diff --git a/README.md b/README.md --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ ## Version -`1.4.3` +`1.4.4` ## Description @@ -25,7 +25,7 @@ __Signing Requests__ -Requests must be signed by using an access key ID and a secret access key. We strongly recommend that you /do not/ use your AWS account access key ID and secret key for everyday work with AWS KMS. Instead, use the access key ID and secret access key for an IAM user, or you can use the AWS Security Token Service to generate temporary security credentials that you can use to sign requests. +Requests must be signed by using an access key ID and a secret access key. We strongly recommend that you /do not/ use your AWS account (root) access key ID and secret key for everyday work with AWS KMS. Instead, use the access key ID and secret access key for an IAM user, or you can use the AWS Security Token Service to generate temporary security credentials that you can use to sign requests. All AWS KMS operations require . @@ -38,16 +38,21 @@ For more information about credentials and request signing, see the following: - - This topic provides general information about the types of credentials used for accessing AWS. -- - This guide describes how to create and use temporary security credentials. -- - This set of topics walks you through the process of signing a request using an access key ID and a secret access key. +- - This section of the /IAM User Guide/ describes how to create and use temporary security credentials. + +- - This set of topics walks you through the process of signing a request using an access key ID and a secret access key. + __Commonly Used APIs__ Of the APIs discussed in this guide, the following will prove the most useful for most applications. You will likely perform actions other than these, such as creating keys and assigning policies, by using the console. - < Encrypt> + - < Decrypt> + - < GenerateDataKey> + - < GenerateDataKeyWithoutPlaintext> Documentation is available via [Hackage](http://hackage.haskell.org/package/amazonka-kms) diff --git a/amazonka-kms.cabal b/amazonka-kms.cabal --- a/amazonka-kms.cabal +++ b/amazonka-kms.cabal @@ -1,5 +1,5 @@ name: amazonka-kms -version: 1.4.3 +version: 1.4.4 synopsis: Amazon Key Management Service SDK. homepage: https://github.com/brendanhay/amazonka bug-reports: https://github.com/brendanhay/amazonka/issues @@ -11,7 +11,7 @@ category: Network, AWS, Cloud, Distributed Computing build-type: Simple cabal-version: >= 1.10 -extra-source-files: README.md fixture/*.yaml fixture/*.proto +extra-source-files: README.md fixture/*.yaml fixture/*.proto src/.gitkeep description: AWS Key Management Service @@ -25,7 +25,7 @@ __Signing Requests__ - Requests must be signed by using an access key ID and a secret access key. We strongly recommend that you /do not/ use your AWS account access key ID and secret key for everyday work with AWS KMS. Instead, use the access key ID and secret access key for an IAM user, or you can use the AWS Security Token Service to generate temporary security credentials that you can use to sign requests. + Requests must be signed by using an access key ID and a secret access key. We strongly recommend that you /do not/ use your AWS account (root) access key ID and secret key for everyday work with AWS KMS. Instead, use the access key ID and secret access key for an IAM user, or you can use the AWS Security Token Service to generate temporary security credentials that you can use to sign requests. All AWS KMS operations require . @@ -38,16 +38,21 @@ For more information about credentials and request signing, see the following: - - This topic provides general information about the types of credentials used for accessing AWS. - - - This guide describes how to create and use temporary security credentials. - - - This set of topics walks you through the process of signing a request using an access key ID and a secret access key. + - - This section of the /IAM User Guide/ describes how to create and use temporary security credentials. + + - - This set of topics walks you through the process of signing a request using an access key ID and a secret access key. + __Commonly Used APIs__ Of the APIs discussed in this guide, the following will prove the most useful for most applications. You will likely perform actions other than these, such as creating keys and assigning policies, by using the console. - < Encrypt> + - < Decrypt> + - < GenerateDataKey> + - < GenerateDataKeyWithoutPlaintext> . The types from this library are intended to be used with @@ -82,6 +87,7 @@ , Network.AWS.KMS.CreateKey , Network.AWS.KMS.Decrypt , Network.AWS.KMS.DeleteAlias + , Network.AWS.KMS.DeleteImportedKeyMaterial , Network.AWS.KMS.DescribeKey , Network.AWS.KMS.DisableKey , Network.AWS.KMS.DisableKeyRotation @@ -93,6 +99,8 @@ , Network.AWS.KMS.GenerateRandom , Network.AWS.KMS.GetKeyPolicy , Network.AWS.KMS.GetKeyRotationStatus + , Network.AWS.KMS.GetParametersForImport + , Network.AWS.KMS.ImportKeyMaterial , Network.AWS.KMS.ListAliases , Network.AWS.KMS.ListGrants , Network.AWS.KMS.ListKeyPolicies @@ -113,7 +121,7 @@ , Network.AWS.KMS.Types.Sum build-depends: - amazonka-core == 1.4.3.* + amazonka-core == 1.4.4.* , base >= 4.7 && < 5 test-suite amazonka-kms-test @@ -133,9 +141,9 @@ , Test.AWS.KMS.Internal build-depends: - amazonka-core == 1.4.3.* - , amazonka-test == 1.4.3.* - , amazonka-kms == 1.4.3.* + amazonka-core == 1.4.4.* + , amazonka-test == 1.4.4.* + , amazonka-kms == 1.4.4.* , base , bytestring , tasty diff --git a/fixture/DeleteImportedKeyMaterial.yaml b/fixture/DeleteImportedKeyMaterial.yaml new file mode 100644 --- /dev/null +++ b/fixture/DeleteImportedKeyMaterial.yaml diff --git a/fixture/DeleteImportedKeyMaterialResponse.proto b/fixture/DeleteImportedKeyMaterialResponse.proto new file mode 100644 --- /dev/null +++ b/fixture/DeleteImportedKeyMaterialResponse.proto diff --git a/fixture/GetParametersForImport.yaml b/fixture/GetParametersForImport.yaml new file mode 100644 --- /dev/null +++ b/fixture/GetParametersForImport.yaml diff --git a/fixture/GetParametersForImportResponse.proto b/fixture/GetParametersForImportResponse.proto new file mode 100644 --- /dev/null +++ b/fixture/GetParametersForImportResponse.proto diff --git a/fixture/ImportKeyMaterial.yaml b/fixture/ImportKeyMaterial.yaml new file mode 100644 --- /dev/null +++ b/fixture/ImportKeyMaterial.yaml diff --git a/fixture/ImportKeyMaterialResponse.proto b/fixture/ImportKeyMaterialResponse.proto new file mode 100644 --- /dev/null +++ b/fixture/ImportKeyMaterialResponse.proto diff --git a/gen/Network/AWS/KMS.hs b/gen/Network/AWS/KMS.hs --- a/gen/Network/AWS/KMS.hs +++ b/gen/Network/AWS/KMS.hs @@ -23,7 +23,7 @@ -- -- __Signing Requests__ -- --- Requests must be signed by using an access key ID and a secret access key. We strongly recommend that you /do not/ use your AWS account access key ID and secret key for everyday work with AWS KMS. Instead, use the access key ID and secret access key for an IAM user, or you can use the AWS Security Token Service to generate temporary security credentials that you can use to sign requests. +-- Requests must be signed by using an access key ID and a secret access key. We strongly recommend that you /do not/ use your AWS account (root) access key ID and secret key for everyday work with AWS KMS. Instead, use the access key ID and secret access key for an IAM user, or you can use the AWS Security Token Service to generate temporary security credentials that you can use to sign requests. -- -- All AWS KMS operations require . -- @@ -36,17 +36,23 @@ -- For more information about credentials and request signing, see the following: -- -- - - This topic provides general information about the types of credentials used for accessing AWS. --- - - This guide describes how to create and use temporary security credentials. --- - - This set of topics walks you through the process of signing a request using an access key ID and a secret access key. -- +-- - - This section of the /IAM User Guide/ describes how to create and use temporary security credentials. +-- +-- - - This set of topics walks you through the process of signing a request using an access key ID and a secret access key. +-- -- __Commonly Used APIs__ -- -- Of the APIs discussed in this guide, the following will prove the most useful for most applications. You will likely perform actions other than these, such as creating keys and assigning policies, by using the console. -- -- - < Encrypt> +-- -- - < Decrypt> +-- -- - < GenerateDataKey> +-- -- - < GenerateDataKeyWithoutPlaintext> +-- module Network.AWS.KMS ( -- * Service Configuration @@ -76,9 +82,15 @@ -- ** KeyUnavailableException , _KeyUnavailableException + -- ** IncorrectKeyMaterialException + , _IncorrectKeyMaterialException + -- ** KMSInternalException , _KMSInternalException + -- ** InvalidImportTokenException + , _InvalidImportTokenException + -- ** NotFoundException , _NotFoundException @@ -97,6 +109,9 @@ -- ** DependencyTimeoutException , _DependencyTimeoutException + -- ** ExpiredImportTokenException + , _ExpiredImportTokenException + -- ** InvalidCiphertextException , _InvalidCiphertextException @@ -124,6 +139,9 @@ -- ** GenerateDataKeyWithoutPlaintext , module Network.AWS.KMS.GenerateDataKeyWithoutPlaintext + -- ** GetParametersForImport + , module Network.AWS.KMS.GetParametersForImport + -- ** EnableKeyRotation , module Network.AWS.KMS.EnableKeyRotation @@ -199,11 +217,23 @@ -- ** GetKeyPolicy , module Network.AWS.KMS.GetKeyPolicy + -- ** ImportKeyMaterial + , module Network.AWS.KMS.ImportKeyMaterial + + -- ** DeleteImportedKeyMaterial + , module Network.AWS.KMS.DeleteImportedKeyMaterial + -- * Types + -- ** AlgorithmSpec + , AlgorithmSpec (..) + -- ** DataKeySpec , DataKeySpec (..) + -- ** ExpirationModelType + , ExpirationModelType (..) + -- ** GrantOperation , GrantOperation (..) @@ -213,6 +243,12 @@ -- ** KeyUsageType , KeyUsageType (..) + -- ** OriginType + , OriginType (..) + + -- ** WrappingKeySpec + , WrappingKeySpec (..) + -- ** AliasListEntry , AliasListEntry , aliasListEntry @@ -248,7 +284,10 @@ -- ** KeyMetadata , KeyMetadata , keyMetadata + , kmOrigin + , kmExpirationModel , kmEnabled + , kmValidTo , kmARN , kmKeyState , kmAWSAccountId @@ -272,6 +311,7 @@ import Network.AWS.KMS.CreateKey import Network.AWS.KMS.Decrypt import Network.AWS.KMS.DeleteAlias +import Network.AWS.KMS.DeleteImportedKeyMaterial import Network.AWS.KMS.DescribeKey import Network.AWS.KMS.DisableKey import Network.AWS.KMS.DisableKeyRotation @@ -283,6 +323,8 @@ import Network.AWS.KMS.GenerateRandom import Network.AWS.KMS.GetKeyPolicy import Network.AWS.KMS.GetKeyRotationStatus +import Network.AWS.KMS.GetParametersForImport +import Network.AWS.KMS.ImportKeyMaterial import Network.AWS.KMS.ListAliases import Network.AWS.KMS.ListGrants import Network.AWS.KMS.ListKeyPolicies diff --git a/gen/Network/AWS/KMS/CancelKeyDeletion.hs b/gen/Network/AWS/KMS/CancelKeyDeletion.hs --- a/gen/Network/AWS/KMS/CancelKeyDeletion.hs +++ b/gen/Network/AWS/KMS/CancelKeyDeletion.hs @@ -20,7 +20,7 @@ -- -- Cancels the deletion of a customer master key (CMK). When this operation is successful, the CMK is set to the 'Disabled' state. To enable a CMK, use < EnableKey>. -- --- For more information about scheduling and canceling deletion of a CMK, go to in the /AWS Key Management Service Developer Guide/. +-- For more information about scheduling and canceling deletion of a CMK, see in the /AWS Key Management Service Developer Guide/. module Network.AWS.KMS.CancelKeyDeletion ( -- * Creating a Request @@ -67,6 +67,7 @@ -- To specify this value, use the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples: -- -- - Unique key ID: 1234abcd-12ab-34cd-56ef-1234567890ab +-- -- - Key ARN: arn:aws:kms:us-west-2:111122223333:key\/1234abcd-12ab-34cd-56ef-1234567890ab -- -- To obtain the unique key ID and key ARN for a given CMK, use < ListKeys> or < DescribeKey>. diff --git a/gen/Network/AWS/KMS/CreateAlias.hs b/gen/Network/AWS/KMS/CreateAlias.hs --- a/gen/Network/AWS/KMS/CreateAlias.hs +++ b/gen/Network/AWS/KMS/CreateAlias.hs @@ -74,7 +74,9 @@ -- | An identifier of the key for which you are creating the alias. This value cannot be another alias but can be a globally unique identifier or a fully specified ARN to a key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- caTargetKeyId :: Lens' CreateAlias Text caTargetKeyId = lens _caTargetKeyId (\ s a -> s{_caTargetKeyId = a}); diff --git a/gen/Network/AWS/KMS/CreateGrant.hs b/gen/Network/AWS/KMS/CreateGrant.hs --- a/gen/Network/AWS/KMS/CreateGrant.hs +++ b/gen/Network/AWS/KMS/CreateGrant.hs @@ -102,7 +102,7 @@ -- | A list of grant tokens. -- --- For more information, go to in the /AWS Key Management Service Developer Guide/. +-- For more information, see in the /AWS Key Management Service Developer Guide/. cgGrantTokens :: Lens' CreateGrant [Text] cgGrantTokens = lens _cgGrantTokens (\ s a -> s{_cgGrantTokens = a}) . _Default . _Coerce; @@ -122,14 +122,24 @@ -- | A list of operations that the grant permits. The list can contain any combination of one or more of the following values: -- --- - Decrypt --- - Encrypt --- - GenerateDataKey --- - GenerateDataKeyWithoutPlaintext --- - ReEncryptFrom --- - ReEncryptTo --- - CreateGrant --- - RetireGrant +-- - < Decrypt> +-- +-- - < Encrypt> +-- +-- - < GenerateDataKey> +-- +-- - < GenerateDataKeyWithoutPlaintext> +-- +-- - +-- +-- - +-- +-- - < CreateGrant> +-- +-- - < RetireGrant> +-- +-- - < DescribeKey> +-- cgOperations :: Lens' CreateGrant [GrantOperation] cgOperations = lens _cgOperations (\ s a -> s{_cgOperations = a}) . _Default . _Coerce; @@ -138,7 +148,9 @@ -- To specify this value, use the globally unique key ID or the Amazon Resource Name (ARN) of the key. Examples: -- -- - Globally unique key ID: 12345678-1234-1234-1234-123456789012 +-- -- - Key ARN: arn:aws:kms:us-west-2:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- cgKeyId :: Lens' CreateGrant Text cgKeyId = lens _cgKeyId (\ s a -> s{_cgKeyId = a}); @@ -223,7 +235,7 @@ -- | The grant token. -- --- For more information about using grant tokens, see in the /AWS Key Management Service Developer Guide/. +-- For more information, see in the /AWS Key Management Service Developer Guide/. cgrsGrantToken :: Lens' CreateGrantResponse (Maybe Text) cgrsGrantToken = lens _cgrsGrantToken (\ s a -> s{_cgrsGrantToken = a}); diff --git a/gen/Network/AWS/KMS/CreateKey.hs b/gen/Network/AWS/KMS/CreateKey.hs --- a/gen/Network/AWS/KMS/CreateKey.hs +++ b/gen/Network/AWS/KMS/CreateKey.hs @@ -18,14 +18,23 @@ -- Stability : auto-generated -- Portability : non-portable (GHC extensions) -- --- Creates a customer master key. Customer master keys can be used to encrypt small amounts of data (less than 4K) directly, but they are most commonly used to encrypt or envelope data keys that are then used to encrypt customer data. For more information about data keys, see < GenerateDataKey> and < GenerateDataKeyWithoutPlaintext>. +-- Creates a customer master key (CMK). +-- +-- You can use a CMK to encrypt small amounts of data (4 KiB or less) directly, but CMKs are more commonly used to encrypt data encryption keys (DEKs), which are used to encrypt raw data. For more information about DEKs and the difference between CMKs and DEKs, see the following: +-- +-- - The < GenerateDataKey> operation +-- +-- - in the /AWS Key Management Service Developer Guide/ +-- module Network.AWS.KMS.CreateKey ( -- * Creating a Request createKey , CreateKey -- * Request Lenses + , ckOrigin , ckKeyUsage + , ckBypassPolicyLockoutSafetyCheck , ckPolicy , ckDescription @@ -46,17 +55,23 @@ -- | /See:/ 'createKey' smart constructor. data CreateKey = CreateKey' - { _ckKeyUsage :: !(Maybe KeyUsageType) - , _ckPolicy :: !(Maybe Text) - , _ckDescription :: !(Maybe Text) + { _ckOrigin :: !(Maybe OriginType) + , _ckKeyUsage :: !(Maybe KeyUsageType) + , _ckBypassPolicyLockoutSafetyCheck :: !(Maybe Bool) + , _ckPolicy :: !(Maybe Text) + , _ckDescription :: !(Maybe Text) } deriving (Eq,Read,Show,Data,Typeable,Generic) -- | Creates a value of 'CreateKey' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- +-- * 'ckOrigin' +-- -- * 'ckKeyUsage' -- +-- * 'ckBypassPolicyLockoutSafetyCheck' +-- -- * 'ckPolicy' -- -- * 'ckDescription' @@ -64,20 +79,56 @@ :: CreateKey createKey = CreateKey' - { _ckKeyUsage = Nothing + { _ckOrigin = Nothing + , _ckKeyUsage = Nothing + , _ckBypassPolicyLockoutSafetyCheck = Nothing , _ckPolicy = Nothing , _ckDescription = Nothing } --- | Specifies the intended use of the key. Currently this defaults to ENCRYPT\/DECRYPT, and only symmetric encryption and decryption are supported. +-- | The source of the CMK\'s key material. +-- +-- The default is 'AWS_KMS', which means AWS KMS creates the key material. When this parameter is set to 'EXTERNAL', the request creates a CMK without key material so that you can import key material from your existing key management infrastructure. For more information about importing key material into AWS KMS, see in the /AWS Key Management Service Developer Guide/. +-- +-- The CMK\'s 'Origin' is immutable and is set when the CMK is created. +ckOrigin :: Lens' CreateKey (Maybe OriginType) +ckOrigin = lens _ckOrigin (\ s a -> s{_ckOrigin = a}); + +-- | The intended use of the CMK. +-- +-- You can use CMKs only for symmetric encryption and decryption. ckKeyUsage :: Lens' CreateKey (Maybe KeyUsageType) ckKeyUsage = lens _ckKeyUsage (\ s a -> s{_ckKeyUsage = a}); --- | Policy to attach to the key. This is required and delegates back to the account. The key is the root of trust. The policy size limit is 32 KiB (32768 bytes). +-- | A flag to indicate whether to bypass the key policy lockout safety check. +-- +-- Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately. +-- +-- For more information, refer to the scenario in the section in the /AWS Key Management Service Developer Guide/. +-- +-- Use this parameter only when you include a policy in the request and you intend to prevent the principal making the request from making a subsequent < PutKeyPolicy> request on the CMK. +-- +-- The default value is false. +ckBypassPolicyLockoutSafetyCheck :: Lens' CreateKey (Maybe Bool) +ckBypassPolicyLockoutSafetyCheck = lens _ckBypassPolicyLockoutSafetyCheck (\ s a -> s{_ckBypassPolicyLockoutSafetyCheck = a}); + +-- | The key policy to attach to the CMK. +-- +-- If you specify a policy and do not set 'BypassPolicyLockoutSafetyCheck' to true, the policy must meet the following criteria: +-- +-- - It must allow the principal making the 'CreateKey' request to make a subsequent < PutKeyPolicy> request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the section in the /AWS Key Management Service Developer Guide/. +-- +-- - The principal(s) specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see in the /IAM User Guide/. +-- +-- If you do not specify a policy, AWS KMS attaches a default key policy to the CMK. For more information, see in the /AWS Key Management Service Developer Guide/. +-- +-- The policy size limit is 32 KiB (32768 bytes). ckPolicy :: Lens' CreateKey (Maybe Text) ckPolicy = lens _ckPolicy (\ s a -> s{_ckPolicy = a}); --- | Description of the key. We recommend that you choose a description that helps your customer decide whether the key is appropriate for a task. +-- | A description of the CMK. +-- +-- Use a description that helps you decide whether the CMK is appropriate for a task. ckDescription :: Lens' CreateKey (Maybe Text) ckDescription = lens _ckDescription (\ s a -> s{_ckDescription = a}); @@ -107,7 +158,10 @@ toJSON CreateKey'{..} = object (catMaybes - [("KeyUsage" .=) <$> _ckKeyUsage, + [("Origin" .=) <$> _ckOrigin, + ("KeyUsage" .=) <$> _ckKeyUsage, + ("BypassPolicyLockoutSafetyCheck" .=) <$> + _ckBypassPolicyLockoutSafetyCheck, ("Policy" .=) <$> _ckPolicy, ("Description" .