amazonka-kms 1.4.5 → 1.5.0

raw patch · 50 files changed

+2041/−1263 lines, 50 filesdep ~amazonka-coredep ~amazonka-kmsdep ~amazonka-testPVP ok

version bump matches the API change (PVP)

Dependency ranges changed: amazonka-core, amazonka-kms, amazonka-test

API changes (from Hackage documentation)

Files

• README.md +1/−1
• amazonka-kms.cabal +19/−11
• fixture/ListResourceTags.yaml +10/−0
• fixture/ListResourceTagsResponse.proto +0/−0
• fixture/TagResource.yaml +10/−0
• fixture/TagResourceResponse.proto +0/−0
• fixture/UntagResource.yaml +10/−0
• fixture/UntagResourceResponse.proto +0/−0
• gen/Network/AWS/KMS.hs +61/−36
• gen/Network/AWS/KMS/CancelKeyDeletion.hs +26/−27
• gen/Network/AWS/KMS/CreateAlias.hs +32/−25
• gen/Network/AWS/KMS/CreateGrant.hs +58/−55
• gen/Network/AWS/KMS/CreateKey.hs +51/−37
• gen/Network/AWS/KMS/Decrypt.hs +36/−32
• gen/Network/AWS/KMS/DeleteAlias.hs +27/−22
• gen/Network/AWS/KMS/DeleteImportedKeyMaterial.hs +23/−20
• gen/Network/AWS/KMS/DescribeKey.hs +29/−29
• gen/Network/AWS/KMS/DisableKey.hs +25/−22
• gen/Network/AWS/KMS/DisableKeyRotation.hs +23/−22
• gen/Network/AWS/KMS/EnableKey.hs +23/−22
• gen/Network/AWS/KMS/EnableKeyRotation.hs +23/−22
• gen/Network/AWS/KMS/Encrypt.hs +46/−40
• gen/Network/AWS/KMS/GenerateDataKey.hs +48/−44
• gen/Network/AWS/KMS/GenerateDataKeyWithoutPlaintext.hs +44/−36
• gen/Network/AWS/KMS/GenerateRandom.hs +28/−27
• gen/Network/AWS/KMS/GetKeyPolicy.hs +29/−30
• gen/Network/AWS/KMS/GetKeyRotationStatus.hs +30/−27
• gen/Network/AWS/KMS/GetParametersForImport.hs +43/−39
• gen/Network/AWS/KMS/ImportKeyMaterial.hs +49/−35
• gen/Network/AWS/KMS/ListAliases.hs +44/−42
• gen/Network/AWS/KMS/ListGrants.hs +27/−27
• gen/Network/AWS/KMS/ListKeyPolicies.hs +44/−43
• gen/Network/AWS/KMS/ListKeys.hs +42/−42
• gen/Network/AWS/KMS/ListResourceTags.hs +176/−0
• gen/Network/AWS/KMS/ListRetirableGrants.hs +25/−23
• gen/Network/AWS/KMS/PutKeyPolicy.hs +37/−33
• gen/Network/AWS/KMS/ReEncrypt.hs +55/−49
• gen/Network/AWS/KMS/RetireGrant.hs +32/−31
• gen/Network/AWS/KMS/RevokeGrant.hs +26/−23
• gen/Network/AWS/KMS/ScheduleKeyDeletion.hs +33/−30
• gen/Network/AWS/KMS/TagResource.hs +123/−0
• gen/Network/AWS/KMS/Types.hs +88/−48
• gen/Network/AWS/KMS/Types/Product.hs +175/−113
• gen/Network/AWS/KMS/Types/Sum.hs +70/−35
• gen/Network/AWS/KMS/UntagResource.hs +119/−0
• gen/Network/AWS/KMS/UpdateAlias.hs +27/−26
• gen/Network/AWS/KMS/UpdateKeyDescription.hs +28/−25
• gen/Network/AWS/KMS/Waiters.hs +6/−6
• test/Main.hs +2/−2
• test/Test/AWS/Gen/KMS.hs +58/−4

@@ -8,7 +8,7 @@  ## Version -`1.4.5`+`1.5.0`   ## Description

@@ -1,13 +1,13 @@ name:                  amazonka-kms-version:               1.4.5+version:               1.5.0 synopsis:              Amazon Key Management Service SDK. homepage:              https://github.com/brendanhay/amazonka bug-reports:           https://github.com/brendanhay/amazonka/issues-license:               OtherLicense+license:               MPL-2.0 license-file:          LICENSE author:                Brendan Hay-maintainer:            Brendan Hay <brendan.g.hay@gmail.com>-copyright:             Copyright (c) 2013-2016 Brendan Hay+maintainer:            Brendan Hay <brendan.g.hay+amazonka@gmail.com>+copyright:             Copyright (c) 2013-2017 Brendan Hay category:              Network, AWS, Cloud, Distributed Computing build-type:            Simple cabal-version:         >= 1.10@@ -29,14 +29,19 @@     to get started.  source-repository head-    type:     git-    location: git://github.com/brendanhay/amazonka.git+    type:              git+    location:          git://github.com/brendanhay/amazonka.git+    subdir:            amazonka-kms  library     default-language:  Haskell2010     hs-source-dirs:    src gen -    ghc-options:       -Wall+    ghc-options:+        -Wall+        -fwarn-incomplete-uni-patterns+        -fwarn-incomplete-record-updates+        -funbox-strict-fields      exposed-modules:           Network.AWS.KMS@@ -64,13 +69,16 @@         , Network.AWS.KMS.ListGrants         , Network.AWS.KMS.ListKeyPolicies         , Network.AWS.KMS.ListKeys+        , Network.AWS.KMS.ListResourceTags         , Network.AWS.KMS.ListRetirableGrants         , Network.AWS.KMS.PutKeyPolicy         , Network.AWS.KMS.ReEncrypt         , Network.AWS.KMS.RetireGrant         , Network.AWS.KMS.RevokeGrant         , Network.AWS.KMS.ScheduleKeyDeletion+        , Network.AWS.KMS.TagResource         , Network.AWS.KMS.Types+        , Network.AWS.KMS.UntagResource         , Network.AWS.KMS.UpdateAlias         , Network.AWS.KMS.UpdateKeyDescription         , Network.AWS.KMS.Waiters@@ -80,7 +88,7 @@         , Network.AWS.KMS.Types.Sum      build-depends:-          amazonka-core == 1.4.5.*+          amazonka-core == 1.5.0.*         , base          >= 4.7     && < 5  test-suite amazonka-kms-test@@ -100,9 +108,9 @@         , Test.AWS.KMS.Internal      build-depends:-          amazonka-core == 1.4.5.*-        , amazonka-test == 1.4.5.*-        , amazonka-kms == 1.4.5.*+          amazonka-core == 1.5.0.*+        , amazonka-test == 1.5.0.*+        , amazonka-kms         , base         , bytestring         , tasty

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/kms/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  kms.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/kms/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  kms.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -0,0 +1,10 @@+---+method: POST+headers:+  Authorization:         AWS4-HMAC-SHA256 Credential=access/20091028/us-east-1/kms/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=?+  Host:                  kms.us-east-1.amazonaws.com+  Content-Type:          application/x-www-form-urlencoded; charset=utf-8+  X-Amz-Content-SHA256:  abcdef+  X-Amz-Date:            20091028T223200Z+body:+  ''

@@ -5,9 +5,9 @@  -- | -- Module      : Network.AWS.KMS--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) --@@ -90,6 +90,9 @@     -- ** KMSInternalException     , _KMSInternalException +    -- ** TagException+    , _TagException+     -- ** InvalidImportTokenException     , _InvalidImportTokenException @@ -174,6 +177,9 @@     -- ** ListKeys (Paginated)     , module Network.AWS.KMS.ListKeys +    -- ** ListResourceTags+    , module Network.AWS.KMS.ListResourceTags+     -- ** GetKeyRotationStatus     , module Network.AWS.KMS.GetKeyRotationStatus @@ -201,9 +207,15 @@     -- ** ReEncrypt     , module Network.AWS.KMS.ReEncrypt +    -- ** TagResource+    , module Network.AWS.KMS.TagResource+     -- ** ListKeyPolicies (Paginated)     , module Network.AWS.KMS.ListKeyPolicies +    -- ** UntagResource+    , module Network.AWS.KMS.UntagResource+     -- ** ScheduleKeyDeletion     , module Network.AWS.KMS.ScheduleKeyDeletion @@ -239,6 +251,9 @@     -- ** GrantOperation     , GrantOperation (..) +    -- ** KeyManagerType+    , KeyManagerType (..)+     -- ** KeyState     , KeyState (..) @@ -288,6 +303,7 @@     , keyMetadata     , kmOrigin     , kmExpirationModel+    , kmKeyManager     , kmEnabled     , kmValidTo     , kmARN@@ -305,42 +321,51 @@     , lgTruncated     , lgGrants     , lgNextMarker++    -- ** Tag+    , Tag+    , tag+    , tagTagKey+    , tagTagValue     ) where -import           Network.AWS.KMS.CancelKeyDeletion-import           Network.AWS.KMS.CreateAlias-import           Network.AWS.KMS.CreateGrant-import           Network.AWS.KMS.CreateKey-import           Network.AWS.KMS.Decrypt-import           Network.AWS.KMS.DeleteAlias-import           Network.AWS.KMS.DeleteImportedKeyMaterial-import           Network.AWS.KMS.DescribeKey-import           Network.AWS.KMS.DisableKey-import           Network.AWS.KMS.DisableKeyRotation-import           Network.AWS.KMS.EnableKey-import           Network.AWS.KMS.EnableKeyRotation-import           Network.AWS.KMS.Encrypt-import           Network.AWS.KMS.GenerateDataKey-import           Network.AWS.KMS.GenerateDataKeyWithoutPlaintext-import           Network.AWS.KMS.GenerateRandom-import           Network.AWS.KMS.GetKeyPolicy-import           Network.AWS.KMS.GetKeyRotationStatus-import           Network.AWS.KMS.GetParametersForImport-import           Network.AWS.KMS.ImportKeyMaterial-import           Network.AWS.KMS.ListAliases-import           Network.AWS.KMS.ListGrants-import           Network.AWS.KMS.ListKeyPolicies-import           Network.AWS.KMS.ListKeys-import           Network.AWS.KMS.ListRetirableGrants-import           Network.AWS.KMS.PutKeyPolicy-import           Network.AWS.KMS.ReEncrypt-import           Network.AWS.KMS.RetireGrant-import           Network.AWS.KMS.RevokeGrant-import           Network.AWS.KMS.ScheduleKeyDeletion-import           Network.AWS.KMS.Types-import           Network.AWS.KMS.UpdateAlias-import           Network.AWS.KMS.UpdateKeyDescription-import           Network.AWS.KMS.Waiters+import Network.AWS.KMS.CancelKeyDeletion+import Network.AWS.KMS.CreateAlias+import Network.AWS.KMS.CreateGrant+import Network.AWS.KMS.CreateKey+import Network.AWS.KMS.Decrypt+import Network.AWS.KMS.DeleteAlias+import Network.AWS.KMS.DeleteImportedKeyMaterial+import Network.AWS.KMS.DescribeKey+import Network.AWS.KMS.DisableKey+import Network.AWS.KMS.DisableKeyRotation+import Network.AWS.KMS.EnableKey+import Network.AWS.KMS.EnableKeyRotation+import Network.AWS.KMS.Encrypt+import Network.AWS.KMS.GenerateDataKey+import Network.AWS.KMS.GenerateDataKeyWithoutPlaintext+import Network.AWS.KMS.GenerateRandom+import Network.AWS.KMS.GetKeyPolicy+import Network.AWS.KMS.GetKeyRotationStatus+import Network.AWS.KMS.GetParametersForImport+import Network.AWS.KMS.ImportKeyMaterial+import Network.AWS.KMS.ListAliases+import Network.AWS.KMS.ListGrants+import Network.AWS.KMS.ListKeyPolicies+import Network.AWS.KMS.ListKeys+import Network.AWS.KMS.ListResourceTags+import Network.AWS.KMS.ListRetirableGrants+import Network.AWS.KMS.PutKeyPolicy+import Network.AWS.KMS.ReEncrypt+import Network.AWS.KMS.RetireGrant+import Network.AWS.KMS.RevokeGrant+import Network.AWS.KMS.ScheduleKeyDeletion+import Network.AWS.KMS.TagResource+import Network.AWS.KMS.Types+import Network.AWS.KMS.UntagResource+import Network.AWS.KMS.UpdateAlias+import Network.AWS.KMS.UpdateKeyDescription+import Network.AWS.KMS.Waiters  {- $errors Error matchers are designed for use with the functions provided by

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.CancelKeyDeletion--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Cancels the deletion of a customer master key (CMK). When this operation is successful, the CMK is set to the @Disabled@ state. To enable a CMK, use 'EnableKey' .+-- Cancels the deletion of a customer master key (CMK). When this operation is successful, the CMK is set to the @Disabled@ state. To enable a CMK, use 'EnableKey' . You cannot perform this operation on a CMK in a different AWS account. -- -- -- For more information about scheduling and canceling deletion of a CMK, see <http://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html Deleting Customer Master Keys> in the /AWS Key Management Service Developer Guide/ .@@ -39,32 +39,31 @@     , ckdrsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'cancelKeyDeletion' smart constructor. newtype CancelKeyDeletion = CancelKeyDeletion'-    { _ckdKeyId :: Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _ckdKeyId :: Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'CancelKeyDeletion' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'ckdKeyId' - The unique identifier for the customer master key (CMK) for which to cancel deletion. To specify this value, use the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples:     * Unique key ID: 1234abcd-12ab-34cd-56ef-1234567890ab     * Key ARN: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To obtain the unique key ID and key ARN for a given CMK, use 'ListKeys' or 'DescribeKey' .+-- * 'ckdKeyId' - The unique identifier for the customer master key (CMK) for which to cancel deletion. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . cancelKeyDeletion     :: Text -- ^ 'ckdKeyId'     -> CancelKeyDeletion-cancelKeyDeletion pKeyId_ =-    CancelKeyDeletion'-    { _ckdKeyId = pKeyId_-    }+cancelKeyDeletion pKeyId_ = CancelKeyDeletion' {_ckdKeyId = pKeyId_} --- | The unique identifier for the customer master key (CMK) for which to cancel deletion. To specify this value, use the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples:     * Unique key ID: 1234abcd-12ab-34cd-56ef-1234567890ab     * Key ARN: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To obtain the unique key ID and key ARN for a given CMK, use 'ListKeys' or 'DescribeKey' .++-- | The unique identifier for the customer master key (CMK) for which to cancel deletion. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . ckdKeyId :: Lens' CancelKeyDeletion Text ckdKeyId = lens _ckdKeyId (\ s a -> s{_ckdKeyId = a}); @@ -77,9 +76,9 @@                  CancelKeyDeletionResponse' <$>                    (x .?> "KeyId") <*> (pure (fromEnum s))) -instance Hashable CancelKeyDeletion+instance Hashable CancelKeyDeletion where -instance NFData CancelKeyDeletion+instance NFData CancelKeyDeletion where  instance ToHeaders CancelKeyDeletion where         toHeaders@@ -102,10 +101,11 @@  -- | /See:/ 'cancelKeyDeletionResponse' smart constructor. data CancelKeyDeletionResponse = CancelKeyDeletionResponse'-    { _ckdrsKeyId          :: !(Maybe Text)-    , _ckdrsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _ckdrsKeyId          :: !(Maybe Text)+  , _ckdrsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'CancelKeyDeletionResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -117,11 +117,10 @@     :: Int -- ^ 'ckdrsResponseStatus'     -> CancelKeyDeletionResponse cancelKeyDeletionResponse pResponseStatus_ =-    CancelKeyDeletionResponse'-    { _ckdrsKeyId = Nothing-    , _ckdrsResponseStatus = pResponseStatus_-    }+  CancelKeyDeletionResponse'+  {_ckdrsKeyId = Nothing, _ckdrsResponseStatus = pResponseStatus_} + -- | The unique identifier of the master key for which deletion is canceled. ckdrsKeyId :: Lens' CancelKeyDeletionResponse (Maybe Text) ckdrsKeyId = lens _ckdrsKeyId (\ s a -> s{_ckdrsKeyId = a});@@ -130,4 +129,4 @@ ckdrsResponseStatus :: Lens' CancelKeyDeletionResponse Int ckdrsResponseStatus = lens _ckdrsResponseStatus (\ s a -> s{_ckdrsResponseStatus = a}); -instance NFData CancelKeyDeletionResponse+instance NFData CancelKeyDeletionResponse where

@@ -12,19 +12,25 @@  -- | -- Module      : Network.AWS.KMS.CreateAlias--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Creates a display name for a customer master key. An alias can be used to identify a key and should be unique. The console enforces a one-to-one mapping between the alias and a key. An alias name can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). An alias must start with the word "alias" followed by a forward slash (alias/). An alias that begins with "aws" after the forward slash (alias/aws...) is reserved by Amazon Web Services (AWS).+-- Creates a display name for a customer master key (CMK). You can use an alias to identify a CMK in selected operations, such as 'Encrypt' and 'GenerateDataKey' . -- ----- The alias and the key it is mapped to must be in the same AWS account and the same region.+-- Each CMK can have multiple aliases, but each alias points to only one CMK. The alias name must be unique in the AWS account and region. To simplify code that runs in multiple regions, use the same alias name, but point it to a different CMK in each region. ----- To map an alias to a different key, call 'UpdateAlias' .+-- Because an alias is not a property of a CMK, you can delete and change the aliases of a CMK without affecting the CMK. Also, aliases do not appear in the response from the 'DescribeKey' operation. To get the aliases of all CMKs, use the 'ListAliases' operation. --+-- An alias must start with the word @alias@ followed by a forward slash (@alias/@ ). The alias name can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). Alias names cannot begin with @aws@ ; that alias name prefix is reserved by Amazon Web Services (AWS).+--+-- The alias and the CMK it is mapped to must be in the same AWS account and the same region. You cannot perform this operation on an alias in a different AWS account.+--+-- To map an existing alias to a different CMK, call 'UpdateAlias' .+-- module Network.AWS.KMS.CreateAlias     (     -- * Creating a Request@@ -39,41 +45,40 @@     , CreateAliasResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'createAlias' smart constructor. data CreateAlias = CreateAlias'-    { _caAliasName   :: !Text-    , _caTargetKeyId :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _caAliasName   :: !Text+  , _caTargetKeyId :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'CreateAlias' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- -- * 'caAliasName' - String that contains the display name. The name must start with the word "alias" followed by a forward slash (alias/). Aliases that begin with "alias/AWS" are reserved. ----- * 'caTargetKeyId' - An identifier of the key for which you are creating the alias. This value cannot be another alias but can be a globally unique identifier or a fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- * 'caTargetKeyId' - Identifies the CMK for which you are creating the alias. This value cannot be an alias. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . createAlias     :: Text -- ^ 'caAliasName'     -> Text -- ^ 'caTargetKeyId'     -> CreateAlias createAlias pAliasName_ pTargetKeyId_ =-    CreateAlias'-    { _caAliasName = pAliasName_-    , _caTargetKeyId = pTargetKeyId_-    }+  CreateAlias' {_caAliasName = pAliasName_, _caTargetKeyId = pTargetKeyId_} + -- | String that contains the display name. The name must start with the word "alias" followed by a forward slash (alias/). Aliases that begin with "alias/AWS" are reserved. caAliasName :: Lens' CreateAlias Text caAliasName = lens _caAliasName (\ s a -> s{_caAliasName = a}); --- | An identifier of the key for which you are creating the alias. This value cannot be another alias but can be a globally unique identifier or a fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- | Identifies the CMK for which you are creating the alias. This value cannot be an alias. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . caTargetKeyId :: Lens' CreateAlias Text caTargetKeyId = lens _caTargetKeyId (\ s a -> s{_caTargetKeyId = a}); @@ -82,9 +87,9 @@         request = postJSON kms         response = receiveNull CreateAliasResponse' -instance Hashable CreateAlias+instance Hashable CreateAlias where -instance NFData CreateAlias+instance NFData CreateAlias where  instance ToHeaders CreateAlias where         toHeaders@@ -110,13 +115,15 @@  -- | /See:/ 'createAliasResponse' smart constructor. data CreateAliasResponse =-    CreateAliasResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  CreateAliasResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'CreateAliasResponse' with the minimum fields required to make a request. -- createAliasResponse     :: CreateAliasResponse createAliasResponse = CreateAliasResponse' -instance NFData CreateAliasResponse++instance NFData CreateAliasResponse where

@@ -12,16 +12,16 @@  -- | -- Module      : Network.AWS.KMS.CreateGrant--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Adds a grant to a key to specify who can use the key and under what conditions. Grants are alternate permission mechanisms to key policies.+-- Adds a grant to a customer master key (CMK). The grant specifies who can use the CMK and under what conditions. When setting permissions, grants are an alternative to key policies. -- ----- For more information about grants, see <http://docs.aws.amazon.com/kms/latest/developerguide/grants.html Grants> in the /AWS Key Management Service Developer Guide/ .+-- To perform this operation on a CMK in a different AWS account, specify the key ARN in the value of the KeyId parameter. For more information about grants, see <http://docs.aws.amazon.com/kms/latest/developerguide/grants.html Grants> in the /AWS Key Management Service Developer Guide/ . -- module Network.AWS.KMS.CreateGrant     (@@ -33,9 +33,9 @@     , cgGrantTokens     , cgConstraints     , cgName-    , cgOperations     , cgKeyId     , cgGranteePrincipal+    , cgOperations      -- * Destructuring the Response     , createGrantResponse@@ -46,24 +46,25 @@     , cgrsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'createGrant' smart constructor. data CreateGrant = CreateGrant'-    { _cgRetiringPrincipal :: !(Maybe Text)-    , _cgGrantTokens       :: !(Maybe [Text])-    , _cgConstraints       :: !(Maybe GrantConstraints)-    , _cgName              :: !(Maybe Text)-    , _cgOperations        :: !(Maybe [GrantOperation])-    , _cgKeyId             :: !Text-    , _cgGranteePrincipal  :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _cgRetiringPrincipal :: !(Maybe Text)+  , _cgGrantTokens       :: !(Maybe [Text])+  , _cgConstraints       :: !(Maybe GrantConstraints)+  , _cgName              :: !(Maybe Text)+  , _cgKeyId             :: !Text+  , _cgGranteePrincipal  :: !Text+  , _cgOperations        :: ![GrantOperation]+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'CreateGrant' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -72,30 +73,31 @@ -- -- * 'cgGrantTokens' - A list of grant tokens. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token Grant Tokens> in the /AWS Key Management Service Developer Guide/ . ----- * 'cgConstraints' - The conditions under which the operations permitted by the grant are allowed. You can use this value to allow the operations permitted by the grant only when a specified encryption context is present. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html Encryption Context> in the /AWS Key Management Service Developer Guide/ .+-- * 'cgConstraints' - A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see <http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html Encryption Context> in the /AWS Key Management Service Developer Guide/ . -- -- * 'cgName' - A friendly name for identifying the grant. Use this value to prevent unintended creation of duplicate grants when retrying this request. When this value is absent, all @CreateGrant@ requests result in a new grant with a unique @GrantId@ even if all the supplied parameters are identical. This can result in unintended duplicates when you retry the @CreateGrant@ request. When this value is present, you can retry a @CreateGrant@ request with identical parameters; if the grant already exists, the original @GrantId@ is returned without creating a new grant. Note that the returned grant token is unique with every @CreateGrant@ request, even when a duplicate @GrantId@ is returned. All grant tokens obtained in this way can be used interchangeably. ----- * 'cgOperations' - A list of operations that the grant permits. The list can contain any combination of one or more of the following values:     * 'Decrypt'      * 'Encrypt'      * 'GenerateDataKey'      * 'GenerateDataKeyWithoutPlaintext'      * <http://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html ReEncryptFrom>      * <http://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html ReEncryptTo>      * 'CreateGrant'      * 'RetireGrant'      * 'DescribeKey'+-- * 'cgKeyId' - The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . ----- * 'cgKeyId' - The unique identifier for the customer master key (CMK) that the grant applies to. To specify this value, use the globally unique key ID or the Amazon Resource Name (ARN) of the key. Examples:     * Globally unique key ID: 12345678-1234-1234-1234-123456789012     * Key ARN: arn:aws:kms:us-west-2:123456789012:key/12345678-1234-1234-1234-123456789012+-- * 'cgGranteePrincipal' - The principal that is given permission to perform the operations that the grant permits. To specify the principal, use the <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Name (ARN)> of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, IAM roles, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam AWS Identity and Access Management (IAM)> in the Example ARNs section of the /AWS General Reference/ . ----- * 'cgGranteePrincipal' - The principal that is given permission to perform the operations that the grant permits. To specify the principal, use the <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Name (ARN)> of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam AWS Identity and Access Management (IAM)> in the Example ARNs section of the /AWS General Reference/ .+-- * 'cgOperations' - A list of operations that the grant permits. createGrant     :: Text -- ^ 'cgKeyId'     -> Text -- ^ 'cgGranteePrincipal'     -> CreateGrant createGrant pKeyId_ pGranteePrincipal_ =-    CreateGrant'-    { _cgRetiringPrincipal = Nothing-    , _cgGrantTokens = Nothing-    , _cgConstraints = Nothing-    , _cgName = Nothing-    , _cgOperations = Nothing-    , _cgKeyId = pKeyId_-    , _cgGranteePrincipal = pGranteePrincipal_-    }+  CreateGrant'+  { _cgRetiringPrincipal = Nothing+  , _cgGrantTokens = Nothing+  , _cgConstraints = Nothing+  , _cgName = Nothing+  , _cgKeyId = pKeyId_+  , _cgGranteePrincipal = pGranteePrincipal_+  , _cgOperations = mempty+  } + -- | The principal that is given permission to retire the grant by using 'RetireGrant' operation. To specify the principal, use the <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Name (ARN)> of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam AWS Identity and Access Management (IAM)> in the Example ARNs section of the /AWS General Reference/ . cgRetiringPrincipal :: Lens' CreateGrant (Maybe Text) cgRetiringPrincipal = lens _cgRetiringPrincipal (\ s a -> s{_cgRetiringPrincipal = a});@@ -104,7 +106,7 @@ cgGrantTokens :: Lens' CreateGrant [Text] cgGrantTokens = lens _cgGrantTokens (\ s a -> s{_cgGrantTokens = a}) . _Default . _Coerce; --- | The conditions under which the operations permitted by the grant are allowed. You can use this value to allow the operations permitted by the grant only when a specified encryption context is present. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html Encryption Context> in the /AWS Key Management Service Developer Guide/ .+-- | A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see <http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html Encryption Context> in the /AWS Key Management Service Developer Guide/ . cgConstraints :: Lens' CreateGrant (Maybe GrantConstraints) cgConstraints = lens _cgConstraints (\ s a -> s{_cgConstraints = a}); @@ -112,18 +114,18 @@ cgName :: Lens' CreateGrant (Maybe Text) cgName = lens _cgName (\ s a -> s{_cgName = a}); --- | A list of operations that the grant permits. The list can contain any combination of one or more of the following values:     * 'Decrypt'      * 'Encrypt'      * 'GenerateDataKey'      * 'GenerateDataKeyWithoutPlaintext'      * <http://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html ReEncryptFrom>      * <http://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html ReEncryptTo>      * 'CreateGrant'      * 'RetireGrant'      * 'DescribeKey'-cgOperations :: Lens' CreateGrant [GrantOperation]-cgOperations = lens _cgOperations (\ s a -> s{_cgOperations = a}) . _Default . _Coerce;---- | The unique identifier for the customer master key (CMK) that the grant applies to. To specify this value, use the globally unique key ID or the Amazon Resource Name (ARN) of the key. Examples:     * Globally unique key ID: 12345678-1234-1234-1234-123456789012     * Key ARN: arn:aws:kms:us-west-2:123456789012:key/12345678-1234-1234-1234-123456789012+-- | The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . cgKeyId :: Lens' CreateGrant Text cgKeyId = lens _cgKeyId (\ s a -> s{_cgKeyId = a}); --- | The principal that is given permission to perform the operations that the grant permits. To specify the principal, use the <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Name (ARN)> of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam AWS Identity and Access Management (IAM)> in the Example ARNs section of the /AWS General Reference/ .+-- | The principal that is given permission to perform the operations that the grant permits. To specify the principal, use the <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Name (ARN)> of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, IAM roles, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam AWS Identity and Access Management (IAM)> in the Example ARNs section of the /AWS General Reference/ . cgGranteePrincipal :: Lens' CreateGrant Text cgGranteePrincipal = lens _cgGranteePrincipal (\ s a -> s{_cgGranteePrincipal = a}); +-- | A list of operations that the grant permits.+cgOperations :: Lens' CreateGrant [GrantOperation]+cgOperations = lens _cgOperations (\ s a -> s{_cgOperations = a}) . _Coerce;+ instance AWSRequest CreateGrant where         type Rs CreateGrant = CreateGrantResponse         request = postJSON kms@@ -134,9 +136,9 @@                    (x .?> "GrantId") <*> (x .?> "GrantToken") <*>                      (pure (fromEnum s))) -instance Hashable CreateGrant+instance Hashable CreateGrant where -instance NFData CreateGrant+instance NFData CreateGrant where  instance ToHeaders CreateGrant where         toHeaders@@ -154,10 +156,9 @@                  [("RetiringPrincipal" .=) <$> _cgRetiringPrincipal,                   ("GrantTokens" .=) <$> _cgGrantTokens,                   ("Constraints" .=) <$> _cgConstraints,-                  ("Name" .=) <$> _cgName,-                  ("Operations" .=) <$> _cgOperations,-                  Just ("KeyId" .= _cgKeyId),-                  Just ("GranteePrincipal" .= _cgGranteePrincipal)])+                  ("Name" .=) <$> _cgName, Just ("KeyId" .= _cgKeyId),+                  Just ("GranteePrincipal" .= _cgGranteePrincipal),+                  Just ("Operations" .= _cgOperations)])  instance ToPath CreateGrant where         toPath = const "/"@@ -167,11 +168,12 @@  -- | /See:/ 'createGrantResponse' smart constructor. data CreateGrantResponse = CreateGrantResponse'-    { _cgrsGrantId        :: !(Maybe Text)-    , _cgrsGrantToken     :: !(Maybe Text)-    , _cgrsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _cgrsGrantId        :: !(Maybe Text)+  , _cgrsGrantToken     :: !(Maybe Text)+  , _cgrsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'CreateGrantResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -185,12 +187,13 @@     :: Int -- ^ 'cgrsResponseStatus'     -> CreateGrantResponse createGrantResponse pResponseStatus_ =-    CreateGrantResponse'-    { _cgrsGrantId = Nothing-    , _cgrsGrantToken = Nothing-    , _cgrsResponseStatus = pResponseStatus_-    }+  CreateGrantResponse'+  { _cgrsGrantId = Nothing+  , _cgrsGrantToken = Nothing+  , _cgrsResponseStatus = pResponseStatus_+  } + -- | The unique identifier for the grant. You can use the @GrantId@ in a subsequent 'RetireGrant' or 'RevokeGrant' operation. cgrsGrantId :: Lens' CreateGrantResponse (Maybe Text) cgrsGrantId = lens _cgrsGrantId (\ s a -> s{_cgrsGrantId = a});@@ -203,4 +206,4 @@ cgrsResponseStatus :: Lens' CreateGrantResponse Int cgrsResponseStatus = lens _cgrsResponseStatus (\ s a -> s{_cgrsResponseStatus = a}); -instance NFData CreateGrantResponse+instance NFData CreateGrantResponse where

