMS key. The standard asymmetric encryption algorithms
    // and HMAC algorithms that KMS uses do not support an encryption context.
    //
    // An encryption context is a collection of non-secret key-value pairs that
    // represent additional authenticated data. When you use an encryption context
    // to encrypt data, you must specify the same (an exact case-sensitive match)
    // encryption context to decrypt the data. An encryption context is supported
    // only on operations with symmetric encryption KMS keys. On operations with
    // symmetric encryption KMS keys, an encryption context is optional, but it
    // is strongly recommended.
    //
    // For more information, see Encryption context (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
    // in the Key Management Service Developer Guide.
    EncryptionContext map[string]*string `type:"map"`

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // Specifies the KMS key that KMS uses to decrypt the ciphertext.
    //
    // Enter a key ID of the KMS key that was used to encrypt the ciphertext. If
    // you identify a different KMS key, the Decrypt operation throws an IncorrectKeyException.
    //
    // This parameter is required only when the ciphertext was encrypted under an
    // asymmetric KMS key. If you used a symmetric encryption KMS key, KMS can get
    // the KMS key from metadata that it adds to the symmetric ciphertext blob.
    // However, it is always recommended as a best practice. This practice ensures
    // that you use the KMS key that you intend.
    //
    // To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN.
    // When using an alias name, prefix it with "alias/". To specify a KMS key in
    // a different Amazon Web Services account, you must use the key ARN or alias
    // ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Alias name: alias/ExampleAlias
    //
    //    * Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    // To get the alias name and alias ARN, use ListAliases.
    KeyId *string `min:"1" type:"string"`

    // A signed attestation document (https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave-concepts.html#term-attestdoc)
    // from an Amazon Web Services Nitro enclave and the encryption algorithm to
    // use with the enclave's public key. The only valid encryption algorithm is
    // RSAES_OAEP_SHA_256.
    //
    // This parameter only supports attestation documents for Amazon Web Services
    // Nitro Enclaves. To include this parameter, use the Amazon Web Services Nitro
    // Enclaves SDK (https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk)
    // or any Amazon Web Services SDK.
    //
    // When you use this parameter, instead of returning the plaintext data, KMS
    // encrypts the plaintext data with the public key in the attestation document,
    // and returns the resulting ciphertext in the CiphertextForRecipient field
    // in the response. This ciphertext can be decrypted only with the private key
    // in the enclave. The Plaintext field in the response is null or empty.
    //
    // For information about the interaction between KMS and Amazon Web Services
    // Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses KMS (https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html)
    // in the Key Management Service Developer Guide.
    Recipient *RecipientInfo `type:"structure"`
    // contains filtered or unexported fields
}

func (DecryptInput) GoString ¶

func (s DecryptInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DecryptInput) SetCiphertextBlob ¶

func (s *DecryptInput) SetCiphertextBlob(v []byte) *DecryptInput

SetCiphertextBlob sets the CiphertextBlob field's value.

func (*DecryptInput) SetDryRun ¶

func (s *DecryptInput) SetDryRun(v bool) *DecryptInput

SetDryRun sets the DryRun field's value.

func (*DecryptInput) SetEncryptionAlgorithm ¶

func (s *DecryptInput) SetEncryptionAlgorithm(v string) *DecryptInput

SetEncryptionAlgorithm sets the EncryptionAlgorithm field's value.

func (*DecryptInput) SetEncryptionContext ¶

func (s *DecryptInput) SetEncryptionContext(v map[string]*string) *DecryptInput

SetEncryptionContext sets the EncryptionContext field's value.

func (*DecryptInput) SetGrantTokens ¶

func (s *DecryptInput) SetGrantTokens(v []*string) *DecryptInput

SetGrantTokens sets the GrantTokens field's value.

func (*DecryptInput) SetKeyId ¶

func (s *DecryptInput) SetKeyId(v string) *DecryptInput

SetKeyId sets the KeyId field's value.

func (*DecryptInput) SetRecipient ¶

func (s *DecryptInput) SetRecipient(v *RecipientInfo) *DecryptInput

SetRecipient sets the Recipient field's value.

func (DecryptInput) String ¶

func (s DecryptInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DecryptInput) Validate ¶

func (s *DecryptInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type DecryptOutput ¶

type DecryptOutput struct {

    // The plaintext data encrypted with the public key in the attestation document.
    //
    // This field is included in the response only when the Recipient parameter
    // in the request includes a valid attestation document from an Amazon Web Services
    // Nitro enclave. For information about the interaction between KMS and Amazon
    // Web Services Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses
    // KMS (https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html)
    // in the Key Management Service Developer Guide.
    // CiphertextForRecipient is automatically base64 encoded/decoded by the SDK.
    CiphertextForRecipient []byte `min:"1" type:"blob"`

    // The encryption algorithm that was used to decrypt the ciphertext.
    EncryptionAlgorithm *string `type:"string" enum:"EncryptionAlgorithmSpec"`

    // The Amazon Resource Name (key ARN (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
    // of the KMS key that was used to decrypt the ciphertext.
    KeyId *string `min:"1" type:"string"`

    // Decrypted plaintext data. When you use the HTTP API or the Amazon Web Services
    // CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.
    //
    // If the response includes the CiphertextForRecipient field, the Plaintext
    // field is null or empty.
    //
    // Plaintext is a sensitive parameter and its value will be
    // replaced with "sensitive" in string returned by DecryptOutput's
    // String and GoString methods.
    //
    // Plaintext is automatically base64 encoded/decoded by the SDK.
    Plaintext []byte `min:"1" type:"blob" sensitive:"true"`
    // contains filtered or unexported fields
}

func (DecryptOutput) GoString ¶

func (s DecryptOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DecryptOutput) SetCiphertextForRecipient ¶

func (s *DecryptOutput) SetCiphertextForRecipient(v []byte) *DecryptOutput

SetCiphertextForRecipient sets the CiphertextForRecipient field's value.

func (*DecryptOutput) SetEncryptionAlgorithm ¶

func (s *DecryptOutput) SetEncryptionAlgorithm(v string) *DecryptOutput

SetEncryptionAlgorithm sets the EncryptionAlgorithm field's value.

func (*DecryptOutput) SetKeyId ¶

func (s *DecryptOutput) SetKeyId(v string) *DecryptOutput

SetKeyId sets the KeyId field's value.

func (*DecryptOutput) SetPlaintext ¶

func (s *DecryptOutput) SetPlaintext(v []byte) *DecryptOutput

SetPlaintext sets the Plaintext field's value.

func (DecryptOutput) String ¶

func (s DecryptOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DeleteAliasInput ¶

type DeleteAliasInput struct {

    // The alias to be deleted. The alias name must begin with alias/ followed by
    // the alias name, such as alias/ExampleAlias.
    //
    // AliasName is a required field
    AliasName *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (DeleteAliasInput) GoString ¶

func (s DeleteAliasInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DeleteAliasInput) SetAliasName ¶

func (s *DeleteAliasInput) SetAliasName(v string) *DeleteAliasInput

SetAliasName sets the AliasName field's value.

func (DeleteAliasInput) String ¶

func (s DeleteAliasInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DeleteAliasInput) Validate ¶

func (s *DeleteAliasInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type DeleteAliasOutput ¶

type DeleteAliasOutput struct {
    // contains filtered or unexported fields
}

func (DeleteAliasOutput) GoString ¶

func (s DeleteAliasOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (DeleteAliasOutput) String ¶

func (s DeleteAliasOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DeleteCustomKeyStoreInput ¶

type DeleteCustomKeyStoreInput struct {

    // Enter the ID of the custom key store you want to delete. To find the ID of
    // a custom key store, use the DescribeCustomKeyStores operation.
    //
    // CustomKeyStoreId is a required field
    CustomKeyStoreId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (DeleteCustomKeyStoreInput) GoString ¶

func (s DeleteCustomKeyStoreInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DeleteCustomKeyStoreInput) SetCustomKeyStoreId ¶

func (s *DeleteCustomKeyStoreInput) SetCustomKeyStoreId(v string) *DeleteCustomKeyStoreInput

SetCustomKeyStoreId sets the CustomKeyStoreId field's value.

func (DeleteCustomKeyStoreInput) String ¶

func (s DeleteCustomKeyStoreInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DeleteCustomKeyStoreInput) Validate ¶

func (s *DeleteCustomKeyStoreInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type DeleteCustomKeyStoreOutput ¶

type DeleteCustomKeyStoreOutput struct {
    // contains filtered or unexported fields
}

func (DeleteCustomKeyStoreOutput) GoString ¶

func (s DeleteCustomKeyStoreOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (DeleteCustomKeyStoreOutput) String ¶

func (s DeleteCustomKeyStoreOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DeleteImportedKeyMaterialInput ¶

type DeleteImportedKeyMaterialInput struct {

    // Identifies the KMS key from which you are deleting imported key material.
    // The Origin of the KMS key must be EXTERNAL.
    //
    // Specify the key ID or key ARN of the KMS key.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (DeleteImportedKeyMaterialInput) GoString ¶

func (s DeleteImportedKeyMaterialInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DeleteImportedKeyMaterialInput) SetKeyId ¶

func (s *DeleteImportedKeyMaterialInput) SetKeyId(v string) *DeleteImportedKeyMaterialInput

SetKeyId sets the KeyId field's value.

func (DeleteImportedKeyMaterialInput) String ¶

func (s DeleteImportedKeyMaterialInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DeleteImportedKeyMaterialInput) Validate ¶

func (s *DeleteImportedKeyMaterialInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type DeleteImportedKeyMaterialOutput ¶

type DeleteImportedKeyMaterialOutput struct {
    // contains filtered or unexported fields
}

func (DeleteImportedKeyMaterialOutput) GoString ¶

func (s DeleteImportedKeyMaterialOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (DeleteImportedKeyMaterialOutput) String ¶

func (s DeleteImportedKeyMaterialOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DependencyTimeoutException ¶

type DependencyTimeoutException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The system timed out while trying to fulfill the request. You can retry the request.

func (*DependencyTimeoutException) Code ¶

func (s *DependencyTimeoutException) Code() string

Code returns the exception type name.

func (*DependencyTimeoutException) Error ¶

func (s *DependencyTimeoutException) Error() string

func (DependencyTimeoutException) GoString ¶

func (s DependencyTimeoutException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DependencyTimeoutException) Message ¶

func (s *DependencyTimeoutException) Message() string

Message returns the exception's message.

func (*DependencyTimeoutException) OrigErr ¶

func (s *DependencyTimeoutException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*DependencyTimeoutException) RequestID ¶

func (s *DependencyTimeoutException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*DependencyTimeoutException) StatusCode ¶

func (s *DependencyTimeoutException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (DependencyTimeoutException) String ¶

func (s DependencyTimeoutException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DeriveSharedSecretInput ¶

type DeriveSharedSecretInput struct {

    // Checks if your request will succeed. DryRun is an optional parameter.
    //
    // To learn more about how to use this parameter, see Testing your KMS API calls
    // (https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html)
    // in the Key Management Service Developer Guide.
    DryRun *bool `type:"boolean"`

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // Specifies the key agreement algorithm used to derive the shared secret. The
    // only valid value is ECDH.
    //
    // KeyAgreementAlgorithm is a required field
    KeyAgreementAlgorithm *string `type:"string" required:"true" enum:"KeyAgreementAlgorithmSpec"`

    // Identifies an asymmetric NIST-recommended ECC or SM2 (China Regions only)
    // KMS key. KMS uses the private key in the specified key pair to derive the
    // shared secret. The key usage of the KMS key must be KEY_AGREEMENT. To find
    // the KeyUsage of a KMS key, use the DescribeKey operation.
    //
    // To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN.
    // When using an alias name, prefix it with "alias/". To specify a KMS key in
    // a different Amazon Web Services account, you must use the key ARN or alias
    // ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Alias name: alias/ExampleAlias
    //
    //    * Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    // To get the alias name and alias ARN, use ListAliases.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // Specifies the public key in your peer's NIST-recommended elliptic curve (ECC)
    // or SM2 (China Regions only) key pair.
    //
    // The public key must be a DER-encoded X.509 public key, also known as SubjectPublicKeyInfo
    // (SPKI), as defined in RFC 5280 (https://tools.ietf.org/html/rfc5280).
    //
    // GetPublicKey returns the public key of an asymmetric KMS key pair in the
    // required DER-encoded format.
    //
    // If you use Amazon Web Services CLI version 1 (https://docs.aws.amazon.com/cli/v1/userguide/cli-chap-welcome.html),
    // you must provide the DER-encoded X.509 public key in a file. Otherwise, the
    // Amazon Web Services CLI Base64-encodes the public key a second time, resulting
    // in a ValidationException.
    //
    // You can specify the public key as binary data in a file using fileb (fileb://<path-to-file>)
    // or in-line using a Base64 encoded string.
    // PublicKey is automatically base64 encoded/decoded by the SDK.
    //
    // PublicKey is a required field
    PublicKey []byte `min:"1" type:"blob" required:"true"`

    // A signed attestation document (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc)
    // from an Amazon Web Services Nitro enclave and the encryption algorithm to
    // use with the enclave's public key. The only valid encryption algorithm is
    // RSAES_OAEP_SHA_256.
    //
    // This parameter only supports attestation documents for Amazon Web Services
    // Nitro Enclaves. To call DeriveSharedSecret for an Amazon Web Services Nitro
    // Enclaves, use the Amazon Web Services Nitro Enclaves SDK (https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk)
    // to generate the attestation document and then use the Recipient parameter
    // from any Amazon Web Services SDK to provide the attestation document for
    // the enclave.
    //
    // When you use this parameter, instead of returning a plaintext copy of the
    // shared secret, KMS encrypts the plaintext shared secret under the public
    // key in the attestation document, and returns the resulting ciphertext in
    // the CiphertextForRecipient field in the response. This ciphertext can be
    // decrypted only with the private key in the enclave. The CiphertextBlob field
    // in the response contains the encrypted shared secret derived from the KMS
    // key specified by the KeyId parameter and public key specified by the PublicKey
    // parameter. The SharedSecret field in the response is null or empty.
    //
    // For information about the interaction between KMS and Amazon Web Services
    // Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses KMS (https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html)
    // in the Key Management Service Developer Guide.
    Recipient *RecipientInfo `type:"structure"`
    // contains filtered or unexported fields
}

func (DeriveSharedSecretInput) GoString ¶

func (s DeriveSharedSecretInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DeriveSharedSecretInput) SetDryRun ¶

func (s *DeriveSharedSecretInput) SetDryRun(v bool) *DeriveSharedSecretInput

SetDryRun sets the DryRun field's value.

