mirror of
https://github.com/aptly-dev/aptly.git
synced 2026-05-08 22:30:41 +00:00
Upgrade AWS SDK to the latest version
This commit is contained in:
Andrey Smirnov
+9
-1
@@ -1122,6 +1122,13 @@
|
||||
"KeyArn":{"shape":"ArnType"}
|
||||
}
|
||||
},
|
||||
"KeyManagerType":{
|
||||
"type":"string",
|
||||
"enum":[
|
||||
"AWS",
|
||||
"CUSTOMER"
|
||||
]
|
||||
},
|
||||
"KeyMetadata":{
|
||||
"type":"structure",
|
||||
"required":["KeyId"],
|
||||
@@ -1137,7 +1144,8 @@
|
||||
"DeletionDate":{"shape":"DateType"},
|
||||
"ValidTo":{"shape":"DateType"},
|
||||
"Origin":{"shape":"OriginType"},
|
||||
"ExpirationModel":{"shape":"ExpirationModelType"}
|
||||
"ExpirationModel":{"shape":"ExpirationModelType"},
|
||||
"KeyManager":{"shape":"KeyManagerType"}
|
||||
}
|
||||
},
|
||||
"KeyState":{
|
||||
|
||||
+15
-9
@@ -15,9 +15,9 @@
|
||||
"EnableKey": "<p>Marks a key as enabled, thereby permitting its use.</p>",
|
||||
"EnableKeyRotation": "<p>Enables rotation of the specified customer master key.</p>",
|
||||
"Encrypt": "<p>Encrypts plaintext into ciphertext by using a customer master key. The <code>Encrypt</code> function has two primary use cases:</p> <ul> <li> <p>You can encrypt up to 4 KB of arbitrary data such as an RSA key, a database password, or other sensitive customer information.</p> </li> <li> <p>If you are moving encrypted data from one region to another, you can use this API to encrypt in the new region the plaintext data key that was used to encrypt the data in the original region. This provides you with an encrypted copy of the data key that can be decrypted in the new region and used there to decrypt the encrypted data.</p> </li> </ul> <p>Unless you are moving encrypted data from one region to another, you don't use this function to encrypt a generated data key within a region. You retrieve data keys already encrypted by calling the <a>GenerateDataKey</a> or <a>GenerateDataKeyWithoutPlaintext</a> function. Data keys don't need to be encrypted again by calling <code>Encrypt</code>.</p> <p>If you want to encrypt data locally in your application, you can use the <code>GenerateDataKey</code> function to return a plaintext data encryption key and a copy of the key encrypted under the customer master key (CMK) of your choosing.</p>",
|
||||
"GenerateDataKey": "<p>Returns a data encryption key that you can use in your application to encrypt data locally.</p> <p>You must specify the customer master key (CMK) under which to generate the data key. You must also specify the length of the data key using either the <code>KeySpec</code> or <code>NumberOfBytes</code> field. You must specify one field or the other, but not both. For common key lengths (128-bit and 256-bit symmetric keys), we recommend that you use <code>KeySpec</code>.</p> <p>This operation returns a plaintext copy of the data key in the <code>Plaintext</code> field of the response, and an encrypted copy of the data key in the <code>CiphertextBlob</code> field. The data key is encrypted under the CMK specified in the <code>KeyId</code> field of the request.</p> <p>We recommend that you use the following pattern to encrypt data locally in your application:</p> <ol> <li> <p>Use this operation (<code>GenerateDataKey</code>) to retrieve a data encryption key.</p> </li> <li> <p>Use the plaintext data encryption key (returned in the <code>Plaintext</code> field of the response) to encrypt data locally, then erase the plaintext data key from memory.</p> </li> <li> <p>Store the encrypted data key (returned in the <code>CiphertextBlob</code> field of the response) alongside the locally encrypted data.</p> </li> </ol> <p>To decrypt data locally:</p> <ol> <li> <p>Use the <a>Decrypt</a> operation to decrypt the encrypted data key into a plaintext copy of the data key.</p> </li> <li> <p>Use the plaintext data key to decrypt data locally, then erase the plaintext data key from memory.</p> </li> </ol> <p>To return only an encrypted copy of the data key, use <a>GenerateDataKeyWithoutPlaintext</a>. To return an arbitrary unpredictable byte string, use <a>GenerateRandom</a>.</p> <p>If you use the optional <code>EncryptionContext</code> field, you must store at least enough information to be able to reconstruct the full encryption context when you later send the ciphertext to the <a>Decrypt</a> operation. It is a good practice to choose an encryption context that you can reconstruct on the fly to better secure the ciphertext. For more information, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html\">Encryption Context</a> in the <i>AWS Key Management Service Developer Guide</i>.</p>",
|
||||