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.CreateKey--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Creates a customer master key (CMK).+-- Creates a customer master key (CMK) in the caller's AWS account. -- -- -- You can use a CMK to encrypt small amounts of data (4 KiB or less) directly, but CMKs are more commonly used to encrypt data encryption keys (DEKs), which are used to encrypt raw data. For more information about DEKs and the difference between CMKs and DEKs, see the following:@@ -29,6 +29,8 @@ -- -- --+-- You cannot use this operation to create a CMK in a different AWS account.+-- module Network.AWS.KMS.CreateKey     (     -- * Creating a Request@@ -40,6 +42,7 @@     , ckBypassPolicyLockoutSafetyCheck     , ckPolicy     , ckDescription+    , ckTags      -- * Destructuring the Response     , createKeyResponse@@ -49,22 +52,24 @@     , ckrsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'createKey' smart constructor. data CreateKey = CreateKey'-    { _ckOrigin                         :: !(Maybe OriginType)-    , _ckKeyUsage                       :: !(Maybe KeyUsageType)-    , _ckBypassPolicyLockoutSafetyCheck :: !(Maybe Bool)-    , _ckPolicy                         :: !(Maybe Text)-    , _ckDescription                    :: !(Maybe Text)-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _ckOrigin                         :: !(Maybe OriginType)+  , _ckKeyUsage                       :: !(Maybe KeyUsageType)+  , _ckBypassPolicyLockoutSafetyCheck :: !(Maybe Bool)+  , _ckPolicy                         :: !(Maybe Text)+  , _ckDescription                    :: !(Maybe Text)+  , _ckTags                           :: !(Maybe [Tag])+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'CreateKey' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -73,22 +78,26 @@ -- -- * 'ckKeyUsage' - The intended use of the CMK. You can use CMKs only for symmetric encryption and decryption. ----- * 'ckBypassPolicyLockoutSafetyCheck' - A flag to indicate whether to bypass the key policy lockout safety check. /Important:/ Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ . Use this parameter only when you include a policy in the request and you intend to prevent the principal making the request from making a subsequent 'PutKeyPolicy' request on the CMK. The default value is false.+-- * 'ckBypassPolicyLockoutSafetyCheck' - A flag to indicate whether to bypass the key policy lockout safety check. /Important:/ Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ . Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent 'PutKeyPolicy' request on the CMK. The default value is false. ----- * 'ckPolicy' - The key policy to attach to the CMK. If you specify a policy and do not set @BypassPolicyLockoutSafetyCheck@ to true, the policy must meet the following criteria:     * It must allow the principal making the @CreateKey@ request to make a subsequent 'PutKeyPolicy' request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ .     * The principal(s) specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see <http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency Changes that I make are not always immediately visible> in the /IAM User Guide/ . If you do not specify a policy, AWS KMS attaches a default key policy to the CMK. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default Default Key Policy> in the /AWS Key Management Service Developer Guide/ . The policy size limit is 32 KiB (32768 bytes).+-- * 'ckPolicy' - The key policy to attach to the CMK. If you specify a policy and do not set @BypassPolicyLockoutSafetyCheck@ to true, the policy must meet the following criteria:     * It must allow the principal that is making the @CreateKey@ request to make a subsequent 'PutKeyPolicy' request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ .     * The principals that are specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see <http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency Changes that I make are not always immediately visible> in the /IAM User Guide/ . If you do not specify a policy, AWS KMS attaches a default key policy to the CMK. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default Default Key Policy> in the /AWS Key Management Service Developer Guide/ . The policy size limit is 32 kilobytes (32768 bytes). -- -- * 'ckDescription' - A description of the CMK. Use a description that helps you decide whether the CMK is appropriate for a task.+--+-- * 'ckTags' - One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings. Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using 'TagResource' . createKey     :: CreateKey createKey =-    CreateKey'-    { _ckOrigin = Nothing-    , _ckKeyUsage = Nothing-    , _ckBypassPolicyLockoutSafetyCheck = Nothing-    , _ckPolicy = Nothing-    , _ckDescription = Nothing-    }+  CreateKey'+  { _ckOrigin = Nothing+  , _ckKeyUsage = Nothing+  , _ckBypassPolicyLockoutSafetyCheck = Nothing+  , _ckPolicy = Nothing+  , _ckDescription = Nothing+  , _ckTags = Nothing+  } + -- | The source of the CMK's key material. The default is @AWS_KMS@ , which means AWS KMS creates the key material. When this parameter is set to @EXTERNAL@ , the request creates a CMK without key material so that you can import key material from your existing key management infrastructure. For more information about importing key material into AWS KMS, see <http://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html Importing Key Material> in the /AWS Key Management Service Developer Guide/ . The CMK's @Origin@ is immutable and is set when the CMK is created. ckOrigin :: Lens' CreateKey (Maybe OriginType) ckOrigin = lens _ckOrigin (\ s a -> s{_ckOrigin = a});@@ -97,11 +106,11 @@ ckKeyUsage :: Lens' CreateKey (Maybe KeyUsageType) ckKeyUsage = lens _ckKeyUsage (\ s a -> s{_ckKeyUsage = a}); --- | A flag to indicate whether to bypass the key policy lockout safety check. /Important:/ Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ . Use this parameter only when you include a policy in the request and you intend to prevent the principal making the request from making a subsequent 'PutKeyPolicy' request on the CMK. The default value is false.+-- | A flag to indicate whether to bypass the key policy lockout safety check. /Important:/ Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ . Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent 'PutKeyPolicy' request on the CMK. The default value is false. ckBypassPolicyLockoutSafetyCheck :: Lens' CreateKey (Maybe Bool) ckBypassPolicyLockoutSafetyCheck = lens _ckBypassPolicyLockoutSafetyCheck (\ s a -> s{_ckBypassPolicyLockoutSafetyCheck = a}); --- | The key policy to attach to the CMK. If you specify a policy and do not set @BypassPolicyLockoutSafetyCheck@ to true, the policy must meet the following criteria:     * It must allow the principal making the @CreateKey@ request to make a subsequent 'PutKeyPolicy' request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ .     * The principal(s) specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see <http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency Changes that I make are not always immediately visible> in the /IAM User Guide/ . If you do not specify a policy, AWS KMS attaches a default key policy to the CMK. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default Default Key Policy> in the /AWS Key Management Service Developer Guide/ . The policy size limit is 32 KiB (32768 bytes).+-- | The key policy to attach to the CMK. If you specify a policy and do not set @BypassPolicyLockoutSafetyCheck@ to true, the policy must meet the following criteria:     * It must allow the principal that is making the @CreateKey@ request to make a subsequent 'PutKeyPolicy' request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ .     * The principals that are specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see <http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency Changes that I make are not always immediately visible> in the /IAM User Guide/ . If you do not specify a policy, AWS KMS attaches a default key policy to the CMK. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default Default Key Policy> in the /AWS Key Management Service Developer Guide/ . The policy size limit is 32 kilobytes (32768 bytes). ckPolicy :: Lens' CreateKey (Maybe Text) ckPolicy = lens _ckPolicy (\ s a -> s{_ckPolicy = a}); @@ -109,6 +118,10 @@ ckDescription :: Lens' CreateKey (Maybe Text) ckDescription = lens _ckDescription (\ s a -> s{_ckDescription = a}); +-- | One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings. Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using 'TagResource' .+ckTags :: Lens' CreateKey [Tag]+ckTags = lens _ckTags (\ s a -> s{_ckTags = a}) . _Default . _Coerce;+ instance AWSRequest CreateKey where         type Rs CreateKey = CreateKeyResponse         request = postJSON kms@@ -118,9 +131,9 @@                  CreateKeyResponse' <$>                    (x .?> "KeyMetadata") <*> (pure (fromEnum s))) -instance Hashable CreateKey+instance Hashable CreateKey where -instance NFData CreateKey+instance NFData CreateKey where  instance ToHeaders CreateKey where         toHeaders@@ -140,7 +153,8 @@                   ("BypassPolicyLockoutSafetyCheck" .=) <$>                     _ckBypassPolicyLockoutSafetyCheck,                   ("Policy" .=) <$> _ckPolicy,-                  ("Description" .=) <$> _ckDescription])+                  ("Description" .=) <$> _ckDescription,+                  ("Tags" .=) <$> _ckTags])  instance ToPath CreateKey where         toPath = const "/"@@ -150,10 +164,11 @@  -- | /See:/ 'createKeyResponse' smart constructor. data CreateKeyResponse = CreateKeyResponse'-    { _ckrsKeyMetadata    :: !(Maybe KeyMetadata)-    , _ckrsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _ckrsKeyMetadata    :: !(Maybe KeyMetadata)+  , _ckrsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'CreateKeyResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -165,11 +180,10 @@     :: Int -- ^ 'ckrsResponseStatus'     -> CreateKeyResponse createKeyResponse pResponseStatus_ =-    CreateKeyResponse'-    { _ckrsKeyMetadata = Nothing-    , _ckrsResponseStatus = pResponseStatus_-    }+  CreateKeyResponse'+  {_ckrsKeyMetadata = Nothing, _ckrsResponseStatus = pResponseStatus_} + -- | Metadata associated with the CMK. ckrsKeyMetadata :: Lens' CreateKeyResponse (Maybe KeyMetadata) ckrsKeyMetadata = lens _ckrsKeyMetadata (\ s a -> s{_ckrsKeyMetadata = a});@@ -178,4 +192,4 @@ ckrsResponseStatus :: Lens' CreateKeyResponse Int ckrsResponseStatus = lens _ckrsResponseStatus (\ s a -> s{_ckrsResponseStatus = a}); -instance NFData CreateKeyResponse+instance NFData CreateKeyResponse where

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.Decrypt--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Decrypts ciphertext. Ciphertext is plaintext that has been previously encrypted by using any of the following functions:+-- Decrypts ciphertext. Ciphertext is plaintext that has been previously encrypted by using any of the following operations: -- -- --     * 'GenerateDataKey'@@ -50,20 +50,21 @@     , drsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'decrypt' smart constructor. data Decrypt = Decrypt'-    { _decEncryptionContext :: !(Maybe (Map Text Text))-    , _decGrantTokens       :: !(Maybe [Text])-    , _decCiphertextBlob    :: !Base64-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _decEncryptionContext :: !(Maybe (Map Text Text))+  , _decGrantTokens       :: !(Maybe [Text])+  , _decCiphertextBlob    :: !Base64+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'Decrypt' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -77,12 +78,13 @@     :: ByteString -- ^ 'decCiphertextBlob'     -> Decrypt decrypt pCiphertextBlob_ =-    Decrypt'-    { _decEncryptionContext = Nothing-    , _decGrantTokens = Nothing-    , _decCiphertextBlob = _Base64 # pCiphertextBlob_-    }+  Decrypt'+  { _decEncryptionContext = Nothing+  , _decGrantTokens = Nothing+  , _decCiphertextBlob = _Base64 # pCiphertextBlob_+  } + -- | The encryption context. If this was specified in the 'Encrypt' function, it must be specified here or the decryption operation will fail. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html Encryption Context> . decEncryptionContext :: Lens' Decrypt (HashMap Text Text) decEncryptionContext = lens _decEncryptionContext (\ s a -> s{_decEncryptionContext = a}) . _Default . _Map;@@ -105,9 +107,9 @@                    (x .?> "KeyId") <*> (x .?> "Plaintext") <*>                      (pure (fromEnum s))) -instance Hashable Decrypt+instance Hashable Decrypt where -instance NFData Decrypt+instance NFData Decrypt where  instance ToHeaders Decrypt where         toHeaders@@ -134,35 +136,37 @@  -- | /See:/ 'decryptResponse' smart constructor. data DecryptResponse = DecryptResponse'-    { _drsKeyId          :: !(Maybe Text)-    , _drsPlaintext      :: !(Maybe (Sensitive Base64))-    , _drsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _drsKeyId          :: !(Maybe Text)+  , _drsPlaintext      :: !(Maybe (Sensitive Base64))+  , _drsResponseStatus :: !Int+  } deriving (Eq, Show, Data, Typeable, Generic) + -- | Creates a value of 'DecryptResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- -- * 'drsKeyId' - ARN of the key used to perform the decryption. This value is returned if no errors are encountered during the operation. ----- * 'drsPlaintext' - Decrypted plaintext data. This value may not be returned if the customer master key is not available or if you didn't have permission to use it.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- * 'drsPlaintext' - Decrypted plaintext data. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. -- -- * 'drsResponseStatus' - -- | The response status code. decryptResponse     :: Int -- ^ 'drsResponseStatus'     -> DecryptResponse decryptResponse pResponseStatus_ =-    DecryptResponse'-    { _drsKeyId = Nothing-    , _drsPlaintext = Nothing-    , _drsResponseStatus = pResponseStatus_-    }+  DecryptResponse'+  { _drsKeyId = Nothing+  , _drsPlaintext = Nothing+  , _drsResponseStatus = pResponseStatus_+  } + -- | ARN of the key used to perform the decryption. This value is returned if no errors are encountered during the operation. drsKeyId :: Lens' DecryptResponse (Maybe Text) drsKeyId = lens _drsKeyId (\ s a -> s{_drsKeyId = a}); --- | Decrypted plaintext data. This value may not be returned if the customer master key is not available or if you didn't have permission to use it.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- | Decrypted plaintext data. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. drsPlaintext :: Lens' DecryptResponse (Maybe ByteString) drsPlaintext = lens _drsPlaintext (\ s a -> s{_drsPlaintext = a}) . mapping (_Sensitive . _Base64); @@ -170,4 +174,4 @@ drsResponseStatus :: Lens' DecryptResponse Int drsResponseStatus = lens _drsResponseStatus (\ s a -> s{_drsResponseStatus = a}); -instance NFData DecryptResponse+instance NFData DecryptResponse where

@@ -12,15 +12,19 @@  -- | -- Module      : Network.AWS.KMS.DeleteAlias--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Deletes the specified alias. To map an alias to a different key, call 'UpdateAlias' .+-- Deletes the specified alias. You cannot perform this operation on an alias in a different AWS account. -- --+-- Because an alias is not a property of a CMK, you can delete and change the aliases of a CMK without affecting the CMK. Also, aliases do not appear in the response from the 'DescribeKey' operation. To get the aliases of all CMKs, use the 'ListAliases' operation.+--+-- Each CMK can have multiple aliases. To change the alias of a CMK, use 'DeleteAlias' to delete the current alias and 'CreateAlias' to create a new alias. To associate an existing alias with a different customer master key (CMK), call 'UpdateAlias' .+-- module Network.AWS.KMS.DeleteAlias     (     -- * Creating a Request@@ -34,32 +38,31 @@     , DeleteAliasResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'deleteAlias' smart constructor. newtype DeleteAlias = DeleteAlias'-    { _daAliasName :: Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _daAliasName :: Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'DeleteAlias' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'daAliasName' - The alias to be deleted. The name must start with the word "alias" followed by a forward slash (alias/). Aliases that begin with "alias/AWS" are reserved.+-- * 'daAliasName' - The alias to be deleted. The name must start with the word "alias" followed by a forward slash (alias/). Aliases that begin with "alias/aws" are reserved. deleteAlias     :: Text -- ^ 'daAliasName'     -> DeleteAlias-deleteAlias pAliasName_ =-    DeleteAlias'-    { _daAliasName = pAliasName_-    }+deleteAlias pAliasName_ = DeleteAlias' {_daAliasName = pAliasName_} --- | The alias to be deleted. The name must start with the word "alias" followed by a forward slash (alias/). Aliases that begin with "alias/AWS" are reserved.++-- | The alias to be deleted. The name must start with the word "alias" followed by a forward slash (alias/). Aliases that begin with "alias/aws" are reserved. daAliasName :: Lens' DeleteAlias Text daAliasName = lens _daAliasName (\ s a -> s{_daAliasName = a}); @@ -68,9 +71,9 @@         request = postJSON kms         response = receiveNull DeleteAliasResponse' -instance Hashable DeleteAlias+instance Hashable DeleteAlias where -instance NFData DeleteAlias+instance NFData DeleteAlias where  instance ToHeaders DeleteAlias where         toHeaders@@ -94,13 +97,15 @@  -- | /See:/ 'deleteAliasResponse' smart constructor. data DeleteAliasResponse =-    DeleteAliasResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  DeleteAliasResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'DeleteAliasResponse' with the minimum fields required to make a request. -- deleteAliasResponse     :: DeleteAliasResponse deleteAliasResponse = DeleteAliasResponse' -instance NFData DeleteAliasResponse++instance NFData DeleteAliasResponse where

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.DeleteImportedKeyMaterial--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Deletes key material that you previously imported and makes the specified customer master key (CMK) unusable. For more information about importing key material into AWS KMS, see <http://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html Importing Key Material> in the /AWS Key Management Service Developer Guide/ .+-- Deletes key material that you previously imported. This operation makes the specified customer master key (CMK) unusable. For more information about importing key material into AWS KMS, see <http://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html Importing Key Material> in the /AWS Key Management Service Developer Guide/ . You cannot perform this operation on a CMK in a different AWS account. -- -- -- When the specified CMK is in the @PendingDeletion@ state, this operation does not change the CMK's state. Otherwise, it changes the CMK's state to @PendingImport@ .@@ -38,32 +38,32 @@     , DeleteImportedKeyMaterialResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'deleteImportedKeyMaterial' smart constructor. newtype DeleteImportedKeyMaterial = DeleteImportedKeyMaterial'-    { _dikmKeyId :: Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _dikmKeyId :: Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'DeleteImportedKeyMaterial' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'dikmKeyId' - The identifier of the CMK whose key material to delete. The CMK's @Origin@ must be @EXTERNAL@ . A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples:     * Unique key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@+-- * 'dikmKeyId' - The identifier of the CMK whose key material to delete. The CMK's @Origin@ must be @EXTERNAL@ . Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . deleteImportedKeyMaterial     :: Text -- ^ 'dikmKeyId'     -> DeleteImportedKeyMaterial deleteImportedKeyMaterial pKeyId_ =-    DeleteImportedKeyMaterial'-    { _dikmKeyId = pKeyId_-    }+  DeleteImportedKeyMaterial' {_dikmKeyId = pKeyId_} --- | The identifier of the CMK whose key material to delete. The CMK's @Origin@ must be @EXTERNAL@ . A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples:     * Unique key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@++-- | The identifier of the CMK whose key material to delete. The CMK's @Origin@ must be @EXTERNAL@ . Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . dikmKeyId :: Lens' DeleteImportedKeyMaterial Text dikmKeyId = lens _dikmKeyId (\ s a -> s{_dikmKeyId = a}); @@ -74,9 +74,9 @@         response           = receiveNull DeleteImportedKeyMaterialResponse' -instance Hashable DeleteImportedKeyMaterial+instance Hashable DeleteImportedKeyMaterial where -instance NFData DeleteImportedKeyMaterial+instance NFData DeleteImportedKeyMaterial where  instance ToHeaders DeleteImportedKeyMaterial where         toHeaders@@ -100,13 +100,16 @@  -- | /See:/ 'deleteImportedKeyMaterialResponse' smart constructor. data DeleteImportedKeyMaterialResponse =-    DeleteImportedKeyMaterialResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  DeleteImportedKeyMaterialResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'DeleteImportedKeyMaterialResponse' with the minimum fields required to make a request. -- deleteImportedKeyMaterialResponse     :: DeleteImportedKeyMaterialResponse deleteImportedKeyMaterialResponse = DeleteImportedKeyMaterialResponse' + instance NFData DeleteImportedKeyMaterialResponse+         where

@@ -12,15 +12,17 @@  -- | -- Module      : Network.AWS.KMS.DescribeKey--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Provides detailed information about the specified customer master key.+-- Provides detailed information about the specified customer master key (CMK). -- --+-- To perform this operation on a CMK in a different AWS account, specify the key ARN or alias ARN in the value of the KeyId parameter.+-- module Network.AWS.KMS.DescribeKey     (     -- * Creating a Request@@ -38,40 +40,38 @@     , dkrsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'describeKey' smart constructor. data DescribeKey = DescribeKey'-    { _dGrantTokens :: !(Maybe [Text])-    , _dKeyId       :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _dGrantTokens :: !(Maybe [Text])+  , _dKeyId       :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'DescribeKey' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- -- * 'dGrantTokens' - A list of grant tokens. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token Grant Tokens> in the /AWS Key Management Service Developer Guide/ . ----- * 'dKeyId' - A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by "alias/".     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias/MyAliasName     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012     * Alias Name Example - alias/MyAliasName+-- * 'dKeyId' - A unique identifier for the customer master key (CMK). To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To get the alias name and alias ARN, use 'ListAliases' . describeKey     :: Text -- ^ 'dKeyId'     -> DescribeKey-describeKey pKeyId_ =-    DescribeKey'-    { _dGrantTokens = Nothing-    , _dKeyId = pKeyId_-    }+describeKey pKeyId_ = DescribeKey' {_dGrantTokens = Nothing, _dKeyId = pKeyId_} + -- | A list of grant tokens. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token Grant Tokens> in the /AWS Key Management Service Developer Guide/ . dGrantTokens :: Lens' DescribeKey [Text] dGrantTokens = lens _dGrantTokens (\ s a -> s{_dGrantTokens = a}) . _Default . _Coerce; --- | A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by "alias/".     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias/MyAliasName     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012     * Alias Name Example - alias/MyAliasName+-- | A unique identifier for the customer master key (CMK). To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To get the alias name and alias ARN, use 'ListAliases' . dKeyId :: Lens' DescribeKey Text dKeyId = lens _dKeyId (\ s a -> s{_dKeyId = a}); @@ -84,9 +84,9 @@                  DescribeKeyResponse' <$>                    (x .?> "KeyMetadata") <*> (pure (fromEnum s))) -instance Hashable DescribeKey+instance Hashable DescribeKey where -instance NFData DescribeKey+instance NFData DescribeKey where  instance ToHeaders DescribeKey where         toHeaders@@ -112,10 +112,11 @@  -- | /See:/ 'describeKeyResponse' smart constructor. data DescribeKeyResponse = DescribeKeyResponse'-    { _dkrsKeyMetadata    :: !(Maybe KeyMetadata)-    , _dkrsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _dkrsKeyMetadata    :: !(Maybe KeyMetadata)+  , _dkrsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'DescribeKeyResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -127,11 +128,10 @@     :: Int -- ^ 'dkrsResponseStatus'     -> DescribeKeyResponse describeKeyResponse pResponseStatus_ =-    DescribeKeyResponse'-    { _dkrsKeyMetadata = Nothing-    , _dkrsResponseStatus = pResponseStatus_-    }+  DescribeKeyResponse'+  {_dkrsKeyMetadata = Nothing, _dkrsResponseStatus = pResponseStatus_} + -- | Metadata associated with the key. dkrsKeyMetadata :: Lens' DescribeKeyResponse (Maybe KeyMetadata) dkrsKeyMetadata = lens _dkrsKeyMetadata (\ s a -> s{_dkrsKeyMetadata = a});@@ -140,4 +140,4 @@ dkrsResponseStatus :: Lens' DescribeKeyResponse Int dkrsResponseStatus = lens _dkrsResponseStatus (\ s a -> s{_dkrsResponseStatus = a}); -instance NFData DescribeKeyResponse+instance NFData DescribeKeyResponse where