=) <$> _ckDescription]) @@ -139,7 +193,7 @@ , _ckrsResponseStatus = pResponseStatus_ } --- | Metadata associated with the key. +-- | Metadata associated with the CMK. ckrsKeyMetadata :: Lens' CreateKeyResponse (Maybe KeyMetadata) ckrsKeyMetadata = lens _ckrsKeyMetadata (\ s a -> s{_ckrsKeyMetadata = a}); diff --git a/gen/Network/AWS/KMS/Decrypt.hs b/gen/Network/AWS/KMS/Decrypt.hs --- a/gen/Network/AWS/KMS/Decrypt.hs +++ b/gen/Network/AWS/KMS/Decrypt.hs @@ -21,7 +21,9 @@ -- Decrypts ciphertext. Ciphertext is plaintext that has been previously encrypted by using any of the following functions: -- -- - < GenerateDataKey> +-- -- - < GenerateDataKeyWithoutPlaintext> +-- -- - < Encrypt> -- -- Note that if a caller has been granted access permissions to all keys (through, for example, IAM user policies that grant 'Decrypt' permission on all resources), then ciphertext encrypted by using keys in other accounts where the key grants access to the caller can be decrypted. To remedy this, we recommend that you do not grant 'Decrypt' access in an IAM user policy. Instead grant 'Decrypt' access only in key policies. If you must grant 'Decrypt' access in an IAM user policy, you should scope the resource to specific keys or to specific trusted accounts. @@ -83,7 +85,7 @@ -- | A list of grant tokens. -- --- For more information, go to in the /AWS Key Management Service Developer Guide/. +-- For more information, see in the /AWS Key Management Service Developer Guide/. decGrantTokens :: Lens' Decrypt [Text] decGrantTokens = lens _decGrantTokens (\ s a -> s{_decGrantTokens = a}) . _Default . _Coerce; diff --git a/gen/Network/AWS/KMS/DeleteImportedKeyMaterial.hs b/gen/Network/AWS/KMS/DeleteImportedKeyMaterial.hs new file mode 100644 --- /dev/null +++ b/gen/Network/AWS/KMS/DeleteImportedKeyMaterial.hs @@ -0,0 +1,117 @@ +{-# LANGUAGE DeriveDataTypeable #-} +{-# LANGUAGE DeriveGeneric #-} +{-# LANGUAGE OverloadedStrings #-} +{-# LANGUAGE RecordWildCards #-} +{-# LANGUAGE TypeFamilies #-} + +{-# OPTIONS_GHC -fno-warn-unused-imports #-} +{-# OPTIONS_GHC -fno-warn-unused-binds #-} +{-# OPTIONS_GHC -fno-warn-unused-matches #-} + +-- Derived from AWS service descriptions, licensed under Apache 2.0. + +-- | +-- Module : Network.AWS.KMS.DeleteImportedKeyMaterial +-- Copyright : (c) 2013-2016 Brendan Hay +-- License : Mozilla Public License, v. 2.0. +-- Maintainer : Brendan Hay +-- Stability : auto-generated +-- Portability : non-portable (GHC extensions) +-- +-- Deletes key material that you previously imported and makes the specified customer master key (CMK) unusable. For more information about importing key material into AWS KMS, see in the /AWS Key Management Service Developer Guide/. +-- +-- When the specified CMK is in the 'PendingDeletion' state, this operation does not change the CMK\'s state. Otherwise, it changes the CMK\'s state to 'PendingImport'. +-- +-- After you delete key material, you can use < ImportKeyMaterial> to reimport the same key material into the CMK. +module Network.AWS.KMS.DeleteImportedKeyMaterial + ( + -- * Creating a Request + deleteImportedKeyMaterial + , DeleteImportedKeyMaterial + -- * Request Lenses + , dikmKeyId + + -- * Destructuring the Response + , deleteImportedKeyMaterialResponse + , DeleteImportedKeyMaterialResponse + ) where + +import Network.AWS.KMS.Types +import Network.AWS.KMS.Types.Product +import Network.AWS.Lens +import Network.AWS.Prelude +import Network.AWS.Request +import Network.AWS.Response + +-- | /See:/ 'deleteImportedKeyMaterial' smart constructor. +newtype DeleteImportedKeyMaterial = DeleteImportedKeyMaterial' + { _dikmKeyId :: Text + } deriving (Eq,Read,Show,Data,Typeable,Generic) + +-- | Creates a value of 'DeleteImportedKeyMaterial' with the minimum fields required to make a request. +-- +-- Use one of the following lenses to modify other fields as desired: +-- +-- * 'dikmKeyId' +deleteImportedKeyMaterial + :: Text -- ^ 'dikmKeyId' + -> DeleteImportedKeyMaterial +deleteImportedKeyMaterial pKeyId_ = + DeleteImportedKeyMaterial' + { _dikmKeyId = pKeyId_ + } + +-- | The identifier of the CMK whose key material to delete. The CMK\'s 'Origin' must be 'EXTERNAL'. +-- +-- A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples: +-- +-- - Unique key ID: '1234abcd-12ab-34cd-56ef-1234567890ab' +-- +-- - Key ARN: 'arn:aws:kms:us-west-2:111122223333:key\/1234abcd-12ab-34cd-56ef-1234567890ab' +-- +dikmKeyId :: Lens' DeleteImportedKeyMaterial Text +dikmKeyId = lens _dikmKeyId (\ s a -> s{_dikmKeyId = a}); + +instance AWSRequest DeleteImportedKeyMaterial where + type Rs DeleteImportedKeyMaterial = + DeleteImportedKeyMaterialResponse + request = postJSON kms + response + = receiveNull DeleteImportedKeyMaterialResponse' + +instance Hashable DeleteImportedKeyMaterial + +instance NFData DeleteImportedKeyMaterial + +instance ToHeaders DeleteImportedKeyMaterial where + toHeaders + = const + (mconcat + ["X-Amz-Target" =# + ("TrentService.DeleteImportedKeyMaterial" :: + ByteString), + "Content-Type" =# + ("application/x-amz-json-1.1" :: ByteString)]) + +instance ToJSON DeleteImportedKeyMaterial where + toJSON DeleteImportedKeyMaterial'{..} + = object (catMaybes [Just ("KeyId" .= _dikmKeyId)]) + +instance ToPath DeleteImportedKeyMaterial where + toPath = const "/" + +instance ToQuery DeleteImportedKeyMaterial where + toQuery = const mempty + +-- | /See:/ 'deleteImportedKeyMaterialResponse' smart constructor. +data DeleteImportedKeyMaterialResponse = + DeleteImportedKeyMaterialResponse' + deriving (Eq,Read,Show,Data,Typeable,Generic) + +-- | Creates a value of 'DeleteImportedKeyMaterialResponse' with the minimum fields required to make a request. +-- +deleteImportedKeyMaterialResponse + :: DeleteImportedKeyMaterialResponse +deleteImportedKeyMaterialResponse = DeleteImportedKeyMaterialResponse' + +instance NFData DeleteImportedKeyMaterialResponse diff --git a/gen/Network/AWS/KMS/DescribeKey.hs b/gen/Network/AWS/KMS/DescribeKey.hs --- a/gen/Network/AWS/KMS/DescribeKey.hs +++ b/gen/Network/AWS/KMS/DescribeKey.hs @@ -67,16 +67,20 @@ -- | A list of grant tokens. -- --- For more information, go to in the /AWS Key Management Service Developer Guide/. +-- For more information, see in the /AWS Key Management Service Developer Guide/. dGrantTokens :: Lens' DescribeKey [Text] dGrantTokens = lens _dGrantTokens (\ s a -> s{_dGrantTokens = a}) . _Default . _Coerce; -- | A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by \"alias\/\". -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias\/MyAliasName +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- -- - Alias Name Example - alias\/MyAliasName +-- dKeyId :: Lens' DescribeKey Text dKeyId = lens _dKeyId (\ s a -> s{_dKeyId = a}); diff --git a/gen/Network/AWS/KMS/DisableKey.hs b/gen/Network/AWS/KMS/DisableKey.hs --- a/gen/Network/AWS/KMS/DisableKey.hs +++ b/gen/Network/AWS/KMS/DisableKey.hs @@ -18,7 +18,7 @@ -- Stability : auto-generated -- Portability : non-portable (GHC extensions) -- --- Sets the state of a master key to disabled, thereby preventing its use for cryptographic operations. For more information about how key state affects the use of a master key, go to in the /AWS Key Management Service Developer Guide/. +-- Sets the state of a customer master key (CMK) to disabled, thereby preventing its use for cryptographic operations. For more information about how key state affects the use of a CMK, see in the /AWS Key Management Service Developer Guide/. module Network.AWS.KMS.DisableKey ( -- * Creating a Request @@ -57,10 +57,14 @@ { _dkKeyId = pKeyId_ } --- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key. +-- | A unique identifier for the CMK. -- --- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 --- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- Use the CMK\'s unique identifier or its Amazon Resource Name (ARN). For example: +-- +-- - Unique ID: 1234abcd-12ab-34cd-56ef-1234567890ab +-- +-- - ARN: arn:aws:kms:us-west-2:111122223333:key\/1234abcd-12ab-34cd-56ef-1234567890ab +-- dkKeyId :: Lens' DisableKey Text dkKeyId = lens _dkKeyId (\ s a -> s{_dkKeyId = a}); diff --git a/gen/Network/AWS/KMS/DisableKeyRotation.hs b/gen/Network/AWS/KMS/DisableKeyRotation.hs --- a/gen/Network/AWS/KMS/DisableKeyRotation.hs +++ b/gen/Network/AWS/KMS/DisableKeyRotation.hs @@ -60,7 +60,9 @@ -- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- dkrKeyId :: Lens' DisableKeyRotation Text dkrKeyId = lens _dkrKeyId (\ s a -> s{_dkrKeyId = a}); diff --git a/gen/Network/AWS/KMS/EnableKey.hs b/gen/Network/AWS/KMS/EnableKey.hs --- a/gen/Network/AWS/KMS/EnableKey.hs +++ b/gen/Network/AWS/KMS/EnableKey.hs @@ -60,7 +60,9 @@ -- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- ekKeyId :: Lens' EnableKey Text ekKeyId = lens _ekKeyId (\ s a -> s{_ekKeyId = a}); diff --git a/gen/Network/AWS/KMS/EnableKeyRotation.hs b/gen/Network/AWS/KMS/EnableKeyRotation.hs --- a/gen/Network/AWS/KMS/EnableKeyRotation.hs +++ b/gen/Network/AWS/KMS/EnableKeyRotation.hs @@ -60,7 +60,9 @@ -- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- ekrKeyId :: Lens' EnableKeyRotation Text ekrKeyId = lens _ekrKeyId (\ s a -> s{_ekrKeyId = a}); diff --git a/gen/Network/AWS/KMS/Encrypt.hs b/gen/Network/AWS/KMS/Encrypt.hs --- a/gen/Network/AWS/KMS/Encrypt.hs +++ b/gen/Network/AWS/KMS/Encrypt.hs @@ -21,6 +21,7 @@ -- Encrypts plaintext into ciphertext by using a customer master key. The 'Encrypt' function has two primary use cases: -- -- - You can encrypt up to 4 KB of arbitrary data such as an RSA key, a database password, or other sensitive customer information. +-- -- - If you are moving encrypted data from one region to another, you can use this API to encrypt in the new region the plaintext data key that was used to encrypt the data in the original region. This provides you with an encrypted copy of the data key that can be decrypted in the new region and used there to decrypt the encrypted data. -- -- Unless you are moving encrypted data from one region to another, you don\'t use this function to encrypt a generated data key within a region. You retrieve data keys already encrypted by calling the < GenerateDataKey> or < GenerateDataKeyWithoutPlaintext> function. Data keys