Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Returns a data key encrypted by a customer master key without the plaintext copy of that key. Otherwise, this API functions exactly like GenerateDataKey. You can use this API to, for example, satisfy an audit requirement that an encrypted key be made available without exposing the plaintext copy of that key.

http://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html

Request

data GenerateDataKeyWithoutPlaintext

Instances

Eq GenerateDataKeyWithoutPlaintext

Read GenerateDataKeyWithoutPlaintext

Show GenerateDataKeyWithoutPlaintext

ToJSON GenerateDataKeyWithoutPlaintext

AWSRequest GenerateDataKeyWithoutPlaintext

ToQuery GenerateDataKeyWithoutPlaintext

ToPath GenerateDataKeyWithoutPlaintext

ToHeaders GenerateDataKeyWithoutPlaintext

type Sv GenerateDataKeyWithoutPlaintext = KMS

type Rs GenerateDataKeyWithoutPlaintext = GenerateDataKeyWithoutPlaintextResponse

Request constructor

generateDataKeyWithoutPlaintext

Arguments

:: Text

gdkwpKeyId

-> GenerateDataKeyWithoutPlaintext

GenerateDataKeyWithoutPlaintext constructor.

The fields accessible through corresponding lenses are:

• gdkwpEncryptionContext :: HashMap Text Text
• gdkwpGrantTokens :: [Text]
• gdkwpKeyId :: Text
• gdkwpKeySpec :: Maybe DataKeySpec
• gdkwpNumberOfBytes :: Maybe Natural

Request lenses

gdkwpEncryptionContext :: Lens' GenerateDataKeyWithoutPlaintext (HashMap Text Text)

Name:value pair that contains additional data to be authenticated during the encryption and decryption processes.

gdkwpGrantTokens :: Lens' GenerateDataKeyWithoutPlaintext [Text]

For more information, see Grant Tokens.

gdkwpKeyId :: Lens' GenerateDataKeyWithoutPlaintext Text

A unique identifier for the customer master key. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by "alias/". Key ARN Example - arn:aws:kms:us-east-1:123456789012:key12345678-1234-1234-1234-123456789012 Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias/MyAliasName Globally Unique Key ID Example - 12345678-1234-1234-123456789012 Alias Name Example - alias/MyAliasName

gdkwpKeySpec :: Lens' GenerateDataKeyWithoutPlaintext (Maybe DataKeySpec)

Value that identifies the encryption algorithm and key size. Currently this can be AES_128 or AES_256.

gdkwpNumberOfBytes :: Lens' GenerateDataKeyWithoutPlaintext (Maybe Natural)

Integer that contains the number of bytes to generate. Common values are 128, 256, 512, 1024 and so on. We recommend that you use the KeySpec parameter instead.

Response

data GenerateDataKeyWithoutPlaintextResponse

Instances

Eq GenerateDataKeyWithoutPlaintextResponse

Read GenerateDataKeyWithoutPlaintextResponse

Show GenerateDataKeyWithoutPlaintextResponse

FromJSON GenerateDataKeyWithoutPlaintextResponse

Response constructor

generateDataKeyWithoutPlaintextResponse :: GenerateDataKeyWithoutPlaintextResponse

GenerateDataKeyWithoutPlaintextResponse constructor.

The fields accessible through corresponding lenses are:

• gdkwprCiphertextBlob :: Maybe Base64
• gdkwprKeyId :: Maybe Text

Response lenses

gdkwprCiphertextBlob :: Lens' GenerateDataKeyWithoutPlaintextResponse (Maybe Base64)

Ciphertext that contains the wrapped data key. You must store the blob and encryption context so that the key can be used in a future decrypt operation.

If you are using the CLI, the value is Base64 encoded. Otherwise, it is not encoded.

gdkwprKeyId :: Lens' GenerateDataKeyWithoutPlaintextResponse (Maybe Text)

System generated unique identifier of the key to be used to decrypt the encrypted copy of the data key.