@@ -12,15 +12,17 @@  -- | -- Module      : Network.AWS.KMS.DisableKey--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Sets the state of a customer master key (CMK) to disabled, thereby preventing its use for cryptographic operations. For more information about how key state affects the use of a CMK, see <http://docs.aws.amazon.com/kms/latest/developerguide/key-state.html How Key State Affects the Use of a Customer Master Key> in the /AWS Key Management Service Developer Guide/ .+-- Sets the state of a customer master key (CMK) to disabled, thereby preventing its use for cryptographic operations. You cannot perform this operation on a CMK in a different AWS account. -- --+-- For more information about how key state affects the use of a CMK, see <http://docs.aws.amazon.com/kms/latest/developerguide/key-state.html How Key State Affects the Use of a Customer Master Key> in the /AWS Key Management Service Developer Guide/ .+-- module Network.AWS.KMS.DisableKey     (     -- * Creating a Request@@ -34,32 +36,31 @@     , DisableKeyResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'disableKey' smart constructor. newtype DisableKey = DisableKey'-    { _dkKeyId :: Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _dkKeyId :: Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'DisableKey' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'dkKeyId' - A unique identifier for the CMK. Use the CMK's unique identifier or its Amazon Resource Name (ARN). For example:     * Unique ID: 1234abcd-12ab-34cd-56ef-1234567890ab     * ARN: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab+-- * 'dkKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . disableKey     :: Text -- ^ 'dkKeyId'     -> DisableKey-disableKey pKeyId_ =-    DisableKey'-    { _dkKeyId = pKeyId_-    }+disableKey pKeyId_ = DisableKey' {_dkKeyId = pKeyId_} --- | A unique identifier for the CMK. Use the CMK's unique identifier or its Amazon Resource Name (ARN). For example:     * Unique ID: 1234abcd-12ab-34cd-56ef-1234567890ab     * ARN: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab++-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . dkKeyId :: Lens' DisableKey Text dkKeyId = lens _dkKeyId (\ s a -> s{_dkKeyId = a}); @@ -68,9 +69,9 @@         request = postJSON kms         response = receiveNull DisableKeyResponse' -instance Hashable DisableKey+instance Hashable DisableKey where -instance NFData DisableKey+instance NFData DisableKey where  instance ToHeaders DisableKey where         toHeaders@@ -93,13 +94,15 @@  -- | /See:/ 'disableKeyResponse' smart constructor. data DisableKeyResponse =-    DisableKeyResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  DisableKeyResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'DisableKeyResponse' with the minimum fields required to make a request. -- disableKeyResponse     :: DisableKeyResponse disableKeyResponse = DisableKeyResponse' -instance NFData DisableKeyResponse++instance NFData DisableKeyResponse where

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.DisableKeyRotation--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Disables rotation of the specified key.+-- Disables automatic rotation of the key material for the specified customer master key (CMK). You cannot perform this operation on a CMK in a different AWS account. -- -- module Network.AWS.KMS.DisableKeyRotation@@ -34,32 +34,31 @@     , DisableKeyRotationResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'disableKeyRotation' smart constructor. newtype DisableKeyRotation = DisableKeyRotation'-    { _dkrKeyId :: Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _dkrKeyId :: Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'DisableKeyRotation' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'dkrKeyId' - A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- * 'dkrKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . disableKeyRotation     :: Text -- ^ 'dkrKeyId'     -> DisableKeyRotation-disableKeyRotation pKeyId_ =-    DisableKeyRotation'-    { _dkrKeyId = pKeyId_-    }+disableKeyRotation pKeyId_ = DisableKeyRotation' {_dkrKeyId = pKeyId_} --- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012++-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . dkrKeyId :: Lens' DisableKeyRotation Text dkrKeyId = lens _dkrKeyId (\ s a -> s{_dkrKeyId = a}); @@ -69,9 +68,9 @@         request = postJSON kms         response = receiveNull DisableKeyRotationResponse' -instance Hashable DisableKeyRotation+instance Hashable DisableKeyRotation where -instance NFData DisableKeyRotation+instance NFData DisableKeyRotation where  instance ToHeaders DisableKeyRotation where         toHeaders@@ -94,13 +93,15 @@  -- | /See:/ 'disableKeyRotationResponse' smart constructor. data DisableKeyRotationResponse =-    DisableKeyRotationResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  DisableKeyRotationResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'DisableKeyRotationResponse' with the minimum fields required to make a request. -- disableKeyRotationResponse     :: DisableKeyRotationResponse disableKeyRotationResponse = DisableKeyRotationResponse' -instance NFData DisableKeyRotationResponse++instance NFData DisableKeyRotationResponse where

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.EnableKey--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Marks a key as enabled, thereby permitting its use.+-- Sets the state of a customer master key (CMK) to enabled, thereby permitting its use for cryptographic operations. You cannot perform this operation on a CMK in a different AWS account. -- -- module Network.AWS.KMS.EnableKey@@ -34,32 +34,31 @@     , EnableKeyResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'enableKey' smart constructor. newtype EnableKey = EnableKey'-    { _ekKeyId :: Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _ekKeyId :: Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'EnableKey' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'ekKeyId' - A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- * 'ekKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . enableKey     :: Text -- ^ 'ekKeyId'     -> EnableKey-enableKey pKeyId_ =-    EnableKey'-    { _ekKeyId = pKeyId_-    }+enableKey pKeyId_ = EnableKey' {_ekKeyId = pKeyId_} --- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012++-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . ekKeyId :: Lens' EnableKey Text ekKeyId = lens _ekKeyId (\ s a -> s{_ekKeyId = a}); @@ -68,9 +67,9 @@         request = postJSON kms         response = receiveNull EnableKeyResponse' -instance Hashable EnableKey+instance Hashable EnableKey where -instance NFData EnableKey+instance NFData EnableKey where  instance ToHeaders EnableKey where         toHeaders@@ -93,13 +92,15 @@  -- | /See:/ 'enableKeyResponse' smart constructor. data EnableKeyResponse =-    EnableKeyResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  EnableKeyResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'EnableKeyResponse' with the minimum fields required to make a request. -- enableKeyResponse     :: EnableKeyResponse enableKeyResponse = EnableKeyResponse' -instance NFData EnableKeyResponse++instance NFData EnableKeyResponse where

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.EnableKeyRotation--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Enables rotation of the specified customer master key.+-- Enables automatic rotation of the key material for the specified customer master key (CMK). You cannot perform this operation on a CMK in a different AWS account. -- -- module Network.AWS.KMS.EnableKeyRotation@@ -34,32 +34,31 @@     , EnableKeyRotationResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'enableKeyRotation' smart constructor. newtype EnableKeyRotation = EnableKeyRotation'-    { _ekrKeyId :: Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _ekrKeyId :: Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'EnableKeyRotation' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'ekrKeyId' - A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- * 'ekrKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . enableKeyRotation     :: Text -- ^ 'ekrKeyId'     -> EnableKeyRotation-enableKeyRotation pKeyId_ =-    EnableKeyRotation'-    { _ekrKeyId = pKeyId_-    }+enableKeyRotation pKeyId_ = EnableKeyRotation' {_ekrKeyId = pKeyId_} --- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012++-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . ekrKeyId :: Lens' EnableKeyRotation Text ekrKeyId = lens _ekrKeyId (\ s a -> s{_ekrKeyId = a}); @@ -68,9 +67,9 @@         request = postJSON kms         response = receiveNull EnableKeyRotationResponse' -instance Hashable EnableKeyRotation+instance Hashable EnableKeyRotation where -instance NFData EnableKeyRotation+instance NFData EnableKeyRotation where  instance ToHeaders EnableKeyRotation where         toHeaders@@ -93,13 +92,15 @@  -- | /See:/ 'enableKeyRotationResponse' smart constructor. data EnableKeyRotationResponse =-    EnableKeyRotationResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  EnableKeyRotationResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'EnableKeyRotationResponse' with the minimum fields required to make a request. -- enableKeyRotationResponse     :: EnableKeyRotationResponse enableKeyRotationResponse = EnableKeyRotationResponse' -instance NFData EnableKeyRotationResponse++instance NFData EnableKeyRotationResponse where

@@ -12,25 +12,27 @@  -- | -- Module      : Network.AWS.KMS.Encrypt--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Encrypts plaintext into ciphertext by using a customer master key. The @Encrypt@ function has two primary use cases:+-- Encrypts plaintext into ciphertext by using a customer master key (CMK). The @Encrypt@ operation has two primary use cases: -- -----     * You can encrypt up to 4 KB of arbitrary data such as an RSA key, a database password, or other sensitive customer information.+--     * You can encrypt up to 4 kilobytes (4096 bytes) of arbitrary data such as an RSA key, a database password, or other sensitive information. -----     * If you are moving encrypted data from one region to another, you can use this API to encrypt in the new region the plaintext data key that was used to encrypt the data in the original region. This provides you with an encrypted copy of the data key that can be decrypted in the new region and used there to decrypt the encrypted data.+--     * To move encrypted data from one AWS region to another, you can use this operation to encrypt in the new region the plaintext data key that was used to encrypt the data in the original region. This provides you with an encrypted copy of the data key that can be decrypted in the new region and used there to decrypt the encrypted data. -- -- ----- Unless you are moving encrypted data from one region to another, you don't use this function to encrypt a generated data key within a region. You retrieve data keys already encrypted by calling the 'GenerateDataKey' or 'GenerateDataKeyWithoutPlaintext' function. Data keys don't need to be encrypted again by calling @Encrypt@ .+-- To perform this operation on a CMK in a different AWS account, specify the key ARN or alias ARN in the value of the KeyId parameter. ----- If you want to encrypt data locally in your application, you can use the @GenerateDataKey@ function to return a plaintext data encryption key and a copy of the key encrypted under the customer master key (CMK) of your choosing.+-- Unless you are moving encrypted data from one region to another, you don't use this operation to encrypt a generated data key within a region. To get data keys that are already encrypted, call the 'GenerateDataKey' or 'GenerateDataKeyWithoutPlaintext' operation. Data keys don't need to be encrypted again by calling @Encrypt@ . --+-- To encrypt data locally in your application, use the 'GenerateDataKey' operation to return a plaintext data encryption key and a copy of the key encrypted under the CMK of your choosing.+-- module Network.AWS.KMS.Encrypt     (     -- * Creating a Request@@ -51,21 +53,22 @@     , ersResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'encrypt' smart constructor. data Encrypt = Encrypt'-    { _eEncryptionContext :: !(Maybe (Map Text Text))-    , _eGrantTokens       :: !(Maybe [Text])-    , _eKeyId             :: !Text-    , _ePlaintext         :: !(Sensitive Base64)-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _eEncryptionContext :: !(Maybe (Map Text Text))+  , _eGrantTokens       :: !(Maybe [Text])+  , _eKeyId             :: !Text+  , _ePlaintext         :: !(Sensitive Base64)+  } deriving (Eq, Show, Data, Typeable, Generic) + -- | Creates a value of 'Encrypt' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -74,7 +77,7 @@ -- -- * 'eGrantTokens' - A list of grant tokens. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token Grant Tokens> in the /AWS Key Management Service Developer Guide/ . ----- * 'eKeyId' - A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by "alias/".     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias/MyAliasName     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012     * Alias Name Example - alias/MyAliasName+-- * 'eKeyId' - A unique identifier for the customer master key (CMK). To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To get the alias name and alias ARN, use 'ListAliases' . -- -- * 'ePlaintext' - Data to be encrypted.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. encrypt@@ -82,13 +85,14 @@     -> ByteString -- ^ 'ePlaintext'     -> Encrypt encrypt pKeyId_ pPlaintext_ =-    Encrypt'-    { _eEncryptionContext = Nothing-    , _eGrantTokens = Nothing-    , _eKeyId = pKeyId_-    , _ePlaintext = _Sensitive . _Base64 # pPlaintext_-    }+  Encrypt'+  { _eEncryptionContext = Nothing+  , _eGrantTokens = Nothing+  , _eKeyId = pKeyId_+  , _ePlaintext = _Sensitive . _Base64 # pPlaintext_+  } + -- | Name-value pair that specifies the encryption context to be used for authenticated encryption. If used here, the same value must be supplied to the @Decrypt@ API or decryption will fail. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html Encryption Context> . eEncryptionContext :: Lens' Encrypt (HashMap Text Text) eEncryptionContext = lens _eEncryptionContext (\ s a -> s{_eEncryptionContext = a}) . _Default . _Map;@@ -97,7 +101,7 @@ eGrantTokens :: Lens' Encrypt [Text] eGrantTokens = lens _eGrantTokens (\ s a -> s{_eGrantTokens = a}) . _Default . _Coerce; --- | A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by "alias/".     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias/MyAliasName     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012     * Alias Name Example - alias/MyAliasName+-- | A unique identifier for the customer master key (CMK). To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To get the alias name and alias ARN, use 'ListAliases' . eKeyId :: Lens' Encrypt Text eKeyId = lens _eKeyId (\ s a -> s{_eKeyId = a}); @@ -115,9 +119,9 @@                    (x .?> "KeyId") <*> (x .?> "CiphertextBlob") <*>                      (pure (fromEnum s))) -instance Hashable Encrypt+instance Hashable Encrypt where -instance NFData Encrypt+instance NFData Encrypt where  instance ToHeaders Encrypt where         toHeaders@@ -145,35 +149,37 @@  -- | /See:/ 'encryptResponse' smart constructor. data EncryptResponse = EncryptResponse'-    { _ersKeyId          :: !(Maybe Text)-    , _ersCiphertextBlob :: !(Maybe Base64)-    , _ersResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _ersKeyId          :: !(Maybe Text)+  , _ersCiphertextBlob :: !(Maybe Base64)+  , _ersResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'EncryptResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- -- * 'ersKeyId' - The ID of the key used during encryption. ----- * 'ersCiphertextBlob' - The encrypted plaintext. If you are using the CLI, the value is Base64 encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- * 'ersCiphertextBlob' - The encrypted plaintext. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. -- -- * 'ersResponseStatus' - -- | The response status code. encryptResponse     :: Int -- ^ 'ersResponseStatus'     -> EncryptResponse encryptResponse pResponseStatus_ =-    EncryptResponse'-    { _ersKeyId = Nothing-    , _ersCiphertextBlob = Nothing-    , _ersResponseStatus = pResponseStatus_-    }+  EncryptResponse'+  { _ersKeyId = Nothing+  , _ersCiphertextBlob = Nothing+  , _ersResponseStatus = pResponseStatus_+  } + -- | The ID of the key used during encryption. ersKeyId :: Lens' EncryptResponse (Maybe Text) ersKeyId = lens _ersKeyId (\ s a -> s{_ersKeyId = a}); --- | The encrypted plaintext. If you are using the CLI, the value is Base64 encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- | The encrypted plaintext. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. ersCiphertextBlob :: Lens' EncryptResponse (Maybe ByteString) ersCiphertextBlob = lens _ersCiphertextBlob (\ s a -> s{_ersCiphertextBlob = a}) . mapping _Base64; @@ -181,4 +187,4 @@ ersResponseStatus :: Lens' EncryptResponse Int ersResponseStatus = lens _ersResponseStatus (\ s a -> s{_ersResponseStatus = a}); -instance NFData EncryptResponse+instance NFData EncryptResponse where

@@ -12,22 +12,22 @@  -- | -- Module      : Network.AWS.KMS.GenerateDataKey--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) -- -- Returns a data encryption key that you can use in your application to encrypt data locally. -- ----- You must specify the customer master key (CMK) under which to generate the data key. You must also specify the length of the data key using either the @KeySpec@ or @NumberOfBytes@ field. You must specify one field or the other, but not both. For common key lengths (128-bit and 256-bit symmetric keys), we recommend that you use @KeySpec@ .+-- You must specify the customer master key (CMK) under which to generate the data key. You must also specify the length of the data key using either the @KeySpec@ or @NumberOfBytes@ field. You must specify one field or the other, but not both. For common key lengths (128-bit and 256-bit symmetric keys), we recommend that you use @KeySpec@ . To perform this operation on a CMK in a different AWS account, specify the key ARN or alias ARN in the value of the KeyId parameter. -- -- This operation returns a plaintext copy of the data key in the @Plaintext@ field of the response, and an encrypted copy of the data key in the @CiphertextBlob@ field. The data key is encrypted under the CMK specified in the @KeyId@ field of the request. -- -- We recommend that you use the following pattern to encrypt data locally in your application: -----     * Use this operation (@GenerateDataKey@ ) to retrieve a data encryption key.+--     * Use this operation (@GenerateDataKey@ ) to get a data encryption key. -- --     * Use the plaintext data encryption key (returned in the @Plaintext@ field of the response) to encrypt data locally, then erase the plaintext data key from memory. --@@ -43,7 +43,7 @@ -- -- ----- To return only an encrypted copy of the data key, use 'GenerateDataKeyWithoutPlaintext' . To return an arbitrary unpredictable byte string, use 'GenerateRandom' .+-- To return only an encrypted copy of the data key, use 'GenerateDataKeyWithoutPlaintext' . To return a random byte string that is cryptographically secure, use 'GenerateRandom' . -- -- If you use the optional @EncryptionContext@ field, you must store at least enough information to be able to reconstruct the full encryption context when you later send the ciphertext to the 'Decrypt' operation. It is a good practice to choose an encryption context that you can reconstruct on the fly to better secure the ciphertext. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html Encryption Context> in the /AWS Key Management Service Developer Guide/ . --@@ -69,22 +69,23 @@     , gdkrsCiphertextBlob     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'generateDataKey' smart constructor. data GenerateDataKey = GenerateDataKey'-    { _gdkKeySpec           :: !(Maybe DataKeySpec)-    , _gdkEncryptionContext :: !(Maybe (Map Text Text))-    , _gdkNumberOfBytes     :: !(Maybe Nat)-    , _gdkGrantTokens       :: !(Maybe [Text])-    , _gdkKeyId             :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gdkKeySpec           :: !(Maybe DataKeySpec)+  , _gdkEncryptionContext :: !(Maybe (Map Text Text))+  , _gdkNumberOfBytes     :: !(Maybe Nat)+  , _gdkGrantTokens       :: !(Maybe [Text])+  , _gdkKeyId             :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GenerateDataKey' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -97,19 +98,20 @@ -- -- * 'gdkGrantTokens' - A list of grant tokens. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token Grant Tokens> in the /AWS Key Management Service Developer Guide/ . ----- * 'gdkKeyId' - The identifier of the CMK under which to generate and encrypt the data encryption key. A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK, or the alias name or ARN of an alias that points to the CMK. Examples:     * Unique key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * CMK ARN: @arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-west-2:111122223333:alias/ExampleAlias@+-- * 'gdkKeyId' - The identifier of the CMK under which to generate and encrypt the data encryption key. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To get the alias name and alias ARN, use 'ListAliases' . generateDataKey     :: Text -- ^ 'gdkKeyId'     -> GenerateDataKey generateDataKey pKeyId_ =-    GenerateDataKey'-    { _gdkKeySpec = Nothing-    , _gdkEncryptionContext = Nothing-    , _gdkNumberOfBytes = Nothing-    , _gdkGrantTokens = Nothing-    , _gdkKeyId = pKeyId_-    }+  GenerateDataKey'+  { _gdkKeySpec = Nothing+  , _gdkEncryptionContext = Nothing+  , _gdkNumberOfBytes = Nothing+  , _gdkGrantTokens = Nothing+  , _gdkKeyId = pKeyId_+  } + -- | The length of the data encryption key. Use @AES_128@ to generate a 128-bit symmetric key, or @AES_256@ to generate a 256-bit symmetric key. gdkKeySpec :: Lens' GenerateDataKey (Maybe DataKeySpec) gdkKeySpec = lens _gdkKeySpec (\ s a -> s{_gdkKeySpec = a});@@ -126,7 +128,7 @@ gdkGrantTokens :: Lens' GenerateDataKey [Text] gdkGrantTokens = lens _gdkGrantTokens (\ s a -> s{_gdkGrantTokens = a}) . _Default . _Coerce; --- | The identifier of the CMK under which to generate and encrypt the data encryption key. A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK, or the alias name or ARN of an alias that points to the CMK. Examples:     * Unique key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * CMK ARN: @arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-west-2:111122223333:alias/ExampleAlias@+-- | The identifier of the CMK under which to generate and encrypt the data encryption key. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To get the alias name and alias ARN, use 'ListAliases' . gdkKeyId :: Lens' GenerateDataKey Text gdkKeyId = lens _gdkKeyId (\ s a -> s{_gdkKeyId = a}); @@ -141,9 +143,9 @@                      (x .:> "Plaintext")                      <*> (x .:> "CiphertextBlob")) -instance Hashable GenerateDataKey+instance Hashable GenerateDataKey where -instance NFData GenerateDataKey+instance NFData GenerateDataKey where  instance ToHeaders GenerateDataKey where         toHeaders@@ -172,12 +174,13 @@  -- | /See:/ 'generateDataKeyResponse' smart constructor. data GenerateDataKeyResponse = GenerateDataKeyResponse'-    { _gdkrsResponseStatus :: !Int-    , _gdkrsKeyId          :: !Text-    , _gdkrsPlaintext      :: !(Sensitive Base64)-    , _gdkrsCiphertextBlob :: !Base64-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gdkrsResponseStatus :: !Int+  , _gdkrsKeyId          :: !Text+  , _gdkrsPlaintext      :: !(Sensitive Base64)+  , _gdkrsCiphertextBlob :: !Base64+  } deriving (Eq, Show, Data, Typeable, Generic) + -- | Creates a value of 'GenerateDataKeyResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -186,9 +189,9 @@ -- -- * 'gdkrsKeyId' - The identifier of the CMK under which the data encryption key was generated and encrypted. ----- * 'gdkrsPlaintext' - The data encryption key. Use this data key for local encryption and decryption, then remove it from memory as soon as possible.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- * 'gdkrsPlaintext' - The data encryption key. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded. Use this data key for local encryption and decryption, then remove it from memory as soon as possible.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. ----- * 'gdkrsCiphertextBlob' - The encrypted data encryption key.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- * 'gdkrsCiphertextBlob' - The encrypted data encryption key. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. generateDataKeyResponse     :: Int -- ^ 'gdkrsResponseStatus'     -> Text -- ^ 'gdkrsKeyId'@@ -196,13 +199,14 @@     -> ByteString -- ^ 'gdkrsCiphertextBlob'     -> GenerateDataKeyResponse generateDataKeyResponse pResponseStatus_ pKeyId_ pPlaintext_ pCiphertextBlob_ =-    GenerateDataKeyResponse'-    { _gdkrsResponseStatus = pResponseStatus_-    , _gdkrsKeyId = pKeyId_-    , _gdkrsPlaintext = _Sensitive . _Base64 # pPlaintext_-    , _gdkrsCiphertextBlob = _Base64 # pCiphertextBlob_-    }+  GenerateDataKeyResponse'+  { _gdkrsResponseStatus = pResponseStatus_+  , _gdkrsKeyId = pKeyId_+  , _gdkrsPlaintext = _Sensitive . _Base64 # pPlaintext_+  , _gdkrsCiphertextBlob = _Base64 # pCiphertextBlob_+  } + -- | -- | The response status code. gdkrsResponseStatus :: Lens' GenerateDataKeyResponse Int gdkrsResponseStatus = lens _gdkrsResponseStatus (\ s a -> s{_gdkrsResponseStatus = a});@@ -211,12 +215,12 @@ gdkrsKeyId :: Lens' GenerateDataKeyResponse Text gdkrsKeyId = lens _gdkrsKeyId (\ s a -> s{_gdkrsKeyId = a}); --- | The data encryption key. Use this data key for local encryption and decryption, then remove it from memory as soon as possible.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- | The data encryption key. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded. Use this data key for local encryption and decryption, then remove it from memory as soon as possible.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. gdkrsPlaintext :: Lens' GenerateDataKeyResponse ByteString gdkrsPlaintext = lens _gdkrsPlaintext (\ s a -> s{_gdkrsPlaintext = a}) . _Sensitive . _Base64; --- | The encrypted data encryption key.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- | The encrypted data encryption key. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. gdkrsCiphertextBlob :: Lens' GenerateDataKeyResponse ByteString gdkrsCiphertextBlob = lens _gdkrsCiphertextBlob (\ s a -> s{_gdkrsCiphertextBlob = a}) . _Base64; -instance NFData GenerateDataKeyResponse+instance NFData GenerateDataKeyResponse where

@@ -12,15 +12,17 @@  -- | -- Module      : Network.AWS.KMS.GenerateDataKeyWithoutPlaintext--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) -- -- Returns a data encryption key encrypted under a customer master key (CMK). This operation is identical to 'GenerateDataKey' but returns only the encrypted copy of the data key. -- --+-- To perform this operation on a CMK in a different AWS account, specify the key ARN or alias ARN in the value of the KeyId parameter.+-- -- This operation is useful in a system that has multiple components with different degrees of trust. For example, consider a system that stores encrypted data in containers. Each container stores the encrypted data and an encrypted copy of the data key. One component of the system, called the /control plane/ , creates new containers. When it creates a new container, it uses this operation (@GenerateDataKeyWithoutPlaintext@ ) to get an encrypted data key and then stores it in the container. Later, a different component of the system, called the /data plane/ , puts encrypted data into the containers. To do this, it passes the encrypted data key to the 'Decrypt' operation, then uses the returned plaintext data key to encrypt data, and finally stores the encrypted data in the container. In this system, the control plane never sees the plaintext data key. -- module Network.AWS.KMS.GenerateDataKeyWithoutPlaintext@@ -44,22 +46,23 @@     , gdkwprsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'generateDataKeyWithoutPlaintext' smart constructor. data GenerateDataKeyWithoutPlaintext = GenerateDataKeyWithoutPlaintext'-    { _gdkwpKeySpec           :: !(Maybe DataKeySpec)-    , _gdkwpEncryptionContext :: !(Maybe (Map Text Text))-    , _gdkwpNumberOfBytes     :: !(Maybe Nat)-    , _gdkwpGrantTokens       :: !(Maybe [Text])-    , _gdkwpKeyId             :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gdkwpKeySpec           :: !(Maybe DataKeySpec)+  , _gdkwpEncryptionContext :: !(Maybe (Map Text Text))+  , _gdkwpNumberOfBytes     :: !(Maybe Nat)+  , _gdkwpGrantTokens       :: !(Maybe [Text])+  , _gdkwpKeyId             :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GenerateDataKeyWithoutPlaintext' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -72,19 +75,20 @@ -- -- * 'gdkwpGrantTokens' - A list of grant tokens. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token Grant Tokens> in the /AWS Key Management Service Developer Guide/ . ----- * 'gdkwpKeyId' - The identifier of the CMK under which to generate and encrypt the data encryption key. A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK, or the alias name or ARN of an alias that points to the CMK. Examples:     * Unique key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * CMK ARN: @arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-west-2:111122223333:alias/ExampleAlias@+-- * 'gdkwpKeyId' - The identifier of the customer master key (CMK) under which to generate and encrypt the data encryption key. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To get the alias name and alias ARN, use 'ListAliases' . generateDataKeyWithoutPlaintext     :: Text -- ^ 'gdkwpKeyId'     -> GenerateDataKeyWithoutPlaintext generateDataKeyWithoutPlaintext pKeyId_ =-    GenerateDataKeyWithoutPlaintext'-    { _gdkwpKeySpec = Nothing-    , _gdkwpEncryptionContext = Nothing-    , _gdkwpNumberOfBytes = Nothing-    , _gdkwpGrantTokens = Nothing-    , _gdkwpKeyId = pKeyId_-    }+  GenerateDataKeyWithoutPlaintext'+  { _gdkwpKeySpec = Nothing+  , _gdkwpEncryptionContext = Nothing+  , _gdkwpNumberOfBytes = Nothing+  , _gdkwpGrantTokens = Nothing+  , _gdkwpKeyId = pKeyId_+  } + -- | The length of the data encryption key. Use @AES_128@ to generate a 128-bit symmetric key, or @AES_256@ to generate a 256-bit symmetric key. gdkwpKeySpec :: Lens' GenerateDataKeyWithoutPlaintext (Maybe DataKeySpec) gdkwpKeySpec = lens _gdkwpKeySpec (\ s a -> s{_gdkwpKeySpec = a});@@ -101,7 +105,7 @@ gdkwpGrantTokens :: Lens' GenerateDataKeyWithoutPlaintext [Text] gdkwpGrantTokens = lens _gdkwpGrantTokens (\ s a -> s{_gdkwpGrantTokens = a}) . _Default . _Coerce; --- | The identifier of the CMK under which to generate and encrypt the data encryption key. A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK, or the alias name or ARN of an alias that points to the CMK. Examples:     * Unique key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * CMK ARN: @arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-west-2:111122223333:alias/ExampleAlias@+-- | The identifier of the customer master key (CMK) under which to generate and encrypt the data encryption key. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To get the alias name and alias ARN, use 'ListAliases' . gdkwpKeyId :: Lens' GenerateDataKeyWithoutPlaintext Text gdkwpKeyId = lens _gdkwpKeyId (\ s a -> s{_gdkwpKeyId = a}); @@ -118,8 +122,9 @@                      (pure (fromEnum s)))  instance Hashable GenerateDataKeyWithoutPlaintext+         where -instance NFData GenerateDataKeyWithoutPlaintext+instance NFData GenerateDataKeyWithoutPlaintext where  instance ToHeaders GenerateDataKeyWithoutPlaintext          where@@ -151,35 +156,37 @@  -- | /See:/ 'generateDataKeyWithoutPlaintextResponse' smart constructor. data GenerateDataKeyWithoutPlaintextResponse = GenerateDataKeyWithoutPlaintextResponse'-    { _gdkwprsKeyId          :: !(Maybe Text)-    , _gdkwprsCiphertextBlob :: !(Maybe Base64)-    , _gdkwprsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gdkwprsKeyId          :: !(Maybe Text)+  , _gdkwprsCiphertextBlob :: !(Maybe Base64)+  , _gdkwprsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GenerateDataKeyWithoutPlaintextResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- -- * 'gdkwprsKeyId' - The identifier of the CMK under which the data encryption key was generated and encrypted. ----- * 'gdkwprsCiphertextBlob' - The encrypted data encryption key.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- * 'gdkwprsCiphertextBlob' - The encrypted data encryption key. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. -- -- * 'gdkwprsResponseStatus' - -- | The response status code. generateDataKeyWithoutPlaintextResponse     :: Int -- ^ 'gdkwprsResponseStatus'     -> GenerateDataKeyWithoutPlaintextResponse generateDataKeyWithoutPlaintextResponse pResponseStatus_ =-    GenerateDataKeyWithoutPlaintextResponse'-    { _gdkwprsKeyId = Nothing-    , _gdkwprsCiphertextBlob = Nothing-    , _gdkwprsResponseStatus = pResponseStatus_-    }+  GenerateDataKeyWithoutPlaintextResponse'+  { _gdkwprsKeyId = Nothing+  , _gdkwprsCiphertextBlob = Nothing+  , _gdkwprsResponseStatus = pResponseStatus_+  } + -- | The identifier of the CMK under which the data encryption key was generated and encrypted. gdkwprsKeyId :: Lens' GenerateDataKeyWithoutPlaintextResponse (Maybe Text) gdkwprsKeyId = lens _gdkwprsKeyId (\ s a -> s{_gdkwprsKeyId = a}); --- | The encrypted data encryption key.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- | The encrypted data encryption key. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. gdkwprsCiphertextBlob :: Lens' GenerateDataKeyWithoutPlaintextResponse (Maybe ByteString) gdkwprsCiphertextBlob = lens _gdkwprsCiphertextBlob (\ s a -> s{_gdkwprsCiphertextBlob = a}) . mapping _Base64; @@ -188,4 +195,5 @@ gdkwprsResponseStatus = lens _gdkwprsResponseStatus (\ s a -> s{_gdkwprsResponseStatus = a});  instance NFData-         GenerateDataKeyWithoutPlaintextResponse+           GenerateDataKeyWithoutPlaintextResponse+         where