func (*DeriveSharedSecretInput) SetGrantTokens ¶

func (s *DeriveSharedSecretInput) SetGrantTokens(v []*string) *DeriveSharedSecretInput

SetGrantTokens sets the GrantTokens field's value.

func (*DeriveSharedSecretInput) SetKeyAgreementAlgorithm ¶

func (s *DeriveSharedSecretInput) SetKeyAgreementAlgorithm(v string) *DeriveSharedSecretInput

SetKeyAgreementAlgorithm sets the KeyAgreementAlgorithm field's value.

func (*DeriveSharedSecretInput) SetKeyId ¶

func (s *DeriveSharedSecretInput) SetKeyId(v string) *DeriveSharedSecretInput

SetKeyId sets the KeyId field's value.

func (*DeriveSharedSecretInput) SetPublicKey ¶

func (s *DeriveSharedSecretInput) SetPublicKey(v []byte) *DeriveSharedSecretInput

SetPublicKey sets the PublicKey field's value.

func (*DeriveSharedSecretInput) SetRecipient ¶

func (s *DeriveSharedSecretInput) SetRecipient(v *RecipientInfo) *DeriveSharedSecretInput

SetRecipient sets the Recipient field's value.

func (DeriveSharedSecretInput) String ¶

func (s DeriveSharedSecretInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DeriveSharedSecretInput) Validate ¶

func (s *DeriveSharedSecretInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type DeriveSharedSecretOutput ¶

type DeriveSharedSecretOutput struct {

    // The plaintext shared secret encrypted with the public key in the attestation
    // document.
    //
    // This field is included in the response only when the Recipient parameter
    // in the request includes a valid attestation document from an Amazon Web Services
    // Nitro enclave. For information about the interaction between KMS and Amazon
    // Web Services Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses
    // KMS (https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html)
    // in the Key Management Service Developer Guide.
    // CiphertextForRecipient is automatically base64 encoded/decoded by the SDK.
    CiphertextForRecipient []byte `min:"1" type:"blob"`

    // Identifies the key agreement algorithm used to derive the shared secret.
    KeyAgreementAlgorithm *string `type:"string" enum:"KeyAgreementAlgorithmSpec"`

    // Identifies the KMS key used to derive the shared secret.
    KeyId *string `min:"1" type:"string"`

    // The source of the key material for the specified KMS key.
    //
    // When this value is AWS_KMS, KMS created the key material. When this value
    // is EXTERNAL, the key material was imported or the KMS key doesn't have any
    // key material.
    //
    // The only valid values for DeriveSharedSecret are AWS_KMS and EXTERNAL. DeriveSharedSecret
    // does not support KMS keys with a KeyOrigin value of AWS_CLOUDHSM or EXTERNAL_KEY_STORE.
    KeyOrigin *string `type:"string" enum:"OriginType"`

    // The raw secret derived from the specified key agreement algorithm, private
    // key in the asymmetric KMS key, and your peer's public key.
    //
    // If the response includes the CiphertextForRecipient field, the SharedSecret
    // field is null or empty.
    //
    // SharedSecret is a sensitive parameter and its value will be
    // replaced with "sensitive" in string returned by DeriveSharedSecretOutput's
    // String and GoString methods.
    //
    // SharedSecret is automatically base64 encoded/decoded by the SDK.
    SharedSecret []byte `min:"1" type:"blob" sensitive:"true"`
    // contains filtered or unexported fields
}

func (DeriveSharedSecretOutput) GoString ¶

func (s DeriveSharedSecretOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DeriveSharedSecretOutput) SetCiphertextForRecipient ¶

func (s *DeriveSharedSecretOutput) SetCiphertextForRecipient(v []byte) *DeriveSharedSecretOutput

SetCiphertextForRecipient sets the CiphertextForRecipient field's value.

func (*DeriveSharedSecretOutput) SetKeyAgreementAlgorithm ¶

func (s *DeriveSharedSecretOutput) SetKeyAgreementAlgorithm(v string) *DeriveSharedSecretOutput

SetKeyAgreementAlgorithm sets the KeyAgreementAlgorithm field's value.

func (*DeriveSharedSecretOutput) SetKeyId ¶

func (s *DeriveSharedSecretOutput) SetKeyId(v string) *DeriveSharedSecretOutput

SetKeyId sets the KeyId field's value.

func (*DeriveSharedSecretOutput) SetKeyOrigin ¶

func (s *DeriveSharedSecretOutput) SetKeyOrigin(v string) *DeriveSharedSecretOutput

SetKeyOrigin sets the KeyOrigin field's value.

func (*DeriveSharedSecretOutput) SetSharedSecret ¶

func (s *DeriveSharedSecretOutput) SetSharedSecret(v []byte) *DeriveSharedSecretOutput

SetSharedSecret sets the SharedSecret field's value.

func (DeriveSharedSecretOutput) String ¶

func (s DeriveSharedSecretOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DescribeCustomKeyStoresInput ¶

type DescribeCustomKeyStoresInput struct {

    // Gets only information about the specified custom key store. Enter the key
    // store ID.
    //
    // By default, this operation gets information about all custom key stores in
    // the account and Region. To limit the output to a particular custom key store,
    // provide either the CustomKeyStoreId or CustomKeyStoreName parameter, but
    // not both.
    CustomKeyStoreId *string `min:"1" type:"string"`

    // Gets only information about the specified custom key store. Enter the friendly
    // name of the custom key store.
    //
    // By default, this operation gets information about all custom key stores in
    // the account and Region. To limit the output to a particular custom key store,
    // provide either the CustomKeyStoreId or CustomKeyStoreName parameter, but
    // not both.
    CustomKeyStoreName *string `min:"1" type:"string"`

    // Use this parameter to specify the maximum number of items to return. When
    // this value is present, KMS does not return more than the specified number
    // of items, but it might return fewer.
    Limit *int64 `min:"1" type:"integer"`

    // Use this parameter in a subsequent request after you receive a response with
    // truncated results. Set it to the value of NextMarker from the truncated response
    // you just received.
    Marker *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

func (DescribeCustomKeyStoresInput) GoString ¶

func (s DescribeCustomKeyStoresInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DescribeCustomKeyStoresInput) SetCustomKeyStoreId ¶

func (s *DescribeCustomKeyStoresInput) SetCustomKeyStoreId(v string) *DescribeCustomKeyStoresInput

SetCustomKeyStoreId sets the CustomKeyStoreId field's value.

func (*DescribeCustomKeyStoresInput) SetCustomKeyStoreName ¶

func (s *DescribeCustomKeyStoresInput) SetCustomKeyStoreName(v string) *DescribeCustomKeyStoresInput

SetCustomKeyStoreName sets the CustomKeyStoreName field's value.

func (*DescribeCustomKeyStoresInput) SetLimit ¶

func (s *DescribeCustomKeyStoresInput) SetLimit(v int64) *DescribeCustomKeyStoresInput

SetLimit sets the Limit field's value.

func (*DescribeCustomKeyStoresInput) SetMarker ¶

func (s *DescribeCustomKeyStoresInput) SetMarker(v string) *DescribeCustomKeyStoresInput

SetMarker sets the Marker field's value.

func (DescribeCustomKeyStoresInput) String ¶

func (s DescribeCustomKeyStoresInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DescribeCustomKeyStoresInput) Validate ¶

func (s *DescribeCustomKeyStoresInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type DescribeCustomKeyStoresOutput ¶

type DescribeCustomKeyStoresOutput struct {

    // Contains metadata about each custom key store.
    CustomKeyStores []*CustomKeyStoresListEntry `type:"list"`

    // When Truncated is true, this element is present and contains the value to
    // use for the Marker parameter in a subsequent request.
    NextMarker *string `min:"1" type:"string"`

    // A flag that indicates whether there are more items in the list. When this
    // value is true, the list in this response is truncated. To get more items,
    // pass the value of the NextMarker element in this response to the Marker parameter
    // in a subsequent request.
    Truncated *bool `type:"boolean"`
    // contains filtered or unexported fields
}

func (DescribeCustomKeyStoresOutput) GoString ¶

func (s DescribeCustomKeyStoresOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DescribeCustomKeyStoresOutput) SetCustomKeyStores ¶

func (s *DescribeCustomKeyStoresOutput) SetCustomKeyStores(v []*CustomKeyStoresListEntry) *DescribeCustomKeyStoresOutput

SetCustomKeyStores sets the CustomKeyStores field's value.

func (*DescribeCustomKeyStoresOutput) SetNextMarker ¶

func (s *DescribeCustomKeyStoresOutput) SetNextMarker(v string) *DescribeCustomKeyStoresOutput

SetNextMarker sets the NextMarker field's value.

func (*DescribeCustomKeyStoresOutput) SetTruncated ¶

func (s *DescribeCustomKeyStoresOutput) SetTruncated(v bool) *DescribeCustomKeyStoresOutput

SetTruncated sets the Truncated field's value.

func (DescribeCustomKeyStoresOutput) String ¶

func (s DescribeCustomKeyStoresOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DescribeKeyInput ¶

type DescribeKeyInput struct {

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // Describes the specified KMS key.
    //
    // If you specify a predefined Amazon Web Services alias (an Amazon Web Services
    // alias with no key ID), KMS associates the alias with an Amazon Web Services
    // managed key (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html##aws-managed-cmk)
    // and returns its KeyId and Arn in the response.
    //
    // To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN.
    // When using an alias name, prefix it with "alias/". To specify a KMS key in
    // a different Amazon Web Services account, you must use the key ARN or alias
    // ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Alias name: alias/ExampleAlias
    //
    //    * Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    // To get the alias name and alias ARN, use ListAliases.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (DescribeKeyInput) GoString ¶

func (s DescribeKeyInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DescribeKeyInput) SetGrantTokens ¶

func (s *DescribeKeyInput) SetGrantTokens(v []*string) *DescribeKeyInput

SetGrantTokens sets the GrantTokens field's value.

func (*DescribeKeyInput) SetKeyId ¶

func (s *DescribeKeyInput) SetKeyId(v string) *DescribeKeyInput

SetKeyId sets the KeyId field's value.

func (DescribeKeyInput) String ¶

func (s DescribeKeyInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DescribeKeyInput) Validate ¶

func (s *DescribeKeyInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type DescribeKeyOutput ¶

type DescribeKeyOutput struct {

    // Metadata associated with the key.
    KeyMetadata *KeyMetadata `type:"structure"`
    // contains filtered or unexported fields
}

func (DescribeKeyOutput) GoString ¶

func (s DescribeKeyOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DescribeKeyOutput) SetKeyMetadata ¶

func (s *DescribeKeyOutput) SetKeyMetadata(v *KeyMetadata) *DescribeKeyOutput

SetKeyMetadata sets the KeyMetadata field's value.

func (DescribeKeyOutput) String ¶

func (s DescribeKeyOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DisableKeyInput ¶

type DisableKeyInput struct {

    // Identifies the KMS key to disable.
    //
    // Specify the key ID or key ARN of the KMS key.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (DisableKeyInput) GoString ¶

func (s DisableKeyInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DisableKeyInput) SetKeyId ¶

func (s *DisableKeyInput) SetKeyId(v string) *DisableKeyInput

SetKeyId sets the KeyId field's value.

func (DisableKeyInput) String ¶

func (s DisableKeyInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DisableKeyInput) Validate ¶

func (s *DisableKeyInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type DisableKeyOutput ¶

type DisableKeyOutput struct {
    // contains filtered or unexported fields
}

func (DisableKeyOutput) GoString ¶

func (s DisableKeyOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (DisableKeyOutput) String ¶

func (s DisableKeyOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DisableKeyRotationInput ¶

type DisableKeyRotationInput struct {

    // Identifies a symmetric encryption KMS key. You cannot enable or disable automatic
    // rotation of asymmetric KMS keys (https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks),
    // HMAC KMS keys (https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html),
    // KMS keys with imported key material (https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html),
    // or KMS keys in a custom key store (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html).
    //
    // Specify the key ID or key ARN of the KMS key.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (DisableKeyRotationInput) GoString ¶

func (s DisableKeyRotationInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DisableKeyRotationInput) SetKeyId ¶

func (s *DisableKeyRotationInput) SetKeyId(v string) *DisableKeyRotationInput

SetKeyId sets the KeyId field's value.

func (DisableKeyRotationInput) String ¶

func (s DisableKeyRotationInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DisableKeyRotationInput) Validate ¶

func (s *DisableKeyRotationInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type DisableKeyRotationOutput ¶

type DisableKeyRotationOutput struct {
    // contains filtered or unexported fields
}

func (DisableKeyRotationOutput) GoString ¶

func (s DisableKeyRotationOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (DisableKeyRotationOutput) String ¶

func (s DisableKeyRotationOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DisabledException ¶

type DisabledException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the specified KMS key is not enabled.

func (*DisabledException) Code ¶

func (s *DisabledException) Code() string

Code returns the exception type name.

func (*DisabledException) Error ¶

func (s *DisabledException) Error() string

func (DisabledException) GoString ¶

func (s DisabledException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DisabledException) Message ¶

func (s *DisabledException) Message() string

Message returns the exception's message.

func (*DisabledException) OrigErr ¶

func (s *DisabledException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*DisabledException) RequestID ¶

func (s *DisabledException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*DisabledException) StatusCode ¶

func (s *DisabledException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (DisabledException) String ¶

func (s DisabledException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DisconnectCustomKeyStoreInput ¶

type DisconnectCustomKeyStoreInput struct {

    // Enter the ID of the custom key store you want to disconnect. To find the
    // ID of a custom key store, use the DescribeCustomKeyStores operation.
    //
    // CustomKeyStoreId is a required field
    CustomKeyStoreId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (DisconnectCustomKeyStoreInput) GoString ¶

func (s DisconnectCustomKeyStoreInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DisconnectCustomKeyStoreInput) SetCustomKeyStoreId ¶

func (s *DisconnectCustomKeyStoreInput) SetCustomKeyStoreId(v string) *DisconnectCustomKeyStoreInput

