Network.AWS.KMS.GenerateDataKey

Generates a secure data key. Data keys are used to encrypt and decrypt data. They are wrapped by customer master keys.

http://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html

Request

data GenerateDataKey

Instances

Eq GenerateDataKey

Show GenerateDataKey

ToJSON GenerateDataKey

AWSRequest GenerateDataKey

ToQuery GenerateDataKey

ToHeaders GenerateDataKey

ToPath GenerateDataKey

type Rs GenerateDataKey = GenerateDataKeyResponse

type Sv GenerateDataKey = KMS

Request constructor

generateDataKey

Arguments

:: Text

gdkKeyId

-> GenerateDataKey

GenerateDataKey constructor.

The fields accessible through corresponding lenses are:

• gdkEncryptionContext :: HashMap Text Text
• gdkGrantTokens :: [Text]
• gdkKeyId :: Text
• gdkKeySpec :: Maybe DataKeySpec
• gdkNumberOfBytes :: Maybe Natural

Request lenses

gdkEncryptionContext :: Lens' GenerateDataKey (HashMap Text Text)

Name/value pair that contains additional data to be authenticated during the encryption and decryption processes that use the key. This value is logged by AWS CloudTrail to provide context around the data encrypted by the key.

gdkGrantTokens :: Lens' GenerateDataKey [Text]

A list of grant tokens that represent grants which can be used to provide long term permissions to generate a key.

gdkKeyId :: Lens' GenerateDataKey Text

Unique identifier of the key. This can be an ARN, an alias, or a globally unique identifier.

gdkKeySpec :: Lens' GenerateDataKey (Maybe DataKeySpec)

Value that identifies the encryption algorithm and key size to generate a data key for. Currently this can be AES_128 or AES_256.

gdkNumberOfBytes :: Lens' GenerateDataKey (Maybe Natural)

Integer that contains the number of bytes to generate. Common values are 128, 256, 512, 1024 and so on. 1024 is the current limit.

Response

data GenerateDataKeyResponse

Instances

Eq GenerateDataKeyResponse

Show GenerateDataKeyResponse

FromJSON GenerateDataKeyResponse

Response constructor

generateDataKeyResponse :: GenerateDataKeyResponse

GenerateDataKeyResponse constructor.

The fields accessible through corresponding lenses are:

• gdkrCiphertextBlob :: Maybe Base64
• gdkrKeyId :: Maybe Text
• gdkrPlaintext :: Maybe Base64

Response lenses

gdkrCiphertextBlob :: Lens' GenerateDataKeyResponse (Maybe Base64)

Ciphertext that contains the wrapped key. You must store the blob and encryption context so that the ciphertext can be decrypted. You must provide both the ciphertext blob and the encryption context.

gdkrKeyId :: Lens' GenerateDataKeyResponse (Maybe Text)

System generated unique identifier for the key.

gdkrPlaintext :: Lens' GenerateDataKeyResponse (Maybe Base64)

Plaintext that contains the unwrapped key. Use this for encryption and decryption and then remove it from memory as soon as possible.