@@ -12,15 +12,17 @@  -- | -- Module      : Network.AWS.KMS.GenerateRandom--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Generates an unpredictable byte string.+-- Returns a random byte string that is cryptographically secure. -- --+-- For more information about entropy and random number generation, see the <https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf AWS Key Management Service Cryptographic Details> whitepaper.+-- module Network.AWS.KMS.GenerateRandom     (     -- * Creating a Request@@ -37,18 +39,19 @@     , grrsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'generateRandom' smart constructor. newtype GenerateRandom = GenerateRandom'-    { _grNumberOfBytes :: Maybe Nat-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _grNumberOfBytes :: Maybe Nat+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GenerateRandom' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -56,11 +59,9 @@ -- * 'grNumberOfBytes' - The length of the byte string. generateRandom     :: GenerateRandom-generateRandom =-    GenerateRandom'-    { _grNumberOfBytes = Nothing-    }+generateRandom = GenerateRandom' {_grNumberOfBytes = Nothing} + -- | The length of the byte string. grNumberOfBytes :: Lens' GenerateRandom (Maybe Natural) grNumberOfBytes = lens _grNumberOfBytes (\ s a -> s{_grNumberOfBytes = a}) . mapping _Nat;@@ -74,9 +75,9 @@                  GenerateRandomResponse' <$>                    (x .?> "Plaintext") <*> (pure (fromEnum s))) -instance Hashable GenerateRandom+instance Hashable GenerateRandom where -instance NFData GenerateRandom+instance NFData GenerateRandom where  instance ToHeaders GenerateRandom where         toHeaders@@ -101,27 +102,27 @@  -- | /See:/ 'generateRandomResponse' smart constructor. data GenerateRandomResponse = GenerateRandomResponse'-    { _grrsPlaintext      :: !(Maybe (Sensitive Base64))-    , _grrsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _grrsPlaintext      :: !(Maybe (Sensitive Base64))+  , _grrsResponseStatus :: !Int+  } deriving (Eq, Show, Data, Typeable, Generic) + -- | Creates a value of 'GenerateRandomResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'grrsPlaintext' - The unpredictable byte string.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- * 'grrsPlaintext' - The random byte string. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. -- -- * 'grrsResponseStatus' - -- | The response status code. generateRandomResponse     :: Int -- ^ 'grrsResponseStatus'     -> GenerateRandomResponse generateRandomResponse pResponseStatus_ =-    GenerateRandomResponse'-    { _grrsPlaintext = Nothing-    , _grrsResponseStatus = pResponseStatus_-    }+  GenerateRandomResponse'+  {_grrsPlaintext = Nothing, _grrsResponseStatus = pResponseStatus_} --- | The unpredictable byte string.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.++-- | The random byte string. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. grrsPlaintext :: Lens' GenerateRandomResponse (Maybe ByteString) grrsPlaintext = lens _grrsPlaintext (\ s a -> s{_grrsPlaintext = a}) . mapping (_Sensitive . _Base64); @@ -129,4 +130,4 @@ grrsResponseStatus :: Lens' GenerateRandomResponse Int grrsResponseStatus = lens _grrsResponseStatus (\ s a -> s{_grrsResponseStatus = a}); -instance NFData GenerateRandomResponse+instance NFData GenerateRandomResponse where

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.GetKeyPolicy--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Retrieves a policy attached to the specified key.+-- Gets a key policy attached to the specified customer master key (CMK). You cannot perform this operation on a CMK in a different AWS account. -- -- module Network.AWS.KMS.GetKeyPolicy@@ -38,41 +38,40 @@     , gkprsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'getKeyPolicy' smart constructor. data GetKeyPolicy = GetKeyPolicy'-    { _gkpKeyId      :: !Text-    , _gkpPolicyName :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gkpKeyId      :: !Text+  , _gkpPolicyName :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GetKeyPolicy' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'gkpKeyId' - A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- * 'gkpKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . ----- * 'gkpPolicyName' - String that contains the name of the policy. Currently, this must be "default". Policy names can be discovered by calling 'ListKeyPolicies' .+-- * 'gkpPolicyName' - Specifies the name of the policy. The only valid name is @default@ . To get the names of key policies, use 'ListKeyPolicies' . getKeyPolicy     :: Text -- ^ 'gkpKeyId'     -> Text -- ^ 'gkpPolicyName'     -> GetKeyPolicy getKeyPolicy pKeyId_ pPolicyName_ =-    GetKeyPolicy'-    { _gkpKeyId = pKeyId_-    , _gkpPolicyName = pPolicyName_-    }+  GetKeyPolicy' {_gkpKeyId = pKeyId_, _gkpPolicyName = pPolicyName_} --- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012++-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . gkpKeyId :: Lens' GetKeyPolicy Text gkpKeyId = lens _gkpKeyId (\ s a -> s{_gkpKeyId = a}); --- | String that contains the name of the policy. Currently, this must be "default". Policy names can be discovered by calling 'ListKeyPolicies' .+-- | Specifies the name of the policy. The only valid name is @default@ . To get the names of key policies, use 'ListKeyPolicies' . gkpPolicyName :: Lens' GetKeyPolicy Text gkpPolicyName = lens _gkpPolicyName (\ s a -> s{_gkpPolicyName = a}); @@ -85,9 +84,9 @@                  GetKeyPolicyResponse' <$>                    (x .?> "Policy") <*> (pure (fromEnum s))) -instance Hashable GetKeyPolicy+instance Hashable GetKeyPolicy where -instance NFData GetKeyPolicy+instance NFData GetKeyPolicy where  instance ToHeaders GetKeyPolicy where         toHeaders@@ -113,10 +112,11 @@  -- | /See:/ 'getKeyPolicyResponse' smart constructor. data GetKeyPolicyResponse = GetKeyPolicyResponse'-    { _gkprsPolicy         :: !(Maybe Text)-    , _gkprsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gkprsPolicy         :: !(Maybe Text)+  , _gkprsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GetKeyPolicyResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -128,11 +128,10 @@     :: Int -- ^ 'gkprsResponseStatus'     -> GetKeyPolicyResponse getKeyPolicyResponse pResponseStatus_ =-    GetKeyPolicyResponse'-    { _gkprsPolicy = Nothing-    , _gkprsResponseStatus = pResponseStatus_-    }+  GetKeyPolicyResponse'+  {_gkprsPolicy = Nothing, _gkprsResponseStatus = pResponseStatus_} + -- | A policy document in JSON format. gkprsPolicy :: Lens' GetKeyPolicyResponse (Maybe Text) gkprsPolicy = lens _gkprsPolicy (\ s a -> s{_gkprsPolicy = a});@@ -141,4 +140,4 @@ gkprsResponseStatus :: Lens' GetKeyPolicyResponse Int gkprsResponseStatus = lens _gkprsResponseStatus (\ s a -> s{_gkprsResponseStatus = a}); -instance NFData GetKeyPolicyResponse+instance NFData GetKeyPolicyResponse where

@@ -12,15 +12,17 @@  -- | -- Module      : Network.AWS.KMS.GetKeyRotationStatus--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Retrieves a Boolean value that indicates whether key rotation is enabled for the specified key.+-- Gets a Boolean value that indicates whether automatic rotation of the key material is enabled for the specified customer master key (CMK). -- --+-- To perform this operation on a CMK in a different AWS account, specify the key ARN in the value of the KeyId parameter.+-- module Network.AWS.KMS.GetKeyRotationStatus     (     -- * Creating a Request@@ -37,32 +39,31 @@     , gkrsrsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'getKeyRotationStatus' smart constructor. newtype GetKeyRotationStatus = GetKeyRotationStatus'-    { _gkrsKeyId :: Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gkrsKeyId :: Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GetKeyRotationStatus' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'gkrsKeyId' - A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- * 'gkrsKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . getKeyRotationStatus     :: Text -- ^ 'gkrsKeyId'     -> GetKeyRotationStatus-getKeyRotationStatus pKeyId_ =-    GetKeyRotationStatus'-    { _gkrsKeyId = pKeyId_-    }+getKeyRotationStatus pKeyId_ = GetKeyRotationStatus' {_gkrsKeyId = pKeyId_} --- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012++-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . gkrsKeyId :: Lens' GetKeyRotationStatus Text gkrsKeyId = lens _gkrsKeyId (\ s a -> s{_gkrsKeyId = a}); @@ -76,9 +77,9 @@                  GetKeyRotationStatusResponse' <$>                    (x .?> "KeyRotationEnabled") <*> (pure (fromEnum s))) -instance Hashable GetKeyRotationStatus+instance Hashable GetKeyRotationStatus where -instance NFData GetKeyRotationStatus+instance NFData GetKeyRotationStatus where  instance ToHeaders GetKeyRotationStatus where         toHeaders@@ -101,10 +102,11 @@  -- | /See:/ 'getKeyRotationStatusResponse' smart constructor. data GetKeyRotationStatusResponse = GetKeyRotationStatusResponse'-    { _gkrsrsKeyRotationEnabled :: !(Maybe Bool)-    , _gkrsrsResponseStatus     :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gkrsrsKeyRotationEnabled :: !(Maybe Bool)+  , _gkrsrsResponseStatus     :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GetKeyRotationStatusResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -116,11 +118,12 @@     :: Int -- ^ 'gkrsrsResponseStatus'     -> GetKeyRotationStatusResponse getKeyRotationStatusResponse pResponseStatus_ =-    GetKeyRotationStatusResponse'-    { _gkrsrsKeyRotationEnabled = Nothing-    , _gkrsrsResponseStatus = pResponseStatus_-    }+  GetKeyRotationStatusResponse'+  { _gkrsrsKeyRotationEnabled = Nothing+  , _gkrsrsResponseStatus = pResponseStatus_+  } + -- | A Boolean value that specifies whether key rotation is enabled. gkrsrsKeyRotationEnabled :: Lens' GetKeyRotationStatusResponse (Maybe Bool) gkrsrsKeyRotationEnabled = lens _gkrsrsKeyRotationEnabled (\ s a -> s{_gkrsrsKeyRotationEnabled = a});@@ -129,4 +132,4 @@ gkrsrsResponseStatus :: Lens' GetKeyRotationStatusResponse Int gkrsrsResponseStatus = lens _gkrsrsResponseStatus (\ s a -> s{_gkrsrsResponseStatus = a}); -instance NFData GetKeyRotationStatusResponse+instance NFData GetKeyRotationStatusResponse where

@@ -12,18 +12,18 @@  -- | -- Module      : Network.AWS.KMS.GetParametersForImport--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) -- -- Returns the items you need in order to import key material into AWS KMS from your existing key management infrastructure. For more information about importing key material into AWS KMS, see <http://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html Importing Key Material> in the /AWS Key Management Service Developer Guide/ . -- ----- You must specify the key ID of the customer master key (CMK) into which you will import key material. This CMK's @Origin@ must be @EXTERNAL@ . You must also specify the wrapping algorithm and type of wrapping key (public key) that you will use to encrypt the key material.+-- You must specify the key ID of the customer master key (CMK) into which you will import key material. This CMK's @Origin@ must be @EXTERNAL@ . You must also specify the wrapping algorithm and type of wrapping key (public key) that you will use to encrypt the key material. You cannot perform this operation on a CMK in a different AWS account. ----- This operation returns a public key and an import token. Use the public key to encrypt the key material. Store the import token to send with a subsequent 'ImportKeyMaterial' request. The public key and import token from the same response must be used together. These items are valid for 24 hours, after which they cannot be used for a subsequent 'ImportKeyMaterial' request. To retrieve new ones, send another @GetParametersForImport@ request.+-- This operation returns a public key and an import token. Use the public key to encrypt the key material. Store the import token to send with a subsequent 'ImportKeyMaterial' request. The public key and import token from the same response must be used together. These items are valid for 24 hours. When they expire, they cannot be used for a subsequent 'ImportKeyMaterial' request. To get new ones, send another @GetParametersForImport@ request. -- module Network.AWS.KMS.GetParametersForImport     (@@ -46,25 +46,26 @@     , gpfirsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'getParametersForImport' smart constructor. data GetParametersForImport = GetParametersForImport'-    { _gpfiKeyId             :: !Text-    , _gpfiWrappingAlgorithm :: !AlgorithmSpec-    , _gpfiWrappingKeySpec   :: !WrappingKeySpec-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gpfiKeyId             :: !Text+  , _gpfiWrappingAlgorithm :: !AlgorithmSpec+  , _gpfiWrappingKeySpec   :: !WrappingKeySpec+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GetParametersForImport' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'gpfiKeyId' - The identifier of the CMK into which you will import key material. The CMK's @Origin@ must be @EXTERNAL@ . A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples:     * Unique key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@+-- * 'gpfiKeyId' - The identifier of the CMK into which you will import key material. The CMK's @Origin@ must be @EXTERNAL@ . Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . -- -- * 'gpfiWrappingAlgorithm' - The algorithm you will use to encrypt the key material before importing it with 'ImportKeyMaterial' . For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-encrypt-key-material.html Encrypt the Key Material> in the /AWS Key Management Service Developer Guide/ . --@@ -75,13 +76,14 @@     -> WrappingKeySpec -- ^ 'gpfiWrappingKeySpec'     -> GetParametersForImport getParametersForImport pKeyId_ pWrappingAlgorithm_ pWrappingKeySpec_ =-    GetParametersForImport'-    { _gpfiKeyId = pKeyId_-    , _gpfiWrappingAlgorithm = pWrappingAlgorithm_-    , _gpfiWrappingKeySpec = pWrappingKeySpec_-    }+  GetParametersForImport'+  { _gpfiKeyId = pKeyId_+  , _gpfiWrappingAlgorithm = pWrappingAlgorithm_+  , _gpfiWrappingKeySpec = pWrappingKeySpec_+  } --- | The identifier of the CMK into which you will import key material. The CMK's @Origin@ must be @EXTERNAL@ . A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples:     * Unique key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@++-- | The identifier of the CMK into which you will import key material. The CMK's @Origin@ must be @EXTERNAL@ . Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . gpfiKeyId :: Lens' GetParametersForImport Text gpfiKeyId = lens _gpfiKeyId (\ s a -> s{_gpfiKeyId = a}); @@ -106,9 +108,9 @@                      <*> (x .?> "ImportToken")                      <*> (pure (fromEnum s))) -instance Hashable GetParametersForImport+instance Hashable GetParametersForImport where -instance NFData GetParametersForImport+instance NFData GetParametersForImport where  instance ToHeaders GetParametersForImport where         toHeaders@@ -136,13 +138,14 @@  -- | /See:/ 'getParametersForImportResponse' smart constructor. data GetParametersForImportResponse = GetParametersForImportResponse'-    { _gpfirsKeyId             :: !(Maybe Text)-    , _gpfirsPublicKey         :: !(Maybe (Sensitive Base64))-    , _gpfirsParametersValidTo :: !(Maybe POSIX)-    , _gpfirsImportToken       :: !(Maybe Base64)-    , _gpfirsResponseStatus    :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gpfirsKeyId             :: !(Maybe Text)+  , _gpfirsPublicKey         :: !(Maybe (Sensitive Base64))+  , _gpfirsParametersValidTo :: !(Maybe POSIX)+  , _gpfirsImportToken       :: !(Maybe Base64)+  , _gpfirsResponseStatus    :: !Int+  } deriving (Eq, Show, Data, Typeable, Generic) + -- | Creates a value of 'GetParametersForImportResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -151,7 +154,7 @@ -- -- * 'gpfirsPublicKey' - The public key to use to encrypt the key material before importing it with 'ImportKeyMaterial' .-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. ----- * 'gpfirsParametersValidTo' - The time at which the import token and public key are no longer valid. After this time, you cannot use them to make an 'ImportKeyMaterial' request and you must send another @GetParametersForImport@ request to retrieve new ones.+-- * 'gpfirsParametersValidTo' - The time at which the import token and public key are no longer valid. After this time, you cannot use them to make an 'ImportKeyMaterial' request and you must send another @GetParametersForImport@ request to get new ones. -- -- * 'gpfirsImportToken' - The import token to send in a subsequent 'ImportKeyMaterial' request.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. --@@ -160,14 +163,15 @@     :: Int -- ^ 'gpfirsResponseStatus'     -> GetParametersForImportResponse getParametersForImportResponse pResponseStatus_ =-    GetParametersForImportResponse'-    { _gpfirsKeyId = Nothing-    , _gpfirsPublicKey = Nothing-    , _gpfirsParametersValidTo = Nothing-    , _gpfirsImportToken = Nothing-    , _gpfirsResponseStatus = pResponseStatus_-    }+  GetParametersForImportResponse'+  { _gpfirsKeyId = Nothing+  , _gpfirsPublicKey = Nothing+  , _gpfirsParametersValidTo = Nothing+  , _gpfirsImportToken = Nothing+  , _gpfirsResponseStatus = pResponseStatus_+  } + -- | The identifier of the CMK to use in a subsequent 'ImportKeyMaterial' request. This is the same CMK specified in the @GetParametersForImport@ request. gpfirsKeyId :: Lens' GetParametersForImportResponse (Maybe Text) gpfirsKeyId = lens _gpfirsKeyId (\ s a -> s{_gpfirsKeyId = a});@@ -176,7 +180,7 @@ gpfirsPublicKey :: Lens' GetParametersForImportResponse (Maybe ByteString) gpfirsPublicKey = lens _gpfirsPublicKey (\ s a -> s{_gpfirsPublicKey = a}) . mapping (_Sensitive . _Base64); --- | The time at which the import token and public key are no longer valid. After this time, you cannot use them to make an 'ImportKeyMaterial' request and you must send another @GetParametersForImport@ request to retrieve new ones.+-- | The time at which the import token and public key are no longer valid. After this time, you cannot use them to make an 'ImportKeyMaterial' request and you must send another @GetParametersForImport@ request to get new ones. gpfirsParametersValidTo :: Lens' GetParametersForImportResponse (Maybe UTCTime) gpfirsParametersValidTo = lens _gpfirsParametersValidTo (\ s a -> s{_gpfirsParametersValidTo = a}) . mapping _Time; @@ -188,4 +192,4 @@ gpfirsResponseStatus :: Lens' GetParametersForImportResponse Int gpfirsResponseStatus = lens _gpfirsResponseStatus (\ s a -> s{_gpfirsResponseStatus = a}); -instance NFData GetParametersForImportResponse+instance NFData GetParametersForImportResponse where

@@ -12,21 +12,33 @@  -- | -- Module      : Network.AWS.KMS.ImportKeyMaterial--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Imports key material into an AWS KMS customer master key (CMK) from your existing key management infrastructure. For more information about importing key material into AWS KMS, see <http://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html Importing Key Material> in the /AWS Key Management Service Developer Guide/ .+-- Imports key material into an existing AWS KMS customer master key (CMK) that was created without key material. You cannot perform this operation on a CMK in a different AWS account. For more information about creating CMKs with no key material and then importing key material, see <http://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html Importing Key Material> in the /AWS Key Management Service Developer Guide/ . -- ----- You must specify the key ID of the CMK to import the key material into. This CMK's @Origin@ must be @EXTERNAL@ . You must also send an import token and the encrypted key material. Send the import token that you received in the same 'GetParametersForImport' response that contained the public key that you used to encrypt the key material. You must also specify whether the key material expires and if so, when. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. To use the CMK again, you can reimport the same key material. If you set an expiration date, you can change it only by reimporting the same key material and specifying a new expiration date.+-- Before using this operation, call 'GetParametersForImport' . Its response includes a public key and an import token. Use the public key to encrypt the key material. Then, submit the import token from the same @GetParametersForImport@ response. ----- When this operation is successful, the specified CMK's key state changes to @Enabled@ , and you can use the CMK.+-- When calling this operation, you must specify the following values: ----- After you successfully import key material into a CMK, you can reimport the same key material into that CMK, but you cannot import different key material.+--     * The key ID or key ARN of a CMK with no key material. Its @Origin@ must be @EXTERNAL@ . --+-- To create a CMK with no key material, call 'CreateKey' and set the value of its @Origin@ parameter to @EXTERNAL@ . To get the @Origin@ of a CMK, call 'DescribeKey' .)+--+--     * The encrypted key material. To get the public key to encrypt the key material, call 'GetParametersForImport' .+--+--     * The import token that 'GetParametersForImport' returned. This token and the public key used to encrypt the key material must have come from the same response.+--+--     * Whether the key material expires and if so, when. If you set an expiration date, you can change it only by reimporting the same key material and specifying a new expiration date. If the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. To use the CMK again, you must reimport the same key material.+--+--+--+-- When this operation is successful, the CMK's key state changes from @PendingImport@ to @Enabled@ , and you can use the CMK. After you successfully import key material into a CMK, you can reimport the same key material into that CMK, but you cannot import different key material.+-- module Network.AWS.KMS.ImportKeyMaterial     (     -- * Creating a Request@@ -46,22 +58,23 @@     , ikmrsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'importKeyMaterial' smart constructor. data ImportKeyMaterial = ImportKeyMaterial'-    { _ikmExpirationModel      :: !(Maybe ExpirationModelType)-    , _ikmValidTo              :: !(Maybe POSIX)-    , _ikmKeyId                :: !Text-    , _ikmImportToken          :: !Base64-    , _ikmEncryptedKeyMaterial :: !Base64-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _ikmExpirationModel      :: !(Maybe ExpirationModelType)+  , _ikmValidTo              :: !(Maybe POSIX)+  , _ikmKeyId                :: !Text+  , _ikmImportToken          :: !Base64+  , _ikmEncryptedKeyMaterial :: !Base64+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ImportKeyMaterial' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -70,7 +83,7 @@ -- -- * 'ikmValidTo' - The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. You must omit this parameter when the @ExpirationModel@ parameter is set to @KEY_MATERIAL_DOES_NOT_EXPIRE@ . Otherwise it is required. ----- * 'ikmKeyId' - The identifier of the CMK to import the key material into. The CMK's @Origin@ must be @EXTERNAL@ . A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples:     * Unique key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@+-- * 'ikmKeyId' - The identifier of the CMK to import the key material into. The CMK's @Origin@ must be @EXTERNAL@ . Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . -- -- * 'ikmImportToken' - The import token that you received in the response to a previous 'GetParametersForImport' request. It must be from the same response that contained the public key that you used to encrypt the key material.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. --@@ -81,14 +94,15 @@     -> ByteString -- ^ 'ikmEncryptedKeyMaterial'     -> ImportKeyMaterial importKeyMaterial pKeyId_ pImportToken_ pEncryptedKeyMaterial_ =-    ImportKeyMaterial'-    { _ikmExpirationModel = Nothing-    , _ikmValidTo = Nothing-    , _ikmKeyId = pKeyId_-    , _ikmImportToken = _Base64 # pImportToken_-    , _ikmEncryptedKeyMaterial = _Base64 # pEncryptedKeyMaterial_-    }+  ImportKeyMaterial'+  { _ikmExpirationModel = Nothing+  , _ikmValidTo = Nothing+  , _ikmKeyId = pKeyId_+  , _ikmImportToken = _Base64 # pImportToken_+  , _ikmEncryptedKeyMaterial = _Base64 # pEncryptedKeyMaterial_+  } + -- | Specifies whether the key material expires. The default is @KEY_MATERIAL_EXPIRES@ , in which case you must include the @ValidTo@ parameter. When this parameter is set to @KEY_MATERIAL_DOES_NOT_EXPIRE@ , you must omit the @ValidTo@ parameter. ikmExpirationModel :: Lens' ImportKeyMaterial (Maybe ExpirationModelType) ikmExpirationModel = lens _ikmExpirationModel (\ s a -> s{_ikmExpirationModel = a});@@ -97,7 +111,7 @@ ikmValidTo :: Lens' ImportKeyMaterial (Maybe UTCTime) ikmValidTo = lens _ikmValidTo (\ s a -> s{_ikmValidTo = a}) . mapping _Time; --- | The identifier of the CMK to import the key material into. The CMK's @Origin@ must be @EXTERNAL@ . A valid identifier is the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples:     * Unique key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@+-- | The identifier of the CMK to import the key material into. The CMK's @Origin@ must be @EXTERNAL@ . Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . ikmKeyId :: Lens' ImportKeyMaterial Text ikmKeyId = lens _ikmKeyId (\ s a -> s{_ikmKeyId = a}); @@ -117,9 +131,9 @@               (\ s h x ->                  ImportKeyMaterialResponse' <$> (pure (fromEnum s))) -instance Hashable ImportKeyMaterial+instance Hashable ImportKeyMaterial where -instance NFData ImportKeyMaterial+instance NFData ImportKeyMaterial where  instance ToHeaders ImportKeyMaterial where         toHeaders@@ -150,9 +164,10 @@  -- | /See:/ 'importKeyMaterialResponse' smart constructor. newtype ImportKeyMaterialResponse = ImportKeyMaterialResponse'-    { _ikmrsResponseStatus :: Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _ikmrsResponseStatus :: Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ImportKeyMaterialResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -162,12 +177,11 @@     :: Int -- ^ 'ikmrsResponseStatus'     -> ImportKeyMaterialResponse importKeyMaterialResponse pResponseStatus_ =-    ImportKeyMaterialResponse'-    { _ikmrsResponseStatus = pResponseStatus_-    }+  ImportKeyMaterialResponse' {_ikmrsResponseStatus = pResponseStatus_} + -- | -- | The response status code. ikmrsResponseStatus :: Lens' ImportKeyMaterialResponse Int ikmrsResponseStatus = lens _ikmrsResponseStatus (\ s a -> s{_ikmrsResponseStatus = a}); -instance NFData ImportKeyMaterialResponse+instance NFData ImportKeyMaterialResponse where