SetCustomKeyStoreId sets the CustomKeyStoreId field's value.

func (DisconnectCustomKeyStoreInput) String ¶

func (s DisconnectCustomKeyStoreInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DisconnectCustomKeyStoreInput) Validate ¶

func (s *DisconnectCustomKeyStoreInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type DisconnectCustomKeyStoreOutput ¶

type DisconnectCustomKeyStoreOutput struct {
    // contains filtered or unexported fields
}

func (DisconnectCustomKeyStoreOutput) GoString ¶

func (s DisconnectCustomKeyStoreOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (DisconnectCustomKeyStoreOutput) String ¶

func (s DisconnectCustomKeyStoreOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type DryRunOperationException ¶

type DryRunOperationException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the DryRun parameter was specified.

func (*DryRunOperationException) Code ¶

func (s *DryRunOperationException) Code() string

Code returns the exception type name.

func (*DryRunOperationException) Error ¶

func (s *DryRunOperationException) Error() string

func (DryRunOperationException) GoString ¶

func (s DryRunOperationException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*DryRunOperationException) Message ¶

func (s *DryRunOperationException) Message() string

Message returns the exception's message.

func (*DryRunOperationException) OrigErr ¶

func (s *DryRunOperationException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*DryRunOperationException) RequestID ¶

func (s *DryRunOperationException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*DryRunOperationException) StatusCode ¶

func (s *DryRunOperationException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (DryRunOperationException) String ¶

func (s DryRunOperationException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type EnableKeyInput ¶

type EnableKeyInput struct {

    // Identifies the KMS key to enable.
    //
    // Specify the key ID or key ARN of the KMS key.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (EnableKeyInput) GoString ¶

func (s EnableKeyInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*EnableKeyInput) SetKeyId ¶

func (s *EnableKeyInput) SetKeyId(v string) *EnableKeyInput

SetKeyId sets the KeyId field's value.

func (EnableKeyInput) String ¶

func (s EnableKeyInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*EnableKeyInput) Validate ¶

func (s *EnableKeyInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type EnableKeyOutput ¶

type EnableKeyOutput struct {
    // contains filtered or unexported fields
}

func (EnableKeyOutput) GoString ¶

func (s EnableKeyOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (EnableKeyOutput) String ¶

func (s EnableKeyOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type EnableKeyRotationInput ¶

type EnableKeyRotationInput struct {

    // Identifies a symmetric encryption KMS key. You cannot enable automatic rotation
    // of asymmetric KMS keys (https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html),
    // HMAC KMS keys (https://docs.aws.amazon.com/kms/latest/developerguide/hmac.html),
    // KMS keys with imported key material (https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html),
    // or KMS keys in a custom key store (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html).
    // To enable or disable automatic rotation of a set of related multi-Region
    // keys (https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-manage.html#multi-region-rotate),
    // set the property on the primary key.
    //
    // Specify the key ID or key ARN of the KMS key.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // Use this parameter to specify a custom period of time between each rotation
    // date. If no value is specified, the default value is 365 days.
    //
    // The rotation period defines the number of days after you enable automatic
    // key rotation that KMS will rotate your key material, and the number of days
    // between each automatic rotation thereafter.
    //
    // You can use the kms:RotationPeriodInDays (https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-rotation-period-in-days)
    // condition key to further constrain the values that principals can specify
    // in the RotationPeriodInDays parameter.
    RotationPeriodInDays *int64 `min:"90" type:"integer"`
    // contains filtered or unexported fields
}

func (EnableKeyRotationInput) GoString ¶

func (s EnableKeyRotationInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*EnableKeyRotationInput) SetKeyId ¶

func (s *EnableKeyRotationInput) SetKeyId(v string) *EnableKeyRotationInput

SetKeyId sets the KeyId field's value.

func (*EnableKeyRotationInput) SetRotationPeriodInDays ¶

func (s *EnableKeyRotationInput) SetRotationPeriodInDays(v int64) *EnableKeyRotationInput

SetRotationPeriodInDays sets the RotationPeriodInDays field's value.

func (EnableKeyRotationInput) String ¶

func (s EnableKeyRotationInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*EnableKeyRotationInput) Validate ¶

func (s *EnableKeyRotationInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type EnableKeyRotationOutput ¶

type EnableKeyRotationOutput struct {
    // contains filtered or unexported fields
}

func (EnableKeyRotationOutput) GoString ¶

func (s EnableKeyRotationOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (EnableKeyRotationOutput) String ¶

func (s EnableKeyRotationOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type EncryptInput ¶

type EncryptInput struct {

    // Checks if your request will succeed. DryRun is an optional parameter.
    //
    // To learn more about how to use this parameter, see Testing your KMS API calls
    // (https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html)
    // in the Key Management Service Developer Guide.
    DryRun *bool `type:"boolean"`

    // Specifies the encryption algorithm that KMS will use to encrypt the plaintext
    // message. The algorithm must be compatible with the KMS key that you specify.
    //
    // This parameter is required only for asymmetric KMS keys. The default value,
    // SYMMETRIC_DEFAULT, is the algorithm used for symmetric encryption KMS keys.
    // If you are using an asymmetric KMS key, we recommend RSAES_OAEP_SHA_256.
    //
    // The SM2PKE algorithm is only available in China Regions.
    EncryptionAlgorithm *string `type:"string" enum:"EncryptionAlgorithmSpec"`

    // Specifies the encryption context that will be used to encrypt the data. An
    // encryption context is valid only for cryptographic operations (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
    // with a symmetric encryption KMS key. The standard asymmetric encryption algorithms
    // and HMAC algorithms that KMS uses do not support an encryption context.
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // An encryption context is a collection of non-secret key-value pairs that
    // represent additional authenticated data. When you use an encryption context
    // to encrypt data, you must specify the same (an exact case-sensitive match)
    // encryption context to decrypt the data. An encryption context is supported
    // only on operations with symmetric encryption KMS keys. On operations with
    // symmetric encryption KMS keys, an encryption context is optional, but it
    // is strongly recommended.
    //
    // For more information, see Encryption context (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
    // in the Key Management Service Developer Guide.
    EncryptionContext map[string]*string `type:"map"`

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // Identifies the KMS key to use in the encryption operation. The KMS key must
    // have a KeyUsage of ENCRYPT_DECRYPT. To find the KeyUsage of a KMS key, use
    // the DescribeKey operation.
    //
    // To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN.
    // When using an alias name, prefix it with "alias/". To specify a KMS key in
    // a different Amazon Web Services account, you must use the key ARN or alias
    // ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Alias name: alias/ExampleAlias
    //
    //    * Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    // To get the alias name and alias ARN, use ListAliases.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // Data to be encrypted.
    //
    // Plaintext is a sensitive parameter and its value will be
    // replaced with "sensitive" in string returned by EncryptInput's
    // String and GoString methods.
    //
    // Plaintext is automatically base64 encoded/decoded by the SDK.
    //
    // Plaintext is a required field
    Plaintext []byte `min:"1" type:"blob" required:"true" sensitive:"true"`
    // contains filtered or unexported fields
}

func (EncryptInput) GoString ¶

func (s EncryptInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*EncryptInput) SetDryRun ¶

func (s *EncryptInput) SetDryRun(v bool) *EncryptInput

SetDryRun sets the DryRun field's value.

func (*EncryptInput) SetEncryptionAlgorithm ¶

func (s *EncryptInput) SetEncryptionAlgorithm(v string) *EncryptInput

SetEncryptionAlgorithm sets the EncryptionAlgorithm field's value.

func (*EncryptInput) SetEncryptionContext ¶

func (s *EncryptInput) SetEncryptionContext(v map[string]*string) *EncryptInput

SetEncryptionContext sets the EncryptionContext field's value.

func (*EncryptInput) SetGrantTokens ¶

func (s *EncryptInput) SetGrantTokens(v []*string) *EncryptInput

SetGrantTokens sets the GrantTokens field's value.

func (*EncryptInput) SetKeyId ¶

func (s *EncryptInput) SetKeyId(v string) *EncryptInput

SetKeyId sets the KeyId field's value.

func (*EncryptInput) SetPlaintext ¶

func (s *EncryptInput) SetPlaintext(v []byte) *EncryptInput

SetPlaintext sets the Plaintext field's value.

func (EncryptInput) String ¶

func (s EncryptInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*EncryptInput) Validate ¶

func (s *EncryptInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type EncryptOutput ¶

type EncryptOutput struct {

    // The encrypted plaintext. When you use the HTTP API or the Amazon Web Services
    // CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.
    // CiphertextBlob is automatically base64 encoded/decoded by the SDK.
    CiphertextBlob []byte `min:"1" type:"blob"`

    // The encryption algorithm that was used to encrypt the plaintext.
    EncryptionAlgorithm *string `type:"string" enum:"EncryptionAlgorithmSpec"`

    // The Amazon Resource Name (key ARN (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
    // of the KMS key that was used to encrypt the plaintext.
    KeyId *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

func (EncryptOutput) GoString ¶

func (s EncryptOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*EncryptOutput) SetCiphertextBlob ¶

func (s *EncryptOutput) SetCiphertextBlob(v []byte) *EncryptOutput

SetCiphertextBlob sets the CiphertextBlob field's value.

func (*EncryptOutput) SetEncryptionAlgorithm ¶

func (s *EncryptOutput) SetEncryptionAlgorithm(v string) *EncryptOutput

SetEncryptionAlgorithm sets the EncryptionAlgorithm field's value.

func (*EncryptOutput) SetKeyId ¶

func (s *EncryptOutput) SetKeyId(v string) *EncryptOutput

SetKeyId sets the KeyId field's value.

func (EncryptOutput) String ¶

func (s EncryptOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type ExpiredImportTokenException ¶

type ExpiredImportTokenException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the specified import token is expired. Use GetParametersForImport to get a new import token and public key, use the new public key to encrypt the key material, and then try the request again.

func (*ExpiredImportTokenException) Code ¶

func (s *ExpiredImportTokenException) Code() string

Code returns the exception type name.

func (*ExpiredImportTokenException) Error ¶

func (s *ExpiredImportTokenException) Error() string

func (ExpiredImportTokenException) GoString ¶

func (s ExpiredImportTokenException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*ExpiredImportTokenException) Message ¶

func (s *ExpiredImportTokenException) Message() string

Message returns the exception's message.

func (*ExpiredImportTokenException) OrigErr ¶

func (s *ExpiredImportTokenException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*ExpiredImportTokenException) RequestID ¶

func (s *ExpiredImportTokenException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*ExpiredImportTokenException) StatusCode ¶

func (s *ExpiredImportTokenException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (ExpiredImportTokenException) String ¶

func (s ExpiredImportTokenException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GenerateDataKeyInput ¶

type GenerateDataKeyInput struct {

    // Checks if your request will succeed. DryRun is an optional parameter.
    //
    // To learn more about how to use this parameter, see Testing your KMS API calls
    // (https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html)
    // in the Key Management Service Developer Guide.
    DryRun *bool `type:"boolean"`

    // Specifies the encryption context that will be used when encrypting the data
    // key.
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // An encryption context is a collection of non-secret key-value pairs that
    // represent additional authenticated data. When you use an encryption context
    // to encrypt data, you must specify the same (an exact case-sensitive match)
    // encryption context to decrypt the data. An encryption context is supported
    // only on operations with symmetric encryption KMS keys. On operations with
    // symmetric encryption KMS keys, an encryption context is optional, but it
    // is strongly recommended.
    //
    // For more information, see Encryption context (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
    // in the Key Management Service Developer Guide.
    EncryptionContext map[string]*string `type:"map"`

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // Specifies the symmetric encryption KMS key that encrypts the data key. You
    // cannot specify an asymmetric KMS key or a KMS key in a custom key store.
    // To get the type and origin of your KMS key, use the DescribeKey operation.
    //
    // To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN.
    // When using an alias name, prefix it with "alias/". To specify a KMS key in
    // a different Amazon Web Services account, you must use the key ARN or alias
    // ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Alias name: alias/ExampleAlias
    //
    //    * Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    // To get the alias name and alias ARN, use ListAliases.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // Specifies the length of the data key. Use AES_128 to generate a 128-bit symmetric
    // key, or AES_256 to generate a 256-bit symmetric key.
    //
    // You must specify either the KeySpec or the NumberOfBytes parameter (but not
    // both) in every GenerateDataKey request.
    KeySpec *string `type:"string" enum:"DataKeySpec"`

    // Specifies the length of the data key in bytes. For example, use the value
    // 64 to generate a 512-bit data key (64 bytes is 512 bits). For 128-bit (16-byte)
    // and 256-bit (32-byte) data keys, use the KeySpec parameter.
    //
    // You must specify either the KeySpec or the NumberOfBytes parameter (but not
    // both) in every GenerateDataKey request.
    NumberOfBytes *int64 `min:"1" type:"integer"`

    // A signed attestation document (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc)
    // from an Amazon Web Services Nitro enclave and the encryption algorithm to
    // use with the enclave's public key. The only valid encryption algorithm is
    // RSAES_OAEP_SHA_256.
    //
    // This parameter only supports attestation documents for Amazon Web Services
    // Nitro Enclaves. To include this parameter, use the Amazon Web Services Nitro
    // Enclaves SDK (https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk)
    // or any Amazon Web Services SDK.
    //
    // When you use this parameter, instead of returning the plaintext data key,
    // KMS encrypts the plaintext data key under the public key in the attestation
    // document, and returns the resulting ciphertext in the CiphertextForRecipient
    // field in the response. This ciphertext can be decrypted only with the private
    // key in the enclave. The CiphertextBlob field in the response contains a copy
    // of the data key encrypted under the KMS key specified by the KeyId parameter.
    // The Plaintext field in the response is null or empty.
    //
    // For information about the interaction between KMS and Amazon Web Services
    // Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses KMS (https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html)
    // in the Key Management Service Developer Guide.
    Recipient *RecipientInfo `type:"structure"`
    // contains filtered or unexported fields
}

func (GenerateDataKeyInput) GoString ¶

func (s GenerateDataKeyInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyInput) SetDryRun ¶

func (s *GenerateDataKeyInput) SetDryRun(v bool) *GenerateDataKeyInput

SetDryRun sets the DryRun field's value.

