Amazonka.KMS.VerifyMac

Verifies the hash-based message authentication code (HMAC) for a specified message, HMAC KMS key, and MAC algorithm. To verify the HMAC, VerifyMac computes an HMAC using the message, HMAC KMS key, and MAC algorithm that you specify, and compares the computed HMAC to the HMAC that you specify. If the HMACs are identical, the verification succeeds; otherwise, it fails. Verification indicates that the message hasn't changed since the HMAC was calculated, and the specified key was used to generate and verify the HMAC.

HMAC KMS keys and the HMAC algorithms that KMS uses conform to industry standards defined in RFC 2104.

This operation is part of KMS support for HMAC KMS keys. For details, see HMAC keys in KMS in the Key Management Service Developer Guide.

The KMS key that you use for this operation must be in a compatible key state. For details, see Key states of KMS keys in the Key Management Service Developer Guide.

Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter.

Required permissions: kms:VerifyMac (key policy)

Related operations: GenerateMac

Creating a Request

data VerifyMac

See: newVerifyMac smart constructor.

Constructors

VerifyMac'

Fields

• grantTokens :: Maybe [Text]

  A list of grant tokens.

  Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved eventual consistency. For more information, see Grant token and Using a grant token in the Key Management Service Developer Guide.

• message :: Sensitive Base64

  The message that will be used in the verification. Enter the same message that was used to generate the HMAC.

  GenerateMac and VerifyMac do not provide special handling for message digests. If you generated an HMAC for a hash digest of a message, you must verify the HMAC for the same hash digest.

• keyId :: Text

  The KMS key that will be used in the verification.

  Enter a key ID of the KMS key that was used to generate the HMAC. If you identify a different KMS key, the VerifyMac operation fails.

• macAlgorithm :: MacAlgorithmSpec

  The MAC algorithm that will be used in the verification. Enter the same MAC algorithm that was used to compute the HMAC. This algorithm must be supported by the HMAC KMS key identified by the KeyId parameter.

• mac :: Base64

  The HMAC to verify. Enter the HMAC that was generated by the GenerateMac operation when you specified the same message, HMAC KMS key, and MAC algorithm as the values specified in this request.

Instances

ToJSON VerifyMac

Defined in Amazonka.KMS.VerifyMac

Methods

toJSON :: VerifyMac -> Value

toEncoding :: VerifyMac -> Encoding

toJSONList :: [VerifyMac] -> Value

toEncodingList :: [VerifyMac] -> Encoding

ToHeaders VerifyMac

Defined in Amazonka.KMS.VerifyMac

Methods

toHeaders :: VerifyMac -> [Header]

ToPath VerifyMac

Defined in Amazonka.KMS.VerifyMac

Methods

toPath :: VerifyMac -> ByteString

ToQuery VerifyMac

Defined in Amazonka.KMS.VerifyMac

Methods

toQuery :: VerifyMac -> QueryString

AWSRequest VerifyMac

Defined in Amazonka.KMS.VerifyMac

Associated Types

type AWSResponse VerifyMac

Methods

request :: (Service -> Service) -> VerifyMac -> Request VerifyMac

response :: MonadResource m => (ByteStringLazy -> IO ByteStringLazy) -> Service -> Proxy VerifyMac -> ClientResponse ClientBody -> m (Either Error (ClientResponse (AWSResponse VerifyMac)))

Generic VerifyMac

Defined in Amazonka.KMS.VerifyMac

Associated Types

type Rep VerifyMac :: Type -> Type

Methods

from :: VerifyMac -> Rep VerifyMac x

to :: Rep VerifyMac x -> VerifyMac

Show VerifyMac

Defined in Amazonka.KMS.VerifyMac

Methods

showsPrec :: Int -> VerifyMac -> ShowS

show :: VerifyMac -> String

showList :: [VerifyMac] -> ShowS

NFData VerifyMac

Defined in Amazonka.KMS.VerifyMac

Methods

rnf :: VerifyMac -> ()