@@ -12,16 +12,18 @@  -- | -- Module      : Network.AWS.KMS.ListAliases--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Lists all of the key aliases in the account.+-- Gets a list of all aliases in the caller's AWS account and region. You cannot list aliases in other accounts. For more information about aliases, see 'CreateAlias' . -- --+-- The response might include several aliases that do not have a @TargetKeyId@ field because they are not associated with a CMK. These are predefined aliases that are reserved for CMKs managed by AWS services. If an alias is not associated with a CMK, the alias does not count against the <http://docs.aws.amazon.com/kms/latest/developerguide/limits.html#aliases-limit alias limit> for your account. --+-- -- This operation returns paginated results. module Network.AWS.KMS.ListAliases     (@@ -42,40 +44,38 @@     , larsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Pager-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Pager+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'listAliases' smart constructor. data ListAliases = ListAliases'-    { _laMarker :: !(Maybe Text)-    , _laLimit  :: !(Maybe Nat)-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _laMarker :: !(Maybe Text)+  , _laLimit  :: !(Maybe Nat)+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ListAliases' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'laMarker' - Use this parameter only when paginating results and only in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the response you just received.+-- * 'laMarker' - Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. ----- * 'laLimit' - When paginating results, specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the @Truncated@ element in the response is set to true. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.+-- * 'laLimit' - Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50. listAliases     :: ListAliases-listAliases =-    ListAliases'-    { _laMarker = Nothing-    , _laLimit = Nothing-    }+listAliases = ListAliases' {_laMarker = Nothing, _laLimit = Nothing} --- | Use this parameter only when paginating results and only in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the response you just received.++-- | Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. laMarker :: Lens' ListAliases (Maybe Text) laMarker = lens _laMarker (\ s a -> s{_laMarker = a}); --- | When paginating results, specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the @Truncated@ element in the response is set to true. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.+-- | Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50. laLimit :: Lens' ListAliases (Maybe Natural) laLimit = lens _laLimit (\ s a -> s{_laLimit = a}) . mapping _Nat; @@ -97,9 +97,9 @@                      <*> (x .?> "NextMarker")                      <*> (pure (fromEnum s))) -instance Hashable ListAliases+instance Hashable ListAliases where -instance NFData ListAliases+instance NFData ListAliases where  instance ToHeaders ListAliases where         toHeaders@@ -125,43 +125,45 @@  -- | /See:/ 'listAliasesResponse' smart constructor. data ListAliasesResponse = ListAliasesResponse'-    { _larsTruncated      :: !(Maybe Bool)-    , _larsAliases        :: !(Maybe [AliasListEntry])-    , _larsNextMarker     :: !(Maybe Text)-    , _larsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _larsTruncated      :: !(Maybe Bool)+  , _larsAliases        :: !(Maybe [AliasListEntry])+  , _larsNextMarker     :: !(Maybe Text)+  , _larsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ListAliasesResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'larsTruncated' - A flag that indicates whether there are more items in the list. If your results were truncated, you can use the @Marker@ parameter to make a subsequent pagination request to retrieve more items in the list.+-- * 'larsTruncated' - A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the @NextMarker@ element in this response to the @Marker@ parameter in a subsequent request. ----- * 'larsAliases' - A list of key aliases in the user's account.+-- * 'larsAliases' - A list of aliases. ----- * 'larsNextMarker' - When @Truncated@ is true, this value is present and contains the value to use for the @Marker@ parameter in a subsequent pagination request.+-- * 'larsNextMarker' - When @Truncated@ is true, this element is present and contains the value to use for the @Marker@ parameter in a subsequent request. -- -- * 'larsResponseStatus' - -- | The response status code. listAliasesResponse     :: Int -- ^ 'larsResponseStatus'     -> ListAliasesResponse listAliasesResponse pResponseStatus_ =-    ListAliasesResponse'-    { _larsTruncated = Nothing-    , _larsAliases = Nothing-    , _larsNextMarker = Nothing-    , _larsResponseStatus = pResponseStatus_-    }+  ListAliasesResponse'+  { _larsTruncated = Nothing+  , _larsAliases = Nothing+  , _larsNextMarker = Nothing+  , _larsResponseStatus = pResponseStatus_+  } --- | A flag that indicates whether there are more items in the list. If your results were truncated, you can use the @Marker@ parameter to make a subsequent pagination request to retrieve more items in the list.++-- | A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the @NextMarker@ element in this response to the @Marker@ parameter in a subsequent request. larsTruncated :: Lens' ListAliasesResponse (Maybe Bool) larsTruncated = lens _larsTruncated (\ s a -> s{_larsTruncated = a}); --- | A list of key aliases in the user's account.+-- | A list of aliases. larsAliases :: Lens' ListAliasesResponse [AliasListEntry] larsAliases = lens _larsAliases (\ s a -> s{_larsAliases = a}) . _Default . _Coerce; --- | When @Truncated@ is true, this value is present and contains the value to use for the @Marker@ parameter in a subsequent pagination request.+-- | When @Truncated@ is true, this element is present and contains the value to use for the @Marker@ parameter in a subsequent request. larsNextMarker :: Lens' ListAliasesResponse (Maybe Text) larsNextMarker = lens _larsNextMarker (\ s a -> s{_larsNextMarker = a}); @@ -169,4 +171,4 @@ larsResponseStatus :: Lens' ListAliasesResponse Int larsResponseStatus = lens _larsResponseStatus (\ s a -> s{_larsResponseStatus = a}); -instance NFData ListAliasesResponse+instance NFData ListAliasesResponse where

@@ -12,16 +12,18 @@  -- | -- Module      : Network.AWS.KMS.ListGrants--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- List the grants for a specified key.+-- Gets a list of all grants for the specified customer master key (CMK). -- --+-- To perform this operation on a CMK in a different AWS account, specify the key ARN in the value of the KeyId parameter. --+-- -- This operation returns paginated results. module Network.AWS.KMS.ListGrants     (@@ -42,49 +44,47 @@     , lgNextMarker     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Pager-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Pager+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'listGrants' smart constructor. data ListGrants = ListGrants'-    { _lgMarker :: !(Maybe Text)-    , _lgLimit  :: !(Maybe Nat)-    , _lgKeyId  :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _lgMarker :: !(Maybe Text)+  , _lgLimit  :: !(Maybe Nat)+  , _lgKeyId  :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ListGrants' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'lgMarker' - Use this parameter only when paginating results and only in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the response you just received.+-- * 'lgMarker' - Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. ----- * 'lgLimit' - When paginating results, specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the @Truncated@ element in the response is set to true. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.+-- * 'lgLimit' - Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50. ----- * 'lgKeyId' - A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- * 'lgKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . listGrants     :: Text -- ^ 'lgKeyId'     -> ListGrants listGrants pKeyId_ =-    ListGrants'-    { _lgMarker = Nothing-    , _lgLimit = Nothing-    , _lgKeyId = pKeyId_-    }+  ListGrants' {_lgMarker = Nothing, _lgLimit = Nothing, _lgKeyId = pKeyId_} --- | Use this parameter only when paginating results and only in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the response you just received.++-- | Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. lgMarker :: Lens' ListGrants (Maybe Text) lgMarker = lens _lgMarker (\ s a -> s{_lgMarker = a}); --- | When paginating results, specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the @Truncated@ element in the response is set to true. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.+-- | Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50. lgLimit :: Lens' ListGrants (Maybe Natural) lgLimit = lens _lgLimit (\ s a -> s{_lgLimit = a}) . mapping _Nat; --- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . lgKeyId :: Lens' ListGrants Text lgKeyId = lens _lgKeyId (\ s a -> s{_lgKeyId = a}); @@ -100,9 +100,9 @@         request = postJSON kms         response = receiveJSON (\ s h x -> eitherParseJSON x) -instance Hashable ListGrants+instance Hashable ListGrants where -instance NFData ListGrants+instance NFData ListGrants where  instance ToHeaders ListGrants where         toHeaders

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.ListKeyPolicies--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Retrieves a list of policies attached to a key.+-- Gets the names of the key policies that are attached to a customer master key (CMK). This operation is designed to get policy names that you can use in a 'GetKeyPolicy' operation. However, the only valid policy name is @default@ . You cannot perform this operation on a CMK in a different AWS account. -- -- --@@ -43,49 +43,48 @@     , lkprsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Pager-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Pager+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'listKeyPolicies' smart constructor. data ListKeyPolicies = ListKeyPolicies'-    { _lkpMarker :: !(Maybe Text)-    , _lkpLimit  :: !(Maybe Nat)-    , _lkpKeyId  :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _lkpMarker :: !(Maybe Text)+  , _lkpLimit  :: !(Maybe Nat)+  , _lkpKeyId  :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ListKeyPolicies' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'lkpMarker' - Use this parameter only when paginating results and only in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the response you just received.+-- * 'lkpMarker' - Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. ----- * 'lkpLimit' - When paginating results, specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the @Truncated@ element in the response is set to true. This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100. Currently only 1 policy can be attached to a key.+-- * 'lkpLimit' - Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100. Currently only 1 policy can be attached to a key. ----- * 'lkpKeyId' - A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by "alias/".     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias/MyAliasName     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012     * Alias Name Example - alias/MyAliasName+-- * 'lkpKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . listKeyPolicies     :: Text -- ^ 'lkpKeyId'     -> ListKeyPolicies listKeyPolicies pKeyId_ =-    ListKeyPolicies'-    { _lkpMarker = Nothing-    , _lkpLimit = Nothing-    , _lkpKeyId = pKeyId_-    }+  ListKeyPolicies'+  {_lkpMarker = Nothing, _lkpLimit = Nothing, _lkpKeyId = pKeyId_} --- | Use this parameter only when paginating results and only in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the response you just received.++-- | Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. lkpMarker :: Lens' ListKeyPolicies (Maybe Text) lkpMarker = lens _lkpMarker (\ s a -> s{_lkpMarker = a}); --- | When paginating results, specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the @Truncated@ element in the response is set to true. This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100. Currently only 1 policy can be attached to a key.+-- | Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100. Currently only 1 policy can be attached to a key. lkpLimit :: Lens' ListKeyPolicies (Maybe Natural) lkpLimit = lens _lkpLimit (\ s a -> s{_lkpLimit = a}) . mapping _Nat; --- | A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by "alias/".     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias/MyAliasName     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012     * Alias Name Example - alias/MyAliasName+-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . lkpKeyId :: Lens' ListKeyPolicies Text lkpKeyId = lens _lkpKeyId (\ s a -> s{_lkpKeyId = a}); @@ -108,9 +107,9 @@                      <*> (x .?> "NextMarker")                      <*> (pure (fromEnum s))) -instance Hashable ListKeyPolicies+instance Hashable ListKeyPolicies where -instance NFData ListKeyPolicies+instance NFData ListKeyPolicies where  instance ToHeaders ListKeyPolicies where         toHeaders@@ -137,43 +136,45 @@  -- | /See:/ 'listKeyPoliciesResponse' smart constructor. data ListKeyPoliciesResponse = ListKeyPoliciesResponse'-    { _lkprsPolicyNames    :: !(Maybe [Text])-    , _lkprsTruncated      :: !(Maybe Bool)-    , _lkprsNextMarker     :: !(Maybe Text)-    , _lkprsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _lkprsPolicyNames    :: !(Maybe [Text])+  , _lkprsTruncated      :: !(Maybe Bool)+  , _lkprsNextMarker     :: !(Maybe Text)+  , _lkprsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ListKeyPoliciesResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- -- * 'lkprsPolicyNames' - A list of policy names. Currently, there is only one policy and it is named "Default". ----- * 'lkprsTruncated' - A flag that indicates whether there are more items in the list. If your results were truncated, you can use the @Marker@ parameter to make a subsequent pagination request to retrieve more items in the list.+-- * 'lkprsTruncated' - A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the @NextMarker@ element in this response to the @Marker@ parameter in a subsequent request. ----- * 'lkprsNextMarker' - When @Truncated@ is true, this value is present and contains the value to use for the @Marker@ parameter in a subsequent pagination request.+-- * 'lkprsNextMarker' - When @Truncated@ is true, this element is present and contains the value to use for the @Marker@ parameter in a subsequent request. -- -- * 'lkprsResponseStatus' - -- | The response status code. listKeyPoliciesResponse     :: Int -- ^ 'lkprsResponseStatus'     -> ListKeyPoliciesResponse listKeyPoliciesResponse pResponseStatus_ =-    ListKeyPoliciesResponse'-    { _lkprsPolicyNames = Nothing-    , _lkprsTruncated = Nothing-    , _lkprsNextMarker = Nothing-    , _lkprsResponseStatus = pResponseStatus_-    }+  ListKeyPoliciesResponse'+  { _lkprsPolicyNames = Nothing+  , _lkprsTruncated = Nothing+  , _lkprsNextMarker = Nothing+  , _lkprsResponseStatus = pResponseStatus_+  } + -- | A list of policy names. Currently, there is only one policy and it is named "Default". lkprsPolicyNames :: Lens' ListKeyPoliciesResponse [Text] lkprsPolicyNames = lens _lkprsPolicyNames (\ s a -> s{_lkprsPolicyNames = a}) . _Default . _Coerce; --- | A flag that indicates whether there are more items in the list. If your results were truncated, you can use the @Marker@ parameter to make a subsequent pagination request to retrieve more items in the list.+-- | A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the @NextMarker@ element in this response to the @Marker@ parameter in a subsequent request. lkprsTruncated :: Lens' ListKeyPoliciesResponse (Maybe Bool) lkprsTruncated = lens _lkprsTruncated (\ s a -> s{_lkprsTruncated = a}); --- | When @Truncated@ is true, this value is present and contains the value to use for the @Marker@ parameter in a subsequent pagination request.+-- | When @Truncated@ is true, this element is present and contains the value to use for the @Marker@ parameter in a subsequent request. lkprsNextMarker :: Lens' ListKeyPoliciesResponse (Maybe Text) lkprsNextMarker = lens _lkprsNextMarker (\ s a -> s{_lkprsNextMarker = a}); @@ -181,4 +182,4 @@ lkprsResponseStatus :: Lens' ListKeyPoliciesResponse Int lkprsResponseStatus = lens _lkprsResponseStatus (\ s a -> s{_lkprsResponseStatus = a}); -instance NFData ListKeyPoliciesResponse+instance NFData ListKeyPoliciesResponse where

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.ListKeys--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Lists the customer master keys.+-- Gets a list of all customer master keys (CMKs) in the caller's AWS account and region. -- -- --@@ -42,40 +42,38 @@     , lkrsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Pager-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Pager+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'listKeys' smart constructor. data ListKeys = ListKeys'-    { _lkMarker :: !(Maybe Text)-    , _lkLimit  :: !(Maybe Nat)-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _lkMarker :: !(Maybe Text)+  , _lkLimit  :: !(Maybe Nat)+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ListKeys' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'lkMarker' - Use this parameter only when paginating results and only in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the response you just received.+-- * 'lkMarker' - Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. ----- * 'lkLimit' - When paginating results, specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the @Truncated@ element in the response is set to true. This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100.+-- * 'lkLimit' - Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100. listKeys     :: ListKeys-listKeys =-    ListKeys'-    { _lkMarker = Nothing-    , _lkLimit = Nothing-    }+listKeys = ListKeys' {_lkMarker = Nothing, _lkLimit = Nothing} --- | Use this parameter only when paginating results and only in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the response you just received.++-- | Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. lkMarker :: Lens' ListKeys (Maybe Text) lkMarker = lens _lkMarker (\ s a -> s{_lkMarker = a}); --- | When paginating results, specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the @Truncated@ element in the response is set to true. This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100.+-- | Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100. lkLimit :: Lens' ListKeys (Maybe Natural) lkLimit = lens _lkLimit (\ s a -> s{_lkLimit = a}) . mapping _Nat; @@ -97,9 +95,9 @@                      (x .?> "NextMarker")                      <*> (pure (fromEnum s))) -instance Hashable ListKeys+instance Hashable ListKeys where -instance NFData ListKeys+instance NFData ListKeys where  instance ToHeaders ListKeys where         toHeaders@@ -125,43 +123,45 @@  -- | /See:/ 'listKeysResponse' smart constructor. data ListKeysResponse = ListKeysResponse'-    { _lkrsTruncated      :: !(Maybe Bool)-    , _lkrsKeys           :: !(Maybe [KeyListEntry])-    , _lkrsNextMarker     :: !(Maybe Text)-    , _lkrsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _lkrsTruncated      :: !(Maybe Bool)+  , _lkrsKeys           :: !(Maybe [KeyListEntry])+  , _lkrsNextMarker     :: !(Maybe Text)+  , _lkrsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ListKeysResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'lkrsTruncated' - A flag that indicates whether there are more items in the list. If your results were truncated, you can use the @Marker@ parameter to make a subsequent pagination request to retrieve more items in the list.+-- * 'lkrsTruncated' - A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the @NextMarker@ element in this response to the @Marker@ parameter in a subsequent request. ----- * 'lkrsKeys' - A list of keys.+-- * 'lkrsKeys' - A list of customer master keys (CMKs). ----- * 'lkrsNextMarker' - When @Truncated@ is true, this value is present and contains the value to use for the @Marker@ parameter in a subsequent pagination request.+-- * 'lkrsNextMarker' - When @Truncated@ is true, this element is present and contains the value to use for the @Marker@ parameter in a subsequent request. -- -- * 'lkrsResponseStatus' - -- | The response status code. listKeysResponse     :: Int -- ^ 'lkrsResponseStatus'     -> ListKeysResponse listKeysResponse pResponseStatus_ =-    ListKeysResponse'-    { _lkrsTruncated = Nothing-    , _lkrsKeys = Nothing-    , _lkrsNextMarker = Nothing-    , _lkrsResponseStatus = pResponseStatus_-    }+  ListKeysResponse'+  { _lkrsTruncated = Nothing+  , _lkrsKeys = Nothing+  , _lkrsNextMarker = Nothing+  , _lkrsResponseStatus = pResponseStatus_+  } --- | A flag that indicates whether there are more items in the list. If your results were truncated, you can use the @Marker@ parameter to make a subsequent pagination request to retrieve more items in the list.++-- | A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the @NextMarker@ element in this response to the @Marker@ parameter in a subsequent request. lkrsTruncated :: Lens' ListKeysResponse (Maybe Bool) lkrsTruncated = lens _lkrsTruncated (\ s a -> s{_lkrsTruncated = a}); --- | A list of keys.+-- | A list of customer master keys (CMKs). lkrsKeys :: Lens' ListKeysResponse [KeyListEntry] lkrsKeys = lens _lkrsKeys (\ s a -> s{_lkrsKeys = a}) . _Default . _Coerce; --- | When @Truncated@ is true, this value is present and contains the value to use for the @Marker@ parameter in a subsequent pagination request.+-- | When @Truncated@ is true, this element is present and contains the value to use for the @Marker@ parameter in a subsequent request. lkrsNextMarker :: Lens' ListKeysResponse (Maybe Text) lkrsNextMarker = lens _lkrsNextMarker (\ s a -> s{_lkrsNextMarker = a}); @@ -169,4 +169,4 @@ lkrsResponseStatus :: Lens' ListKeysResponse Int lkrsResponseStatus = lens _lkrsResponseStatus (\ s a -> s{_lkrsResponseStatus = a}); -instance NFData ListKeysResponse+instance NFData ListKeysResponse where

@@ -0,0 +1,176 @@+{-# LANGUAGE DeriveDataTypeable #-}+{-# LANGUAGE DeriveGeneric      #-}+{-# LANGUAGE OverloadedStrings  #-}+{-# LANGUAGE RecordWildCards    #-}+{-# LANGUAGE TypeFamilies       #-}++{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Network.AWS.KMS.ListResourceTags+-- Copyright   : (c) 2013-2017 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Returns a list of all tags for the specified customer master key (CMK).+--+--+-- You cannot perform this operation on a CMK in a different AWS account.+--+module Network.AWS.KMS.ListResourceTags+    (+    -- * Creating a Request+      listResourceTags+    , ListResourceTags+    -- * Request Lenses+    , lrtMarker+    , lrtLimit+    , lrtKeyId++    -- * Destructuring the Response+    , listResourceTagsResponse+    , ListResourceTagsResponse+    -- * Response Lenses+    , lrtrsTruncated+    , lrtrsNextMarker+    , lrtrsTags+    , lrtrsResponseStatus+    ) where++import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response++-- | /See:/ 'listResourceTags' smart constructor.+data ListResourceTags = ListResourceTags'+  { _lrtMarker :: !(Maybe Text)+  , _lrtLimit  :: !(Maybe Nat)+  , _lrtKeyId  :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic)+++-- | Creates a value of 'ListResourceTags' with the minimum fields required to make a request.+--+-- Use one of the following lenses to modify other fields as desired:+--+-- * 'lrtMarker' - Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. Do not attempt to construct this value. Use only the value of @NextMarker@ from the truncated response you just received.+--+-- * 'lrtLimit' - Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 50, inclusive. If you do not include a value, it defaults to 50.+--+-- * 'lrtKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' .+listResourceTags+    :: Text -- ^ 'lrtKeyId'+    -> ListResourceTags+listResourceTags pKeyId_ =+  ListResourceTags'+  {_lrtMarker = Nothing, _lrtLimit = Nothing, _lrtKeyId = pKeyId_}+++-- | Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. Do not attempt to construct this value. Use only the value of @NextMarker@ from the truncated response you just received.+lrtMarker :: Lens' ListResourceTags (Maybe Text)+lrtMarker = lens _lrtMarker (\ s a -> s{_lrtMarker = a});++-- | Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 50, inclusive. If you do not include a value, it defaults to 50.+lrtLimit :: Lens' ListResourceTags (Maybe Natural)+lrtLimit = lens _lrtLimit (\ s a -> s{_lrtLimit = a}) . mapping _Nat;++-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' .+lrtKeyId :: Lens' ListResourceTags Text+lrtKeyId = lens _lrtKeyId (\ s a -> s{_lrtKeyId = a});++instance AWSRequest ListResourceTags where+        type Rs ListResourceTags = ListResourceTagsResponse+        request = postJSON kms+        response+          = receiveJSON+              (\ s h x ->+                 ListResourceTagsResponse' <$>+                   (x .?> "Truncated") <*> (x .?> "NextMarker") <*>+                     (x .?> "Tags" .!@ mempty)+                     <*> (pure (fromEnum s)))++instance Hashable ListResourceTags where++instance NFData ListResourceTags where++instance ToHeaders ListResourceTags where+        toHeaders+          = const+              (mconcat+                 ["X-Amz-Target" =#+                    ("TrentService.ListResourceTags" :: ByteString),+                  "Content-Type" =#+                    ("application/x-amz-json-1.1" :: ByteString)])++instance ToJSON ListResourceTags where+        toJSON ListResourceTags'{..}+          = object+              (catMaybes+                 [("Marker" .=) <$> _lrtMarker,+                  ("Limit" .=) <$> _lrtLimit,+                  Just ("KeyId" .= _lrtKeyId)])++instance ToPath ListResourceTags where+        toPath = const "/"++instance ToQuery ListResourceTags where+        toQuery = const mempty++-- | /See:/ 'listResourceTagsResponse' smart constructor.+data ListResourceTagsResponse = ListResourceTagsResponse'+  { _lrtrsTruncated      :: !(Maybe Bool)+  , _lrtrsNextMarker     :: !(Maybe Text)+  , _lrtrsTags           :: !(Maybe [Tag])+  , _lrtrsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic)+++-- | Creates a value of 'ListResourceTagsResponse' with the minimum fields required to make a request.+--+-- Use one of the following lenses to modify other fields as desired:+--+-- * 'lrtrsTruncated' - A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the @NextMarker@ element in this response to the @Marker@ parameter in a subsequent request.+--+-- * 'lrtrsNextMarker' - When @Truncated@ is true, this element is present and contains the value to use for the @Marker@ parameter in a subsequent request. Do not assume or infer any information from this value.+--+-- * 'lrtrsTags' - A list of tags. Each tag consists of a tag key and a tag value.+--+-- * 'lrtrsResponseStatus' - -- | The response status code.+listResourceTagsResponse+    :: Int -- ^ 'lrtrsResponseStatus'+    -> ListResourceTagsResponse+listResourceTagsResponse pResponseStatus_ =+  ListResourceTagsResponse'+  { _lrtrsTruncated = Nothing+  , _lrtrsNextMarker = Nothing+  , _lrtrsTags = Nothing+  , _lrtrsResponseStatus = pResponseStatus_+  }+++-- | A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the @NextMarker@ element in this response to the @Marker@ parameter in a subsequent request.+lrtrsTruncated :: Lens' ListResourceTagsResponse (Maybe Bool)+lrtrsTruncated = lens _lrtrsTruncated (\ s a -> s{_lrtrsTruncated = a});++-- | When @Truncated@ is true, this element is present and contains the value to use for the @Marker@ parameter in a subsequent request. Do not assume or infer any information from this value.+lrtrsNextMarker :: Lens' ListResourceTagsResponse (Maybe Text)+lrtrsNextMarker = lens _lrtrsNextMarker (\ s a -> s{_lrtrsNextMarker = a});++-- | A list of tags. Each tag consists of a tag key and a tag value.+lrtrsTags :: Lens' ListResourceTagsResponse [Tag]+lrtrsTags = lens _lrtrsTags (\ s a -> s{_lrtrsTags = a}) . _Default . _Coerce;++-- | -- | The response status code.+lrtrsResponseStatus :: Lens' ListResourceTagsResponse Int+lrtrsResponseStatus = lens _lrtrsResponseStatus (\ s a -> s{_lrtrsResponseStatus = a});++instance NFData ListResourceTagsResponse where

@@ -12,9 +12,9 @@  -- | -- Module      : Network.AWS.KMS.ListRetirableGrants--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) --@@ -42,44 +42,46 @@     , lgNextMarker     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'listRetirableGrants' smart constructor. data ListRetirableGrants = ListRetirableGrants'-    { _lrgMarker            :: !(Maybe Text)-    , _lrgLimit             :: !(Maybe Nat)-    , _lrgRetiringPrincipal :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _lrgMarker            :: !(Maybe Text)+  , _lrgLimit             :: !(Maybe Nat)+  , _lrgRetiringPrincipal :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ListRetirableGrants' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'lrgMarker' - Use this parameter only when paginating results and only in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the response you just received.+-- * 'lrgMarker' - Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. ----- * 'lrgLimit' - When paginating results, specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the @Truncated@ element in the response is set to true. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.+-- * 'lrgLimit' - Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50. -- -- * 'lrgRetiringPrincipal' - The retiring principal for which to list grants. To specify the retiring principal, use the <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html Amazon Resource Name (ARN)> of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax for specifying a principal, see <http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam AWS Identity and Access Management (IAM)> in the Example ARNs section of the /Amazon Web Services General Reference/ . listRetirableGrants     :: Text -- ^ 'lrgRetiringPrincipal'     -> ListRetirableGrants listRetirableGrants pRetiringPrincipal_ =-    ListRetirableGrants'-    { _lrgMarker = Nothing-    , _lrgLimit = Nothing-    , _lrgRetiringPrincipal = pRetiringPrincipal_-    }+  ListRetirableGrants'+  { _lrgMarker = Nothing+  , _lrgLimit = Nothing+  , _lrgRetiringPrincipal = pRetiringPrincipal_+  } --- | Use this parameter only when paginating results and only in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the response you just received.++-- | Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of @NextMarker@ from the truncated response you just received. lrgMarker :: Lens' ListRetirableGrants (Maybe Text) lrgMarker = lens _lrgMarker (\ s a -> s{_lrgMarker = a}); --- | When paginating results, specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the @Truncated@ element in the response is set to true. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.+-- | Use this parameter to specify the maximum number of items to return. When this value is present, AWS KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50. lrgLimit :: Lens' ListRetirableGrants (Maybe Natural) lrgLimit = lens _lrgLimit (\ s a -> s{_lrgLimit = a}) . mapping _Nat; @@ -92,9 +94,9 @@         request = postJSON kms         response = receiveJSON (\ s h x -> eitherParseJSON x) -instance Hashable ListRetirableGrants+instance Hashable ListRetirableGrants where -instance NFData ListRetirableGrants+instance NFData ListRetirableGrants where  instance ToHeaders ListRetirableGrants where         toHeaders