func (*GenerateDataKeyInput) SetEncryptionContext ¶

func (s *GenerateDataKeyInput) SetEncryptionContext(v map[string]*string) *GenerateDataKeyInput

SetEncryptionContext sets the EncryptionContext field's value.

func (*GenerateDataKeyInput) SetGrantTokens ¶

func (s *GenerateDataKeyInput) SetGrantTokens(v []*string) *GenerateDataKeyInput

SetGrantTokens sets the GrantTokens field's value.

func (*GenerateDataKeyInput) SetKeyId ¶

func (s *GenerateDataKeyInput) SetKeyId(v string) *GenerateDataKeyInput

SetKeyId sets the KeyId field's value.

func (*GenerateDataKeyInput) SetKeySpec ¶

func (s *GenerateDataKeyInput) SetKeySpec(v string) *GenerateDataKeyInput

SetKeySpec sets the KeySpec field's value.

func (*GenerateDataKeyInput) SetNumberOfBytes ¶

func (s *GenerateDataKeyInput) SetNumberOfBytes(v int64) *GenerateDataKeyInput

SetNumberOfBytes sets the NumberOfBytes field's value.

func (*GenerateDataKeyInput) SetRecipient ¶

func (s *GenerateDataKeyInput) SetRecipient(v *RecipientInfo) *GenerateDataKeyInput

SetRecipient sets the Recipient field's value.

func (GenerateDataKeyInput) String ¶

func (s GenerateDataKeyInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyInput) Validate ¶

func (s *GenerateDataKeyInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type GenerateDataKeyOutput ¶

type GenerateDataKeyOutput struct {

    // The encrypted copy of the data key. When you use the HTTP API or the Amazon
    // Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.
    // CiphertextBlob is automatically base64 encoded/decoded by the SDK.
    CiphertextBlob []byte `min:"1" type:"blob"`

    // The plaintext data key encrypted with the public key from the Nitro enclave.
    // This ciphertext can be decrypted only by using a private key in the Nitro
    // enclave.
    //
    // This field is included in the response only when the Recipient parameter
    // in the request includes a valid attestation document from an Amazon Web Services
    // Nitro enclave. For information about the interaction between KMS and Amazon
    // Web Services Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses
    // KMS (https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html)
    // in the Key Management Service Developer Guide.
    // CiphertextForRecipient is automatically base64 encoded/decoded by the SDK.
    CiphertextForRecipient []byte `min:"1" type:"blob"`

    // The Amazon Resource Name (key ARN (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
    // of the KMS key that encrypted the data key.
    KeyId *string `min:"1" type:"string"`

    // The plaintext data key. When you use the HTTP API or the Amazon Web Services
    // CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded. Use
    // this data key to encrypt your data outside of KMS. Then, remove it from memory
    // as soon as possible.
    //
    // If the response includes the CiphertextForRecipient field, the Plaintext
    // field is null or empty.
    //
    // Plaintext is a sensitive parameter and its value will be
    // replaced with "sensitive" in string returned by GenerateDataKeyOutput's
    // String and GoString methods.
    //
    // Plaintext is automatically base64 encoded/decoded by the SDK.
    Plaintext []byte `min:"1" type:"blob" sensitive:"true"`
    // contains filtered or unexported fields
}

func (GenerateDataKeyOutput) GoString ¶

func (s GenerateDataKeyOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyOutput) SetCiphertextBlob ¶

func (s *GenerateDataKeyOutput) SetCiphertextBlob(v []byte) *GenerateDataKeyOutput

SetCiphertextBlob sets the CiphertextBlob field's value.

func (*GenerateDataKeyOutput) SetCiphertextForRecipient ¶

func (s *GenerateDataKeyOutput) SetCiphertextForRecipient(v []byte) *GenerateDataKeyOutput

SetCiphertextForRecipient sets the CiphertextForRecipient field's value.

func (*GenerateDataKeyOutput) SetKeyId ¶

func (s *GenerateDataKeyOutput) SetKeyId(v string) *GenerateDataKeyOutput

SetKeyId sets the KeyId field's value.

func (*GenerateDataKeyOutput) SetPlaintext ¶

func (s *GenerateDataKeyOutput) SetPlaintext(v []byte) *GenerateDataKeyOutput

SetPlaintext sets the Plaintext field's value.

func (GenerateDataKeyOutput) String ¶

func (s GenerateDataKeyOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GenerateDataKeyPairInput ¶

type GenerateDataKeyPairInput struct {

    // Checks if your request will succeed. DryRun is an optional parameter.
    //
    // To learn more about how to use this parameter, see Testing your KMS API calls
    // (https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html)
    // in the Key Management Service Developer Guide.
    DryRun *bool `type:"boolean"`

    // Specifies the encryption context that will be used when encrypting the private
    // key in the data key pair.
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // An encryption context is a collection of non-secret key-value pairs that
    // represent additional authenticated data. When you use an encryption context
    // to encrypt data, you must specify the same (an exact case-sensitive match)
    // encryption context to decrypt the data. An encryption context is supported
    // only on operations with symmetric encryption KMS keys. On operations with
    // symmetric encryption KMS keys, an encryption context is optional, but it
    // is strongly recommended.
    //
    // For more information, see Encryption context (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
    // in the Key Management Service Developer Guide.
    EncryptionContext map[string]*string `type:"map"`

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // Specifies the symmetric encryption KMS key that encrypts the private key
    // in the data key pair. You cannot specify an asymmetric KMS key or a KMS key
    // in a custom key store. To get the type and origin of your KMS key, use the
    // DescribeKey operation.
    //
    // To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN.
    // When using an alias name, prefix it with "alias/". To specify a KMS key in
    // a different Amazon Web Services account, you must use the key ARN or alias
    // ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Alias name: alias/ExampleAlias
    //
    //    * Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    // To get the alias name and alias ARN, use ListAliases.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // Determines the type of data key pair that is generated.
    //
    // The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to
    // encrypt and decrypt or to sign and verify (but not both), and the rule that
    // permits you to use ECC KMS keys only to sign and verify, are not effective
    // on data key pairs, which are used outside of KMS. The SM2 key spec is only
    // available in China Regions.
    //
    // KeyPairSpec is a required field
    KeyPairSpec *string `type:"string" required:"true" enum:"DataKeyPairSpec"`

    // A signed attestation document (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc)
    // from an Amazon Web Services Nitro enclave and the encryption algorithm to
    // use with the enclave's public key. The only valid encryption algorithm is
    // RSAES_OAEP_SHA_256.
    //
    // This parameter only supports attestation documents for Amazon Web Services
    // Nitro Enclaves. To call DeriveSharedSecret for an Amazon Web Services Nitro
    // Enclaves, use the Amazon Web Services Nitro Enclaves SDK (https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk)
    // to generate the attestation document and then use the Recipient parameter
    // from any Amazon Web Services SDK to provide the attestation document for
    // the enclave.
    //
    // When you use this parameter, instead of returning a plaintext copy of the
    // private data key, KMS encrypts the plaintext private data key under the public
    // key in the attestation document, and returns the resulting ciphertext in
    // the CiphertextForRecipient field in the response. This ciphertext can be
    // decrypted only with the private key in the enclave. The CiphertextBlob field
    // in the response contains a copy of the private data key encrypted under the
    // KMS key specified by the KeyId parameter. The PrivateKeyPlaintext field in
    // the response is null or empty.
    //
    // For information about the interaction between KMS and Amazon Web Services
    // Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses KMS (https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html)
    // in the Key Management Service Developer Guide.
    Recipient *RecipientInfo `type:"structure"`
    // contains filtered or unexported fields
}

func (GenerateDataKeyPairInput) GoString ¶

func (s GenerateDataKeyPairInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyPairInput) SetDryRun ¶

func (s *GenerateDataKeyPairInput) SetDryRun(v bool) *GenerateDataKeyPairInput

SetDryRun sets the DryRun field's value.

func (*GenerateDataKeyPairInput) SetEncryptionContext ¶

func (s *GenerateDataKeyPairInput) SetEncryptionContext(v map[string]*string) *GenerateDataKeyPairInput

SetEncryptionContext sets the EncryptionContext field's value.

func (*GenerateDataKeyPairInput) SetGrantTokens ¶

func (s *GenerateDataKeyPairInput) SetGrantTokens(v []*string) *GenerateDataKeyPairInput

SetGrantTokens sets the GrantTokens field's value.

func (*GenerateDataKeyPairInput) SetKeyId ¶

func (s *GenerateDataKeyPairInput) SetKeyId(v string) *GenerateDataKeyPairInput

SetKeyId sets the KeyId field's value.

func (*GenerateDataKeyPairInput) SetKeyPairSpec ¶

func (s *GenerateDataKeyPairInput) SetKeyPairSpec(v string) *GenerateDataKeyPairInput

SetKeyPairSpec sets the KeyPairSpec field's value.

func (*GenerateDataKeyPairInput) SetRecipient ¶

func (s *GenerateDataKeyPairInput) SetRecipient(v *RecipientInfo) *GenerateDataKeyPairInput

SetRecipient sets the Recipient field's value.

func (GenerateDataKeyPairInput) String ¶

func (s GenerateDataKeyPairInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyPairInput) Validate ¶

func (s *GenerateDataKeyPairInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type GenerateDataKeyPairOutput ¶

type GenerateDataKeyPairOutput struct {

    // The plaintext private data key encrypted with the public key from the Nitro
    // enclave. This ciphertext can be decrypted only by using a private key in
    // the Nitro enclave.
    //
    // This field is included in the response only when the Recipient parameter
    // in the request includes a valid attestation document from an Amazon Web Services
    // Nitro enclave. For information about the interaction between KMS and Amazon
    // Web Services Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses
    // KMS (https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html)
    // in the Key Management Service Developer Guide.
    // CiphertextForRecipient is automatically base64 encoded/decoded by the SDK.
    CiphertextForRecipient []byte `min:"1" type:"blob"`

    // The Amazon Resource Name (key ARN (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
    // of the KMS key that encrypted the private key.
    KeyId *string `min:"1" type:"string"`

    // The type of data key pair that was generated.
    KeyPairSpec *string `type:"string" enum:"DataKeyPairSpec"`

    // The encrypted copy of the private key. When you use the HTTP API or the Amazon
    // Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.
    // PrivateKeyCiphertextBlob is automatically base64 encoded/decoded by the SDK.
    PrivateKeyCiphertextBlob []byte `min:"1" type:"blob"`

    // The plaintext copy of the private key. When you use the HTTP API or the Amazon
    // Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.
    //
    // If the response includes the CiphertextForRecipient field, the PrivateKeyPlaintext
    // field is null or empty.
    //
    // PrivateKeyPlaintext is a sensitive parameter and its value will be
    // replaced with "sensitive" in string returned by GenerateDataKeyPairOutput's
    // String and GoString methods.
    //
    // PrivateKeyPlaintext is automatically base64 encoded/decoded by the SDK.
    PrivateKeyPlaintext []byte `min:"1" type:"blob" sensitive:"true"`

    // The public key (in plaintext). When you use the HTTP API or the Amazon Web
    // Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.
    // PublicKey is automatically base64 encoded/decoded by the SDK.
    PublicKey []byte `min:"1" type:"blob"`
    // contains filtered or unexported fields
}

func (GenerateDataKeyPairOutput) GoString ¶

func (s GenerateDataKeyPairOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyPairOutput) SetCiphertextForRecipient ¶

func (s *GenerateDataKeyPairOutput) SetCiphertextForRecipient(v []byte) *GenerateDataKeyPairOutput

SetCiphertextForRecipient sets the CiphertextForRecipient field's value.

func (*GenerateDataKeyPairOutput) SetKeyId ¶

func (s *GenerateDataKeyPairOutput) SetKeyId(v string) *GenerateDataKeyPairOutput

SetKeyId sets the KeyId field's value.

func (*GenerateDataKeyPairOutput) SetKeyPairSpec ¶

func (s *GenerateDataKeyPairOutput) SetKeyPairSpec(v string) *GenerateDataKeyPairOutput

SetKeyPairSpec sets the KeyPairSpec field's value.

func (*GenerateDataKeyPairOutput) SetPrivateKeyCiphertextBlob ¶

func (s *GenerateDataKeyPairOutput) SetPrivateKeyCiphertextBlob(v []byte) *GenerateDataKeyPairOutput

SetPrivateKeyCiphertextBlob sets the PrivateKeyCiphertextBlob field's value.

func (*GenerateDataKeyPairOutput) SetPrivateKeyPlaintext ¶

func (s *GenerateDataKeyPairOutput) SetPrivateKeyPlaintext(v []byte) *GenerateDataKeyPairOutput

SetPrivateKeyPlaintext sets the PrivateKeyPlaintext field's value.

func (*GenerateDataKeyPairOutput) SetPublicKey ¶

func (s *GenerateDataKeyPairOutput) SetPublicKey(v []byte) *GenerateDataKeyPairOutput

SetPublicKey sets the PublicKey field's value.

func (GenerateDataKeyPairOutput) String ¶

func (s GenerateDataKeyPairOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GenerateDataKeyPairWithoutPlaintextInput ¶

type GenerateDataKeyPairWithoutPlaintextInput struct {

    // Checks if your request will succeed. DryRun is an optional parameter.
    //
    // To learn more about how to use this parameter, see Testing your KMS API calls
    // (https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html)
    // in the Key Management Service Developer Guide.
    DryRun *bool `type:"boolean"`