"GenerateDataKey": "<p>Returns a data encryption key that you can use in your application to encrypt data locally.</p> <p>You must specify the customer master key (CMK) under which to generate the data key. You must also specify the length of the data key using either the <code>KeySpec</code> or <code>NumberOfBytes</code> field. You must specify one field or the other, but not both. For common key lengths (128-bit and 256-bit symmetric keys), we recommend that you use <code>KeySpec</code>.</p> <p>This operation returns a plaintext copy of the data key in the <code>Plaintext</code> field of the response, and an encrypted copy of the data key in the <code>CiphertextBlob</code> field. The data key is encrypted under the CMK specified in the <code>KeyId</code> field of the request.</p> <p>We recommend that you use the following pattern to encrypt data locally in your application:</p> <ol> <li> <p>Use this operation (<code>GenerateDataKey</code>) to retrieve a data encryption key.</p> </li> <li> <p>Use the plaintext data encryption key (returned in the <code>Plaintext</code> field of the response) to encrypt data locally, then erase the plaintext data key from memory.</p> </li> <li> <p>Store the encrypted data key (returned in the <code>CiphertextBlob</code> field of the response) alongside the locally encrypted data.</p> </li> </ol> <p>To decrypt data locally:</p> <ol> <li> <p>Use the <a>Decrypt</a> operation to decrypt the encrypted data key into a plaintext copy of the data key.</p> </li> <li> <p>Use the plaintext data key to decrypt data locally, then erase the plaintext data key from memory.</p> </li> </ol> <p>To return only an encrypted copy of the data key, use <a>GenerateDataKeyWithoutPlaintext</a>. To return a random byte string that is cryptographically secure, use <a>GenerateRandom</a>.</p> <p>If you use the optional <code>EncryptionContext</code> field, you must store at least enough information to be able to reconstruct the full encryption context when you later send the ciphertext to the <a>Decrypt</a> operation. It is a good practice to choose an encryption context that you can reconstruct on the fly to better secure the ciphertext. For more information, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html\">Encryption Context</a> in the <i>AWS Key Management Service Developer Guide</i>.</p>",
|
||||
"GenerateDataKeyWithoutPlaintext": "<p>Returns a data encryption key encrypted under a customer master key (CMK). This operation is identical to <a>GenerateDataKey</a> but returns only the encrypted copy of the data key.</p> <p>This operation is useful in a system that has multiple components with different degrees of trust. For example, consider a system that stores encrypted data in containers. Each container stores the encrypted data and an encrypted copy of the data key. One component of the system, called the <i>control plane</i>, creates new containers. When it creates a new container, it uses this operation (<code>GenerateDataKeyWithoutPlaintext</code>) to get an encrypted data key and then stores it in the container. Later, a different component of the system, called the <i>data plane</i>, puts encrypted data into the containers. To do this, it passes the encrypted data key to the <a>Decrypt</a> operation, then uses the returned plaintext data key to encrypt data, and finally stores the encrypted data in the container. In this system, the control plane never sees the plaintext data key.</p>",
|
||||
"GenerateRandom": "<p>Generates an unpredictable byte string.</p>",
|
||||
"GenerateRandom": "<p>Returns a random byte string that is cryptographically secure.</p> <p>For more information about entropy and random number generation, see the <a href=\"https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf\">AWS Key Management Service Cryptographic Details</a> whitepaper.</p>",
|
||||
"GetKeyPolicy": "<p>Retrieves a policy attached to the specified key.</p>",
|
||||
"GetKeyRotationStatus": "<p>Retrieves a Boolean value that indicates whether key rotation is enabled for the specified key.</p>",
|
||||
"GetParametersForImport": "<p>Returns the items you need in order to import key material into AWS KMS from your existing key management infrastructure. For more information about importing key material into AWS KMS, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html\">Importing Key Material</a> in the <i>AWS Key Management Service Developer Guide</i>.</p> <p>You must specify the key ID of the customer master key (CMK) into which you will import key material. This CMK's <code>Origin</code> must be <code>EXTERNAL</code>. You must also specify the wrapping algorithm and type of wrapping key (public key) that you will use to encrypt the key material.</p> <p>This operation returns a public key and an import token. Use the public key to encrypt the key material. Store the import token to send with a subsequent <a>ImportKeyMaterial</a> request. The public key and import token from the same response must be used together. These items are valid for 24 hours, after which they cannot be used for a subsequent <a>ImportKeyMaterial</a> request. To retrieve new ones, send another <code>GetParametersForImport</code> request.</p>",
|
||||
@@ -258,8 +258,8 @@
|
||||