@@ -12,13 +12,13 @@  -- | -- Module      : Network.AWS.KMS.PutKeyPolicy--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Attaches a key policy to the specified customer master key (CMK).+-- Attaches a key policy to the specified customer master key (CMK). You cannot perform this operation on a CMK in a different AWS account. -- -- -- For more information about key policies, see <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html Key Policies> in the /AWS Key Management Service Developer Guide/ .@@ -39,58 +39,60 @@     , PutKeyPolicyResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'putKeyPolicy' smart constructor. data PutKeyPolicy = PutKeyPolicy'-    { _pkpBypassPolicyLockoutSafetyCheck :: !(Maybe Bool)-    , _pkpKeyId                          :: !Text-    , _pkpPolicyName                     :: !Text-    , _pkpPolicy                         :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _pkpBypassPolicyLockoutSafetyCheck :: !(Maybe Bool)+  , _pkpKeyId                          :: !Text+  , _pkpPolicyName                     :: !Text+  , _pkpPolicy                         :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'PutKeyPolicy' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'pkpBypassPolicyLockoutSafetyCheck' - A flag to indicate whether to bypass the key policy lockout safety check. /Important:/ Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ . Use this parameter only when you intend to prevent the principal making the request from making a subsequent @PutKeyPolicy@ request on the CMK. The default value is false.+-- * 'pkpBypassPolicyLockoutSafetyCheck' - A flag to indicate whether to bypass the key policy lockout safety check. /Important:/ Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ . Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent @PutKeyPolicy@ request on the CMK. The default value is false. ----- * 'pkpKeyId' - A unique identifier for the CMK. Use the CMK's unique identifier or its Amazon Resource Name (ARN). For example:     * Unique ID: 1234abcd-12ab-34cd-56ef-1234567890ab     * ARN: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab+-- * 'pkpKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . ----- * 'pkpPolicyName' - The name of the key policy. This value must be @default@ .+-- * 'pkpPolicyName' - The name of the key policy. The only valid value is @default@ . ----- * 'pkpPolicy' - The key policy to attach to the CMK. If you do not set @BypassPolicyLockoutSafetyCheck@ to true, the policy must meet the following criteria:     * It must allow the principal making the @PutKeyPolicy@ request to make a subsequent @PutKeyPolicy@ request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ .     * The principal(s) specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see <http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency Changes that I make are not always immediately visible> in the /IAM User Guide/ . The policy size limit is 32 KiB (32768 bytes).+-- * 'pkpPolicy' - The key policy to attach to the CMK. If you do not set @BypassPolicyLockoutSafetyCheck@ to true, the policy must meet the following criteria:     * It must allow the principal that is making the @PutKeyPolicy@ request to make a subsequent @PutKeyPolicy@ request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ .     * The principals that are specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see <http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency Changes that I make are not always immediately visible> in the /IAM User Guide/ . The policy size limit is 32 kilobytes (32768 bytes). putKeyPolicy     :: Text -- ^ 'pkpKeyId'     -> Text -- ^ 'pkpPolicyName'     -> Text -- ^ 'pkpPolicy'     -> PutKeyPolicy putKeyPolicy pKeyId_ pPolicyName_ pPolicy_ =-    PutKeyPolicy'-    { _pkpBypassPolicyLockoutSafetyCheck = Nothing-    , _pkpKeyId = pKeyId_-    , _pkpPolicyName = pPolicyName_-    , _pkpPolicy = pPolicy_-    }+  PutKeyPolicy'+  { _pkpBypassPolicyLockoutSafetyCheck = Nothing+  , _pkpKeyId = pKeyId_+  , _pkpPolicyName = pPolicyName_+  , _pkpPolicy = pPolicy_+  } --- | A flag to indicate whether to bypass the key policy lockout safety check. /Important:/ Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ . Use this parameter only when you intend to prevent the principal making the request from making a subsequent @PutKeyPolicy@ request on the CMK. The default value is false.++-- | A flag to indicate whether to bypass the key policy lockout safety check. /Important:/ Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ . Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent @PutKeyPolicy@ request on the CMK. The default value is false. pkpBypassPolicyLockoutSafetyCheck :: Lens' PutKeyPolicy (Maybe Bool) pkpBypassPolicyLockoutSafetyCheck = lens _pkpBypassPolicyLockoutSafetyCheck (\ s a -> s{_pkpBypassPolicyLockoutSafetyCheck = a}); --- | A unique identifier for the CMK. Use the CMK's unique identifier or its Amazon Resource Name (ARN). For example:     * Unique ID: 1234abcd-12ab-34cd-56ef-1234567890ab     * ARN: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab+-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . pkpKeyId :: Lens' PutKeyPolicy Text pkpKeyId = lens _pkpKeyId (\ s a -> s{_pkpKeyId = a}); --- | The name of the key policy. This value must be @default@ .+-- | The name of the key policy. The only valid value is @default@ . pkpPolicyName :: Lens' PutKeyPolicy Text pkpPolicyName = lens _pkpPolicyName (\ s a -> s{_pkpPolicyName = a}); --- | The key policy to attach to the CMK. If you do not set @BypassPolicyLockoutSafetyCheck@ to true, the policy must meet the following criteria:     * It must allow the principal making the @PutKeyPolicy@ request to make a subsequent @PutKeyPolicy@ request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ .     * The principal(s) specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see <http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency Changes that I make are not always immediately visible> in the /IAM User Guide/ . The policy size limit is 32 KiB (32768 bytes).+-- | The key policy to attach to the CMK. If you do not set @BypassPolicyLockoutSafetyCheck@ to true, the policy must meet the following criteria:     * It must allow the principal that is making the @PutKeyPolicy@ request to make a subsequent @PutKeyPolicy@ request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam Default Key Policy> section in the /AWS Key Management Service Developer Guide/ .     * The principals that are specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see <http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency Changes that I make are not always immediately visible> in the /IAM User Guide/ . The policy size limit is 32 kilobytes (32768 bytes). pkpPolicy :: Lens' PutKeyPolicy Text pkpPolicy = lens _pkpPolicy (\ s a -> s{_pkpPolicy = a}); @@ -99,9 +101,9 @@         request = postJSON kms         response = receiveNull PutKeyPolicyResponse' -instance Hashable PutKeyPolicy+instance Hashable PutKeyPolicy where -instance NFData PutKeyPolicy+instance NFData PutKeyPolicy where  instance ToHeaders PutKeyPolicy where         toHeaders@@ -130,13 +132,15 @@  -- | /See:/ 'putKeyPolicyResponse' smart constructor. data PutKeyPolicyResponse =-    PutKeyPolicyResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  PutKeyPolicyResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'PutKeyPolicyResponse' with the minimum fields required to make a request. -- putKeyPolicyResponse     :: PutKeyPolicyResponse putKeyPolicyResponse = PutKeyPolicyResponse' -instance NFData PutKeyPolicyResponse++instance NFData PutKeyPolicyResponse where

@@ -12,17 +12,19 @@  -- | -- Module      : Network.AWS.KMS.ReEncrypt--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Encrypts data on the server side with a new customer master key without exposing the plaintext of the data on the client side. The data is first decrypted and then encrypted. This operation can also be used to change the encryption context of a ciphertext.+-- Encrypts data on the server side with a new customer master key (CMK) without exposing the plaintext of the data on the client side. The data is first decrypted and then reencrypted. You can also use this operation to change the encryption context of a ciphertext. -- ----- Unlike other actions, @ReEncrypt@ is authorized twice - once as @ReEncryptFrom@ on the source key and once as @ReEncryptTo@ on the destination key. We therefore recommend that you include the @"action":"kms:ReEncrypt*"@ statement in your key policies to permit re-encryption from or to the key. The statement is included automatically when you authorize use of the key through the console but must be included manually when you set a policy by using the 'PutKeyPolicy' function.+-- You can reencrypt data using CMKs in different AWS accounts. --+-- Unlike other operations, @ReEncrypt@ is authorized twice, once as @ReEncryptFrom@ on the source CMK and once as @ReEncryptTo@ on the destination CMK. We recommend that you include the @"kms:ReEncrypt*"@ permission in your <http://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html key policies> to permit reencryption from or to the CMK. This permission is automatically included in the key policy when you create a CMK through the console, but you must include it manually when you create a CMK programmatically or when you set a key policy with the 'PutKeyPolicy' operation.+-- module Network.AWS.KMS.ReEncrypt     (     -- * Creating a Request@@ -45,49 +47,51 @@     , rersResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'reEncrypt' smart constructor. data ReEncrypt = ReEncrypt'-    { _reDestinationEncryptionContext :: !(Maybe (Map Text Text))-    , _reSourceEncryptionContext      :: !(Maybe (Map Text Text))-    , _reGrantTokens                  :: !(Maybe [Text])-    , _reCiphertextBlob               :: !Base64-    , _reDestinationKeyId             :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _reDestinationEncryptionContext :: !(Maybe (Map Text Text))+  , _reSourceEncryptionContext      :: !(Maybe (Map Text Text))+  , _reGrantTokens                  :: !(Maybe [Text])+  , _reCiphertextBlob               :: !Base64+  , _reDestinationKeyId             :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ReEncrypt' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'reDestinationEncryptionContext' - Encryption context to be used when the data is re-encrypted.+-- * 'reDestinationEncryptionContext' - Encryption context to use when the data is reencrypted. -- -- * 'reSourceEncryptionContext' - Encryption context used to encrypt and decrypt the data specified in the @CiphertextBlob@ parameter. -- -- * 'reGrantTokens' - A list of grant tokens. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token Grant Tokens> in the /AWS Key Management Service Developer Guide/ . ----- * 'reCiphertextBlob' - Ciphertext of the data to re-encrypt.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- * 'reCiphertextBlob' - Ciphertext of the data to reencrypt.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. ----- * 'reDestinationKeyId' - A unique identifier for the customer master key used to re-encrypt the data. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by "alias/".     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias/MyAliasName     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012     * Alias Name Example - alias/MyAliasName+-- * 'reDestinationKeyId' - A unique identifier for the CMK that is used to reencrypt the data. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To get the alias name and alias ARN, use 'ListAliases' . reEncrypt     :: ByteString -- ^ 'reCiphertextBlob'     -> Text -- ^ 'reDestinationKeyId'     -> ReEncrypt reEncrypt pCiphertextBlob_ pDestinationKeyId_ =-    ReEncrypt'-    { _reDestinationEncryptionContext = Nothing-    , _reSourceEncryptionContext = Nothing-    , _reGrantTokens = Nothing-    , _reCiphertextBlob = _Base64 # pCiphertextBlob_-    , _reDestinationKeyId = pDestinationKeyId_-    }+  ReEncrypt'+  { _reDestinationEncryptionContext = Nothing+  , _reSourceEncryptionContext = Nothing+  , _reGrantTokens = Nothing+  , _reCiphertextBlob = _Base64 # pCiphertextBlob_+  , _reDestinationKeyId = pDestinationKeyId_+  } --- | Encryption context to be used when the data is re-encrypted.++-- | Encryption context to use when the data is reencrypted. reDestinationEncryptionContext :: Lens' ReEncrypt (HashMap Text Text) reDestinationEncryptionContext = lens _reDestinationEncryptionContext (\ s a -> s{_reDestinationEncryptionContext = a}) . _Default . _Map; @@ -99,11 +103,11 @@ reGrantTokens :: Lens' ReEncrypt [Text] reGrantTokens = lens _reGrantTokens (\ s a -> s{_reGrantTokens = a}) . _Default . _Coerce; --- | Ciphertext of the data to re-encrypt.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- | Ciphertext of the data to reencrypt.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. reCiphertextBlob :: Lens' ReEncrypt ByteString reCiphertextBlob = lens _reCiphertextBlob (\ s a -> s{_reCiphertextBlob = a}) . _Base64; --- | A unique identifier for the customer master key used to re-encrypt the data. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by "alias/".     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias/MyAliasName     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012     * Alias Name Example - alias/MyAliasName+-- | A unique identifier for the CMK that is used to reencrypt the data. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@      * Alias name: @alias/ExampleAlias@      * Alias ARN: @arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To get the alias name and alias ARN, use 'ListAliases' . reDestinationKeyId :: Lens' ReEncrypt Text reDestinationKeyId = lens _reDestinationKeyId (\ s a -> s{_reDestinationKeyId = a}); @@ -118,9 +122,9 @@                      (x .?> "CiphertextBlob")                      <*> (pure (fromEnum s))) -instance Hashable ReEncrypt+instance Hashable ReEncrypt where -instance NFData ReEncrypt+instance NFData ReEncrypt where  instance ToHeaders ReEncrypt where         toHeaders@@ -151,43 +155,45 @@  -- | /See:/ 'reEncryptResponse' smart constructor. data ReEncryptResponse = ReEncryptResponse'-    { _rersSourceKeyId    :: !(Maybe Text)-    , _rersKeyId          :: !(Maybe Text)-    , _rersCiphertextBlob :: !(Maybe Base64)-    , _rersResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _rersSourceKeyId    :: !(Maybe Text)+  , _rersKeyId          :: !(Maybe Text)+  , _rersCiphertextBlob :: !(Maybe Base64)+  , _rersResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ReEncryptResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'rersSourceKeyId' - Unique identifier of the key used to originally encrypt the data.+-- * 'rersSourceKeyId' - Unique identifier of the CMK used to originally encrypt the data. ----- * 'rersKeyId' - Unique identifier of the key used to re-encrypt the data.+-- * 'rersKeyId' - Unique identifier of the CMK used to reencrypt the data. ----- * 'rersCiphertextBlob' - The re-encrypted data. If you are using the CLI, the value is Base64 encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- * 'rersCiphertextBlob' - The reencrypted data. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. -- -- * 'rersResponseStatus' - -- | The response status code. reEncryptResponse     :: Int -- ^ 'rersResponseStatus'     -> ReEncryptResponse reEncryptResponse pResponseStatus_ =-    ReEncryptResponse'-    { _rersSourceKeyId = Nothing-    , _rersKeyId = Nothing-    , _rersCiphertextBlob = Nothing-    , _rersResponseStatus = pResponseStatus_-    }+  ReEncryptResponse'+  { _rersSourceKeyId = Nothing+  , _rersKeyId = Nothing+  , _rersCiphertextBlob = Nothing+  , _rersResponseStatus = pResponseStatus_+  } --- | Unique identifier of the key used to originally encrypt the data.++-- | Unique identifier of the CMK used to originally encrypt the data. rersSourceKeyId :: Lens' ReEncryptResponse (Maybe Text) rersSourceKeyId = lens _rersSourceKeyId (\ s a -> s{_rersSourceKeyId = a}); --- | Unique identifier of the key used to re-encrypt the data.+-- | Unique identifier of the CMK used to reencrypt the data. rersKeyId :: Lens' ReEncryptResponse (Maybe Text) rersKeyId = lens _rersKeyId (\ s a -> s{_rersKeyId = a}); --- | The re-encrypted data. If you are using the CLI, the value is Base64 encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data.+-- | The reencrypted data. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- /Note:/ This 'Lens' automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This 'Lens' accepts and returns only raw unencoded data. rersCiphertextBlob :: Lens' ReEncryptResponse (Maybe ByteString) rersCiphertextBlob = lens _rersCiphertextBlob (\ s a -> s{_rersCiphertextBlob = a}) . mapping _Base64; @@ -195,4 +201,4 @@ rersResponseStatus :: Lens' ReEncryptResponse Int rersResponseStatus = lens _rersResponseStatus (\ s a -> s{_rersResponseStatus = a}); -instance NFData ReEncryptResponse+instance NFData ReEncryptResponse where

@@ -12,24 +12,24 @@  -- | -- Module      : Network.AWS.KMS.RetireGrant--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Retires a grant. You can retire a grant when you're done using it to clean up. You should revoke a grant when you intend to actively deny operations that depend on it. The following are permitted to call this API:+-- Retires a grant. To clean up, you can retire a grant when you're done using it. You should revoke a grant when you intend to actively deny operations that depend on it. The following are permitted to call this API: -- -----     * The account that created the grant+--     * The AWS account (root user) under which the grant was created -----     * The @RetiringPrincipal@ , if present+--     * The @RetiringPrincipal@ , if present in the grant -----     * The @GranteePrincipal@ , if @RetireGrant@ is a grantee operation+--     * The @GranteePrincipal@ , if @RetireGrant@ is an operation specified in the grant -- -- ----- The grant to retire must be identified by its grant token or by a combination of the key ARN and the grant ID. A grant token is a unique variable-length base64-encoded string. A grant ID is a 64 character unique identifier of a grant. Both are returned by the @CreateGrant@ function.+-- You must identify the grant to retire by its grant token or by a combination of the grant ID and the Amazon Resource Name (ARN) of the customer master key (CMK). A grant token is a unique variable-length base64-encoded string. A grant ID is a 64 character unique identifier of a grant. The 'CreateGrant' operation returns both. -- module Network.AWS.KMS.RetireGrant     (@@ -46,43 +46,42 @@     , RetireGrantResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'retireGrant' smart constructor. data RetireGrant = RetireGrant'-    { _rgKeyId      :: !(Maybe Text)-    , _rgGrantId    :: !(Maybe Text)-    , _rgGrantToken :: !(Maybe Text)-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _rgKeyId      :: !(Maybe Text)+  , _rgGrantId    :: !(Maybe Text)+  , _rgGrantToken :: !(Maybe Text)+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'RetireGrant' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'rgKeyId' - A unique identifier for the customer master key associated with the grant. This value can be a globally unique identifier or a fully specified ARN of the key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- * 'rgKeyId' - The Amazon Resource Name (ARN) of the CMK associated with the grant.  For example: @arn:aws:kms:us-east-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab@ ----- * 'rgGrantId' - Unique identifier of the grant to be retired. The grant ID is returned by the @CreateGrant@ function.     * Grant ID Example - 0123456789012345678901234567890123456789012345678901234567890123+-- * 'rgGrantId' - Unique identifier of the grant to retire. The grant ID is returned in the response to a @CreateGrant@ operation.     * Grant ID Example - 0123456789012345678901234567890123456789012345678901234567890123 -- -- * 'rgGrantToken' - Token that identifies the grant to be retired. retireGrant     :: RetireGrant retireGrant =-    RetireGrant'-    { _rgKeyId = Nothing-    , _rgGrantId = Nothing-    , _rgGrantToken = Nothing-    }+  RetireGrant'+  {_rgKeyId = Nothing, _rgGrantId = Nothing, _rgGrantToken = Nothing} --- | A unique identifier for the customer master key associated with the grant. This value can be a globally unique identifier or a fully specified ARN of the key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012++-- | The Amazon Resource Name (ARN) of the CMK associated with the grant.  For example: @arn:aws:kms:us-east-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab@ rgKeyId :: Lens' RetireGrant (Maybe Text) rgKeyId = lens _rgKeyId (\ s a -> s{_rgKeyId = a}); --- | Unique identifier of the grant to be retired. The grant ID is returned by the @CreateGrant@ function.     * Grant ID Example - 0123456789012345678901234567890123456789012345678901234567890123+-- | Unique identifier of the grant to retire. The grant ID is returned in the response to a @CreateGrant@ operation.     * Grant ID Example - 0123456789012345678901234567890123456789012345678901234567890123 rgGrantId :: Lens' RetireGrant (Maybe Text) rgGrantId = lens _rgGrantId (\ s a -> s{_rgGrantId = a}); @@ -95,9 +94,9 @@         request = postJSON kms         response = receiveNull RetireGrantResponse' -instance Hashable RetireGrant+instance Hashable RetireGrant where -instance NFData RetireGrant+instance NFData RetireGrant where  instance ToHeaders RetireGrant where         toHeaders@@ -124,13 +123,15 @@  -- | /See:/ 'retireGrantResponse' smart constructor. data RetireGrantResponse =-    RetireGrantResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  RetireGrantResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'RetireGrantResponse' with the minimum fields required to make a request. -- retireGrantResponse     :: RetireGrantResponse retireGrantResponse = RetireGrantResponse' -instance NFData RetireGrantResponse++instance NFData RetireGrantResponse where

@@ -12,15 +12,17 @@  -- | -- Module      : Network.AWS.KMS.RevokeGrant--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Revokes a grant. You can revoke a grant to actively deny operations that depend on it.+-- Revokes the specified grant for the specified customer master key (CMK). You can revoke a grant to actively deny operations that depend on it. -- --+-- To perform this operation on a CMK in a different AWS account, specify the key ARN in the value of the KeyId parameter.+-- module Network.AWS.KMS.RevokeGrant     (     -- * Creating a Request@@ -35,24 +37,25 @@     , RevokeGrantResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'revokeGrant' smart constructor. data RevokeGrant = RevokeGrant'-    { _rKeyId   :: !Text-    , _rGrantId :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _rKeyId   :: !Text+  , _rGrantId :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'RevokeGrant' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'rKeyId' - A unique identifier for the customer master key associated with the grant. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- * 'rKeyId' - A unique identifier for the customer master key associated with the grant. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . -- -- * 'rGrantId' - Identifier of the grant to be revoked. revokeGrant@@ -60,12 +63,10 @@     -> Text -- ^ 'rGrantId'     -> RevokeGrant revokeGrant pKeyId_ pGrantId_ =-    RevokeGrant'-    { _rKeyId = pKeyId_-    , _rGrantId = pGrantId_-    }+  RevokeGrant' {_rKeyId = pKeyId_, _rGrantId = pGrantId_} --- | A unique identifier for the customer master key associated with the grant. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012++-- | A unique identifier for the customer master key associated with the grant. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . rKeyId :: Lens' RevokeGrant Text rKeyId = lens _rKeyId (\ s a -> s{_rKeyId = a}); @@ -78,9 +79,9 @@         request = postJSON kms         response = receiveNull RevokeGrantResponse' -instance Hashable RevokeGrant+instance Hashable RevokeGrant where -instance NFData RevokeGrant+instance NFData RevokeGrant where  instance ToHeaders RevokeGrant where         toHeaders@@ -106,13 +107,15 @@  -- | /See:/ 'revokeGrantResponse' smart constructor. data RevokeGrantResponse =-    RevokeGrantResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  RevokeGrantResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'RevokeGrantResponse' with the minimum fields required to make a request. -- revokeGrantResponse     :: RevokeGrantResponse revokeGrantResponse = RevokeGrantResponse' -instance NFData RevokeGrantResponse++instance NFData RevokeGrantResponse where

@@ -12,15 +12,17 @@  -- | -- Module      : Network.AWS.KMS.ScheduleKeyDeletion--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Schedules the deletion of a customer master key (CMK). You may provide a waiting period, specified in days, before deletion occurs. If you do not provide a waiting period, the default period of 30 days is used. When this operation is successful, the state of the CMK changes to @PendingDeletion@ . Before the waiting period ends, you can use 'CancelKeyDeletion' to cancel the deletion of the CMK. After the waiting period ends, AWS KMS deletes the CMK and all AWS KMS data associated with it, including all aliases that point to it.+-- Schedules the deletion of a customer master key (CMK). You may provide a waiting period, specified in days, before deletion occurs. If you do not provide a waiting period, the default period of 30 days is used. When this operation is successful, the state of the CMK changes to @PendingDeletion@ . Before the waiting period ends, you can use 'CancelKeyDeletion' to cancel the deletion of the CMK. After the waiting period ends, AWS KMS deletes the CMK and all AWS KMS data associated with it, including all aliases that refer to it. -- --+-- You cannot perform this operation on a CMK in a different AWS account.+-- -- /Important:/ Deleting a CMK is a destructive and potentially dangerous operation. When a CMK is deleted, all data that was encrypted under the CMK is rendered unrecoverable. To restrict the use of a CMK without deleting it, use 'DisableKey' . -- -- For more information about scheduling a CMK for deletion, see <http://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html Deleting Customer Master Keys> in the /AWS Key Management Service Developer Guide/ .@@ -43,40 +45,39 @@     , skdrsResponseStatus     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'scheduleKeyDeletion' smart constructor. data ScheduleKeyDeletion = ScheduleKeyDeletion'-    { _skdPendingWindowInDays :: !(Maybe Nat)-    , _skdKeyId               :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _skdPendingWindowInDays :: !(Maybe Nat)+  , _skdKeyId               :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ScheduleKeyDeletion' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- -- * 'skdPendingWindowInDays' - The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the customer master key (CMK). This value is optional. If you include a value, it must be between 7 and 30, inclusive. If you do not include a value, it defaults to 30. ----- * 'skdKeyId' - The unique identifier for the customer master key (CMK) to delete. To specify this value, use the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples:     * Unique key ID: 1234abcd-12ab-34cd-56ef-1234567890ab     * Key ARN: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To obtain the unique key ID and key ARN for a given CMK, use 'ListKeys' or 'DescribeKey' .+-- * 'skdKeyId' - The unique identifier of the customer master key (CMK) to delete. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . scheduleKeyDeletion     :: Text -- ^ 'skdKeyId'     -> ScheduleKeyDeletion scheduleKeyDeletion pKeyId_ =-    ScheduleKeyDeletion'-    { _skdPendingWindowInDays = Nothing-    , _skdKeyId = pKeyId_-    }+  ScheduleKeyDeletion' {_skdPendingWindowInDays = Nothing, _skdKeyId = pKeyId_} + -- | The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the customer master key (CMK). This value is optional. If you include a value, it must be between 7 and 30, inclusive. If you do not include a value, it defaults to 30. skdPendingWindowInDays :: Lens' ScheduleKeyDeletion (Maybe Natural) skdPendingWindowInDays = lens _skdPendingWindowInDays (\ s a -> s{_skdPendingWindowInDays = a}) . mapping _Nat; --- | The unique identifier for the customer master key (CMK) to delete. To specify this value, use the unique key ID or the Amazon Resource Name (ARN) of the CMK. Examples:     * Unique key ID: 1234abcd-12ab-34cd-56ef-1234567890ab     * Key ARN: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To obtain the unique key ID and key ARN for a given CMK, use 'ListKeys' or 'DescribeKey' .+-- | The unique identifier of the customer master key (CMK) to delete. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . skdKeyId :: Lens' ScheduleKeyDeletion Text skdKeyId = lens _skdKeyId (\ s a -> s{_skdKeyId = a}); @@ -91,9 +92,9 @@                    (x .?> "KeyId") <*> (x .?> "DeletionDate") <*>                      (pure (fromEnum s))) -instance Hashable ScheduleKeyDeletion+instance Hashable ScheduleKeyDeletion where -instance NFData ScheduleKeyDeletion+instance NFData ScheduleKeyDeletion where  instance ToHeaders ScheduleKeyDeletion where         toHeaders@@ -120,11 +121,12 @@  -- | /See:/ 'scheduleKeyDeletionResponse' smart constructor. data ScheduleKeyDeletionResponse = ScheduleKeyDeletionResponse'-    { _skdrsKeyId          :: !(Maybe Text)-    , _skdrsDeletionDate   :: !(Maybe POSIX)-    , _skdrsResponseStatus :: !Int-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _skdrsKeyId          :: !(Maybe Text)+  , _skdrsDeletionDate   :: !(Maybe POSIX)+  , _skdrsResponseStatus :: !Int+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ScheduleKeyDeletionResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -138,12 +140,13 @@     :: Int -- ^ 'skdrsResponseStatus'     -> ScheduleKeyDeletionResponse scheduleKeyDeletionResponse pResponseStatus_ =-    ScheduleKeyDeletionResponse'-    { _skdrsKeyId = Nothing-    , _skdrsDeletionDate = Nothing-    , _skdrsResponseStatus = pResponseStatus_-    }+  ScheduleKeyDeletionResponse'+  { _skdrsKeyId = Nothing+  , _skdrsDeletionDate = Nothing+  , _skdrsResponseStatus = pResponseStatus_+  } + -- | The unique identifier of the customer master key (CMK) for which deletion is scheduled. skdrsKeyId :: Lens' ScheduleKeyDeletionResponse (Maybe Text) skdrsKeyId = lens _skdrsKeyId (\ s a -> s{_skdrsKeyId = a});@@ -156,4 +159,4 @@ skdrsResponseStatus :: Lens' ScheduleKeyDeletionResponse Int skdrsResponseStatus = lens _skdrsResponseStatus (\ s a -> s{_skdrsResponseStatus = a}); -instance NFData ScheduleKeyDeletionResponse+instance NFData ScheduleKeyDeletionResponse where