    // Specifies the encryption context that will be used when encrypting the private
    // key in the data key pair.
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // An encryption context is a collection of non-secret key-value pairs that
    // represent additional authenticated data. When you use an encryption context
    // to encrypt data, you must specify the same (an exact case-sensitive match)
    // encryption context to decrypt the data. An encryption context is supported
    // only on operations with symmetric encryption KMS keys. On operations with
    // symmetric encryption KMS keys, an encryption context is optional, but it
    // is strongly recommended.
    //
    // For more information, see Encryption context (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
    // in the Key Management Service Developer Guide.
    EncryptionContext map[string]*string `type:"map"`

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // Specifies the symmetric encryption KMS key that encrypts the private key
    // in the data key pair. You cannot specify an asymmetric KMS key or a KMS key
    // in a custom key store. To get the type and origin of your KMS key, use the
    // DescribeKey operation.
    //
    // To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN.
    // When using an alias name, prefix it with "alias/". To specify a KMS key in
    // a different Amazon Web Services account, you must use the key ARN or alias
    // ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Alias name: alias/ExampleAlias
    //
    //    * Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    // To get the alias name and alias ARN, use ListAliases.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // Determines the type of data key pair that is generated.
    //
    // The KMS rule that restricts the use of asymmetric RSA and SM2 KMS keys to
    // encrypt and decrypt or to sign and verify (but not both), and the rule that
    // permits you to use ECC KMS keys only to sign and verify, are not effective
    // on data key pairs, which are used outside of KMS. The SM2 key spec is only
    // available in China Regions.
    //
    // KeyPairSpec is a required field
    KeyPairSpec *string `type:"string" required:"true" enum:"DataKeyPairSpec"`
    // contains filtered or unexported fields
}

func (GenerateDataKeyPairWithoutPlaintextInput) GoString ¶

func (s GenerateDataKeyPairWithoutPlaintextInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyPairWithoutPlaintextInput) SetDryRun ¶

func (s *GenerateDataKeyPairWithoutPlaintextInput) SetDryRun(v bool) *GenerateDataKeyPairWithoutPlaintextInput

SetDryRun sets the DryRun field's value.

func (*GenerateDataKeyPairWithoutPlaintextInput) SetEncryptionContext ¶

func (s *GenerateDataKeyPairWithoutPlaintextInput) SetEncryptionContext(v map[string]*string) *GenerateDataKeyPairWithoutPlaintextInput

SetEncryptionContext sets the EncryptionContext field's value.

func (*GenerateDataKeyPairWithoutPlaintextInput) SetGrantTokens ¶

func (s *GenerateDataKeyPairWithoutPlaintextInput) SetGrantTokens(v []*string) *GenerateDataKeyPairWithoutPlaintextInput

SetGrantTokens sets the GrantTokens field's value.

func (*GenerateDataKeyPairWithoutPlaintextInput) SetKeyId ¶

func (s *GenerateDataKeyPairWithoutPlaintextInput) SetKeyId(v string) *GenerateDataKeyPairWithoutPlaintextInput

SetKeyId sets the KeyId field's value.

func (*GenerateDataKeyPairWithoutPlaintextInput) SetKeyPairSpec ¶

func (s *GenerateDataKeyPairWithoutPlaintextInput) SetKeyPairSpec(v string) *GenerateDataKeyPairWithoutPlaintextInput

SetKeyPairSpec sets the KeyPairSpec field's value.

func (GenerateDataKeyPairWithoutPlaintextInput) String ¶

func (s GenerateDataKeyPairWithoutPlaintextInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyPairWithoutPlaintextInput) Validate ¶

func (s *GenerateDataKeyPairWithoutPlaintextInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type GenerateDataKeyPairWithoutPlaintextOutput ¶

type GenerateDataKeyPairWithoutPlaintextOutput struct {

    // The Amazon Resource Name (key ARN (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
    // of the KMS key that encrypted the private key.
    KeyId *string `min:"1" type:"string"`

    // The type of data key pair that was generated.
    KeyPairSpec *string `type:"string" enum:"DataKeyPairSpec"`

    // The encrypted copy of the private key. When you use the HTTP API or the Amazon
    // Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.
    // PrivateKeyCiphertextBlob is automatically base64 encoded/decoded by the SDK.
    PrivateKeyCiphertextBlob []byte `min:"1" type:"blob"`

    // The public key (in plaintext). When you use the HTTP API or the Amazon Web
    // Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.
    // PublicKey is automatically base64 encoded/decoded by the SDK.
    PublicKey []byte `min:"1" type:"blob"`
    // contains filtered or unexported fields
}

func (GenerateDataKeyPairWithoutPlaintextOutput) GoString ¶

func (s GenerateDataKeyPairWithoutPlaintextOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyPairWithoutPlaintextOutput) SetKeyId ¶

func (s *GenerateDataKeyPairWithoutPlaintextOutput) SetKeyId(v string) *GenerateDataKeyPairWithoutPlaintextOutput

SetKeyId sets the KeyId field's value.

func (*GenerateDataKeyPairWithoutPlaintextOutput) SetKeyPairSpec ¶

func (s *GenerateDataKeyPairWithoutPlaintextOutput) SetKeyPairSpec(v string) *GenerateDataKeyPairWithoutPlaintextOutput

SetKeyPairSpec sets the KeyPairSpec field's value.

func (*GenerateDataKeyPairWithoutPlaintextOutput) SetPrivateKeyCiphertextBlob ¶

func (s *GenerateDataKeyPairWithoutPlaintextOutput) SetPrivateKeyCiphertextBlob(v []byte) *GenerateDataKeyPairWithoutPlaintextOutput

SetPrivateKeyCiphertextBlob sets the PrivateKeyCiphertextBlob field's value.

func (*GenerateDataKeyPairWithoutPlaintextOutput) SetPublicKey ¶

func (s *GenerateDataKeyPairWithoutPlaintextOutput) SetPublicKey(v []byte) *GenerateDataKeyPairWithoutPlaintextOutput

SetPublicKey sets the PublicKey field's value.

func (GenerateDataKeyPairWithoutPlaintextOutput) String ¶

func (s GenerateDataKeyPairWithoutPlaintextOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GenerateDataKeyWithoutPlaintextInput ¶

type GenerateDataKeyWithoutPlaintextInput struct {

    // Checks if your request will succeed. DryRun is an optional parameter.
    //
    // To learn more about how to use this parameter, see Testing your KMS API calls
    // (https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html)
    // in the Key Management Service Developer Guide.
    DryRun *bool `type:"boolean"`

    // Specifies the encryption context that will be used when encrypting the data
    // key.
    //
    // Do not include confidential or sensitive information in this field. This
    // field may be displayed in plaintext in CloudTrail logs and other output.
    //
    // An encryption context is a collection of non-secret key-value pairs that
    // represent additional authenticated data. When you use an encryption context
    // to encrypt data, you must specify the same (an exact case-sensitive match)
    // encryption context to decrypt the data. An encryption context is supported
    // only on operations with symmetric encryption KMS keys. On operations with
    // symmetric encryption KMS keys, an encryption context is optional, but it
    // is strongly recommended.
    //
    // For more information, see Encryption context (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
    // in the Key Management Service Developer Guide.
    EncryptionContext map[string]*string `type:"map"`

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // Specifies the symmetric encryption KMS key that encrypts the data key. You
    // cannot specify an asymmetric KMS key or a KMS key in a custom key store.
    // To get the type and origin of your KMS key, use the DescribeKey operation.
    //
    // To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN.
    // When using an alias name, prefix it with "alias/". To specify a KMS key in
    // a different Amazon Web Services account, you must use the key ARN or alias
    // ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Alias name: alias/ExampleAlias
    //
    //    * Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    // To get the alias name and alias ARN, use ListAliases.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // The length of the data key. Use AES_128 to generate a 128-bit symmetric key,
    // or AES_256 to generate a 256-bit symmetric key.
    KeySpec *string `type:"string" enum:"DataKeySpec"`

    // The length of the data key in bytes. For example, use the value 64 to generate
    // a 512-bit data key (64 bytes is 512 bits). For common key lengths (128-bit
    // and 256-bit symmetric keys), we recommend that you use the KeySpec field
    // instead of this one.
    NumberOfBytes *int64 `min:"1" type:"integer"`
    // contains filtered or unexported fields
}

func (GenerateDataKeyWithoutPlaintextInput) GoString ¶

func (s GenerateDataKeyWithoutPlaintextInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyWithoutPlaintextInput) SetDryRun ¶

func (s *GenerateDataKeyWithoutPlaintextInput) SetDryRun(v bool) *GenerateDataKeyWithoutPlaintextInput

SetDryRun sets the DryRun field's value.

func (*GenerateDataKeyWithoutPlaintextInput) SetEncryptionContext ¶

func (s *GenerateDataKeyWithoutPlaintextInput) SetEncryptionContext(v map[string]*string) *GenerateDataKeyWithoutPlaintextInput

SetEncryptionContext sets the EncryptionContext field's value.

func (*GenerateDataKeyWithoutPlaintextInput) SetGrantTokens ¶

func (s *GenerateDataKeyWithoutPlaintextInput) SetGrantTokens(v []*string) *GenerateDataKeyWithoutPlaintextInput

SetGrantTokens sets the GrantTokens field's value.

func (*GenerateDataKeyWithoutPlaintextInput) SetKeyId ¶

func (s *GenerateDataKeyWithoutPlaintextInput) SetKeyId(v string) *GenerateDataKeyWithoutPlaintextInput

SetKeyId sets the KeyId field's value.

func (*GenerateDataKeyWithoutPlaintextInput) SetKeySpec ¶

func (s *GenerateDataKeyWithoutPlaintextInput) SetKeySpec(v string) *GenerateDataKeyWithoutPlaintextInput

SetKeySpec sets the KeySpec field's value.

func (*GenerateDataKeyWithoutPlaintextInput) SetNumberOfBytes ¶

func (s *GenerateDataKeyWithoutPlaintextInput) SetNumberOfBytes(v int64) *GenerateDataKeyWithoutPlaintextInput

SetNumberOfBytes sets the NumberOfBytes field's value.

func (GenerateDataKeyWithoutPlaintextInput) String ¶

func (s GenerateDataKeyWithoutPlaintextInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyWithoutPlaintextInput) Validate ¶

func (s *GenerateDataKeyWithoutPlaintextInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type GenerateDataKeyWithoutPlaintextOutput ¶

type GenerateDataKeyWithoutPlaintextOutput struct {

    // The encrypted data key. When you use the HTTP API or the Amazon Web Services
    // CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.
    // CiphertextBlob is automatically base64 encoded/decoded by the SDK.
    CiphertextBlob []byte `min:"1" type:"blob"`

    // The Amazon Resource Name (key ARN (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
    // of the KMS key that encrypted the data key.
    KeyId *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

func (GenerateDataKeyWithoutPlaintextOutput) GoString ¶

func (s GenerateDataKeyWithoutPlaintextOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateDataKeyWithoutPlaintextOutput) SetCiphertextBlob ¶

func (s *GenerateDataKeyWithoutPlaintextOutput) SetCiphertextBlob(v []byte) *GenerateDataKeyWithoutPlaintextOutput

SetCiphertextBlob sets the CiphertextBlob field's value.

func (*GenerateDataKeyWithoutPlaintextOutput) SetKeyId ¶

func (s *GenerateDataKeyWithoutPlaintextOutput) SetKeyId(v string) *GenerateDataKeyWithoutPlaintextOutput

SetKeyId sets the KeyId field's value.

func (GenerateDataKeyWithoutPlaintextOutput) String ¶

func (s GenerateDataKeyWithoutPlaintextOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GenerateMacInput ¶

type GenerateMacInput struct {

    // Checks if your request will succeed. DryRun is an optional parameter.
    //
    // To learn more about how to use this parameter, see Testing your KMS API calls
    // (https://docs.aws.amazon.com/kms/latest/developerguide/programming-dryrun.html)
    // in the Key Management Service Developer Guide.
    DryRun *bool `type:"boolean"`

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // The HMAC KMS key to use in the operation. The MAC algorithm computes the
    // HMAC for the message and the key as described in RFC 2104 (https://datatracker.ietf.org/doc/html/rfc2104).
    //
    // To identify an HMAC KMS key, use the DescribeKey operation and see the KeySpec
    // field in the response.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // The MAC algorithm used in the operation.
    //
    // The algorithm must be compatible with the HMAC KMS key that you specify.
    // To find the MAC algorithms that your HMAC KMS key supports, use the DescribeKey
    // operation and see the MacAlgorithms field in the DescribeKey response.
    //
    // MacAlgorithm is a required field
    MacAlgorithm *string `type:"string" required:"true" enum:"MacAlgorithmSpec"`

    // The message to be hashed. Specify a message of up to 4,096 bytes.
    //
    // GenerateMac and VerifyMac do not provide special handling for message digests.
    // If you generate an HMAC for a hash digest of a message, you must verify the
    // HMAC of the same hash digest.
    //
    // Message is a sensitive parameter and its value will be
    // replaced with "sensitive" in string returned by GenerateMacInput's
    // String and GoString methods.
    //
    // Message is automatically base64 encoded/decoded by the SDK.
    //
    // Message is a required field
    Message []byte `min:"1" type:"blob" required:"true" sensitive:"true"`
    // contains filtered or unexported fields
}

func (GenerateMacInput) GoString ¶

func (s GenerateMacInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateMacInput) SetDryRun ¶

func (s *GenerateMacInput) SetDryRun(v bool) *GenerateMacInput

SetDryRun sets the DryRun field's value.

func (*GenerateMacInput) SetGrantTokens ¶

func (s *GenerateMacInput) SetGrantTokens(v []*string) *GenerateMacInput

SetGrantTokens sets the GrantTokens field's value.

func (*GenerateMacInput) SetKeyId ¶

func (s *GenerateMacInput) SetKeyId(v string) *GenerateMacInput

SetKeyId sets the KeyId field's value.

func (*GenerateMacInput) SetMacAlgorithm ¶

func (s *GenerateMacInput) SetMacAlgorithm(v string) *GenerateMacInput

SetMacAlgorithm sets the MacAlgorithm field's value.

func (*GenerateMacInput) SetMessage ¶

func (s *GenerateMacInput) SetMessage(v []byte) *GenerateMacInput

SetMessage sets the Message field's value.