don\'t need to be encrypted again by calling 'Encrypt'. @@ -90,16 +91,20 @@ -- | A list of grant tokens. -- --- For more information, go to in the /AWS Key Management Service Developer Guide/. +-- For more information, see in the /AWS Key Management Service Developer Guide/. eGrantTokens :: Lens' Encrypt [Text] eGrantTokens = lens _eGrantTokens (\ s a -> s{_eGrantTokens = a}) . _Default . _Coerce; -- | A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by \"alias\/\". -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias\/MyAliasName +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- -- - Alias Name Example - alias\/MyAliasName +-- eKeyId :: Lens' Encrypt Text eKeyId = lens _eKeyId (\ s a -> s{_eKeyId = a}); diff --git a/gen/Network/AWS/KMS/GenerateDataKey.hs b/gen/Network/AWS/KMS/GenerateDataKey.hs --- a/gen/Network/AWS/KMS/GenerateDataKey.hs +++ b/gen/Network/AWS/KMS/GenerateDataKey.hs @@ -104,16 +104,20 @@ -- | A list of grant tokens. -- --- For more information, go to in the /AWS Key Management Service Developer Guide/. +-- For more information, see in the /AWS Key Management Service Developer Guide/. gdkGrantTokens :: Lens' GenerateDataKey [Text] gdkGrantTokens = lens _gdkGrantTokens (\ s a -> s{_gdkGrantTokens = a}) . _Default . _Coerce; -- | A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by \"alias\/\". -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias\/MyAliasName +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- -- - Alias Name Example - alias\/MyAliasName +-- gdkKeyId :: Lens' GenerateDataKey Text gdkKeyId = lens _gdkKeyId (\ s a -> s{_gdkKeyId = a}); diff --git a/gen/Network/AWS/KMS/GenerateDataKeyWithoutPlaintext.hs b/gen/Network/AWS/KMS/GenerateDataKeyWithoutPlaintext.hs --- a/gen/Network/AWS/KMS/GenerateDataKeyWithoutPlaintext.hs +++ b/gen/Network/AWS/KMS/GenerateDataKeyWithoutPlaintext.hs @@ -95,16 +95,20 @@ -- | A list of grant tokens. -- --- For more information, go to in the /AWS Key Management Service Developer Guide/. +-- For more information, see in the /AWS Key Management Service Developer Guide/. gdkwpGrantTokens :: Lens' GenerateDataKeyWithoutPlaintext [Text] gdkwpGrantTokens = lens _gdkwpGrantTokens (\ s a -> s{_gdkwpGrantTokens = a}) . _Default . _Coerce; -- | A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by \"alias\/\". -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias\/MyAliasName +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- -- - Alias Name Example - alias\/MyAliasName +-- gdkwpKeyId :: Lens' GenerateDataKeyWithoutPlaintext Text gdkwpKeyId = lens _gdkwpKeyId (\ s a -> s{_gdkwpKeyId = a}); diff --git a/gen/Network/AWS/KMS/GetKeyPolicy.hs b/gen/Network/AWS/KMS/GetKeyPolicy.hs --- a/gen/Network/AWS/KMS/GetKeyPolicy.hs +++ b/gen/Network/AWS/KMS/GetKeyPolicy.hs @@ -69,7 +69,9 @@ -- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- gkpKeyId :: Lens' GetKeyPolicy Text gkpKeyId = lens _gkpKeyId (\ s a -> s{_gkpKeyId = a}); diff --git a/gen/Network/AWS/KMS/GetKeyRotationStatus.hs b/gen/Network/AWS/KMS/GetKeyRotationStatus.hs --- a/gen/Network/AWS/KMS/GetKeyRotationStatus.hs +++ b/gen/Network/AWS/KMS/GetKeyRotationStatus.hs @@ -63,7 +63,9 @@ -- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- gkrsKeyId :: Lens' GetKeyRotationStatus Text gkrsKeyId = lens _gkrsKeyId (\ s a -> s{_gkrsKeyId = a}); diff --git a/gen/Network/AWS/KMS/GetParametersForImport.hs b/gen/Network/AWS/KMS/GetParametersForImport.hs new file mode 100644 --- /dev/null +++ b/gen/Network/AWS/KMS/GetParametersForImport.hs @@ -0,0 +1,208 @@ +{-# LANGUAGE DeriveDataTypeable #-} +{-# LANGUAGE DeriveGeneric #-} +{-# LANGUAGE OverloadedStrings #-} +{-# LANGUAGE RecordWildCards #-} +{-# LANGUAGE TypeFamilies #-} + +{-# OPTIONS_GHC -fno-warn-unused-imports #-} +{-# OPTIONS_GHC -fno-warn-unused-binds #-} +{-# OPTIONS_GHC -fno-warn-unused-matches #-} + +-- Derived from AWS service descriptions, licensed under Apache 2.0. + +-- | +-- Module : Network.AWS.KMS.GetParametersForImport +-- Copyright : (c) 2013-2016 Brendan Hay +-- License : Mozilla Public License, v. 2.0. +-- Maintainer : Brendan Hay +-- Stability : auto-generated +-- Portability : non-portable (GHC extensions) +-- +-- Returns the items you need in order to import key material into AWS KMS from your existing key management infrastructure. For more information about importing key material into AWS KMS, see in the /AWS Key Management Service Developer Guide/. +-- +-- You must specify the key ID of the customer master key (CMK) into which you will import key material. This CMK\'s 'Origin' must be 'EXTERNAL'. You must also specify the wrapping algorithm and type of wrapping key (public key) that you will use to encrypt the key material. +-- +-- This operation returns a public key and an import token. Use the public key to encrypt the key material. Store the import token to send with a subsequent < ImportKeyMaterial> request. The public key and import token from the same response must be used together. These items are valid for 24 hours, after which they cannot be used for a subsequent < ImportKeyMaterial> request. To retrieve new ones, send another 'GetParametersForImport' request. +module Network.AWS.KMS.GetParametersForImport + ( + -- * Creating a Request + getParametersForImport + , GetParametersForImport + -- * Request Lenses + , gpfiKeyId + , gpfiWrappingAlgorithm + , gpfiWrappingKeySpec + + -- * Destructuring the Response + , getParametersForImportResponse + , GetParametersForImportResponse + -- * Response Lenses + , gpfirsKeyId + , gpfirsPublicKey + , gpfirsParametersValidTo + , gpfirsImportToken + , gpfirsResponseStatus + ) where + +import Network.AWS.KMS.Types +import Network.AWS.KMS.Types.Product +import Network.AWS.Lens +import Network.AWS.Prelude +import Network.AWS.Request +import Network.AWS.Response + +-- | /See:/ 'getParametersForImport' smart constructor. +data GetParametersForImport = GetParametersForImport' + { _gpfiKeyId :: !Text + , _gpfiWrappingAlgorithm :: !AlgorithmSpec + , _gpfiWrappingKeySpec :: !WrappingKeySpec + } deriving (Eq,Read,Show,Data,Typeable,Generic) + +-- | Creates a value of 'GetParametersForImport' with the minimum fields required to make a request. +-- +-- Use one of the following lenses to modify other fields as desired: +-- +-- * 'gpfiKeyId' +-- +-- * 'gpfiWrappingAlgorithm' +-- +-- * 'gpfiWrappingKeySpec' +getParametersForImport + :: Text -- ^ 'gpfiKeyId' + -> AlgorithmSpec -- ^ 'gpfiWrappingAlgorithm' + -> WrappingKeySpec -- ^ 'gpfiWrappingKeySpec' + -> GetParametersForImport +getParametersForImport pKeyId_ pWrappingAlgorithm_ pWrappingKeySpec_ = + GetParametersForImport' + { _gpfiKeyId = pKeyId_ + , _gpfiWrappingAlgorithm = pWrappingAlgorithm_ + , _gpfiWrappingKeySpec = pWrappingKeySpec_ + } + +-- | The identifier of the CMK into which you will import key material. The CMK\'s 'Origin' must be 'EXTERNAL'. +-- +-- A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples: +-- +-- - Unique key ID: '1234abcd-12ab-34cd-56ef-1234567890ab' +-- +-- - Key ARN: 'arn:aws:kms:us-west-2:111122223333:key\/1234abcd-12ab-34cd-56ef-1234567890ab' +-- +gpfiKeyId :: Lens' GetParametersForImport Text +gpfiKeyId = lens _gpfiKeyId (\ s a -> s{_gpfiKeyId = a}); + +-- | The algorithm you will use to encrypt the key material before importing it with < ImportKeyMaterial>. For more information, see in the /AWS Key Management Service Developer Guide/. +gpfiWrappingAlgorithm :: Lens' GetParametersForImport AlgorithmSpec +gpfiWrappingAlgorithm = lens _gpfiWrappingAlgorithm (\ s a -> s{_gpfiWrappingAlgorithm = a}); + +-- | The type of wrapping key (public key) to return in the response. Only 2048-bit RSA public keys are supported. +gpfiWrappingKeySpec :: Lens' GetParametersForImport WrappingKeySpec +gpfiWrappingKeySpec = lens _gpfiWrappingKeySpec (\ s a -> s{_gpfiWrappingKeySpec = a}); + +instance AWSRequest GetParametersForImport where + type Rs GetParametersForImport = + GetParametersForImportResponse + request = postJSON kms + response + = receiveJSON + (\ s h x -> + GetParametersForImportResponse' <$> + (x .?> "KeyId") <*> (x .?> "PublicKey") <*> + (x .?> "ParametersValidTo") + <*> (x .?> "ImportToken") + <*> (pure (fromEnum s))) + +instance Hashable GetParametersForImport + +instance NFData GetParametersForImport + +instance ToHeaders GetParametersForImport where + toHeaders + = const + (mconcat + ["X-Amz-Target" =# + ("TrentService.GetParametersForImport" :: + ByteString), + "Content-Type" =# + ("application/x-amz-json-1.1" :: ByteString)]) + +instance ToJSON GetParametersForImport where + toJSON GetParametersForImport'{..} + = object + (catMaybes + [Just ("KeyId" .= _gpfiKeyId), + Just ("WrappingAlgorithm" .= _gpfiWrappingAlgorithm), + Just ("WrappingKeySpec" .= _gpfiWrappingKeySpec)]) + +instance ToPath GetParametersForImport where + toPath = const "/" + +instance ToQuery GetParametersForImport where + toQuery = const mempty + +-- | /See:/ 'getParametersForImportResponse' smart constructor. +data GetParametersForImportResponse = GetParametersForImportResponse' + { _gpfirsKeyId :: !(Maybe Text) + , _gpfirsPublicKey :: !(Maybe (Sensitive Base64)) + , _gpfirsParametersValidTo :: !(Maybe POSIX) + , _gpfirsImportToken :: !