Eq VerifyMac

Defined in Amazonka.KMS.VerifyMac

Methods

(==) :: VerifyMac -> VerifyMac -> Bool

(/=) :: VerifyMac -> VerifyMac -> Bool

Hashable VerifyMac

Defined in Amazonka.KMS.VerifyMac

Methods

hashWithSalt :: Int -> VerifyMac -> Int

hash :: VerifyMac -> Int

type AWSResponse VerifyMac

Defined in Amazonka.KMS.VerifyMac

type AWSResponse VerifyMac = VerifyMacResponse

type Rep VerifyMac

Defined in Amazonka.KMS.VerifyMac

type Rep VerifyMac = D1 ('MetaData "VerifyMac" "Amazonka.KMS.VerifyMac" "amazonka-kms-2.0-6YhT3Ymbf9Z5PoaGoz7tbG" 'False) (C1 ('MetaCons "VerifyMac'" 'PrefixI 'True) ((S1 ('MetaSel ('Just "grantTokens") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe [Text])) :*: S1 ('MetaSel ('Just "message") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Sensitive Base64))) :*: (S1 ('MetaSel ('Just "keyId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :*: (S1 ('MetaSel ('Just "macAlgorithm") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 MacAlgorithmSpec) :*: S1 ('MetaSel ('Just "mac") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Base64)))))

newVerifyMac

Arguments

:: ByteString

$sel:message:VerifyMac'

-> Text

VerifyMac

-> MacAlgorithmSpec

VerifyMac

-> ByteString

$sel:mac:VerifyMac'

-> VerifyMac

Create a value of VerifyMac with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:grantTokens:VerifyMac', verifyMac_grantTokens - A list of grant tokens.

Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved eventual consistency. For more information, see Grant token and Using a grant token in the Key Management Service Developer Guide.

$sel:message:VerifyMac', verifyMac_message - The message that will be used in the verification. Enter the same message that was used to generate the HMAC.

GenerateMac and VerifyMac do not provide special handling for message digests. If you generated an HMAC for a hash digest of a message, you must verify the HMAC for the same hash digest.-- -- Note: This Lens automatically encodes and decodes Base64 data. -- The underlying isomorphism will encode to Base64 representation during -- serialisation, and decode from Base64 representation during deserialisation. -- This Lens accepts and returns only raw unencoded data.

VerifyMac, verifyMac_keyId - The KMS key that will be used in the verification.

Enter a key ID of the KMS key that was used to generate the HMAC. If you identify a different KMS key, the VerifyMac operation fails.

VerifyMac, verifyMac_macAlgorithm - The MAC algorithm that will be used in the verification. Enter the same MAC algorithm that was used to compute the HMAC. This algorithm must be supported by the HMAC KMS key identified by the KeyId parameter.

$sel:mac:VerifyMac', verifyMac_mac - The HMAC to verify. Enter the HMAC that was generated by the GenerateMac operation when you specified the same message, HMAC KMS key, and MAC algorithm as the values specified in this request.-- -- Note: This Lens automatically encodes and decodes Base64 data. -- The underlying isomorphism will encode to Base64 representation during -- serialisation, and decode from Base64 representation during deserialisation. -- This Lens accepts and returns only raw unencoded data.

Request Lenses

verifyMac_grantTokens :: Lens' VerifyMac (Maybe [Text])

A list of grant tokens.

Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved eventual consistency. For more information, see Grant token and Using a grant token in the Key Management Service Developer Guide.

verifyMac_message :: Lens' VerifyMac ByteString

The message that will be used in the verification. Enter the same message that was used to generate the HMAC.

GenerateMac and VerifyMac do not provide special handling for message digests. If you generated an HMAC for a hash digest of a message, you must verify the HMAC for the same hash digest.-- -- Note: This Lens automatically encodes and decodes Base64 data. -- The underlying isomorphism will encode to Base64 representation during -- serialisation, and decode from Base64 representation during deserialisation. -- This Lens accepts and returns only raw unencoded data.

verifyMac_keyId :: Lens' VerifyMac Text

The KMS key that will be used in the verification.

Enter a key ID of the KMS key that was used to generate the HMAC. If you identify a different KMS key, the VerifyMac operation fails.

verifyMac_macAlgorithm :: Lens' VerifyMac MacAlgorithmSpec

The MAC algorithm that will be used in the verification. Enter the same MAC algorithm that was used to compute the HMAC. This algorithm must be supported by the HMAC KMS key identified by the KeyId parameter.

verifyMac_mac :: Lens' VerifyMac ByteString

The HMAC to verify. Enter the HMAC that was generated by the GenerateMac operation when you specified the same message, HMAC KMS key, and MAC algorithm as the values specified in this request.-- -- Note: This Lens automatically encodes and decodes Base64 data. -- The underlying isomorphism will encode to Base64 representation during -- serialisation, and decode from Base64 representation during deserialisation. -- This Lens accepts and returns only raw unencoded data.