func (GenerateMacInput) String ¶

func (s GenerateMacInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateMacInput) Validate ¶

func (s *GenerateMacInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type GenerateMacOutput ¶

type GenerateMacOutput struct {

    // The HMAC KMS key used in the operation.
    KeyId *string `min:"1" type:"string"`

    // The hash-based message authentication code (HMAC) that was generated for
    // the specified message, HMAC KMS key, and MAC algorithm.
    //
    // This is the standard, raw HMAC defined in RFC 2104 (https://datatracker.ietf.org/doc/html/rfc2104).
    // Mac is automatically base64 encoded/decoded by the SDK.
    Mac []byte `min:"1" type:"blob"`

    // The MAC algorithm that was used to generate the HMAC.
    MacAlgorithm *string `type:"string" enum:"MacAlgorithmSpec"`
    // contains filtered or unexported fields
}

func (GenerateMacOutput) GoString ¶

func (s GenerateMacOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateMacOutput) SetKeyId ¶

func (s *GenerateMacOutput) SetKeyId(v string) *GenerateMacOutput

SetKeyId sets the KeyId field's value.

func (*GenerateMacOutput) SetMac ¶

func (s *GenerateMacOutput) SetMac(v []byte) *GenerateMacOutput

SetMac sets the Mac field's value.

func (*GenerateMacOutput) SetMacAlgorithm ¶

func (s *GenerateMacOutput) SetMacAlgorithm(v string) *GenerateMacOutput

SetMacAlgorithm sets the MacAlgorithm field's value.

func (GenerateMacOutput) String ¶

func (s GenerateMacOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GenerateRandomInput ¶

type GenerateRandomInput struct {

    // Generates the random byte string in the CloudHSM cluster that is associated
    // with the specified CloudHSM key store. To find the ID of a custom key store,
    // use the DescribeCustomKeyStores operation.
    //
    // External key store IDs are not valid for this parameter. If you specify the
    // ID of an external key store, GenerateRandom throws an UnsupportedOperationException.
    CustomKeyStoreId *string `min:"1" type:"string"`

    // The length of the random byte string. This parameter is required.
    NumberOfBytes *int64 `min:"1" type:"integer"`

    // A signed attestation document (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitro-enclave-how.html#term-attestdoc)
    // from an Amazon Web Services Nitro enclave and the encryption algorithm to
    // use with the enclave's public key. The only valid encryption algorithm is
    // RSAES_OAEP_SHA_256.
    //
    // This parameter only supports attestation documents for Amazon Web Services
    // Nitro Enclaves. To include this parameter, use the Amazon Web Services Nitro
    // Enclaves SDK (https://docs.aws.amazon.com/enclaves/latest/user/developing-applications.html#sdk)
    // or any Amazon Web Services SDK.
    //
    // When you use this parameter, instead of returning plaintext bytes, KMS encrypts
    // the plaintext bytes under the public key in the attestation document, and
    // returns the resulting ciphertext in the CiphertextForRecipient field in the
    // response. This ciphertext can be decrypted only with the private key in the
    // enclave. The Plaintext field in the response is null or empty.
    //
    // For information about the interaction between KMS and Amazon Web Services
    // Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses KMS (https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html)
    // in the Key Management Service Developer Guide.
    Recipient *RecipientInfo `type:"structure"`
    // contains filtered or unexported fields
}

func (GenerateRandomInput) GoString ¶

func (s GenerateRandomInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateRandomInput) SetCustomKeyStoreId ¶

func (s *GenerateRandomInput) SetCustomKeyStoreId(v string) *GenerateRandomInput

SetCustomKeyStoreId sets the CustomKeyStoreId field's value.

func (*GenerateRandomInput) SetNumberOfBytes ¶

func (s *GenerateRandomInput) SetNumberOfBytes(v int64) *GenerateRandomInput

SetNumberOfBytes sets the NumberOfBytes field's value.

func (*GenerateRandomInput) SetRecipient ¶

func (s *GenerateRandomInput) SetRecipient(v *RecipientInfo) *GenerateRandomInput

SetRecipient sets the Recipient field's value.

func (GenerateRandomInput) String ¶

func (s GenerateRandomInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateRandomInput) Validate ¶

func (s *GenerateRandomInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type GenerateRandomOutput ¶

type GenerateRandomOutput struct {

    // The plaintext random bytes encrypted with the public key from the Nitro enclave.
    // This ciphertext can be decrypted only by using a private key in the Nitro
    // enclave.
    //
    // This field is included in the response only when the Recipient parameter
    // in the request includes a valid attestation document from an Amazon Web Services
    // Nitro enclave. For information about the interaction between KMS and Amazon
    // Web Services Nitro Enclaves, see How Amazon Web Services Nitro Enclaves uses
    // KMS (https://docs.aws.amazon.com/kms/latest/developerguide/services-nitro-enclaves.html)
    // in the Key Management Service Developer Guide.
    // CiphertextForRecipient is automatically base64 encoded/decoded by the SDK.
    CiphertextForRecipient []byte `min:"1" type:"blob"`

    // The random byte string. When you use the HTTP API or the Amazon Web Services
    // CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.
    //
    // If the response includes the CiphertextForRecipient field, the Plaintext
    // field is null or empty.
    //
    // Plaintext is a sensitive parameter and its value will be
    // replaced with "sensitive" in string returned by GenerateRandomOutput's
    // String and GoString methods.
    //
    // Plaintext is automatically base64 encoded/decoded by the SDK.
    Plaintext []byte `min:"1" type:"blob" sensitive:"true"`
    // contains filtered or unexported fields
}

func (GenerateRandomOutput) GoString ¶

func (s GenerateRandomOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GenerateRandomOutput) SetCiphertextForRecipient ¶

func (s *GenerateRandomOutput) SetCiphertextForRecipient(v []byte) *GenerateRandomOutput

SetCiphertextForRecipient sets the CiphertextForRecipient field's value.

func (*GenerateRandomOutput) SetPlaintext ¶

func (s *GenerateRandomOutput) SetPlaintext(v []byte) *GenerateRandomOutput

SetPlaintext sets the Plaintext field's value.

func (GenerateRandomOutput) String ¶

func (s GenerateRandomOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GetKeyPolicyInput ¶

type GetKeyPolicyInput struct {

    // Gets the key policy for the specified KMS key.
    //
    // Specify the key ID or key ARN of the KMS key.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // Specifies the name of the key policy. If no policy name is specified, the
    // default value is default. The only valid name is default. To get the names
    // of key policies, use ListKeyPolicies.
    PolicyName *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

func (GetKeyPolicyInput) GoString ¶

func (s GetKeyPolicyInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetKeyPolicyInput) SetKeyId ¶

func (s *GetKeyPolicyInput) SetKeyId(v string) *GetKeyPolicyInput

SetKeyId sets the KeyId field's value.

func (*GetKeyPolicyInput) SetPolicyName ¶

func (s *GetKeyPolicyInput) SetPolicyName(v string) *GetKeyPolicyInput

SetPolicyName sets the PolicyName field's value.

func (GetKeyPolicyInput) String ¶

func (s GetKeyPolicyInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetKeyPolicyInput) Validate ¶

func (s *GetKeyPolicyInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type GetKeyPolicyOutput ¶

type GetKeyPolicyOutput struct {

    // A key policy document in JSON format.
    Policy *string `min:"1" type:"string"`

    // The name of the key policy. The only valid value is default.
    PolicyName *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

func (GetKeyPolicyOutput) GoString ¶

func (s GetKeyPolicyOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetKeyPolicyOutput) SetPolicy ¶

func (s *GetKeyPolicyOutput) SetPolicy(v string) *GetKeyPolicyOutput

SetPolicy sets the Policy field's value.

func (*GetKeyPolicyOutput) SetPolicyName ¶

func (s *GetKeyPolicyOutput) SetPolicyName(v string) *GetKeyPolicyOutput

SetPolicyName sets the PolicyName field's value.

func (GetKeyPolicyOutput) String ¶

func (s GetKeyPolicyOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GetKeyRotationStatusInput ¶

type GetKeyRotationStatusInput struct {

    // Gets the rotation status for the specified KMS key.
    //
    // Specify the key ID or key ARN of the KMS key. To specify a KMS key in a different
    // Amazon Web Services account, you must use the key ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (GetKeyRotationStatusInput) GoString ¶

func (s GetKeyRotationStatusInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetKeyRotationStatusInput) SetKeyId ¶

func (s *GetKeyRotationStatusInput) SetKeyId(v string) *GetKeyRotationStatusInput

SetKeyId sets the KeyId field's value.

func (GetKeyRotationStatusInput) String ¶

func (s GetKeyRotationStatusInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetKeyRotationStatusInput) Validate ¶

func (s *GetKeyRotationStatusInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type GetKeyRotationStatusOutput ¶

type GetKeyRotationStatusOutput struct {

    // Identifies the specified symmetric encryption KMS key.
    KeyId *string `min:"1" type:"string"`

    // A Boolean value that specifies whether key rotation is enabled.
    KeyRotationEnabled *bool `type:"boolean"`

    // The next date that KMS will automatically rotate the key material.
    NextRotationDate *time.Time `type:"timestamp"`

    // Identifies the date and time that an in progress on-demand rotation was initiated.
    //
    // The KMS API follows an eventual consistency (https://docs.aws.amazon.com/kms/latest/developerguide/programming-eventual-consistency.html)
    // model due to the distributed nature of the system. As a result, there might
    // be a slight delay between initiating on-demand key rotation and the rotation's
    // completion. Once the on-demand rotation is complete, use ListKeyRotations
    // to view the details of the on-demand rotation.
    OnDemandRotationStartDate *time.Time `type:"timestamp"`

    // The number of days between each automatic rotation. The default value is
    // 365 days.
    RotationPeriodInDays *int64 `min:"90" type:"integer"`
    // contains filtered or unexported fields
}

func (GetKeyRotationStatusOutput) GoString ¶

func (s GetKeyRotationStatusOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetKeyRotationStatusOutput) SetKeyId ¶

func (s *GetKeyRotationStatusOutput) SetKeyId(v string) *GetKeyRotationStatusOutput

SetKeyId sets the KeyId field's value.

func (*GetKeyRotationStatusOutput) SetKeyRotationEnabled ¶

func (s *GetKeyRotationStatusOutput) SetKeyRotationEnabled(v bool) *GetKeyRotationStatusOutput

SetKeyRotationEnabled sets the KeyRotationEnabled field's value.

func (*GetKeyRotationStatusOutput) SetNextRotationDate ¶

func (s *GetKeyRotationStatusOutput) SetNextRotationDate(v time.Time) *GetKeyRotationStatusOutput

SetNextRotationDate sets the NextRotationDate field's value.

func (*GetKeyRotationStatusOutput) SetOnDemandRotationStartDate ¶

func (s *GetKeyRotationStatusOutput) SetOnDemandRotationStartDate(v time.Time) *GetKeyRotationStatusOutput

SetOnDemandRotationStartDate sets the OnDemandRotationStartDate field's value.

func (*GetKeyRotationStatusOutput) SetRotationPeriodInDays ¶

func (s *GetKeyRotationStatusOutput) SetRotationPeriodInDays(v int64) *GetKeyRotationStatusOutput

SetRotationPeriodInDays sets the RotationPeriodInDays field's value.

func (GetKeyRotationStatusOutput) String ¶

func (s GetKeyRotationStatusOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GetParametersForImportInput ¶

type GetParametersForImportInput struct {

    // The identifier of the KMS key that will be associated with the imported key
    // material. The Origin of the KMS key must be EXTERNAL.
    //
    // All KMS key types are supported, including multi-Region keys. However, you
    // cannot import key material into a KMS key in a custom key store.
    //
    // Specify the key ID or key ARN of the KMS key.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // The algorithm you will use with the RSA public key (PublicKey) in the response
    // to protect your key material during import. For more information, see Select
    // a wrapping algorithm (kms/latest/developerguide/importing-keys-get-public-key-and-token.html#select-wrapping-algorithm)
    // in the Key Management Service Developer Guide.
    //
    // For RSA_AES wrapping algorithms, you encrypt your key material with an AES
    // key that you generate, then encrypt your AES key with the RSA public key
    // from KMS. For RSAES wrapping algorithms, you encrypt your key material directly
    // with the RSA public key from KMS.
    //
    // The wrapping algorithms that you can use depend on the type of key material
    // that you are importing. To import an RSA private key, you must use an RSA_AES
    // wrapping algorithm.
    //
    //    * RSA_AES_KEY_WRAP_SHA_256 — Supported for wrapping RSA and ECC key
    //    material.
    //
    //    * RSA_AES_KEY_WRAP_SHA_1 — Supported for wrapping RSA and ECC key material.
    //
    //    * RSAES_OAEP_SHA_256 — Supported for all types of key material, except
    //    RSA key material (private key). You cannot use the RSAES_OAEP_SHA_256
    //    wrapping algorithm with the RSA_2048 wrapping key spec to wrap ECC_NIST_P521
    //    key material.
    //
    //    * RSAES_OAEP_SHA_1 — Supported for all types of key material, except
    //    RSA key material (private key). You cannot use the RSAES_OAEP_SHA_1 wrapping
    //    algorithm with the RSA_2048 wrapping key spec to wrap ECC_NIST_P521 key
    //    material.
    //
    //    * RSAES_PKCS1_V1_5 (Deprecated) — As of October 10, 2023, KMS does not
    //    support the RSAES_PKCS1_V1_5 wrapping algorithm.
    //
    // WrappingAlgorithm is a required field
    WrappingAlgorithm *string `type:"string" required:"true" enum:"AlgorithmSpec"`

    // The type of RSA public key to return in the response. You will use this wrapping
    // key with the specified wrapping algorithm to protect your key material during
    // import.
    //
    // Use the longest RSA wrapping key that is practical.
    //
    // You cannot use an RSA_2048 public key to directly wrap an ECC_NIST_P521 private
    // key. Instead, use an RSA_AES wrapping algorithm or choose a longer RSA public
    // key.
    //
    // WrappingKeySpec is a required field
    WrappingKeySpec *string `type:"string" required:"true" enum:"WrappingKeySpec"`
    // contains filtered or unexported fields
}

func (GetParametersForImportInput) GoString ¶

func (s GetParametersForImportInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetParametersForImportInput) SetKeyId ¶

func (s *GetParametersForImportInput) SetKeyId(v string) *GetParametersForImportInput