(Maybe Base64) + , _gpfirsResponseStatus :: !Int + } deriving (Eq,Read,Show,Data,Typeable,Generic) + +-- | Creates a value of 'GetParametersForImportResponse' with the minimum fields required to make a request. +-- +-- Use one of the following lenses to modify other fields as desired: +-- +-- * 'gpfirsKeyId' +-- +-- * 'gpfirsPublicKey' +-- +-- * 'gpfirsParametersValidTo' +-- +-- * 'gpfirsImportToken' +-- +-- * 'gpfirsResponseStatus' +getParametersForImportResponse + :: Int -- ^ 'gpfirsResponseStatus' + -> GetParametersForImportResponse +getParametersForImportResponse pResponseStatus_ = + GetParametersForImportResponse' + { _gpfirsKeyId = Nothing + , _gpfirsPublicKey = Nothing + , _gpfirsParametersValidTo = Nothing + , _gpfirsImportToken = Nothing + , _gpfirsResponseStatus = pResponseStatus_ + } + +-- | The identifier of the CMK to use in a subsequent < ImportKeyMaterial> request. This is the same CMK specified in the 'GetParametersForImport' request. +gpfirsKeyId :: Lens' GetParametersForImportResponse (Maybe Text) +gpfirsKeyId = lens _gpfirsKeyId (\ s a -> s{_gpfirsKeyId = a}); + +-- | The public key to use to encrypt the key material before importing it with < ImportKeyMaterial>. +-- +-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data, +-- despite what the AWS documentation might say. +-- The underlying isomorphism will encode to Base64 representation during +-- serialisation, and decode from Base64 representation during deserialisation. +-- This 'Lens' accepts and returns only raw unencoded data. +gpfirsPublicKey :: Lens' GetParametersForImportResponse (Maybe ByteString) +gpfirsPublicKey = lens _gpfirsPublicKey (\ s a -> s{_gpfirsPublicKey = a}) . mapping (_Sensitive . _Base64); + +-- | The time at which the import token and public key are no longer valid. After this time, you cannot use them to make an < ImportKeyMaterial> request and you must send another 'GetParametersForImport' request to retrieve new ones. +gpfirsParametersValidTo :: Lens' GetParametersForImportResponse (Maybe UTCTime) +gpfirsParametersValidTo = lens _gpfirsParametersValidTo (\ s a -> s{_gpfirsParametersValidTo = a}) . mapping _Time; + +-- | The import token to send in a subsequent < ImportKeyMaterial> request. +-- +-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data, +-- despite what the AWS documentation might say. +-- The underlying isomorphism will encode to Base64 representation during +-- serialisation, and decode from Base64 representation during deserialisation. +-- This 'Lens' accepts and returns only raw unencoded data. +gpfirsImportToken :: Lens' GetParametersForImportResponse (Maybe ByteString) +gpfirsImportToken = lens _gpfirsImportToken (\ s a -> s{_gpfirsImportToken = a}) . mapping _Base64; + +-- | The response status code. +gpfirsResponseStatus :: Lens' GetParametersForImportResponse Int +gpfirsResponseStatus = lens _gpfirsResponseStatus (\ s a -> s{_gpfirsResponseStatus = a}); + +instance NFData GetParametersForImportResponse diff --git a/gen/Network/AWS/KMS/ImportKeyMaterial.hs b/gen/Network/AWS/KMS/ImportKeyMaterial.hs new file mode 100644 --- /dev/null +++ b/gen/Network/AWS/KMS/ImportKeyMaterial.hs @@ -0,0 +1,190 @@ +{-# LANGUAGE DeriveDataTypeable #-} +{-# LANGUAGE DeriveGeneric #-} +{-# LANGUAGE OverloadedStrings #-} +{-# LANGUAGE RecordWildCards #-} +{-# LANGUAGE TypeFamilies #-} + +{-# OPTIONS_GHC -fno-warn-unused-imports #-} +{-# OPTIONS_GHC -fno-warn-unused-binds #-} +{-# OPTIONS_GHC -fno-warn-unused-matches #-} + +-- Derived from AWS service descriptions, licensed under Apache 2.0. + +-- | +-- Module : Network.AWS.KMS.ImportKeyMaterial +-- Copyright : (c) 2013-2016 Brendan Hay +-- License : Mozilla Public License, v. 2.0. +-- Maintainer : Brendan Hay +-- Stability : auto-generated +-- Portability : non-portable (GHC extensions) +-- +-- Imports key material into an AWS KMS customer master key (CMK) from your existing key management infrastructure. For more information about importing key material into AWS KMS, see in the /AWS Key Management Service Developer Guide/. +-- +-- You must specify the key ID of the CMK to import the key material into. This CMK\'s 'Origin' must be 'EXTERNAL'. You must also send an import token and the encrypted key material. Send the import token that you received in the same < GetParametersForImport> response that contained the public key that you used to encrypt the key material. You must also specify whether the key material expires and if so, when. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. To use the CMK again, you can reimport the same key material. If you set an expiration date, you can change it only by reimporting the same key material and specifying a new expiration date. +-- +-- When this operation is successful, the specified CMK\'s key state changes to 'Enabled', and you can use the CMK. +-- +-- After you successfully import key material into a CMK, you can reimport the same key material into that CMK, but you cannot import different key material. +module Network.AWS.KMS.ImportKeyMaterial + ( + -- * Creating a Request + importKeyMaterial + , ImportKeyMaterial + -- * Request Lenses + , ikmExpirationModel + , ikmValidTo + , ikmKeyId + , ikmImportToken + , ikmEncryptedKeyMaterial + + -- * Destructuring the Response + , importKeyMaterialResponse + , ImportKeyMaterialResponse + -- * Response Lenses + , ikmrsResponseStatus + ) where + +import Network.AWS.KMS.Types +import Network.AWS.KMS.Types.Product +import Network.AWS.Lens +import Network.AWS.Prelude +import Network.AWS.Request +import Network.AWS.Response + +-- | /See:/ 'importKeyMaterial' smart constructor. +data ImportKeyMaterial = ImportKeyMaterial' + { _ikmExpirationModel :: !(Maybe ExpirationModelType) + , _ikmValidTo :: !(Maybe POSIX) + , _ikmKeyId :: !Text + , _ikmImportToken :: !Base64 + , _ikmEncryptedKeyMaterial :: !Base64 + } deriving (Eq,Read,Show,Data,Typeable,Generic) + +-- | Creates a value of 'ImportKeyMaterial' with the minimum fields required to make a request. +-- +-- Use one of the following lenses to modify other fields as desired: +-- +-- * 'ikmExpirationModel' +-- +-- * 'ikmValidTo' +-- +-- * 'ikmKeyId' +-- +-- * 'ikmImportToken' +-- +-- * 'ikmEncryptedKeyMaterial' +importKeyMaterial + :: Text -- ^ 'ikmKeyId' + -> ByteString -- ^ 'ikmImportToken' + -> ByteString -- ^ 'ikmEncryptedKeyMaterial' + -> ImportKeyMaterial +importKeyMaterial pKeyId_ pImportToken_ pEncryptedKeyMaterial_ = + ImportKeyMaterial' + { _ikmExpirationModel = Nothing + , _ikmValidTo = Nothing + , _ikmKeyId = pKeyId_ + , _ikmImportToken = _Base64 # pImportToken_ + , _ikmEncryptedKeyMaterial = _Base64 # pEncryptedKeyMaterial_ + } + +-- | Specifies whether the key material expires. The default is 'KEY_MATERIAL_EXPIRES', in which case you must include the 'ValidTo' parameter. When this parameter is set to 'KEY_MATERIAL_DOES_NOT_EXPIRE', you must omit the 'ValidTo' parameter. +ikmExpirationModel :: Lens' ImportKeyMaterial (Maybe ExpirationModelType) +ikmExpirationModel = lens _ikmExpirationModel (\ s a -> s{_ikmExpirationModel = a}); + +-- | The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. You must omit this parameter when the 'ExpirationModel' parameter is set to 'KEY_MATERIAL_DOES_NOT_EXPIRE'. Otherwise it is required. +ikmValidTo :: Lens' ImportKeyMaterial (Maybe UTCTime) +ikmValidTo = lens _ikmValidTo (\ s a -> s{_ikmValidTo = a}) . mapping _Time; + +-- | The identifier of the CMK to import the key material into. The CMK\'s 'Origin' must be 'EXTERNAL'. +-- +-- A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples: +-- +-- - Unique key ID: '1234abcd-12ab-34cd-56ef-1234567890ab' +-- +-- - Key ARN: 'arn:aws:kms:us-west-2:111122223333:key\/1234abcd-12ab-34cd-56ef-1234567890ab' +-- +ikmKeyId :: Lens' ImportKeyMaterial Text +ikmKeyId = lens _ikmKeyId (\ s a -> s{_ikmKeyId = a}); + +-- | The import token that you received in the response to a previous < GetParametersForImport> request. It must be from the same response that contained the public key that you used to encrypt the key material. +-- +-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data, +-- despite what the AWS documentation might say. +-- The underlying isomorphism will encode to Base64 representation during +-- serialisation, and decode from Base64 representation during deserialisation. +-- This 'Lens' accepts and returns only raw unencoded data. +ikmImportToken :: Lens' ImportKeyMaterial ByteString +ikmImportToken = lens _ikmImportToken (\ s a -> s{_ikmImportToken = a}) . _Base64; + +-- | The encrypted key material to import. It must be encrypted with the public key that you received in the response to a previous < GetParametersForImport> request, using the wrapping algorithm that you specified in that request. +-- +-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data, +-- despite what the AWS documentation might say. +-- The underlying isomorphism will encode to Base64 representation during +-- serialisation, and decode from Base64 representation during deserialisation. +-- This 'Lens' accepts and returns only raw unencoded data. +ikmEncryptedKeyMaterial :: Lens' ImportKeyMaterial ByteString +ikmEncryptedKeyMaterial = lens _ikmEncryptedKeyMaterial (\ s a -> s{_ikmEncryptedKeyMaterial = a}) . _Base64; + +instance AWSRequest ImportKeyMaterial where + type Rs ImportKeyMaterial = ImportKeyMaterialResponse + request = postJSON kms + response + = receiveEmpty + (\ s h x -> + ImportKeyMaterialResponse' <$> (pure (fromEnum s))) + +instance Hashable ImportKeyMaterial + +instance NFData ImportKeyMaterial + +instance ToHeaders ImportKeyMaterial where + toHeaders + = const + (mconcat + ["X-Amz-Target" =# + ("TrentService.ImportKeyMaterial" :: ByteString), + "Content-Type" =# + ("application/x-amz-json-1.1" :: ByteString)]) + +instance ToJSON ImportKeyMaterial where + toJSON ImportKeyMaterial'{..} + = object + (catMaybes + [("ExpirationModel" .=) <$> _ikmExpirationModel, + ("ValidTo" .=) <$> _ikmValidTo, + Just ("KeyId" .= _ikmKeyId), + Just ("ImportToken" .= _ikmImportToken), + Just + ("EncryptedKeyMaterial" .