@@ -0,0 +1,123 @@+{-# LANGUAGE DeriveDataTypeable #-}+{-# LANGUAGE DeriveGeneric      #-}+{-# LANGUAGE OverloadedStrings  #-}+{-# LANGUAGE RecordWildCards    #-}+{-# LANGUAGE TypeFamilies       #-}++{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Network.AWS.KMS.TagResource+-- Copyright   : (c) 2013-2017 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Adds or overwrites one or more tags for the specified customer master key (CMK). You cannot perform this operation on a CMK in a different AWS account.+--+--+-- Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.+--+-- You cannot use the same tag key more than once per CMK. For example, consider a CMK with one tag whose tag key is @Purpose@ and tag value is @Test@ . If you send a @TagResource@ request for this CMK with a tag key of @Purpose@ and a tag value of @Prod@ , it does not create a second tag. Instead, the original tag is overwritten with the new tag value.+--+-- For information about the rules that apply to tag keys and tag values, see <http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation-tag-restrictions.html User-Defined Tag Restrictions> in the /AWS Billing and Cost Management User Guide/ .+--+module Network.AWS.KMS.TagResource+    (+    -- * Creating a Request+      tagResource+    , TagResource+    -- * Request Lenses+    , trKeyId+    , trTags++    -- * Destructuring the Response+    , tagResourceResponse+    , TagResourceResponse+    ) where++import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response++-- | /See:/ 'tagResource' smart constructor.+data TagResource = TagResource'+  { _trKeyId :: !Text+  , _trTags  :: ![Tag]+  } deriving (Eq, Read, Show, Data, Typeable, Generic)+++-- | Creates a value of 'TagResource' with the minimum fields required to make a request.+--+-- Use one of the following lenses to modify other fields as desired:+--+-- * 'trKeyId' - A unique identifier for the CMK you are tagging. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' .+--+-- * 'trTags' - One or more tags. Each tag consists of a tag key and a tag value.+tagResource+    :: Text -- ^ 'trKeyId'+    -> TagResource+tagResource pKeyId_ = TagResource' {_trKeyId = pKeyId_, _trTags = mempty}+++-- | A unique identifier for the CMK you are tagging. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' .+trKeyId :: Lens' TagResource Text+trKeyId = lens _trKeyId (\ s a -> s{_trKeyId = a});++-- | One or more tags. Each tag consists of a tag key and a tag value.+trTags :: Lens' TagResource [Tag]+trTags = lens _trTags (\ s a -> s{_trTags = a}) . _Coerce;++instance AWSRequest TagResource where+        type Rs TagResource = TagResourceResponse+        request = postJSON kms+        response = receiveNull TagResourceResponse'++instance Hashable TagResource where++instance NFData TagResource where++instance ToHeaders TagResource where+        toHeaders+          = const+              (mconcat+                 ["X-Amz-Target" =#+                    ("TrentService.TagResource" :: ByteString),+                  "Content-Type" =#+                    ("application/x-amz-json-1.1" :: ByteString)])++instance ToJSON TagResource where+        toJSON TagResource'{..}+          = object+              (catMaybes+                 [Just ("KeyId" .= _trKeyId),+                  Just ("Tags" .= _trTags)])++instance ToPath TagResource where+        toPath = const "/"++instance ToQuery TagResource where+        toQuery = const mempty++-- | /See:/ 'tagResourceResponse' smart constructor.+data TagResourceResponse =+  TagResourceResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic)+++-- | Creates a value of 'TagResourceResponse' with the minimum fields required to make a request.+--+tagResourceResponse+    :: TagResourceResponse+tagResourceResponse = TagResourceResponse'+++instance NFData TagResourceResponse where

@@ -4,9 +4,9 @@  -- | -- Module      : Network.AWS.KMS.Types--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) --@@ -25,6 +25,7 @@     , _KeyUnavailableException     , _IncorrectKeyMaterialException     , _KMSInternalException+    , _TagException     , _InvalidImportTokenException     , _NotFoundException     , _InvalidAliasNameException@@ -49,6 +50,9 @@     -- * GrantOperation     , GrantOperation (..) +    -- * KeyManagerType+    , KeyManagerType (..)+     -- * KeyState     , KeyState (..) @@ -98,6 +102,7 @@     , keyMetadata     , kmOrigin     , kmExpirationModel+    , kmKeyManager     , kmEnabled     , kmValidTo     , kmARN@@ -115,40 +120,48 @@     , lgTruncated     , lgGrants     , lgNextMarker++    -- * Tag+    , Tag+    , tag+    , tagTagKey+    , tagTagValue     ) where -import           Network.AWS.KMS.Types.Product-import           Network.AWS.KMS.Types.Sum-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Sign.V4+import Network.AWS.KMS.Types.Product+import Network.AWS.KMS.Types.Sum+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Sign.V4  -- | API version @2014-11-01@ of the Amazon Key Management Service SDK configuration. kms :: Service kms =-    Service-    { _svcAbbrev = "KMS"-    , _svcSigner = v4-    , _svcPrefix = "kms"-    , _svcVersion = "2014-11-01"-    , _svcEndpoint = defaultEndpoint kms-    , _svcTimeout = Just 70-    , _svcCheck = statusSuccess-    , _svcError = parseJSONError "KMS"-    , _svcRetry = retry-    }+  Service+  { _svcAbbrev = "KMS"+  , _svcSigner = v4+  , _svcPrefix = "kms"+  , _svcVersion = "2014-11-01"+  , _svcEndpoint = defaultEndpoint kms+  , _svcTimeout = Just 70+  , _svcCheck = statusSuccess+  , _svcError = parseJSONError "KMS"+  , _svcRetry = retry+  }   where     retry =-        Exponential-        { _retryBase = 5.0e-2-        , _retryGrowth = 2-        , _retryAttempts = 5-        , _retryCheck = check-        }+      Exponential+      { _retryBase = 5.0e-2+      , _retryGrowth = 2+      , _retryAttempts = 5+      , _retryCheck = check+      }     check e+      | has (hasCode "ThrottledException" . hasStatus 400) e =+        Just "throttled_exception"       | has (hasStatus 429) e = Just "too_many_requests"       | has (hasCode "ThrottlingException" . hasStatus 400) e =-          Just "throttling_exception"+        Just "throttling_exception"       | has (hasCode "Throttling" . hasStatus 400) e = Just "throttling"       | has (hasStatus 504) e = Just "gateway_timeout"       | has (hasStatus 502) e = Just "bad_gateway"@@ -157,133 +170,160 @@       | has (hasStatus 509) e = Just "limit_exceeded"       | otherwise = Nothing + -- | The request was rejected because the marker that specifies where pagination should next begin is not valid. -- -- _InvalidMarkerException :: AsError a => Getting (First ServiceError) a ServiceError-_InvalidMarkerException = _ServiceError . hasCode "InvalidMarkerException"+_InvalidMarkerException = _MatchServiceError kms "InvalidMarkerException" + -- | The request was rejected because the state of the specified resource is not valid for this request. -- -- -- For more information about how key state affects the use of a CMK, see <http://docs.aws.amazon.com/kms/latest/developerguide/key-state.html How Key State Affects Use of a Customer Master Key> in the /AWS Key Management Service Developer Guide/ . -- _KMSInvalidStateException :: AsError a => Getting (First ServiceError) a ServiceError-_KMSInvalidStateException = _ServiceError . hasCode "KMSInvalidStateException"+_KMSInvalidStateException = _MatchServiceError kms "KMSInvalidStateException" + -- | The request was rejected because the specified @KeySpec@ value is not valid. -- -- _InvalidKeyUsageException :: AsError a => Getting (First ServiceError) a ServiceError-_InvalidKeyUsageException = _ServiceError . hasCode "InvalidKeyUsageException"+_InvalidKeyUsageException = _MatchServiceError kms "InvalidKeyUsageException" + -- | The request was rejected because the specified policy is not syntactically or semantically correct. -- -- _MalformedPolicyDocumentException :: AsError a => Getting (First ServiceError) a ServiceError _MalformedPolicyDocumentException =-    _ServiceError . hasCode "MalformedPolicyDocumentException"+  _MatchServiceError kms "MalformedPolicyDocumentException" + -- | The request was rejected because a specified parameter is not supported or a specified resource is not valid for this operation. -- -- _UnsupportedOperationException :: AsError a => Getting (First ServiceError) a ServiceError _UnsupportedOperationException =-    _ServiceError . hasCode "UnsupportedOperationException"+  _MatchServiceError kms "UnsupportedOperationException" + -- | The request was rejected because the specified CMK is not enabled. -- -- _DisabledException :: AsError a => Getting (First ServiceError) a ServiceError-_DisabledException = _ServiceError . hasCode "DisabledException"+_DisabledException = _MatchServiceError kms "DisabledException" + -- | The request was rejected because the specified CMK was not available. The request can be retried. -- -- _KeyUnavailableException :: AsError a => Getting (First ServiceError) a ServiceError-_KeyUnavailableException = _ServiceError . hasCode "KeyUnavailableException"+_KeyUnavailableException = _MatchServiceError kms "KeyUnavailableException" + -- | The request was rejected because the provided key material is invalid or is not the same key material that was previously imported into this customer master key (CMK). -- -- _IncorrectKeyMaterialException :: AsError a => Getting (First ServiceError) a ServiceError _IncorrectKeyMaterialException =-    _ServiceError . hasCode "IncorrectKeyMaterialException"+  _MatchServiceError kms "IncorrectKeyMaterialException" + -- | The request was rejected because an internal exception occurred. The request can be retried. -- -- _KMSInternalException :: AsError a => Getting (First ServiceError) a ServiceError-_KMSInternalException = _ServiceError . hasCode "KMSInternalException"+_KMSInternalException = _MatchServiceError kms "KMSInternalException" ++-- | The request was rejected because one or more tags are not valid.+--+--+_TagException :: AsError a => Getting (First ServiceError) a ServiceError+_TagException = _MatchServiceError kms "TagException"++ -- | The request was rejected because the provided import token is invalid or is associated with a different customer master key (CMK). -- -- _InvalidImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError _InvalidImportTokenException =-    _ServiceError . hasCode "InvalidImportTokenException"+  _MatchServiceError kms "InvalidImportTokenException" + -- | The request was rejected because the specified entity or resource could not be found. -- -- _NotFoundException :: AsError a => Getting (First ServiceError) a ServiceError-_NotFoundException = _ServiceError . hasCode "NotFoundException"+_NotFoundException = _MatchServiceError kms "NotFoundException" + -- | The request was rejected because the specified alias name is not valid. -- -- _InvalidAliasNameException :: AsError a => Getting (First ServiceError) a ServiceError-_InvalidAliasNameException =-    _ServiceError . hasCode "InvalidAliasNameException"+_InvalidAliasNameException = _MatchServiceError kms "InvalidAliasNameException" + -- | The request was rejected because the specified @GrantId@ is not valid. -- -- _InvalidGrantIdException :: AsError a => Getting (First ServiceError) a ServiceError-_InvalidGrantIdException = _ServiceError . hasCode "InvalidGrantIdException"+_InvalidGrantIdException = _MatchServiceError kms "InvalidGrantIdException" + -- | The request was rejected because the specified grant token is not valid. -- -- _InvalidGrantTokenException :: AsError a => Getting (First ServiceError) a ServiceError _InvalidGrantTokenException =-    _ServiceError . hasCode "InvalidGrantTokenException"+  _MatchServiceError kms "InvalidGrantTokenException" + -- | The request was rejected because a specified ARN was not valid. -- -- _InvalidARNException :: AsError a => Getting (First ServiceError) a ServiceError-_InvalidARNException = _ServiceError . hasCode "InvalidArnException"+_InvalidARNException = _MatchServiceError kms "InvalidArnException" + -- | The system timed out while trying to fulfill the request. The request can be retried. -- -- _DependencyTimeoutException :: AsError a => Getting (First ServiceError) a ServiceError _DependencyTimeoutException =-    _ServiceError . hasCode "DependencyTimeoutException"+  _MatchServiceError kms "DependencyTimeoutException" --- | The request was rejected because the provided import token is expired. Use 'GetParametersForImport' to retrieve a new import token and public key, use the new public key to encrypt the key material, and then try the request again.++-- | The request was rejected because the provided import token is expired. Use 'GetParametersForImport' to get a new import token and public key, use the new public key to encrypt the key material, and then try the request again. -- -- _ExpiredImportTokenException :: AsError a => Getting (First ServiceError) a ServiceError _ExpiredImportTokenException =-    _ServiceError . hasCode "ExpiredImportTokenException"+  _MatchServiceError kms "ExpiredImportTokenException" --- | The request was rejected because the specified ciphertext has been corrupted or is otherwise invalid.++-- | The request was rejected because the specified ciphertext, or additional authenticated data incorporated into the ciphertext, such as the encryption context, is corrupted, missing, or otherwise invalid. -- -- _InvalidCiphertextException :: AsError a => Getting (First ServiceError) a ServiceError _InvalidCiphertextException =-    _ServiceError . hasCode "InvalidCiphertextException"+  _MatchServiceError kms "InvalidCiphertextException" + -- | The request was rejected because it attempted to create a resource that already exists. -- -- _AlreadyExistsException :: AsError a => Getting (First ServiceError) a ServiceError-_AlreadyExistsException = _ServiceError . hasCode "AlreadyExistsException"+_AlreadyExistsException = _MatchServiceError kms "AlreadyExistsException" + -- | The request was rejected because a limit was exceeded. For more information, see <http://docs.aws.amazon.com/kms/latest/developerguide/limits.html Limits> in the /AWS Key Management Service Developer Guide/ . -- -- _LimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError-_LimitExceededException = _ServiceError . hasCode "LimitExceededException"+_LimitExceededException = _MatchServiceError kms "LimitExceededException"+

@@ -9,17 +9,17 @@  -- | -- Module      : Network.AWS.KMS.Types.Product--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) -- module Network.AWS.KMS.Types.Product where -import           Network.AWS.KMS.Types.Sum-import           Network.AWS.Lens-import           Network.AWS.Prelude+import Network.AWS.KMS.Types.Sum+import Network.AWS.Lens+import Network.AWS.Prelude  -- | Contains information about an alias. --@@ -27,16 +27,17 @@ -- -- /See:/ 'aliasListEntry' smart constructor. data AliasListEntry = AliasListEntry'-    { _aleTargetKeyId :: !(Maybe Text)-    , _aleAliasName   :: !(Maybe Text)-    , _aleAliasARN    :: !(Maybe Text)-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _aleTargetKeyId :: !(Maybe Text)+  , _aleAliasName   :: !(Maybe Text)+  , _aleAliasARN    :: !(Maybe Text)+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'AliasListEntry' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'aleTargetKeyId' - String that contains the key identifier pointed to by the alias.+-- * 'aleTargetKeyId' - String that contains the key identifier referred to by the alias. -- -- * 'aleAliasName' - String that contains the alias. --@@ -44,13 +45,11 @@ aliasListEntry     :: AliasListEntry aliasListEntry =-    AliasListEntry'-    { _aleTargetKeyId = Nothing-    , _aleAliasName = Nothing-    , _aleAliasARN = Nothing-    }+  AliasListEntry'+  {_aleTargetKeyId = Nothing, _aleAliasName = Nothing, _aleAliasARN = Nothing} --- | String that contains the key identifier pointed to by the alias.++-- | String that contains the key identifier referred to by the alias. aleTargetKeyId :: Lens' AliasListEntry (Maybe Text) aleTargetKeyId = lens _aleTargetKeyId (\ s a -> s{_aleTargetKeyId = a}); @@ -70,42 +69,42 @@                    (x .:? "TargetKeyId") <*> (x .:? "AliasName") <*>                      (x .:? "AliasArn")) -instance Hashable AliasListEntry+instance Hashable AliasListEntry where -instance NFData AliasListEntry+instance NFData AliasListEntry where --- | A structure for specifying the conditions under which the operations permitted by the grant are allowed.+-- | A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see <http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html Encryption Context> in the /AWS Key Management Service Developer Guide/ . -- ----- You can use this structure to allow the operations permitted by the grant only when a specified encryption context is present. For more information about encryption context, see <http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html Encryption Context> in the /AWS Key Management Service Developer Guide/ .+-- Grant constraints apply only to operations that accept encryption context as input. For example, the @'DescribeKey' @ operation does not accept encryption context as input. A grant that allows the @DescribeKey@ operation does so regardless of the grant constraints. In constrast, the @'Encrypt' @ operation accepts encryption context as input. A grant that allows the @Encrypt@ operation does so only when the encryption context of the @Encrypt@ operation satisfies the grant constraints. -- -- -- /See:/ 'grantConstraints' smart constructor. data GrantConstraints = GrantConstraints'-    { _gcEncryptionContextEquals :: !(Maybe (Map Text Text))-    , _gcEncryptionContextSubset :: !(Maybe (Map Text Text))-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gcEncryptionContextEquals :: !(Maybe (Map Text Text))+  , _gcEncryptionContextSubset :: !(Maybe (Map Text Text))+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GrantConstraints' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'gcEncryptionContextEquals' - Contains a list of key-value pairs that must be present in the encryption context of a subsequent operation permitted by the grant. When a subsequent operation permitted by the grant includes an encryption context that matches this list, the grant allows the operation. Otherwise, the operation is not allowed.+-- * 'gcEncryptionContextEquals' - A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows. When certain subsequent operations allowed by the grant include encryption context that matches this list, the grant allows the operation. Otherwise, the grant does not allow the operation. ----- * 'gcEncryptionContextSubset' - Contains a list of key-value pairs, a subset of which must be present in the encryption context of a subsequent operation permitted by the grant. When a subsequent operation permitted by the grant includes an encryption context that matches this list or is a subset of this list, the grant allows the operation. Otherwise, the operation is not allowed.+-- * 'gcEncryptionContextSubset' - A list of key-value pairs, all of which must be present in the encryption context of certain subsequent operations that the grant allows. When certain subsequent operations allowed by the grant include encryption context that matches this list or is a superset of this list, the grant allows the operation. Otherwise, the grant does not allow the operation. grantConstraints     :: GrantConstraints grantConstraints =-    GrantConstraints'-    { _gcEncryptionContextEquals = Nothing-    , _gcEncryptionContextSubset = Nothing-    }+  GrantConstraints'+  {_gcEncryptionContextEquals = Nothing, _gcEncryptionContextSubset = Nothing} --- | Contains a list of key-value pairs that must be present in the encryption context of a subsequent operation permitted by the grant. When a subsequent operation permitted by the grant includes an encryption context that matches this list, the grant allows the operation. Otherwise, the operation is not allowed.++-- | A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows. When certain subsequent operations allowed by the grant include encryption context that matches this list, the grant allows the operation. Otherwise, the grant does not allow the operation. gcEncryptionContextEquals :: Lens' GrantConstraints (HashMap Text Text) gcEncryptionContextEquals = lens _gcEncryptionContextEquals (\ s a -> s{_gcEncryptionContextEquals = a}) . _Default . _Map; --- | Contains a list of key-value pairs, a subset of which must be present in the encryption context of a subsequent operation permitted by the grant. When a subsequent operation permitted by the grant includes an encryption context that matches this list or is a subset of this list, the grant allows the operation. Otherwise, the operation is not allowed.+-- | A list of key-value pairs, all of which must be present in the encryption context of certain subsequent operations that the grant allows. When certain subsequent operations allowed by the grant include encryption context that matches this list or is a superset of this list, the grant allows the operation. Otherwise, the grant does not allow the operation. gcEncryptionContextSubset :: Lens' GrantConstraints (HashMap Text Text) gcEncryptionContextSubset = lens _gcEncryptionContextSubset (\ s a -> s{_gcEncryptionContextSubset = a}) . _Default . _Map; @@ -117,9 +116,9 @@                    (x .:? "EncryptionContextEquals" .!= mempty) <*>                      (x .:? "EncryptionContextSubset" .!= mempty)) -instance Hashable GrantConstraints+instance Hashable GrantConstraints where -instance NFData GrantConstraints+instance NFData GrantConstraints where  instance ToJSON GrantConstraints where         toJSON GrantConstraints'{..}@@ -136,17 +135,18 @@ -- -- /See:/ 'grantListEntry' smart constructor. data GrantListEntry = GrantListEntry'-    { _gleKeyId             :: !(Maybe Text)-    , _gleRetiringPrincipal :: !(Maybe Text)-    , _gleIssuingAccount    :: !(Maybe Text)-    , _gleGrantId           :: !(Maybe Text)-    , _gleConstraints       :: !(Maybe GrantConstraints)-    , _gleGranteePrincipal  :: !(Maybe Text)-    , _gleName              :: !(Maybe Text)-    , _gleCreationDate      :: !(Maybe POSIX)-    , _gleOperations        :: !(Maybe [GrantOperation])-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _gleKeyId             :: !(Maybe Text)+  , _gleRetiringPrincipal :: !(Maybe Text)+  , _gleIssuingAccount    :: !(Maybe Text)+  , _gleGrantId           :: !(Maybe Text)+  , _gleConstraints       :: !(Maybe GrantConstraints)+  , _gleGranteePrincipal  :: !(Maybe Text)+  , _gleName              :: !(Maybe Text)+  , _gleCreationDate      :: !(Maybe POSIX)+  , _gleOperations        :: !(Maybe [GrantOperation])+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'GrantListEntry' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -159,7 +159,7 @@ -- -- * 'gleGrantId' - The unique identifier for the grant. ----- * 'gleConstraints' - The conditions under which the grant's operations are allowed.+-- * 'gleConstraints' - A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows. -- -- * 'gleGranteePrincipal' - The principal that receives the grant's permissions. --@@ -171,18 +171,19 @@ grantListEntry     :: GrantListEntry grantListEntry =-    GrantListEntry'-    { _gleKeyId = Nothing-    , _gleRetiringPrincipal = Nothing-    , _gleIssuingAccount = Nothing-    , _gleGrantId = Nothing-    , _gleConstraints = Nothing-    , _gleGranteePrincipal = Nothing-    , _gleName = Nothing-    , _gleCreationDate = Nothing-    , _gleOperations = Nothing-    }+  GrantListEntry'+  { _gleKeyId = Nothing+  , _gleRetiringPrincipal = Nothing+  , _gleIssuingAccount = Nothing+  , _gleGrantId = Nothing+  , _gleConstraints = Nothing+  , _gleGranteePrincipal = Nothing+  , _gleName = Nothing+  , _gleCreationDate = Nothing+  , _gleOperations = Nothing+  } + -- | The unique identifier for the customer master key (CMK) to which the grant applies. gleKeyId :: Lens' GrantListEntry (Maybe Text) gleKeyId = lens _gleKeyId (\ s a -> s{_gleKeyId = a});@@ -199,7 +200,7 @@ gleGrantId :: Lens' GrantListEntry (Maybe Text) gleGrantId = lens _gleGrantId (\ s a -> s{_gleGrantId = a}); --- | The conditions under which the grant's operations are allowed.+-- | A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows. gleConstraints :: Lens' GrantListEntry (Maybe GrantConstraints) gleConstraints = lens _gleConstraints (\ s a -> s{_gleConstraints = a}); @@ -233,9 +234,9 @@                      <*> (x .:? "CreationDate")                      <*> (x .:? "Operations" .!= mempty)) -instance Hashable GrantListEntry+instance Hashable GrantListEntry where -instance NFData GrantListEntry+instance NFData GrantListEntry where  -- | Contains information about each entry in the key list. --@@ -243,10 +244,11 @@ -- -- /See:/ 'keyListEntry' smart constructor. data KeyListEntry = KeyListEntry'-    { _kleKeyId  :: !(Maybe Text)-    , _kleKeyARN :: !(Maybe Text)-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _kleKeyId  :: !(Maybe Text)+  , _kleKeyARN :: !(Maybe Text)+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'KeyListEntry' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -256,12 +258,9 @@ -- * 'kleKeyARN' - ARN of the key. keyListEntry     :: KeyListEntry-keyListEntry =-    KeyListEntry'-    { _kleKeyId = Nothing-    , _kleKeyARN = Nothing-    }+keyListEntry = KeyListEntry' {_kleKeyId = Nothing, _kleKeyARN = Nothing} + -- | Unique identifier of the key. kleKeyId :: Lens' KeyListEntry (Maybe Text) kleKeyId = lens _kleKeyId (\ s a -> s{_kleKeyId = a});@@ -277,9 +276,9 @@                  KeyListEntry' <$>                    (x .:? "KeyId") <*> (x .:? "KeyArn")) -instance Hashable KeyListEntry+instance Hashable KeyListEntry where -instance NFData KeyListEntry+instance NFData KeyListEntry where  -- | Contains metadata about a customer master key (CMK). --@@ -289,20 +288,22 @@ -- -- /See:/ 'keyMetadata' smart constructor. data KeyMetadata = KeyMetadata'-    { _kmOrigin          :: !(Maybe OriginType)-    , _kmExpirationModel :: !(Maybe ExpirationModelType)-    , _kmEnabled         :: !(Maybe Bool)-    , _kmValidTo         :: !(Maybe POSIX)-    , _kmARN             :: !(Maybe Text)-    , _kmKeyState        :: !(Maybe KeyState)-    , _kmAWSAccountId    :: !(Maybe Text)-    , _kmKeyUsage        :: !(Maybe KeyUsageType)-    , _kmCreationDate    :: !(Maybe POSIX)-    , _kmDeletionDate    :: !(Maybe POSIX)-    , _kmDescription     :: !(Maybe Text)-    , _kmKeyId           :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _kmOrigin          :: !(Maybe OriginType)+  , _kmExpirationModel :: !(Maybe ExpirationModelType)+  , _kmKeyManager      :: !(Maybe KeyManagerType)+  , _kmEnabled         :: !(Maybe Bool)+  , _kmValidTo         :: !(Maybe POSIX)+  , _kmARN             :: !(Maybe Text)+  , _kmKeyState        :: !(Maybe KeyState)+  , _kmAWSAccountId    :: !(Maybe Text)+  , _kmKeyUsage        :: !(Maybe KeyUsageType)+  , _kmCreationDate    :: !(Maybe POSIX)+  , _kmDeletionDate    :: !(Maybe POSIX)+  , _kmDescription     :: !(Maybe Text)+  , _kmKeyId           :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'KeyMetadata' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired:@@ -311,6 +312,8 @@ -- -- * 'kmExpirationModel' - Specifies whether the CMK's key material expires. This value is present only when @Origin@ is @EXTERNAL@ , otherwise this value is omitted. --+-- * 'kmKeyManager' - The CMK's manager. CMKs are either customer-managed or AWS-managed. For more information about the difference, see <http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys Customer Master Keys> in the /AWS Key Management Service Developer Guide/ .+-- -- * 'kmEnabled' - Specifies whether the CMK is enabled. When @KeyState@ is @Enabled@ this value is true, otherwise it is false. -- -- * 'kmValidTo' - The time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. This value is present only for CMKs whose @Origin@ is @EXTERNAL@ and whose @ExpirationModel@ is @KEY_MATERIAL_EXPIRES@ , otherwise this value is omitted.@@ -334,21 +337,23 @@     :: Text -- ^ 'kmKeyId'     -> KeyMetadata keyMetadata pKeyId_ =-    KeyMetadata'-    { _kmOrigin = Nothing-    , _kmExpirationModel = Nothing-    , _kmEnabled = Nothing-    , _kmValidTo = Nothing-    , _kmARN = Nothing-    , _kmKeyState = Nothing-    , _kmAWSAccountId = Nothing-    , _kmKeyUsage = Nothing-    , _kmCreationDate = Nothing-    , _kmDeletionDate = Nothing-    , _kmDescription = Nothing-    , _kmKeyId = pKeyId_-    }+  KeyMetadata'+  { _kmOrigin = Nothing+  , _kmExpirationModel = Nothing+  , _kmKeyManager = Nothing+  , _kmEnabled = Nothing+  , _kmValidTo = Nothing+  , _kmARN = Nothing+  , _kmKeyState = Nothing+  , _kmAWSAccountId = Nothing+  , _kmKeyUsage = Nothing+  , _kmCreationDate = Nothing+  , _kmDeletionDate = Nothing+  , _kmDescription = Nothing+  , _kmKeyId = pKeyId_+  } + -- | The source of the CMK's key material. When this value is @AWS_KMS@ , AWS KMS created the key material. When this value is @EXTERNAL@ , the key material was imported from your existing key management infrastructure or the CMK lacks key material. kmOrigin :: Lens' KeyMetadata (Maybe OriginType) kmOrigin = lens _kmOrigin (\ s a -> s{_kmOrigin = a});@@ -357,6 +362,10 @@ kmExpirationModel :: Lens' KeyMetadata (Maybe ExpirationModelType) kmExpirationModel = lens _kmExpirationModel (\ s a -> s{_kmExpirationModel = a}); +-- | The CMK's manager. CMKs are either customer-managed or AWS-managed. For more information about the difference, see <http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys Customer Master Keys> in the /AWS Key Management Service Developer Guide/ .+kmKeyManager :: Lens' KeyMetadata (Maybe KeyManagerType)+kmKeyManager = lens _kmKeyManager (\ s a -> s{_kmKeyManager = a});+ -- | Specifies whether the CMK is enabled. When @KeyState@ is @Enabled@ this value is true, otherwise it is false. kmEnabled :: Lens' KeyMetadata (Maybe Bool) kmEnabled = lens _kmEnabled (\ s a -> s{_kmEnabled = a});@@ -403,7 +412,8 @@               (\ x ->                  KeyMetadata' <$>                    (x .:? "Origin") <*> (x .:? "ExpirationModel") <*>-                     (x .:? "Enabled")+                     (x .:? "KeyManager")+                     <*> (x .:? "Enabled")                      <*> (x .:? "ValidTo")                      <*> (x .:? "Arn")                      <*> (x .:? "KeyState")@@ -414,36 +424,35 @@                      <*> (x .:? "Description")                      <*> (x .: "KeyId")) -instance Hashable KeyMetadata+instance Hashable KeyMetadata where -instance NFData KeyMetadata+instance NFData KeyMetadata where  -- | /See:/ 'listGrantsResponse' smart constructor. data ListGrantsResponse = ListGrantsResponse'-    { _lgTruncated  :: !(Maybe Bool)-    , _lgGrants     :: !(Maybe [GrantListEntry])-    , _lgNextMarker :: !(Maybe Text)-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _lgTruncated  :: !(Maybe Bool)+  , _lgGrants     :: !(Maybe [GrantListEntry])+  , _lgNextMarker :: !(Maybe Text)+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'ListGrantsResponse' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'lgTruncated' - A flag that indicates whether there are more items in the list. If your results were truncated, you can use the @Marker@ parameter to make a subsequent pagination request to retrieve more items in the list.+-- * 'lgTruncated' - A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the @NextMarker@ element in this response to the @Marker@ parameter in a subsequent request. -- -- * 'lgGrants' - A list of grants. ----- * 'lgNextMarker' - When @Truncated@ is true, this value is present and contains the value to use for the @Marker@ parameter in a subsequent pagination request.+-- * 'lgNextMarker' - When @Truncated@ is true, this element is present and contains the value to use for the @Marker@ parameter in a subsequent request. listGrantsResponse     :: ListGrantsResponse listGrantsResponse =-    ListGrantsResponse'-    { _lgTruncated = Nothing-    , _lgGrants = Nothing-    , _lgNextMarker = Nothing-    }+  ListGrantsResponse'+  {_lgTruncated = Nothing, _lgGrants = Nothing, _lgNextMarker = Nothing} --- | A flag that indicates whether there are more items in the list. If your results were truncated, you can use the @Marker@ parameter to make a subsequent pagination request to retrieve more items in the list.++-- | A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the @NextMarker@ element in this response to the @Marker@ parameter in a subsequent request. lgTruncated :: Lens' ListGrantsResponse (Maybe Bool) lgTruncated = lens _lgTruncated (\ s a -> s{_lgTruncated = a}); @@ -451,7 +460,7 @@ lgGrants :: Lens' ListGrantsResponse [GrantListEntry] lgGrants = lens _lgGrants (\ s a -> s{_lgGrants = a}) . _Default . _Coerce; --- | When @Truncated@ is true, this value is present and contains the value to use for the @Marker@ parameter in a subsequent pagination request.+-- | When @Truncated@ is true, this element is present and contains the value to use for the @Marker@ parameter in a subsequent request. lgNextMarker :: Lens' ListGrantsResponse (Maybe Text) lgNextMarker = lens _lgNextMarker (\ s a -> s{_lgNextMarker = a}); @@ -463,6 +472,59 @@                    (x .:? "Truncated") <*> (x .:? "Grants" .!= mempty)                      <*> (x .:? "NextMarker")) -instance Hashable ListGrantsResponse+instance Hashable ListGrantsResponse where -instance NFData ListGrantsResponse+instance NFData ListGrantsResponse where++-- | A key-value pair. A tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.+--+--+-- For information about the rules that apply to tag keys and tag values, see <http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation-tag-restrictions.html User-Defined Tag Restrictions> in the /AWS Billing and Cost Management User Guide/ .+--+--+-- /See:/ 'tag' smart constructor.+data Tag = Tag'+  { _tagTagKey   :: !Text+  , _tagTagValue :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic)+++-- | Creates a value of 'Tag' with the minimum fields required to make a request.+--+-- Use one of the following lenses to modify other fields as desired:+--+-- * 'tagTagKey' - The key of the tag.+--+-- * 'tagTagValue' - The value of the tag.+tag+    :: Text -- ^ 'tagTagKey'+    -> Text -- ^ 'tagTagValue'+    -> Tag+tag pTagKey_ pTagValue_ =+  Tag' {_tagTagKey = pTagKey_, _tagTagValue = pTagValue_}+++-- | The key of the tag.+tagTagKey :: Lens' Tag Text+tagTagKey = lens _tagTagKey (\ s a -> s{_tagTagKey = a});++-- | The value of the tag.+tagTagValue :: Lens' Tag Text+tagTagValue = lens _tagTagValue (\ s a -> s{_tagTagValue = a});++instance FromJSON Tag where+        parseJSON+          = withObject "Tag"+              (\ x ->+                 Tag' <$> (x .: "TagKey") <*> (x .: "TagValue"))++instance Hashable Tag where++instance NFData Tag where++instance ToJSON Tag where+        toJSON Tag'{..}+          = object+              (catMaybes+                 [Just ("TagKey" .= _tagTagKey),+                  Just ("TagValue" .= _tagTagValue)])