SetKeyId sets the KeyId field's value.

func (*GetParametersForImportInput) SetWrappingAlgorithm ¶

func (s *GetParametersForImportInput) SetWrappingAlgorithm(v string) *GetParametersForImportInput

SetWrappingAlgorithm sets the WrappingAlgorithm field's value.

func (*GetParametersForImportInput) SetWrappingKeySpec ¶

func (s *GetParametersForImportInput) SetWrappingKeySpec(v string) *GetParametersForImportInput

SetWrappingKeySpec sets the WrappingKeySpec field's value.

func (GetParametersForImportInput) String ¶

func (s GetParametersForImportInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetParametersForImportInput) Validate ¶

func (s *GetParametersForImportInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type GetParametersForImportOutput ¶

type GetParametersForImportOutput struct {

    // The import token to send in a subsequent ImportKeyMaterial request.
    // ImportToken is automatically base64 encoded/decoded by the SDK.
    ImportToken []byte `min:"1" type:"blob"`

    // The Amazon Resource Name (key ARN (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
    // of the KMS key to use in a subsequent ImportKeyMaterial request. This is
    // the same KMS key specified in the GetParametersForImport request.
    KeyId *string `min:"1" type:"string"`

    // The time at which the import token and public key are no longer valid. After
    // this time, you cannot use them to make an ImportKeyMaterial request and you
    // must send another GetParametersForImport request to get new ones.
    ParametersValidTo *time.Time `type:"timestamp"`

    // The public key to use to encrypt the key material before importing it with
    // ImportKeyMaterial.
    //
    // PublicKey is a sensitive parameter and its value will be
    // replaced with "sensitive" in string returned by GetParametersForImportOutput's
    // String and GoString methods.
    //
    // PublicKey is automatically base64 encoded/decoded by the SDK.
    PublicKey []byte `min:"1" type:"blob" sensitive:"true"`
    // contains filtered or unexported fields
}

func (GetParametersForImportOutput) GoString ¶

func (s GetParametersForImportOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetParametersForImportOutput) SetImportToken ¶

func (s *GetParametersForImportOutput) SetImportToken(v []byte) *GetParametersForImportOutput

SetImportToken sets the ImportToken field's value.

func (*GetParametersForImportOutput) SetKeyId ¶

func (s *GetParametersForImportOutput) SetKeyId(v string) *GetParametersForImportOutput

SetKeyId sets the KeyId field's value.

func (*GetParametersForImportOutput) SetParametersValidTo ¶

func (s *GetParametersForImportOutput) SetParametersValidTo(v time.Time) *GetParametersForImportOutput

SetParametersValidTo sets the ParametersValidTo field's value.

func (*GetParametersForImportOutput) SetPublicKey ¶

func (s *GetParametersForImportOutput) SetPublicKey(v []byte) *GetParametersForImportOutput

SetPublicKey sets the PublicKey field's value.

func (GetParametersForImportOutput) String ¶

func (s GetParametersForImportOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GetPublicKeyInput ¶

type GetPublicKeyInput struct {

    // A list of grant tokens.
    //
    // Use a grant token when your permission to call this operation comes from
    // a new grant that has not yet achieved eventual consistency. For more information,
    // see Grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token)
    // and Using a grant token (https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token)
    // in the Key Management Service Developer Guide.
    GrantTokens []*string `type:"list"`

    // Identifies the asymmetric KMS key that includes the public key.
    //
    // To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN.
    // When using an alias name, prefix it with "alias/". To specify a KMS key in
    // a different Amazon Web Services account, you must use the key ARN or alias
    // ARN.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Alias name: alias/ExampleAlias
    //
    //    * Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    // To get the alias name and alias ARN, use ListAliases.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`
    // contains filtered or unexported fields
}

func (GetPublicKeyInput) GoString ¶

func (s GetPublicKeyInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetPublicKeyInput) SetGrantTokens ¶

func (s *GetPublicKeyInput) SetGrantTokens(v []*string) *GetPublicKeyInput

SetGrantTokens sets the GrantTokens field's value.

func (*GetPublicKeyInput) SetKeyId ¶

func (s *GetPublicKeyInput) SetKeyId(v string) *GetPublicKeyInput

SetKeyId sets the KeyId field's value.

func (GetPublicKeyInput) String ¶

func (s GetPublicKeyInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetPublicKeyInput) Validate ¶

func (s *GetPublicKeyInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type GetPublicKeyOutput ¶

type GetPublicKeyOutput struct {

    // Instead, use the KeySpec field in the GetPublicKey response.
    //
    // The KeySpec and CustomerMasterKeySpec fields have the same value. We recommend
    // that you use the KeySpec field in your code. However, to avoid breaking changes,
    // KMS supports both fields.
    //
    // Deprecated: This field has been deprecated. Instead, use the KeySpec field.
    CustomerMasterKeySpec *string `deprecated:"true" type:"string" enum:"CustomerMasterKeySpec"`

    // The encryption algorithms that KMS supports for this key.
    //
    // This information is critical. If a public key encrypts data outside of KMS
    // by using an unsupported encryption algorithm, the ciphertext cannot be decrypted.
    //
    // This field appears in the response only when the KeyUsage of the public key
    // is ENCRYPT_DECRYPT.
    EncryptionAlgorithms []*string `type:"list" enum:"EncryptionAlgorithmSpec"`

    // The key agreement algorithm used to derive a shared secret. This field is
    // present only when the KMS key has a KeyUsage value of KEY_AGREEMENT.
    KeyAgreementAlgorithms []*string `type:"list" enum:"KeyAgreementAlgorithmSpec"`

    // The Amazon Resource Name (key ARN (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
    // of the asymmetric KMS key from which the public key was downloaded.
    KeyId *string `min:"1" type:"string"`

    // The type of the of the public key that was downloaded.
    KeySpec *string `type:"string" enum:"KeySpec"`

    // The permitted use of the public key. Valid values for asymmetric key pairs
    // are ENCRYPT_DECRYPT, SIGN_VERIFY, and KEY_AGREEMENT.
    //
    // This information is critical. For example, if a public key with SIGN_VERIFY
    // key usage encrypts data outside of KMS, the ciphertext cannot be decrypted.
    KeyUsage *string `type:"string" enum:"KeyUsageType"`

    // The exported public key.
    //
    // The value is a DER-encoded X.509 public key, also known as SubjectPublicKeyInfo
    // (SPKI), as defined in RFC 5280 (https://tools.ietf.org/html/rfc5280). When
    // you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded.
    // Otherwise, it is not Base64-encoded.
    // PublicKey is automatically base64 encoded/decoded by the SDK.
    PublicKey []byte `min:"1" type:"blob"`

    // The signing algorithms that KMS supports for this key.
    //
    // This field appears in the response only when the KeyUsage of the public key
    // is SIGN_VERIFY.
    SigningAlgorithms []*string `type:"list" enum:"SigningAlgorithmSpec"`
    // contains filtered or unexported fields
}

func (GetPublicKeyOutput) GoString ¶

func (s GetPublicKeyOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GetPublicKeyOutput) SetCustomerMasterKeySpec ¶

func (s *GetPublicKeyOutput) SetCustomerMasterKeySpec(v string) *GetPublicKeyOutput

SetCustomerMasterKeySpec sets the CustomerMasterKeySpec field's value.

func (*GetPublicKeyOutput) SetEncryptionAlgorithms ¶

func (s *GetPublicKeyOutput) SetEncryptionAlgorithms(v []*string) *GetPublicKeyOutput

SetEncryptionAlgorithms sets the EncryptionAlgorithms field's value.

func (*GetPublicKeyOutput) SetKeyAgreementAlgorithms ¶

func (s *GetPublicKeyOutput) SetKeyAgreementAlgorithms(v []*string) *GetPublicKeyOutput

SetKeyAgreementAlgorithms sets the KeyAgreementAlgorithms field's value.

func (*GetPublicKeyOutput) SetKeyId ¶

func (s *GetPublicKeyOutput) SetKeyId(v string) *GetPublicKeyOutput

SetKeyId sets the KeyId field's value.

func (*GetPublicKeyOutput) SetKeySpec ¶

func (s *GetPublicKeyOutput) SetKeySpec(v string) *GetPublicKeyOutput

SetKeySpec sets the KeySpec field's value.

func (*GetPublicKeyOutput) SetKeyUsage ¶

func (s *GetPublicKeyOutput) SetKeyUsage(v string) *GetPublicKeyOutput

SetKeyUsage sets the KeyUsage field's value.

func (*GetPublicKeyOutput) SetPublicKey ¶

func (s *GetPublicKeyOutput) SetPublicKey(v []byte) *GetPublicKeyOutput

SetPublicKey sets the PublicKey field's value.

func (*GetPublicKeyOutput) SetSigningAlgorithms ¶

func (s *GetPublicKeyOutput) SetSigningAlgorithms(v []*string) *GetPublicKeyOutput

SetSigningAlgorithms sets the SigningAlgorithms field's value.

func (GetPublicKeyOutput) String ¶

func (s GetPublicKeyOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GrantConstraints ¶

type GrantConstraints struct {

    // A list of key-value pairs that must match the encryption context in the cryptographic
    // operation (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
    // request. The grant allows the operation only when the encryption context
    // in the request is the same as the encryption context specified in this constraint.
    EncryptionContextEquals map[string]*string `type:"map"`

    // A list of key-value pairs that must be included in the encryption context
    // of the cryptographic operation (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
    // request. The grant allows the cryptographic operation only when the encryption
    // context in the request includes the key-value pairs specified in this constraint,
    // although it can include additional key-value pairs.
    EncryptionContextSubset map[string]*string `type:"map"`
    // contains filtered or unexported fields
}

Use this structure to allow cryptographic operations (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations) in the grant only when the operation request includes the specified encryption context (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context).

KMS applies the grant constraints only to cryptographic operations that support an encryption context, that is, all cryptographic operations with a symmetric KMS key (https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-concepts.html#symmetric-cmks). Grant constraints are not applied to operations that do not support an encryption context, such as cryptographic operations with asymmetric KMS keys and management operations, such as DescribeKey or RetireGrant.

In a cryptographic operation, the encryption context in the decryption operation must be an exact, case-sensitive match for the keys and values in the encryption context of the encryption operation. Only the order of the pairs can vary.

However, in a grant constraint, the key in each key-value pair is not case sensitive, but the value is case sensitive.

To avoid confusion, do not use multiple encryption context pairs that differ only by case. To require a fully case-sensitive encryption context, use the kms:EncryptionContext: and kms:EncryptionContextKeys conditions in an IAM or key policy. For details, see kms:EncryptionContext: (https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-context) in the Key Management Service Developer Guide .

func (GrantConstraints) GoString ¶

func (s GrantConstraints) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GrantConstraints) SetEncryptionContextEquals ¶

func (s *GrantConstraints) SetEncryptionContextEquals(v map[string]*string) *GrantConstraints

SetEncryptionContextEquals sets the EncryptionContextEquals field's value.

func (*GrantConstraints) SetEncryptionContextSubset ¶

func (s *GrantConstraints) SetEncryptionContextSubset(v map[string]*string) *GrantConstraints

SetEncryptionContextSubset sets the EncryptionContextSubset field's value.

func (GrantConstraints) String ¶

func (s GrantConstraints) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type GrantListEntry ¶

type GrantListEntry struct {

    // A list of key-value pairs that must be present in the encryption context
    // of certain subsequent operations that the grant allows.
    Constraints *GrantConstraints `type:"structure"`

    // The date and time when the grant was created.
    CreationDate *time.Time `type:"timestamp"`

    // The unique identifier for the grant.
    GrantId *string `min:"1" type:"string"`

    // The identity that gets the permissions in the grant.
    //
    // The GranteePrincipal field in the ListGrants response usually contains the
    // user or role designated as the grantee principal in the grant. However, when
    // the grantee principal in the grant is an Amazon Web Services service, the
    // GranteePrincipal field contains the service principal (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services),
    // which might represent several different grantee principals.
    GranteePrincipal *string `min:"1" type:"string"`

    // The Amazon Web Services account under which the grant was issued.
    IssuingAccount *string `min:"1" type:"string"`

    // The unique identifier for the KMS key to which the grant applies.
    KeyId *string `min:"1" type:"string"`

    // The friendly name that identifies the grant. If a name was provided in the
    // CreateGrant request, that name is returned. Otherwise this value is null.
    Name *string `min:"1" type:"string"`

    // The list of operations permitted by the grant.
    Operations []*string `type:"list" enum:"GrantOperation"`

    // The principal that can retire the grant.
    RetiringPrincipal *string `min:"1" type:"string"`
    // contains filtered or unexported fields
}

Contains information about a grant.

func (GrantListEntry) GoString ¶

func (s GrantListEntry) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*GrantListEntry) SetConstraints ¶

func (s *GrantListEntry) SetConstraints(v *GrantConstraints) *GrantListEntry

SetConstraints sets the Constraints field's value.

func (*GrantListEntry) SetCreationDate ¶

func (s *GrantListEntry) SetCreationDate(v time.Time) *GrantListEntry

SetCreationDate sets the CreationDate field's value.

func (*GrantListEntry) SetGrantId ¶

func (s *GrantListEntry) SetGrantId(v string) *GrantListEntry

SetGrantId sets the GrantId field's value.

func (*GrantListEntry) SetGranteePrincipal ¶

func (s *GrantListEntry) SetGranteePrincipal(v string) *GrantListEntry

SetGranteePrincipal sets the GranteePrincipal field's value.

func (*GrantListEntry) SetIssuingAccount ¶

func (s *GrantListEntry) SetIssuingAccount(v string) *GrantListEntry

SetIssuingAccount sets the IssuingAccount field's value.

func (*GrantListEntry) SetKeyId ¶

func (s *GrantListEntry) SetKeyId(v string) *GrantListEntry

SetKeyId sets the KeyId field's value.