Destructuring the Response

data VerifyMacResponse

See: newVerifyMacResponse smart constructor.

Constructors

VerifyMacResponse'

Fields

• keyId :: Maybe Text

  The HMAC KMS key used in the verification.

• macAlgorithm :: Maybe MacAlgorithmSpec

  The MAC algorithm used in the verification.

• macValid :: Maybe Bool

  A Boolean value that indicates whether the HMAC was verified. A value of True indicates that the HMAC (Mac) was generated with the specified Message, HMAC KMS key (KeyID) and MacAlgorithm..

  If the HMAC is not verified, the VerifyMac operation fails with a KMSInvalidMacException exception. This exception indicates that one or more of the inputs changed since the HMAC was computed.

• httpStatus :: Int

  The response's http status code.

Instances

Generic VerifyMacResponse

Defined in Amazonka.KMS.VerifyMac

Associated Types

type Rep VerifyMacResponse :: Type -> Type

Methods

from :: VerifyMacResponse -> Rep VerifyMacResponse x

to :: Rep VerifyMacResponse x -> VerifyMacResponse

Read VerifyMacResponse

Defined in Amazonka.KMS.VerifyMac

Methods

readsPrec :: Int -> ReadS VerifyMacResponse

readList :: ReadS [VerifyMacResponse]

readPrec :: ReadPrec VerifyMacResponse

readListPrec :: ReadPrec [VerifyMacResponse]

Show VerifyMacResponse

Defined in Amazonka.KMS.VerifyMac

Methods

showsPrec :: Int -> VerifyMacResponse -> ShowS

show :: VerifyMacResponse -> String

showList :: [VerifyMacResponse] -> ShowS

NFData VerifyMacResponse

Defined in Amazonka.KMS.VerifyMac

Methods

rnf :: VerifyMacResponse -> ()

Eq VerifyMacResponse

Defined in Amazonka.KMS.VerifyMac

Methods

(==) :: VerifyMacResponse -> VerifyMacResponse -> Bool

(/=) :: VerifyMacResponse -> VerifyMacResponse -> Bool

type Rep VerifyMacResponse

Defined in Amazonka.KMS.VerifyMac

type Rep VerifyMacResponse = D1 ('MetaData "VerifyMacResponse" "Amazonka.KMS.VerifyMac" "amazonka-kms-2.0-6YhT3Ymbf9Z5PoaGoz7tbG" 'False) (C1 ('MetaCons "VerifyMacResponse'" 'PrefixI 'True) ((S1 ('MetaSel ('Just "keyId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "macAlgorithm") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe MacAlgorithmSpec))) :*: (S1 ('MetaSel ('Just "macValid") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Bool)) :*: S1 ('MetaSel ('Just "httpStatus") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Int))))

newVerifyMacResponse

Arguments

:: Int

$sel:httpStatus:VerifyMacResponse'

-> VerifyMacResponse

Create a value of VerifyMacResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

VerifyMac, verifyMacResponse_keyId - The HMAC KMS key used in the verification.

VerifyMac, verifyMacResponse_macAlgorithm - The MAC algorithm used in the verification.

$sel:macValid:VerifyMacResponse', verifyMacResponse_macValid - A Boolean value that indicates whether the HMAC was verified. A value of True indicates that the HMAC (Mac) was generated with the specified Message, HMAC KMS key (KeyID) and MacAlgorithm..

If the HMAC is not verified, the VerifyMac operation fails with a KMSInvalidMacException exception. This exception indicates that one or more of the inputs changed since the HMAC was computed.

$sel:httpStatus:VerifyMacResponse', verifyMacResponse_httpStatus - The response's http status code.

Response Lenses

verifyMacResponse_keyId :: Lens' VerifyMacResponse (Maybe Text)

The HMAC KMS key used in the verification.

verifyMacResponse_macAlgorithm :: Lens' VerifyMacResponse (Maybe MacAlgorithmSpec)

The MAC algorithm used in the verification.

verifyMacResponse_macValid :: Lens' VerifyMacResponse (Maybe Bool)

A Boolean value that indicates whether the HMAC was verified. A value of True indicates that the HMAC (Mac) was generated with the specified Message, HMAC KMS key (KeyID) and MacAlgorithm..

If the HMAC is not verified, the VerifyMac operation fails with a KMSInvalidMacException exception. This exception indicates that one or more of the inputs changed since the HMAC was computed.

verifyMacResponse_httpStatus :: Lens' VerifyMacResponse Int

The response's http status code.