@@ -9,22 +9,23 @@  -- | -- Module      : Network.AWS.KMS.Types.Sum--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) -- module Network.AWS.KMS.Types.Sum where -import           Network.AWS.Prelude+import Network.AWS.Prelude  data AlgorithmSpec-    = RsaesOaepSha1-    | RsaesOaepSha256-    | RsaesPKCS1V15-    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)+  = RsaesOaepSha1+  | RsaesOaepSha256+  | RsaesPKCS1V15+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic) + instance FromText AlgorithmSpec where     parser = takeLowerText >>= \case         "rsaes_oaep_sha_1" -> pure RsaesOaepSha1@@ -49,10 +50,11 @@     toJSON = toJSONText  data DataKeySpec-    = AES128-    | AES256-    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)+  = AES128+  | AES256+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic) + instance FromText DataKeySpec where     parser = takeLowerText >>= \case         "aes_128" -> pure AES128@@ -75,10 +77,11 @@     toJSON = toJSONText  data ExpirationModelType-    = KeyMaterialDoesNotExpire-    | KeyMaterialExpires-    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)+  = KeyMaterialDoesNotExpire+  | KeyMaterialExpires+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic) + instance FromText ExpirationModelType where     parser = takeLowerText >>= \case         "key_material_does_not_expire" -> pure KeyMaterialDoesNotExpire@@ -104,17 +107,18 @@     parseJSON = parseJSONText "ExpirationModelType"  data GrantOperation-    = CreateGrant-    | Decrypt-    | DescribeKey-    | Encrypt-    | GenerateDataKey-    | GenerateDataKeyWithoutPlaintext-    | ReEncryptFrom-    | ReEncryptTo-    | RetireGrant-    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)+  = CreateGrant+  | Decrypt+  | DescribeKey+  | Encrypt+  | GenerateDataKey+  | GenerateDataKeyWithoutPlaintext+  | ReEncryptFrom+  | ReEncryptTo+  | RetireGrant+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic) + instance FromText GrantOperation where     parser = takeLowerText >>= \case         "creategrant" -> pure CreateGrant@@ -153,13 +157,41 @@ instance FromJSON GrantOperation where     parseJSON = parseJSONText "GrantOperation" +data KeyManagerType+  = AWS+  | Customer+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic)+++instance FromText KeyManagerType where+    parser = takeLowerText >>= \case+        "aws" -> pure AWS+        "customer" -> pure Customer+        e -> fromTextError $ "Failure parsing KeyManagerType from value: '" <> e+           <> "'. Accepted values: aws, customer"++instance ToText KeyManagerType where+    toText = \case+        AWS -> "AWS"+        Customer -> "CUSTOMER"++instance Hashable     KeyManagerType+instance NFData       KeyManagerType+instance ToByteString KeyManagerType+instance ToQuery      KeyManagerType+instance ToHeader     KeyManagerType++instance FromJSON KeyManagerType where+    parseJSON = parseJSONText "KeyManagerType"+ data KeyState-    = Disabled-    | Enabled-    | PendingDeletion-    | PendingImport-    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)+  = Disabled+  | Enabled+  | PendingDeletion+  | PendingImport+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic) + instance FromText KeyState where     parser = takeLowerText >>= \case         "disabled" -> pure Disabled@@ -186,9 +218,10 @@     parseJSON = parseJSONText "KeyState"  data KeyUsageType =-    EncryptDecrypt-    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)+  EncryptDecrypt+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic) + instance FromText KeyUsageType where     parser = takeLowerText >>= \case         "encrypt_decrypt" -> pure EncryptDecrypt@@ -212,10 +245,11 @@     parseJSON = parseJSONText "KeyUsageType"  data OriginType-    = AWSKMS-    | External-    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)+  = AWSKMS+  | External+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic) + instance FromText OriginType where     parser = takeLowerText >>= \case         "aws_kms" -> pure AWSKMS@@ -241,8 +275,9 @@     parseJSON = parseJSONText "OriginType"  data WrappingKeySpec =-    Rsa2048-    deriving (Eq,Ord,Read,Show,Enum,Bounded,Data,Typeable,Generic)+  Rsa2048+  deriving (Eq, Ord, Read, Show, Enum, Bounded, Data, Typeable, Generic)+  instance FromText WrappingKeySpec where     parser = takeLowerText >>= \case

@@ -0,0 +1,119 @@+{-# LANGUAGE DeriveDataTypeable #-}+{-# LANGUAGE DeriveGeneric      #-}+{-# LANGUAGE OverloadedStrings  #-}+{-# LANGUAGE RecordWildCards    #-}+{-# LANGUAGE TypeFamilies       #-}++{-# OPTIONS_GHC -fno-warn-unused-imports #-}+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}++-- Derived from AWS service descriptions, licensed under Apache 2.0.++-- |+-- Module      : Network.AWS.KMS.UntagResource+-- Copyright   : (c) 2013-2017 Brendan Hay+-- License     : Mozilla Public License, v. 2.0.+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com>+-- Stability   : auto-generated+-- Portability : non-portable (GHC extensions)+--+-- Removes the specified tag or tags from the specified customer master key (CMK). You cannot perform this operation on a CMK in a different AWS account.+--+--+-- To remove a tag, you specify the tag key for each tag to remove. You do not specify the tag value. To overwrite the tag value for an existing tag, use 'TagResource' .+--+module Network.AWS.KMS.UntagResource+    (+    -- * Creating a Request+      untagResource+    , UntagResource+    -- * Request Lenses+    , urKeyId+    , urTagKeys++    -- * Destructuring the Response+    , untagResourceResponse+    , UntagResourceResponse+    ) where++import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response++-- | /See:/ 'untagResource' smart constructor.+data UntagResource = UntagResource'+  { _urKeyId   :: !Text+  , _urTagKeys :: ![Text]+  } deriving (Eq, Read, Show, Data, Typeable, Generic)+++-- | Creates a value of 'UntagResource' with the minimum fields required to make a request.+--+-- Use one of the following lenses to modify other fields as desired:+--+-- * 'urKeyId' - A unique identifier for the CMK from which you are removing tags. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' .+--+-- * 'urTagKeys' - One or more tag keys. Specify only the tag keys, not the tag values.+untagResource+    :: Text -- ^ 'urKeyId'+    -> UntagResource+untagResource pKeyId_ = UntagResource' {_urKeyId = pKeyId_, _urTagKeys = mempty}+++-- | A unique identifier for the CMK from which you are removing tags. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' .+urKeyId :: Lens' UntagResource Text+urKeyId = lens _urKeyId (\ s a -> s{_urKeyId = a});++-- | One or more tag keys. Specify only the tag keys, not the tag values.+urTagKeys :: Lens' UntagResource [Text]+urTagKeys = lens _urTagKeys (\ s a -> s{_urTagKeys = a}) . _Coerce;++instance AWSRequest UntagResource where+        type Rs UntagResource = UntagResourceResponse+        request = postJSON kms+        response = receiveNull UntagResourceResponse'++instance Hashable UntagResource where++instance NFData UntagResource where++instance ToHeaders UntagResource where+        toHeaders+          = const+              (mconcat+                 ["X-Amz-Target" =#+                    ("TrentService.UntagResource" :: ByteString),+                  "Content-Type" =#+                    ("application/x-amz-json-1.1" :: ByteString)])++instance ToJSON UntagResource where+        toJSON UntagResource'{..}+          = object+              (catMaybes+                 [Just ("KeyId" .= _urKeyId),+                  Just ("TagKeys" .= _urTagKeys)])++instance ToPath UntagResource where+        toPath = const "/"++instance ToQuery UntagResource where+        toQuery = const mempty++-- | /See:/ 'untagResourceResponse' smart constructor.+data UntagResourceResponse =+  UntagResourceResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic)+++-- | Creates a value of 'UntagResourceResponse' with the minimum fields required to make a request.+--+untagResourceResponse+    :: UntagResourceResponse+untagResourceResponse = UntagResourceResponse'+++instance NFData UntagResourceResponse where

@@ -12,20 +12,20 @@  -- | -- Module      : Network.AWS.KMS.UpdateAlias--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Updates an alias to map it to a different key.+-- Associates an existing alias with a different customer master key (CMK). Each CMK can have multiple aliases, but the aliases must be unique within the account and region. You cannot perform this operation on an alias in a different AWS account. -- ----- An alias is not a property of a key. Therefore, an alias can be mapped to and unmapped from an existing key without changing the properties of the key.+-- This operation works only on existing aliases. To change the alias of a CMK to a new value, use 'CreateAlias' to create a new alias and 'DeleteAlias' to delete the old alias. ----- An alias name can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). An alias must start with the word "alias" followed by a forward slash (alias/). An alias that begins with "aws" after the forward slash (alias/aws...) is reserved by Amazon Web Services (AWS).+-- Because an alias is not a property of a CMK, you can create, update, and delete the aliases of a CMK without affecting the CMK. Also, aliases do not appear in the response from the 'DescribeKey' operation. To get the aliases of all CMKs in the account, use the 'ListAliases' operation. ----- The alias and the key it is mapped to must be in the same AWS account and the same region.+-- An alias name can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). An alias must start with the word @alias@ followed by a forward slash (@alias/@ ). The alias name can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-). Alias names cannot begin with @aws@ ; that alias name prefix is reserved by Amazon Web Services (AWS). -- module Network.AWS.KMS.UpdateAlias     (@@ -41,41 +41,40 @@     , UpdateAliasResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'updateAlias' smart constructor. data UpdateAlias = UpdateAlias'-    { _uaAliasName   :: !Text-    , _uaTargetKeyId :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _uaAliasName   :: !Text+  , _uaTargetKeyId :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'UpdateAlias' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: -- -- * 'uaAliasName' - String that contains the name of the alias to be modified. The name must start with the word "alias" followed by a forward slash (alias/). Aliases that begin with "alias/aws" are reserved. ----- * 'uaTargetKeyId' - Unique identifier of the customer master key to be mapped to the alias. This value can be a globally unique identifier or the fully specified ARN of a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 You can call 'ListAliases' to verify that the alias is mapped to the correct @TargetKeyId@ .+-- * 'uaTargetKeyId' - Unique identifier of the customer master key to be mapped to the alias. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To verify that the alias is mapped to the correct CMK, use 'ListAliases' . updateAlias     :: Text -- ^ 'uaAliasName'     -> Text -- ^ 'uaTargetKeyId'     -> UpdateAlias updateAlias pAliasName_ pTargetKeyId_ =-    UpdateAlias'-    { _uaAliasName = pAliasName_-    , _uaTargetKeyId = pTargetKeyId_-    }+  UpdateAlias' {_uaAliasName = pAliasName_, _uaTargetKeyId = pTargetKeyId_} + -- | String that contains the name of the alias to be modified. The name must start with the word "alias" followed by a forward slash (alias/). Aliases that begin with "alias/aws" are reserved. uaAliasName :: Lens' UpdateAlias Text uaAliasName = lens _uaAliasName (\ s a -> s{_uaAliasName = a}); --- | Unique identifier of the customer master key to be mapped to the alias. This value can be a globally unique identifier or the fully specified ARN of a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012 You can call 'ListAliases' to verify that the alias is mapped to the correct @TargetKeyId@ .+-- | Unique identifier of the customer master key to be mapped to the alias. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . To verify that the alias is mapped to the correct CMK, use 'ListAliases' . uaTargetKeyId :: Lens' UpdateAlias Text uaTargetKeyId = lens _uaTargetKeyId (\ s a -> s{_uaTargetKeyId = a}); @@ -84,9 +83,9 @@         request = postJSON kms         response = receiveNull UpdateAliasResponse' -instance Hashable UpdateAlias+instance Hashable UpdateAlias where -instance NFData UpdateAlias+instance NFData UpdateAlias where  instance ToHeaders UpdateAlias where         toHeaders@@ -112,13 +111,15 @@  -- | /See:/ 'updateAliasResponse' smart constructor. data UpdateAliasResponse =-    UpdateAliasResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  UpdateAliasResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'UpdateAliasResponse' with the minimum fields required to make a request. -- updateAliasResponse     :: UpdateAliasResponse updateAliasResponse = UpdateAliasResponse' -instance NFData UpdateAliasResponse++instance NFData UpdateAliasResponse where

@@ -12,15 +12,17 @@  -- | -- Module      : Network.AWS.KMS.UpdateKeyDescription--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) ----- Updates the description of a key.+-- Updates the description of a customer master key (CMK). To see the decription of a CMK, use 'DescribeKey' . -- --+-- You cannot perform this operation on a CMK in a different AWS account.+-- module Network.AWS.KMS.UpdateKeyDescription     (     -- * Creating a Request@@ -35,41 +37,40 @@     , UpdateKeyDescriptionResponse     ) where -import           Network.AWS.KMS.Types-import           Network.AWS.KMS.Types.Product-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Request-import           Network.AWS.Response+import Network.AWS.KMS.Types+import Network.AWS.KMS.Types.Product+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Request+import Network.AWS.Response  -- | /See:/ 'updateKeyDescription' smart constructor. data UpdateKeyDescription = UpdateKeyDescription'-    { _ukdKeyId       :: !Text-    , _ukdDescription :: !Text-    } deriving (Eq,Read,Show,Data,Typeable,Generic)+  { _ukdKeyId       :: !Text+  , _ukdDescription :: !Text+  } deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'UpdateKeyDescription' with the minimum fields required to make a request. -- -- Use one of the following lenses to modify other fields as desired: ----- * 'ukdKeyId' - A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012+-- * 'ukdKeyId' - A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . ----- * 'ukdDescription' - New description for the key.+-- * 'ukdDescription' - New description for the CMK. updateKeyDescription     :: Text -- ^ 'ukdKeyId'     -> Text -- ^ 'ukdDescription'     -> UpdateKeyDescription updateKeyDescription pKeyId_ pDescription_ =-    UpdateKeyDescription'-    { _ukdKeyId = pKeyId_-    , _ukdDescription = pDescription_-    }+  UpdateKeyDescription' {_ukdKeyId = pKeyId_, _ukdDescription = pDescription_} --- | A unique identifier for the customer master key. This value can be a globally unique identifier or the fully specified ARN to a key.     * Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012     * Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012++-- | A unique identifier for the customer master key (CMK). Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:     * Key ID: @1234abcd-12ab-34cd-56ef-1234567890ab@      * Key ARN: @arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab@  To get the key ID and key ARN for a CMK, use 'ListKeys' or 'DescribeKey' . ukdKeyId :: Lens' UpdateKeyDescription Text ukdKeyId = lens _ukdKeyId (\ s a -> s{_ukdKeyId = a}); --- | New description for the key.+-- | New description for the CMK. ukdDescription :: Lens' UpdateKeyDescription Text ukdDescription = lens _ukdDescription (\ s a -> s{_ukdDescription = a}); @@ -79,9 +80,9 @@         request = postJSON kms         response = receiveNull UpdateKeyDescriptionResponse' -instance Hashable UpdateKeyDescription+instance Hashable UpdateKeyDescription where -instance NFData UpdateKeyDescription+instance NFData UpdateKeyDescription where  instance ToHeaders UpdateKeyDescription where         toHeaders@@ -107,13 +108,15 @@  -- | /See:/ 'updateKeyDescriptionResponse' smart constructor. data UpdateKeyDescriptionResponse =-    UpdateKeyDescriptionResponse'-    deriving (Eq,Read,Show,Data,Typeable,Generic)+  UpdateKeyDescriptionResponse'+  deriving (Eq, Read, Show, Data, Typeable, Generic) + -- | Creates a value of 'UpdateKeyDescriptionResponse' with the minimum fields required to make a request. -- updateKeyDescriptionResponse     :: UpdateKeyDescriptionResponse updateKeyDescriptionResponse = UpdateKeyDescriptionResponse' -instance NFData UpdateKeyDescriptionResponse++instance NFData UpdateKeyDescriptionResponse where

@@ -7,15 +7,15 @@  -- | -- Module      : Network.AWS.KMS.Waiters--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) -- module Network.AWS.KMS.Waiters where -import           Network.AWS.KMS.Types-import           Network.AWS.Lens-import           Network.AWS.Prelude-import           Network.AWS.Waiter+import Network.AWS.KMS.Types+import Network.AWS.Lens+import Network.AWS.Prelude+import Network.AWS.Waiter

@@ -2,9 +2,9 @@  -- | -- Module      : Main--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) --

@@ -5,20 +5,20 @@  -- | -- Module      : Test.AWS.Gen.KMS--- Copyright   : (c) 2013-2016 Brendan Hay+-- Copyright   : (c) 2013-2017 Brendan Hay -- License     : Mozilla Public License, v. 2.0.--- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>+-- Maintainer  : Brendan Hay <brendan.g.hay+amazonka@gmail.com> -- Stability   : auto-generated -- Portability : non-portable (GHC extensions) -- module Test.AWS.Gen.KMS where  import Data.Proxy+import Network.AWS.KMS import Test.AWS.Fixture+import Test.AWS.KMS.Internal import Test.AWS.Prelude import Test.Tasty-import Network.AWS.KMS-import Test.AWS.KMS.Internal  -- Auto-generated: the actual test selection needs to be manually placed into -- the top-level so that real test data can be incrementally added.@@ -73,6 +73,9 @@ --         , requestListKeys $ --             listKeys --+--         , requestListResourceTags $+--             listResourceTags+-- --         , requestGetKeyRotationStatus $ --             getKeyRotationStatus --@@ -100,9 +103,15 @@ --         , requestReEncrypt $ --             reEncrypt --+--         , requestTagResource $+--             tagResource+-- --         , requestListKeyPolicies $ --             listKeyPolicies --+--         , requestUntagResource $+--             untagResource+-- --         , requestScheduleKeyDeletion $ --             scheduleKeyDeletion --@@ -172,6 +181,9 @@ --         , responseListKeys $ --             listKeysResponse --+--         , responseListResourceTags $+--             listResourceTagsResponse+-- --         , responseGetKeyRotationStatus $ --             getKeyRotationStatusResponse --@@ -199,9 +211,15 @@ --         , responseReEncrypt $ --             reEncryptResponse --+--         , responseTagResource $+--             tagResourceResponse+-- --         , responseListKeyPolicies $ --             listKeyPoliciesResponse --+--         , responseUntagResource $+--             untagResourceResponse+-- --         , responseScheduleKeyDeletion $ --             scheduleKeyDeletionResponse --@@ -303,6 +321,11 @@     "ListKeys"     "fixture/ListKeys.yaml" +requestListResourceTags :: ListResourceTags -> TestTree+requestListResourceTags = req+    "ListResourceTags"+    "fixture/ListResourceTags.yaml"+ requestGetKeyRotationStatus :: GetKeyRotationStatus -> TestTree requestGetKeyRotationStatus = req     "GetKeyRotationStatus"@@ -348,11 +371,21 @@     "ReEncrypt"     "fixture/ReEncrypt.yaml" +requestTagResource :: TagResource -> TestTree+requestTagResource = req+    "TagResource"+    "fixture/TagResource.yaml"+ requestListKeyPolicies :: ListKeyPolicies -> TestTree requestListKeyPolicies = req     "ListKeyPolicies"     "fixture/ListKeyPolicies.yaml" +requestUntagResource :: UntagResource -> TestTree+requestUntagResource = req+    "UntagResource"+    "fixture/UntagResource.yaml"+ requestScheduleKeyDeletion :: ScheduleKeyDeletion -> TestTree requestScheduleKeyDeletion = req     "ScheduleKeyDeletion"@@ -495,6 +528,13 @@     kms     (Proxy :: Proxy ListKeys) +responseListResourceTags :: ListResourceTagsResponse -> TestTree+responseListResourceTags = res+    "ListResourceTagsResponse"+    "fixture/ListResourceTagsResponse.proto"+    kms+    (Proxy :: Proxy ListResourceTags)+ responseGetKeyRotationStatus :: GetKeyRotationStatusResponse -> TestTree responseGetKeyRotationStatus = res     "GetKeyRotationStatusResponse"@@ -558,12 +598,26 @@     kms     (Proxy :: Proxy ReEncrypt) +responseTagResource :: TagResourceResponse -> TestTree+responseTagResource = res+    "TagResourceResponse"+    "fixture/TagResourceResponse.proto"+    kms+    (Proxy :: Proxy TagResource)+ responseListKeyPolicies :: ListKeyPoliciesResponse -> TestTree responseListKeyPolicies = res     "ListKeyPoliciesResponse"     "fixture/ListKeyPoliciesResponse.proto"     kms     (Proxy :: Proxy ListKeyPolicies)++responseUntagResource :: UntagResourceResponse -> TestTree+responseUntagResource = res+    "UntagResourceResponse"+    "fixture/UntagResourceResponse.proto"+    kms+    (Proxy :: Proxy UntagResource)  responseScheduleKeyDeletion :: ScheduleKeyDeletionResponse -> TestTree responseScheduleKeyDeletion = res