func (*GrantListEntry) SetName ¶

func (s *GrantListEntry) SetName(v string) *GrantListEntry

SetName sets the Name field's value.

func (*GrantListEntry) SetOperations ¶

func (s *GrantListEntry) SetOperations(v []*string) *GrantListEntry

SetOperations sets the Operations field's value.

func (*GrantListEntry) SetRetiringPrincipal ¶

func (s *GrantListEntry) SetRetiringPrincipal(v string) *GrantListEntry

SetRetiringPrincipal sets the RetiringPrincipal field's value.

func (GrantListEntry) String ¶

func (s GrantListEntry) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type ImportKeyMaterialInput ¶

type ImportKeyMaterialInput struct {

    // The encrypted key material to import. The key material must be encrypted
    // under the public wrapping key that GetParametersForImport returned, using
    // the wrapping algorithm that you specified in the same GetParametersForImport
    // request.
    // EncryptedKeyMaterial is automatically base64 encoded/decoded by the SDK.
    //
    // EncryptedKeyMaterial is a required field
    EncryptedKeyMaterial []byte `min:"1" type:"blob" required:"true"`

    // Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES.
    // For help with this choice, see Setting an expiration time (https://docs.aws.amazon.com/en_us/kms/latest/developerguide/importing-keys.html#importing-keys-expiration)
    // in the Key Management Service Developer Guide.
    //
    // When the value of ExpirationModel is KEY_MATERIAL_EXPIRES, you must specify
    // a value for the ValidTo parameter. When value is KEY_MATERIAL_DOES_NOT_EXPIRE,
    // you must omit the ValidTo parameter.
    //
    // You cannot change the ExpirationModel or ValidTo values for the current import
    // after the request completes. To change either value, you must reimport the
    // key material.
    ExpirationModel *string `type:"string" enum:"ExpirationModelType"`

    // The import token that you received in the response to a previous GetParametersForImport
    // request. It must be from the same response that contained the public key
    // that you used to encrypt the key material.
    // ImportToken is automatically base64 encoded/decoded by the SDK.
    //
    // ImportToken is a required field
    ImportToken []byte `min:"1" type:"blob" required:"true"`

    // The identifier of the KMS key that will be associated with the imported key
    // material. This must be the same KMS key specified in the KeyID parameter
    // of the corresponding GetParametersForImport request. The Origin of the KMS
    // key must be EXTERNAL and its KeyState must be PendingImport.
    //
    // The KMS key can be a symmetric encryption KMS key, HMAC KMS key, asymmetric
    // encryption KMS key, or asymmetric signing KMS key, including a multi-Region
    // key (kms/latest/developerguide/multi-region-keys-overview.html) of any supported
    // type. You cannot perform this operation on a KMS key in a custom key store,
    // or on a KMS key in a different Amazon Web Services account.
    //
    // Specify the key ID or key ARN of the KMS key.
    //
    // For example:
    //
    //    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
    //
    //    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
    //
    // To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.
    //
    // KeyId is a required field
    KeyId *string `min:"1" type:"string" required:"true"`

    // The date and time when the imported key material expires. This parameter
    // is required when the value of the ExpirationModel parameter is KEY_MATERIAL_EXPIRES.
    // Otherwise it is not valid.
    //
    // The value of this parameter must be a future date and time. The maximum value
    // is 365 days from the request date.
    //
    // When the key material expires, KMS deletes the key material from the KMS
    // key. Without its key material, the KMS key is unusable. To use the KMS key
    // in cryptographic operations, you must reimport the same key material.
    //
    // You cannot change the ExpirationModel or ValidTo values for the current import
    // after the request completes. To change either value, you must delete (DeleteImportedKeyMaterial)
    // and reimport the key material.
    ValidTo *time.Time `type:"timestamp"`
    // contains filtered or unexported fields
}

func (ImportKeyMaterialInput) GoString ¶

func (s ImportKeyMaterialInput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*ImportKeyMaterialInput) SetEncryptedKeyMaterial ¶

func (s *ImportKeyMaterialInput) SetEncryptedKeyMaterial(v []byte) *ImportKeyMaterialInput

SetEncryptedKeyMaterial sets the EncryptedKeyMaterial field's value.

func (*ImportKeyMaterialInput) SetExpirationModel ¶

func (s *ImportKeyMaterialInput) SetExpirationModel(v string) *ImportKeyMaterialInput

SetExpirationModel sets the ExpirationModel field's value.

func (*ImportKeyMaterialInput) SetImportToken ¶

func (s *ImportKeyMaterialInput) SetImportToken(v []byte) *ImportKeyMaterialInput

SetImportToken sets the ImportToken field's value.

func (*ImportKeyMaterialInput) SetKeyId ¶

func (s *ImportKeyMaterialInput) SetKeyId(v string) *ImportKeyMaterialInput

SetKeyId sets the KeyId field's value.

func (*ImportKeyMaterialInput) SetValidTo ¶

func (s *ImportKeyMaterialInput) SetValidTo(v time.Time) *ImportKeyMaterialInput

SetValidTo sets the ValidTo field's value.

func (ImportKeyMaterialInput) String ¶

func (s ImportKeyMaterialInput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*ImportKeyMaterialInput) Validate ¶

func (s *ImportKeyMaterialInput) Validate() error

Validate inspects the fields of the type to determine if they are valid.

type ImportKeyMaterialOutput ¶

type ImportKeyMaterialOutput struct {
    // contains filtered or unexported fields
}

func (ImportKeyMaterialOutput) GoString ¶

func (s ImportKeyMaterialOutput) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (ImportKeyMaterialOutput) String ¶

func (s ImportKeyMaterialOutput) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type IncorrectKeyException ¶

type IncorrectKeyException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the specified KMS key cannot decrypt the data. The KeyId in a Decrypt request and the SourceKeyId in a ReEncrypt request must identify the same KMS key that was used to encrypt the ciphertext.

func (*IncorrectKeyException) Code ¶

func (s *IncorrectKeyException) Code() string

Code returns the exception type name.

func (*IncorrectKeyException) Error ¶

func (s *IncorrectKeyException) Error() string

func (IncorrectKeyException) GoString ¶

func (s IncorrectKeyException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*IncorrectKeyException) Message ¶

func (s *IncorrectKeyException) Message() string

Message returns the exception's message.

func (*IncorrectKeyException) OrigErr ¶

func (s *IncorrectKeyException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*IncorrectKeyException) RequestID ¶

func (s *IncorrectKeyException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*IncorrectKeyException) StatusCode ¶

func (s *IncorrectKeyException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (IncorrectKeyException) String ¶

func (s IncorrectKeyException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type IncorrectKeyMaterialException ¶

type IncorrectKeyMaterialException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the key material in the request is, expired, invalid, or is not the same key material that was previously imported into this KMS key.

func (*IncorrectKeyMaterialException) Code ¶

func (s *IncorrectKeyMaterialException) Code() string

Code returns the exception type name.

func (*IncorrectKeyMaterialException) Error ¶

func (s *IncorrectKeyMaterialException) Error() string

func (IncorrectKeyMaterialException) GoString ¶

func (s IncorrectKeyMaterialException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*IncorrectKeyMaterialException) Message ¶

func (s *IncorrectKeyMaterialException) Message() string

Message returns the exception's message.

func (*IncorrectKeyMaterialException) OrigErr ¶

func (s *IncorrectKeyMaterialException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*IncorrectKeyMaterialException) RequestID ¶

func (s *IncorrectKeyMaterialException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*IncorrectKeyMaterialException) StatusCode ¶

func (s *IncorrectKeyMaterialException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (IncorrectKeyMaterialException) String ¶

func (s IncorrectKeyMaterialException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type IncorrectTrustAnchorException ¶

type IncorrectTrustAnchorException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the trust anchor certificate in the request to create an CloudHSM key store is not the trust anchor certificate for the specified CloudHSM cluster.

When you initialize the CloudHSM cluster (https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr), you create the trust anchor certificate and save it in the customerCA.crt file.

func (*IncorrectTrustAnchorException) Code ¶

func (s *IncorrectTrustAnchorException) Code() string

Code returns the exception type name.

func (*IncorrectTrustAnchorException) Error ¶

func (s *IncorrectTrustAnchorException) Error() string

func (IncorrectTrustAnchorException) GoString ¶

func (s IncorrectTrustAnchorException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*IncorrectTrustAnchorException) Message ¶

func (s *IncorrectTrustAnchorException) Message() string

Message returns the exception's message.

func (*IncorrectTrustAnchorException) OrigErr ¶

func (s *IncorrectTrustAnchorException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*IncorrectTrustAnchorException) RequestID ¶

func (s *IncorrectTrustAnchorException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*IncorrectTrustAnchorException) StatusCode ¶

func (s *IncorrectTrustAnchorException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (IncorrectTrustAnchorException) String ¶

func (s IncorrectTrustAnchorException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type InternalException ¶

type InternalException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because an internal exception occurred. The request can be retried.

func (*InternalException) Code ¶

func (s *InternalException) Code() string

Code returns the exception type name.

func (*InternalException) Error ¶

func (s *InternalException) Error() string

func (InternalException) GoString ¶

func (s InternalException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*InternalException) Message ¶

func (s *InternalException) Message() string

Message returns the exception's message.

func (*InternalException) OrigErr ¶

func (s *InternalException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*InternalException) RequestID ¶

func (s *InternalException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*InternalException) StatusCode ¶

func (s *InternalException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (InternalException) String ¶

func (s InternalException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type InvalidAliasNameException ¶

type InvalidAliasNameException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the specified alias name is not valid.

func (*InvalidAliasNameException) Code ¶

func (s *InvalidAliasNameException) Code() string

Code returns the exception type name.

func (*InvalidAliasNameException) Error ¶

func (s *InvalidAliasNameException) Error() string

func (InvalidAliasNameException) GoString ¶

func (s InvalidAliasNameException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*InvalidAliasNameException) Message ¶

func (s *InvalidAliasNameException) Message() string

Message returns the exception's message.

func (*InvalidAliasNameException) OrigErr ¶

func (s *InvalidAliasNameException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*InvalidAliasNameException) RequestID ¶

func (s *InvalidAliasNameException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*InvalidAliasNameException) StatusCode ¶

func (s *InvalidAliasNameException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (InvalidAliasNameException) String ¶

func (s InvalidAliasNameException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type InvalidArnException ¶

type InvalidArnException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because a specified ARN, or an ARN in a key policy, is not valid.

func (*InvalidArnException) Code ¶

func (s *InvalidArnException) Code() string

Code returns the exception type name.

func (*InvalidArnException) Error ¶

func (s *InvalidArnException) Error() string

func (InvalidArnException) GoString ¶

func (s InvalidArnException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*InvalidArnException) Message ¶

func (s *InvalidArnException) Message() string

Message returns the exception's message.

func (*InvalidArnException) OrigErr ¶

func (s *InvalidArnException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*InvalidArnException) RequestID ¶

func (s *InvalidArnException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*InvalidArnException) StatusCode ¶

func (s *InvalidArnException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (InvalidArnException) String ¶

func (s InvalidArnException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type InvalidCiphertextException ¶

type InvalidCiphertextException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

From the Decrypt or ReEncrypt operation, the request was rejected because the specified ciphertext, or additional authenticated data incorporated into the ciphertext, such as the encryption context, is corrupted, missing, or otherwise invalid.

From the ImportKeyMaterial operation, the request was rejected because KMS could not decrypt the encrypted (wrapped) key material.

func (*InvalidCiphertextException) Code ¶

func (s *InvalidCiphertextException) Code() string

Code returns the exception type name.

func (*InvalidCiphertextException) Error ¶

func (s *InvalidCiphertextException) Error() string

func (InvalidCiphertextException) GoString ¶

func (s InvalidCiphertextException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*InvalidCiphertextException) Message ¶

func (s *InvalidCiphertextException) Message() string

Message returns the exception's message.

func (*InvalidCiphertextException) OrigErr ¶

func (s *InvalidCiphertextException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*InvalidCiphertextException) RequestID ¶

func (s *InvalidCiphertextException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*InvalidCiphertextException) StatusCode ¶

func (s *InvalidCiphertextException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (InvalidCiphertextException) String ¶

func (s InvalidCiphertextException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type InvalidGrantIdException ¶

type InvalidGrantIdException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the specified GrantId is not valid.

func (*InvalidGrantIdException) Code ¶

func (s *InvalidGrantIdException) Code() string

Code returns the exception type name.

func (*InvalidGrantIdException) Error ¶

func (s *InvalidGrantIdException) Error() string

func (InvalidGrantIdException) GoString ¶

func (s InvalidGrantIdException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*InvalidGrantIdException) Message ¶

func (s *InvalidGrantIdException) Message() string

Message returns the exception's message.

func (*InvalidGrantIdException) OrigErr ¶

func (s *InvalidGrantIdException) OrigErr() error

OrigErr always returns nil, satisfies awserr.Error interface.

func (*InvalidGrantIdException) RequestID ¶

func (s *InvalidGrantIdException) RequestID() string

RequestID returns the service's response RequestID for request.

func (*InvalidGrantIdException) StatusCode ¶

func (s *InvalidGrantIdException) StatusCode() int

Status code returns the HTTP status code for the request's response error.

func (InvalidGrantIdException) String ¶

func (s InvalidGrantIdException) String() string

String returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

type InvalidGrantTokenException ¶

type InvalidGrantTokenException struct {
    RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

    Message_ *string `locationName:"message" type:"string"`
    // contains filtered or unexported fields
}

The request was rejected because the specified grant token is not valid.

func (*InvalidGrantTokenException) Code ¶

func (s *InvalidGrantTokenException) Code() string

Code returns the exception type name.

func (*InvalidGrantTokenException) Error ¶

func (s *InvalidGrantTokenException) Error() string

func (InvalidGrantTokenException) GoString ¶

func (s InvalidGrantTokenException) GoString() string

GoString returns the string representation.

API parameter values that are decorated as "sensitive" in the API will not be included in the string output. The member name will be present, but the value will be replaced with "sensitive".

func (*InvalidGrantTokenException) Message ¶