= + _ikmEncryptedKeyMaterial)]) + +instance ToPath ImportKeyMaterial where + toPath = const "/" + +instance ToQuery ImportKeyMaterial where + toQuery = const mempty + +-- | /See:/ 'importKeyMaterialResponse' smart constructor. +newtype ImportKeyMaterialResponse = ImportKeyMaterialResponse' + { _ikmrsResponseStatus :: Int + } deriving (Eq,Read,Show,Data,Typeable,Generic) + +-- | Creates a value of 'ImportKeyMaterialResponse' with the minimum fields required to make a request. +-- +-- Use one of the following lenses to modify other fields as desired: +-- +-- * 'ikmrsResponseStatus' +importKeyMaterialResponse + :: Int -- ^ 'ikmrsResponseStatus' + -> ImportKeyMaterialResponse +importKeyMaterialResponse pResponseStatus_ = + ImportKeyMaterialResponse' + { _ikmrsResponseStatus = pResponseStatus_ + } + +-- | The response status code. +ikmrsResponseStatus :: Lens' ImportKeyMaterialResponse Int +ikmrsResponseStatus = lens _ikmrsResponseStatus (\ s a -> s{_ikmrsResponseStatus = a}); + +instance NFData ImportKeyMaterialResponse diff --git a/gen/Network/AWS/KMS/ListGrants.hs b/gen/Network/AWS/KMS/ListGrants.hs --- a/gen/Network/AWS/KMS/ListGrants.hs +++ b/gen/Network/AWS/KMS/ListGrants.hs @@ -87,7 +87,9 @@ -- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- lgKeyId :: Lens' ListGrants Text lgKeyId = lens _lgKeyId (\ s a -> s{_lgKeyId = a}); diff --git a/gen/Network/AWS/KMS/ListKeyPolicies.hs b/gen/Network/AWS/KMS/ListKeyPolicies.hs --- a/gen/Network/AWS/KMS/ListKeyPolicies.hs +++ b/gen/Network/AWS/KMS/ListKeyPolicies.hs @@ -90,9 +90,13 @@ -- | A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by \"alias\/\". -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias\/MyAliasName +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- -- - Alias Name Example - alias\/MyAliasName +-- lkpKeyId :: Lens' ListKeyPolicies Text lkpKeyId = lens _lkpKeyId (\ s a -> s{_lkpKeyId = a}); diff --git a/gen/Network/AWS/KMS/ListRetirableGrants.hs b/gen/Network/AWS/KMS/ListRetirableGrants.hs --- a/gen/Network/AWS/KMS/ListRetirableGrants.hs +++ b/gen/Network/AWS/KMS/ListRetirableGrants.hs @@ -85,7 +85,7 @@ -- | The retiring principal for which to list grants. -- --- To specify the retiring principal, use the of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax for specifying a principal, go to in the Example ARNs section of the /Amazon Web Services General Reference/. +-- To specify the retiring principal, use the of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax for specifying a principal, see in the Example ARNs section of the /Amazon Web Services General Reference/. lrgRetiringPrincipal :: Lens' ListRetirableGrants Text lrgRetiringPrincipal = lens _lrgRetiringPrincipal (\ s a -> s{_lrgRetiringPrincipal = a}); diff --git a/gen/Network/AWS/KMS/PutKeyPolicy.hs b/gen/Network/AWS/KMS/PutKeyPolicy.hs --- a/gen/Network/AWS/KMS/PutKeyPolicy.hs +++ b/gen/Network/AWS/KMS/PutKeyPolicy.hs @@ -18,13 +18,16 @@ -- Stability : auto-generated -- Portability : non-portable (GHC extensions) -- --- Attaches a policy to the specified key. +-- Attaches a key policy to the specified customer master key (CMK). +-- +-- For more information about key policies, see in the /AWS Key Management Service Developer Guide/. module Network.AWS.KMS.PutKeyPolicy ( -- * Creating a Request putKeyPolicy , PutKeyPolicy -- * Request Lenses + , pkpBypassPolicyLockoutSafetyCheck , pkpKeyId , pkpPolicyName , pkpPolicy @@ -43,15 +46,18 @@ -- | /See:/ 'putKeyPolicy' smart constructor. data PutKeyPolicy = PutKeyPolicy' - { _pkpKeyId :: !Text - , _pkpPolicyName :: !Text - , _pkpPolicy :: !Text + { _pkpBypassPolicyLockoutSafetyCheck :: !(Maybe Bool) + , _pkpKeyId :: !Text + , _pkpPolicyName :: !Text + , _pkpPolicy :: !Text } deriving (Eq,Read,Show,Data,Typeable,Generic) -- | Creates a value of 'PutKeyPolicy' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- +-- * 'pkpBypassPolicyLockoutSafetyCheck' +-- -- * 'pkpKeyId' -- -- * 'pkpPolicyName' @@ -64,23 +70,50 @@ -> PutKeyPolicy putKeyPolicy pKeyId_ pPolicyName_ pPolicy_ = PutKeyPolicy' - { _pkpKeyId = pKeyId_ + { _pkpBypassPolicyLockoutSafetyCheck = Nothing + , _pkpKeyId = pKeyId_ , _pkpPolicyName = pPolicyName_ , _pkpPolicy = pPolicy_ } --- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key. +-- | A flag to indicate whether to bypass the key policy lockout safety check. -- --- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 --- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately. +-- +-- For more information, refer to the scenario in the section in the /AWS Key Management Service Developer Guide/. +-- +-- Use this parameter only when you intend to prevent the principal making the request from making a subsequent 'PutKeyPolicy' request on the CMK. +-- +-- The default value is false. +pkpBypassPolicyLockoutSafetyCheck :: Lens' PutKeyPolicy (Maybe Bool) +pkpBypassPolicyLockoutSafetyCheck = lens _pkpBypassPolicyLockoutSafetyCheck (\ s a -> s{_pkpBypassPolicyLockoutSafetyCheck = a}); + +-- | A unique identifier for the CMK. +-- +-- Use the CMK\'s unique identifier or its Amazon Resource Name (ARN). For example: +-- +-- - Unique ID: 1234abcd-12ab-34cd-56ef-1234567890ab +-- +-- - ARN: arn:aws:kms:us-west-2:111122223333:key\/1234abcd-12ab-34cd-56ef-1234567890ab +-- pkpKeyId :: Lens' PutKeyPolicy Text pkpKeyId = lens _pkpKeyId (\ s a -> s{_pkpKeyId = a}); --- | Name of the policy to be attached. Currently, the only supported name is \"default\". +-- | The name of the key policy. +-- +-- This value must be 'default'. pkpPolicyName :: Lens' PutKeyPolicy Text pkpPolicyName = lens _pkpPolicyName (\ s a -> s{_pkpPolicyName = a}); --- | The policy to attach to the key. This is required and delegates back to the account. The key is the root of trust. The policy size limit is 32 KiB (32768 bytes). +-- | The key policy to attach to the CMK. +-- +-- If you do not set 'BypassPolicyLockoutSafetyCheck' to true, the policy must meet the following criteria: +-- +-- - It must allow the principal making the 'PutKeyPolicy' request to make a subsequent 'PutKeyPolicy' request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the section in the /AWS Key Management Service Developer Guide/. +-- +-- - The principal(s) specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see in the /IAM User Guide/. +-- +-- The policy size limit is 32 KiB (32768 bytes). pkpPolicy :: Lens' PutKeyPolicy Text pkpPolicy = lens _pkpPolicy (\ s a -> s{_pkpPolicy = a}); @@ -106,7 +139,9 @@ toJSON PutKeyPolicy'{..} = object (catMaybes - [Just ("KeyId" .= _pkpKeyId), + [("BypassPolicyLockoutSafetyCheck" .=) <$> + _pkpBypassPolicyLockoutSafetyCheck, + Just ("KeyId" .= _pkpKeyId), Just ("PolicyName" .= _pkpPolicyName), Just ("Policy" .= _pkpPolicy)]) diff --git a/gen/Network/AWS/KMS/ReEncrypt.hs b/gen/Network/AWS/KMS/ReEncrypt.hs --- a/gen/Network/AWS/KMS/ReEncrypt.hs +++ b/gen/Network/AWS/KMS/ReEncrypt.hs @@ -95,7 +95,7 @@ -- | A list of grant tokens. -- --- For more information, go to in the /AWS Key Management Service Developer Guide/. +-- For more information, see in the /AWS Key Management Service Developer Guide/. reGrantTokens :: Lens' ReEncrypt [Text] reGrantTokens = lens _reGrantTokens (\ s a -> s{_reGrantTokens = a}) . _Default . _Coerce; @@ -112,9 +112,13 @@ -- | A unique identifier for the customer master key used to re-encrypt the data. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by \"alias\/\". -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias\/MyAliasName +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- -- - Alias Name Example - alias\/MyAliasName +-- reDestinationKeyId :: Lens' ReEncrypt Text reDestinationKeyId = lens _reDestinationKeyId (\ s a -> s{_reDestinationKeyId = a}); diff --git a/gen/Network/AWS/KMS/RetireGrant.hs b/gen/Network/AWS/KMS/RetireGrant.hs --- a/gen/Network/AWS/KMS/RetireGrant.hs +++ b/gen/Network/AWS/KMS/RetireGrant.hs @@ -21,7 +21,9 @@ -- Retires a grant. You can retire a grant when you\'re done using it to clean up. You should revoke a grant when you intend to actively deny operations that depend on it. The following are permitted to call this API: -- -- - The account that created the grant +-- -- - The 'RetiringPrincipal', if present +-- -- - The 'GranteePrincipal', if 'RetireGrant' is a grantee operation -- -- The grant to retire must be identified by its grant token or by a combination of the key ARN and the grant ID. A grant token is a unique variable-length base64-encoded string. A grant ID is a 64 character unique identifier of a grant. Both are returned by the 'CreateGrant' function. @@ -75,13 +77,16 @@ -- | A unique identifier for the customer master key associated with the grant. This value can be a globally unique identifier or a fully specified ARN of the key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- rgKeyId :: Lens' RetireGrant (Maybe Text) rgKeyId = lens _rgKeyId (\ s a -> s{_rgKeyId = a}); -- | Unique identifier of the grant to be retired. The grant ID is returned by the 'CreateGrant' function. -- -- - Grant ID Example - 0123456789012345678901234567890123456789012345678901234567890123 +-- rgGrantId :: Lens' RetireGrant (Maybe Text) rgGrantId = lens _rgGrantId (\ s a -> s{_rgGrantId = a}); diff --git a/gen/Network/AWS/KMS/RevokeGrant.hs b/gen/Network/AWS/KMS/RevokeGrant.hs --- a/gen/Network/AWS/KMS/RevokeGrant.hs +++ b/gen/Network/AWS/KMS/RevokeGrant.hs @@ -66,7 +66,9 @@ -- | A unique identifier for the customer master key associated with the grant. This value can be a globally unique identifier or the fully specified ARN to a key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- rKeyId :: Lens' RevokeGrant Text rKeyId = lens _rKeyId (\ s a -> s{_rKeyId = a}); diff --git a/gen/Network/AWS/KMS/ScheduleKeyDeletion.hs b/gen/Network/AWS/KMS/ScheduleKeyDeletion.hs --- a/gen/Network/AWS/KMS/ScheduleKeyDeletion.hs +++ b/gen/Network/AWS/KMS/ScheduleKeyDeletion.hs @@ -22,7 +22,7 @@ -- -- Deleting a CMK is a destructive and potentially dangerous operation. When a CMK is deleted, all data that was encrypted under the CMK is rendered unrecoverable. To restrict the use of a CMK without deleting it, use < DisableKey>. -- --- For more information about scheduling a CMK for deletion, go to in the /AWS Key Management Service Developer Guide/. +-- For more information about scheduling a CMK for deletion, see in the /AWS Key Management Service Developer Guide/. module Network.AWS.KMS.ScheduleKeyDeletion ( -- * Creating a Request @@ -81,6 +81,7 @@ -- To specify this value, use the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples: -- -- - Unique key ID: 1234abcd-12ab-34cd-56ef-1234567890ab +-- -- - Key ARN: arn:aws:kms:us-west-2:111122223333:key\/1234abcd-12ab-34cd-56ef-1234567890ab -- -- To obtain the unique key ID and key ARN for a given CMK, use < ListKeys> or < DescribeKey>. diff --git a/gen/Network/AWS/KMS/Types.hs b/gen/Network/AWS/KMS/Types.hs --- a/gen/Network/AWS/KMS/Types.hs +++ b/gen/Network/AWS/KMS/Types.hs @@ -23,20 +23,29 @@ , _UnsupportedOperationException , _DisabledException , _KeyUnavailableException + , _IncorrectKeyMaterialException , _KMSInternalException + , _InvalidImportTokenException , _NotFoundException , _InvalidAliasNameException , _InvalidGrantIdException , _InvalidGrantTokenException , _InvalidARNException , _DependencyTimeoutException + , _ExpiredImportTokenException , _InvalidCiphertextException , _AlreadyExistsException , _LimitExceededException + -- * AlgorithmSpec + , AlgorithmSpec (..) + -- * DataKeySpec , DataKeySpec (..) + -- * ExpirationModelType + , ExpirationModelType (..) + -- * GrantOperation , GrantOperation (..) @@ -46,6 +55,12 @@ -- * KeyUsageType , KeyUsageType (..) + -- * OriginType + , OriginType (..) + + -- * WrappingKeySpec + , WrappingKeySpec (..) + -- * AliasListEntry , AliasListEntry , aliasListEntry @@ -81,7 +96,10 @@ -- * KeyMetadata , KeyMetadata , keyMetadata + , kmOrigin + , kmExpirationModel , kmEnabled + , kmValidTo , kmARN , kmKeyState , kmAWSAccountId @@ -145,7 +163,7 @@ -- | The request was rejected because the state of the specified resource is not valid for this request. -- --- For more information about how key state affects the use of a customer master key (CMK), go to in the /AWS Key Management Service Developer Guide/. +-- For more information about how key state affects the use of a customer master key (CMK), see in the /AWS Key Management Service Developer Guide/. _KMSInvalidStateException :: AsError a => Getting (First ServiceError) a ServiceError _KMSInvalidStateException = _ServiceError . hasCode "KMSInvalidStateException" @@ -158,7 +176,7 @@ _MalformedPolicyDocumentException = _ServiceError . hasCode "MalformedPolicyDocumentException" --- | The request was rejected because a specified parameter is not supported. +-- | The request was rejected because a specified parameter is not supported or a specified resource is not valid for this operation. _UnsupportedOperationException :: AsError a => Getting (First ServiceError) a ServiceError _UnsupportedOperationException = _ServiceError . hasCode "UnsupportedOperationException" @@ -171,10 +189,20 @@ _KeyUnavailableException :: AsError a => Getting (First ServiceError) a ServiceError _KeyUnavailableException = _ServiceError . hasCode "KeyUnavailableException" +-- | The request was rejected because the provided key material is invalid or is not the same key material that was previously imported into this customer master key (CMK). +_IncorrectKeyMaterialException :: AsError a => Getting (First ServiceError) a ServiceError +_IncorrectKeyMaterialException = + _ServiceError . hasCode "IncorrectKeyMaterialException" + -- | The request was rejected because an internal exception occurred. The request can be retried. _KMSInternalException :: AsError a => Getting (First ServiceError) a ServiceError _KMSInternalException = _ServiceError . hasCode "KMSInternalException" +-- | The request was rejected because the provided import token is invalid or is associated with a different customer master key (CMK). +_InvalidImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError +_InvalidImportTokenException = + _ServiceError . hasCode "InvalidImportTokenException" + -- | The request was rejected because the specified entity or resource could not be found. _NotFoundException :: AsError a => Getting (First ServiceError) a ServiceError _NotFoundException = _ServiceError . hasCode "NotFoundException" @@ -201,6 +229,11 @@ _DependencyTimeoutException :: AsError a => Getting (First ServiceError) a ServiceError _DependencyTimeoutException = _ServiceError . hasCode "DependencyTimeoutException" + +-- | The request was rejected because the provided import token is expired. Use < GetParametersForImport> to retrieve a new import token and public key, use the new public key to encrypt the key material, and then try the request again. +_ExpiredImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError +_ExpiredImportTokenException = + _ServiceError . hasCode "ExpiredImportTokenException" -- | The request was rejected because the specified ciphertext has been corrupted or is otherwise invalid. _InvalidCiphertextException :: AsError a => Getting (First ServiceError) a ServiceError diff --git a/gen/Network/AWS/KMS/Types/Product.hs b/gen/Network/AWS/KMS/Types/Product.hs --- a/gen/Network/AWS/KMS/Types/Product.hs +++ b/gen/Network/AWS/KMS/Types/Product.hs @@ -279,23 +279,32 @@ -- -- /See:/ 'keyMetadata' smart constructor. data KeyMetadata = KeyMetadata' - { _kmEnabled :: !(Maybe Bool) - , _kmARN :: !(Maybe Text) - , _kmKeyState :: !(Maybe KeyState) - , _kmAWSAccountId :: !(Maybe Text) - , _kmKeyUsage :: !(Maybe KeyUsageType) - , _kmCreationDate :: !(Maybe POSIX) - , _kmDeletionDate :: !(Maybe POSIX) - , _kmDescription :: !(Maybe Text) - , _kmKeyId :: !Text + { _kmOrigin :: !(Maybe OriginType) + , _kmExpirationModel :: !(Maybe ExpirationModelType) + , _kmEnabled :: !(Maybe Bool) + , _kmValidTo :: !(Maybe POSIX) + , _kmARN :: !(Maybe Text) + , _kmKeyState :: !(Maybe KeyState) + , _kmAWSAccountId :: !(Maybe Text) + , _kmKeyUsage :: !(Maybe KeyUsageType) + , _kmCreationDate :: !(Maybe POSIX) + , _kmDeletionDate :: !(Maybe POSIX) + , _kmDescription :: !(Maybe Text) + , _kmKeyId :: !Text } deriving (Eq,Read,Show,Data,Typeable,Generic) -- | Creates a value of 'KeyMetadata' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- +-- * 'kmOrigin' +-- +-- * 'kmExpirationModel' +-- -- * 'kmEnabled' -- +-- * 'kmValidTo' +-- -- * 'kmARN' -- -- * 'kmKeyState' @@ -316,7 +325,10 @@ -> KeyMetadata keyMetadata pKeyId_ = KeyMetadata' - { _kmEnabled = Nothing + { _kmOrigin = Nothing + , _kmExpirationModel = Nothing + , _kmEnabled = Nothing + , _kmValidTo = Nothing , _kmARN = Nothing , _kmKeyState = Nothing , _kmAWSAccountId = Nothing @@ -327,41 +339,53 @@ , _kmKeyId = pKeyId_ } --- | Specifies whether the key is enabled. When 'KeyState' is 'Enabled' this value is true, otherwise it is false. +-- | The source of the CMK\'s key material. When this value is 'AWS_KMS', AWS KMS created the key material. When this value is 'EXTERNAL', the key material was imported from your existing key management infrastructure or the CMK lacks key material. +kmOrigin :: Lens' KeyMetadata (Maybe OriginType) +kmOrigin = lens _kmOrigin (\ s a -> s{_kmOrigin = a}); + +-- | Specifies whether the CMK\'s key material expires. This value is present only when 'Origin' is 'EXTERNAL', otherwise this value is omitted. +kmExpirationModel :: Lens' KeyMetadata (Maybe ExpirationModelType) +kmExpirationModel = lens _kmExpirationModel (\ s a -> s{_kmExpirationModel = a}); + +-- | Specifies whether the CMK is enabled. When 'KeyState' is 'Enabled' this value is true, otherwise it is false. kmEnabled :: Lens' KeyMetadata (Maybe Bool) kmEnabled = lens _kmEnabled (\ s a -> s{_kmEnabled = a}); --- | The Amazon Resource Name (ARN) of the key. For examples, see in the Example ARNs section of the /AWS General Reference/. +-- | The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. This value is present only for CMKs whose 'Origin' is 'EXTERNAL' and whose 'ExpirationModel' is 'KEY_MATERIAL_EXPIRES', otherwise this value is omitted. +kmValidTo :: Lens' KeyMetadata (Maybe UTCTime) +kmValidTo = lens _kmValidTo (\ s a -> s{_kmValidTo = a}) . mapping _Time; + +-- | The Amazon Resource Name (ARN) of the CMK. For examples, see in the Example ARNs section of the /AWS General Reference/. kmARN :: Lens' KeyMetadata (Maybe Text) kmARN = lens _kmARN (\ s a -> s{_kmARN = a}); --- | The state of the customer master key (CMK). +-- | The state of the CMK. -- --- For more information about how key state affects the use of a CMK, go to in the /AWS Key Management Service Developer Guide/. +-- For more information about how key state affects the use of a CMK, see in the /AWS Key Management Service Developer Guide/. kmKeyState :: Lens' KeyMetadata (Maybe KeyState) kmKeyState = lens _kmKeyState (\ s a -> s{_kmKeyState = a}); --- | The twelve-digit account ID of the AWS account that owns the key. +-- | The twelve-digit account ID of the AWS account that owns the CMK. kmAWSAccountId :: Lens' KeyMetadata (Maybe Text) kmAWSAccountId = lens _kmAWSAccountId (\ s a -> s{_kmAWSAccountId = a}); --- | The cryptographic operations for which you can use the key. Currently the only allowed value is 'ENCRYPT_DECRYPT', which means you can use the key for the < Encrypt> and < Decrypt> operations. +-- | The cryptographic operations for which you can use the CMK. Currently the only allowed value is 'ENCRYPT_DECRYPT', which means you can use the CMK for the < Encrypt> and < Decrypt> operations. kmKeyUsage :: Lens' KeyMetadata (Maybe KeyUsageType) kmKeyUsage = lens _kmKeyUsage (\ s a -> s{_kmKeyUsage = a}); --- | The date and time when the key was created. +-- | The date and time when the CMK was created. kmCreationDate :: Lens' KeyMetadata (Maybe UTCTime) kmCreationDate = lens _kmCreationDate (\ s a -> s{_kmCreationDate = a}) . mapping _Time; --- | The date and time after which AWS KMS deletes the customer master key (CMK). This value is present only when 'KeyState' is 'PendingDeletion', otherwise this value is null. +-- | The date and time after which AWS KMS deletes the CMK. This value is present only when 'KeyState' is 'PendingDeletion', otherwise this value is omitted. kmDeletionDate :: Lens' KeyMetadata (Maybe UTCTime) kmDeletionDate = lens _kmDeletionDate (\ s a -> s{_kmDeletionDate = a}) . mapping _Time; --- | The friendly description of the key. +-- | The description of the CMK. kmDescription :: Lens' KeyMetadata (Maybe Text) kmDescription = lens _kmDescription (\ s a -> s{_kmDescription = a}); --- | The globally unique identifier for the key. +-- | The globally unique identifier for the CMK. kmKeyId :: Lens' KeyMetadata Text kmKeyId = lens _kmKeyId (\ s a -> s{_kmKeyId = a}); @@ -370,8 +394,11 @@ = withObject "KeyMetadata" (\ x -> KeyMetadata' <$> - (x .:? "Enabled") <*> (x .:? "Arn") <*> - (x .:? "KeyState") + (x .:? "Origin") <*> (x .:? "ExpirationModel") <*> + (x .:? "Enabled") + <*> (x .:? "ValidTo") + <*> (x .:? "Arn") + <*> (x .:? "KeyState") <*> (x .:? "AWSAccountId") <*> (x .:? "KeyUsage") <*> (x .:? "CreationDate") diff --git a/gen/Network/AWS/KMS/Types/Sum.hs b/gen/Network/AWS/KMS/Types/Sum.hs --- a/gen/Network/AWS/KMS/Types/Sum.hs +++ b/gen/Network/AWS/KMS/Types/Sum.hs @@ -19,6 +19,35 @@ import Network.AWS.Prelude +data AlgorithmSpec + = RsaesOaepSha1 + | RsaesOaepSha256 + | RsaesPKCS1V15 + deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic) + +instance FromText AlgorithmSpec where + parser = takeLowerText >>= \case + "rsaes_oaep_sha_1" -> pure RsaesOaepSha1 + "rsaes_oaep_sha_256" -> pure RsaesOaepSha256 + "rsaes_pkcs1_v1_5" -> pure RsaesPKCS1V15 + e -> fromTextError $ "Failure parsing AlgorithmSpec from value: '" <> e + <> "'. Accepted values: rsaes_oaep_sha_1, rsaes_oaep_sha_256, rsaes_pkcs1_v1_5" + +instance ToText AlgorithmSpec where + toText = \case + RsaesOaepSha1 -> "RSAES_OAEP_SHA_1" + RsaesOaepSha256 -> "RSAES_OAEP_SHA_256" + RsaesPKCS1V15 -> "RSAES_PKCS1_V1_5" + +instance Hashable AlgorithmSpec +instance NFData AlgorithmSpec +instance ToByteString AlgorithmSpec +instance ToQuery AlgorithmSpec +instance ToHeader AlgorithmSpec + +instance ToJSON AlgorithmSpec where + toJSON = toJSONText + data DataKeySpec = AES128 | AES256 @@ -29,7 +58,7 @@ "aes_128" -> pure AES128 "aes_256" -> pure AES256 e -> fromTextError $ "Failure parsing DataKeySpec from value: '" <> e - <> "'. Accepted values: AES_128, AES_256" + <> "'. Accepted values: aes_128, aes_256" instance ToText DataKeySpec where toText = \case @@ -45,6 +74,35 @@ instance ToJSON DataKeySpec where toJSON = toJSONText +data ExpirationModelType + = KeyMaterialDoesNotExpire + | KeyMaterialExpires + deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic) + +instance FromText ExpirationModelType where + parser = takeLowerText >>= \case + "key_material_does_not_expire" -> pure KeyMaterialDoesNotExpire + "key_material_expires" -> pure KeyMaterialExpires + e -> fromTextError $ "Failure parsing ExpirationModelType from value: '" <> e + <> "'. Accepted values: key_material_does_not_expire, key_material_expires" + +instance ToText ExpirationModelType where + toText = \case + KeyMaterialDoesNotExpire -> "KEY_MATERIAL_DOES_NOT_EXPIRE" + KeyMaterialExpires -> "KEY_MATERIAL_EXPIRES" + +instance Hashable ExpirationModelType +instance NFData ExpirationModelType +instance ToByteString ExpirationModelType +instance ToQuery ExpirationModelType +instance ToHeader ExpirationModelType + +instance ToJSON ExpirationModelType where + toJSON = toJSONText + +instance FromJSON ExpirationModelType where + parseJSON = parseJSONText "ExpirationModelType" + data GrantOperation = CreateGrant | Decrypt @@ -69,7 +127,7 @@ "reencryptto" -> pure ReEncryptTo "retiregrant" -> pure RetireGrant e -> fromTextError $ "Failure parsing GrantOperation from value: '" <> e - <> "'. Accepted values: CreateGrant, Decrypt, DescribeKey, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, RetireGrant" + <> "'. Accepted values: creategrant, decrypt, describekey, encrypt, generatedatakey, generatedatakeywithoutplaintext, reencryptfrom, reencryptto, retiregrant" instance ToText GrantOperation where toText = \case @@ -99,6 +157,7 @@ = Disabled | Enabled | PendingDeletion + | PendingImport deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic) instance FromText KeyState where @@ -106,14 +165,16 @@ "disabled" -> pure Disabled "enabled" -> pure Enabled "pendingdeletion" -> pure PendingDeletion + "pendingimport" -> pure PendingImport e -> fromTextError $ "Failure parsing KeyState from value: '" <> e - <> "'. Accepted values: Disabled, Enabled, PendingDeletion" + <> "'. Accepted values: disabled, enabled, pendingdeletion, pendingimport" instance ToText KeyState where toText = \case Disabled -> "Disabled" Enabled -> "Enabled" PendingDeletion -> "PendingDeletion" + PendingImport -> "PendingImport" instance Hashable KeyState instance NFData KeyState @@ -132,7 +193,7 @@ parser = takeLowerText >>= \case "encrypt_decrypt" -> pure EncryptDecrypt e -> fromTextError $ "Failure parsing KeyUsageType from value: '" <> e - <> "'. Accepted values: ENCRYPT_DECRYPT" + <> "'. Accepted values: encrypt_decrypt" instance ToText KeyUsageType where toText = \case @@ -149,3 +210,55 @@ instance FromJSON KeyUsageType where parseJSON = parseJSONText "KeyUsageType" + +data OriginType + = AWSKMS + | External + deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic) + +instance FromText OriginType where + parser = takeLowerText >>= \case + "aws_kms" -> pure AWSKMS + "external" -> pure External + e -> fromTextError $ "Failure parsing OriginType from value: '" <> e + <> "'. Accepted values: aws_kms, external" + +instance ToText OriginType where + toText = \case + AWSKMS -> "AWS_KMS" + External -> "EXTERNAL" + +instance Hashable OriginType +instance NFData OriginType +instance ToByteString OriginType +instance ToQuery OriginType +instance ToHeader OriginType + +instance ToJSON OriginType where + toJSON = toJSONText + +instance FromJSON OriginType where + parseJSON = parseJSONText "OriginType" + +data WrappingKeySpec = + Rsa2048 + deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic) + +instance FromText WrappingKeySpec where + parser = takeLowerText >>= \case + "rsa_2048" -> pure Rsa2048 + e -> fromTextError $ "Failure parsing WrappingKeySpec from value: '" <> e + <> "'. Accepted values: rsa_2048" + +instance ToText WrappingKeySpec where + toText = \case + Rsa2048 -> "RSA_2048" + +instance Hashable WrappingKeySpec +instance NFData WrappingKeySpec +instance ToByteString WrappingKeySpec +instance ToQuery WrappingKeySpec +instance ToHeader WrappingKeySpec + +instance ToJSON WrappingKeySpec where + toJSON = toJSONText diff --git a/gen/Network/AWS/KMS/UpdateAlias.hs b/gen/Network/AWS/KMS/UpdateAlias.hs --- a/gen/Network/AWS/KMS/UpdateAlias.hs +++ b/gen/Network/AWS/KMS/UpdateAlias.hs @@ -76,6 +76,7 @@ -- | Unique identifier of the customer master key to be mapped to the alias. This value can be a globally unique identifier or the fully specified ARN of a key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 -- -- You can call < ListAliases> to verify that the alias is mapped to the correct 'TargetKeyId'. diff --git a/gen/Network/AWS/KMS/UpdateKeyDescription.hs b/gen/Network/AWS/KMS/UpdateKeyDescription.hs --- a/gen/Network/AWS/KMS/UpdateKeyDescription.hs +++ b/gen/Network/AWS/KMS/UpdateKeyDescription.hs @@ -66,7 +66,9 @@ -- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key. -- -- - Key ARN Example - arn:aws:kms:us-east-1:123456789012:key\/12345678-1234-1234-1234-123456789012 +-- -- - Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 +-- ukdKeyId :: Lens' UpdateKeyDescription Text ukdKeyId = lens _ukdKeyId (\ s a -> s{_ukdKeyId = a}); diff --git a/src/.gitkeep b/src/.gitkeep new file mode 100644 --- /dev/null +++ b/src/.gitkeep diff --git a/test/Test/AWS/Gen/KMS.hs b/test/Test/AWS/Gen/KMS.hs --- a/test/Test/AWS/Gen/KMS.hs +++ b/test/Test/AWS/Gen/KMS.hs @@ -40,6 +40,9 @@ -- , requestGenerateDataKeyWithoutPlaintext $ -- generateDataKeyWithoutPlaintext -- +-- , requestGetParametersForImport $ +-- getParametersForImport +-- -- , requestEnableKeyRotation $ -- enableKeyRotation -- @@ -115,6 +118,12 @@ -- , requestGetKeyPolicy $ -- getKeyPolicy -- +-- , requestImportKeyMaterial $ +-- importKeyMaterial +-- +-- , requestDeleteImportedKeyMaterial $ +-- deleteImportedKeyMaterial +-- -- ] -- , testGroup "response" @@ -130,6 +139,9 @@ -- , responseGenerateDataKeyWithoutPlaintext $ -- generateDataKeyWithoutPlaintextResponse -- +-- , responseGetParametersForImport $ +-- getParametersForImportResponse +-- -- , responseEnableKeyRotation $ -- enableKeyRotationResponse -- @@ -205,6 +217,12 @@ -- , responseGetKeyPolicy $ -- getKeyPolicyResponse -- +-- , responseImportKeyMaterial $ +-- importKeyMaterialResponse +-- +-- , responseDeleteImportedKeyMaterial $ +-- deleteImportedKeyMaterialResponse +-- -- ] -- ] @@ -230,6 +248,11 @@ "GenerateDataKeyWithoutPlaintext" "fixture/GenerateDataKeyWithoutPlaintext.yaml" +requestGetParametersForImport :: GetParametersForImport -> TestTree +requestGetParametersForImport = req + "GetParametersForImport" + "fixture/GetParametersForImport.yaml" + requestEnableKeyRotation :: EnableKeyRotation -> TestTree requestEnableKeyRotation = req "EnableKeyRotation" @@ -355,6 +378,16 @@ "GetKeyPolicy" "fixture/GetKeyPolicy.yaml" +requestImportKeyMaterial :: ImportKeyMaterial -> TestTree +requestImportKeyMaterial = req + "ImportKeyMaterial" + "fixture/ImportKeyMaterial.yaml" + +requestDeleteImportedKeyMaterial :: DeleteImportedKeyMaterial -> TestTree +requestDeleteImportedKeyMaterial = req + "DeleteImportedKeyMaterial" + "fixture/DeleteImportedKeyMaterial.yaml" + -- Responses responseEncrypt :: EncryptResponse -> TestTree @@ -385,6 +418,13 @@ kms (Proxy :: Proxy GenerateDataKeyWithoutPlaintext) +responseGetParametersForImport :: GetParametersForImportResponse -> TestTree +responseGetParametersForImport = res + "GetParametersForImportResponse" + "fixture/GetParametersForImportResponse.proto" + kms + (Proxy :: Proxy GetParametersForImport) + responseEnableKeyRotation :: EnableKeyRotationResponse -> TestTree responseEnableKeyRotation = res "EnableKeyRotationResponse" @@ -559,3 +599,17 @@ "fixture/GetKeyPolicyResponse.proto" kms (Proxy :: Proxy GetKeyPolicy) + +responseImportKeyMaterial :: ImportKeyMaterialResponse -> TestTree +responseImportKeyMaterial = res + "ImportKeyMaterialResponse" + "fixture/ImportKeyMaterialResponse.proto" + kms + (Proxy :: Proxy ImportKeyMaterial) + +responseDeleteImportedKeyMaterial :: DeleteImportedKeyMaterialResponse -> TestTree +responseDeleteImportedKeyMaterial = res + "DeleteImportedKeyMaterialResponse" + "fixture/DeleteImportedKeyMaterialResponse.proto" + kms + (Proxy :: Proxy DeleteImportedKeyMaterial)