"EncryptRequest$EncryptionContext": "<p>Name-value pair that specifies the encryption context to be used for authenticated encryption. If used here, the same value must be supplied to the <code>Decrypt</code> API or decryption will fail. For more information, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html\">Encryption Context</a>.</p>",
|
||||
"GenerateDataKeyRequest$EncryptionContext": "<p>A set of key-value pairs that represents additional authenticated data.</p> <p>For more information, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html\">Encryption Context</a> in the <i>AWS Key Management Service Developer Guide</i>.</p>",
|
||||
"GenerateDataKeyWithoutPlaintextRequest$EncryptionContext": "<p>A set of key-value pairs that represents additional authenticated data.</p> <p>For more information, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html\">Encryption Context</a> in the <i>AWS Key Management Service Developer Guide</i>.</p>",
|
||||
"GrantConstraints$EncryptionContextSubset": "<p>Contains a list of key-value pairs, a subset of which must be present in the encryption context of a subsequent operation permitted by the grant. When a subsequent operation permitted by the grant includes an encryption context that matches this list or is a subset of this list, the grant allows the operation. Otherwise, the operation is not allowed.</p>",
|
||||
"GrantConstraints$EncryptionContextEquals": "<p>Contains a list of key-value pairs that must be present in the encryption context of a subsequent operation permitted by the grant. When a subsequent operation permitted by the grant includes an encryption context that matches this list, the grant allows the operation. Otherwise, the operation is not allowed.</p>",
|
||||
"GrantConstraints$EncryptionContextSubset": "<p>A list of key-value pairs, all of which must be present in the encryption context of certain subsequent operations that the grant allows. When certain subsequent operations allowed by the grant include encryption context that matches this list or is a superset of this list, the grant allows the operation. Otherwise, the grant does not allow the operation.</p>",
|
||||
"GrantConstraints$EncryptionContextEquals": "<p>A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows. When certain subsequent operations allowed by the grant include encryption context that matches this list, the grant allows the operation. Otherwise, the grant does not allow the operation.</p>",
|
||||
"ReEncryptRequest$SourceEncryptionContext": "<p>Encryption context used to encrypt and decrypt the data specified in the <code>CiphertextBlob</code> parameter.</p>",
|
||||
"ReEncryptRequest$DestinationEncryptionContext": "<p>Encryption context to use when the data is reencrypted.</p>"
|
||||
}
|
||||
@@ -369,10 +369,10 @@
|
||||
}
|
||||
},
|
||||
"GrantConstraints": {
|
||||
"base": "<p>A structure for specifying the conditions under which the operations permitted by the grant are allowed.</p> <p>You can use this structure to allow the operations permitted by the grant only when a specified encryption context is present. For more information about encryption context, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html\">Encryption Context</a> in the <i>AWS Key Management Service Developer Guide</i>.</p>",
|
||||
"base": "<p>A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html\">Encryption Context</a> in the <i>AWS Key Management Service Developer Guide</i>.</p> <p>Grant constraints apply only to operations that accept encryption context as input. For example, the <code> <a>DescribeKey</a> </code> operation does not accept encryption context as input. A grant that allows the <code>DescribeKey</code> operation does so regardless of the grant constraints. In constrast, the <code> <a>Encrypt</a> </code> operation accepts encryption context as input. A grant that allows the <code>Encrypt</code> operation does so only when the encryption context of the <code>Encrypt</code> operation satisfies the grant constraints.</p>",
|
||||
"refs": {
|
||||
"CreateGrantRequest$Constraints": "<p>The conditions under which the operations permitted by the grant are allowed.</p> <p>You can use this value to allow the operations permitted by the grant only when a specified encryption context is present. For more information, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html\">Encryption Context</a> in the <i>AWS Key Management Service Developer Guide</i>.</p>",
|
||||
"GrantListEntry$Constraints": "<p>The conditions under which the grant's operations are allowed.</p>"
|
||||
"CreateGrantRequest$Constraints": "<p>A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html\">Encryption Context</a> in the <i>AWS Key Management Service Developer Guide</i>.</p>",
|
||||
"GrantListEntry$Constraints": "<p>A list of key-value pairs that must be present in the encryption context of certain subsequent operations that the grant allows.</p>"
|
||||
}
|
||||
},
|
||||
"GrantIdType": {
|
||||
@@ -559,6 +559,12 @@
|
||||
"KeyList$member": null
|
||||
}
|
||||
},
|
||||
"KeyManagerType": {
|
||||
"base": null,
|
||||
"refs": {
|
||||
"KeyMetadata$KeyManager": "<p>The CMK's manager. CMKs are either customer-managed or AWS-managed. For more information about the difference, see <a href=\"http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys\">Customer Master Keys</a> in the <i>AWS Key Management Service Developer Guide</i>.</p>"
|
||||
}
|
||||
},
|
||||
"KeyMetadata": {
|
||||
"base": "<p>Contains metadata about a customer master key (CMK).</p> <p>This data type is used as a response element for the <a>CreateKey</a> and <a>DescribeKey</a> operations.</p>",
|
||||
"refs": {
|
||||
@@ -708,7 +714,7 @@
|
||||
"DecryptResponse$Plaintext": "<p>Decrypted plaintext data. This value may not be returned if the customer master key is not available or if you didn't have permission to use it.</p>",
|
||||
"EncryptRequest$Plaintext": "<p>Data to be encrypted.</p>",
|
||||
"GenerateDataKeyResponse$Plaintext": "<p>The data encryption key. Use this data key for local encryption and decryption, then remove it from memory as soon as possible.</p>",
|
||||
"GenerateRandomResponse$Plaintext": "<p>The unpredictable byte string.</p>",
|
||||
"GenerateRandomResponse$Plaintext": "<p>The random byte string.</p>",
|
||||
"GetParametersForImportResponse$PublicKey": "<p>The public key to use to encrypt the key material before importing it with <a>ImportKeyMaterial</a>.</p>"
|
||||
}
|
||||
},
|
||||
@@ -737,7 +743,7 @@
|
||||
"PrincipalIdType": {
|
||||
"base": null,
|
||||
"refs": {
|
||||
"CreateGrantRequest$GranteePrincipal": "<p>The principal that is given permission to perform the operations that the grant permits.</p> <p>To specify the principal, use the <a href=\"http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html\">Amazon Resource Name (ARN)</a> of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href=\"http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam\">AWS Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>AWS General Reference</i>.</p>",
|
||||
"CreateGrantRequest$GranteePrincipal": "<p>The principal that is given permission to perform the operations that the grant permits.</p> <p>To specify the principal, use the <a href=\"http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html\">Amazon Resource Name (ARN)</a> of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, IAM roles, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href=\"http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam\">AWS Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>AWS General Reference</i>.</p>",
|
||||
"CreateGrantRequest$RetiringPrincipal": "<p>The principal that is given permission to retire the grant by using <a>RetireGrant</a> operation.</p> <p>To specify the principal, use the <a href=\"http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html\">Amazon Resource Name (ARN)</a> of an AWS principal. Valid AWS principals include AWS accounts (root), IAM users, federated users, and assumed role users. For examples of the ARN syntax to use for specifying a principal, see <a href=\"http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam\">AWS Identity and Access Management (IAM)</a> in the Example ARNs section of the <i>AWS General Reference</i>.</p>",
|
||||
"GrantListEntry$GranteePrincipal": "<p>The principal that receives the grant's permissions.</p>",
|
||||
"GrantListEntry$RetiringPrincipal": "<p>The principal that can retire the grant.</p>",
|
||||
|
||||
+42
@@ -824,6 +824,48 @@
|
||||
"title": "To schedule a customer master key (CMK) for deletion"
|
||||
}
|
||||
],
|
||||
"TagResource": [
|
||||
{
|
||||
"input": {
|
||||
"KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
|
||||
"Tags": [
|
||||
{
|
||||
"TagKey": "Purpose",
|
||||
"TagValue": "Test"
|
||||
}
|
||||
]
|
||||
},
|
||||
"comments": {
|
||||
"input": {
|
||||
"KeyId": "The identifier of the CMK you are tagging. You can use the key ID or the Amazon Resource Name (ARN) of the CMK.",
|
||||
"Tags": "A list of tags."
|
||||
}
|
||||
},
|
||||
"description": "The following example tags a CMK.",
|
||||
"id": "to-tag-a-cmk-1483997246518",
|
||||
"title": "To tag a customer master key (CMK)"
|
||||
}
|
||||
],
|
||||
"UntagResource": [
|
||||
{
|
||||
"input": {
|
||||
"KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
|
||||
"TagKeys": [
|
||||
"Purpose",
|
||||
"CostCenter"
|
||||
]
|
||||
},
|
||||
"comments": {
|
||||
"input": {
|
||||
"KeyId": "The identifier of the CMK whose tags you are removing.",
|
||||
"TagKeys": "A list of tag keys. Provide only the tag keys, not the tag values."
|
||||
}
|
||||
},
|
||||
"description": "The following example removes tags from a CMK.",
|
||||
"id": "to-remove-tags-from-a-cmk-1483997590962",
|
||||
"title": "To remove tags from a customer master key (CMK)"
|
||||
}
|
||||
],
|
||||
"UpdateAlias": [
|
||||
{
|
||||
"input": {
|
||||
|
||||
Reference in New Issue
Block a user