Network.AWS.KMS.ReEncrypt

Encrypts data on the server side with a new customer master key without exposing the plaintext of the data on the client side. The data is first decrypted and then encrypted. This operation can also be used to change the encryption context of a ciphertext.

Unlike other actions, ReEncrypt is authorized twice - once as ReEncryptFrom on the source key and once as ReEncryptTo on the destination key. We therefore recommend that you include the '"action":"kms:ReEncrypt*"' statement in your key policies to permit re-encryption from or to the key. The statement is included automatically when you authorize use of the key through the console but must be included manually when you set a policy by using the PutKeyPolicy function.

Creating a Request

reEncrypt

Arguments

:: ByteString

reCiphertextBlob

-> Text

reDestinationKeyId

-> ReEncrypt

Creates a value of ReEncrypt with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• reDestinationEncryptionContext
• reSourceEncryptionContext
• reGrantTokens
• reCiphertextBlob
• reDestinationKeyId

data ReEncrypt

See: reEncrypt smart constructor.

Instances

Eq ReEncrypt

Methods

(==) :: ReEncrypt -> ReEncrypt -> Bool

(/=) :: ReEncrypt -> ReEncrypt -> Bool

Data ReEncrypt

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> ReEncrypt -> c ReEncrypt

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c ReEncrypt

toConstr :: ReEncrypt -> Constr

dataTypeOf :: ReEncrypt -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c ReEncrypt)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c ReEncrypt)

gmapT :: (forall b. Data b => b -> b) -> ReEncrypt -> ReEncrypt

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> ReEncrypt -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> ReEncrypt -> r

gmapQ :: (forall d. Data d => d -> u) -> ReEncrypt -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> ReEncrypt -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> ReEncrypt -> m ReEncrypt

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> ReEncrypt -> m ReEncrypt

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> ReEncrypt -> m ReEncrypt

Read ReEncrypt

Methods

readsPrec :: Int -> ReadS ReEncrypt

readList :: ReadS [ReEncrypt]

readPrec :: ReadPrec ReEncrypt

readListPrec :: ReadPrec [ReEncrypt]

Show ReEncrypt

Methods

showsPrec :: Int -> ReEncrypt -> ShowS

show :: ReEncrypt -> String

showList :: [ReEncrypt] -> ShowS

Generic ReEncrypt

Associated Types

type Rep ReEncrypt :: * -> *

Methods

from :: ReEncrypt -> Rep ReEncrypt x

to :: Rep ReEncrypt x -> ReEncrypt

ToJSON ReEncrypt

Methods

toJSON :: ReEncrypt -> Value

toEncoding :: ReEncrypt -> Encoding

Hashable ReEncrypt

Methods

hashWithSalt :: Int -> ReEncrypt -> Int

hash :: ReEncrypt -> Int

NFData ReEncrypt

Methods

rnf :: ReEncrypt -> ()

AWSRequest ReEncrypt

Associated Types

type Rs ReEncrypt :: *

Methods

request :: ReEncrypt -> Request ReEncrypt

response :: MonadResource m => Logger -> Service -> Proxy * ReEncrypt -> ClientResponse -> m (Response ReEncrypt)

ToPath ReEncrypt

Methods

toPath :: ReEncrypt -> ByteString

ToHeaders ReEncrypt

Methods

toHeaders :: ReEncrypt -> [Header]

ToQuery ReEncrypt

Methods

toQuery :: ReEncrypt -> QueryString

type Rep ReEncrypt

type Rep ReEncrypt = D1 (MetaData "ReEncrypt" "Network.AWS.KMS.ReEncrypt" "amazonka-kms-1.4.3-71oGAJhe0mRBKSBLtKegjw" False) (C1 (MetaCons "ReEncrypt'" PrefixI True) ((:*:) ((:*:) (S1 (MetaSel (Just Symbol "_reDestinationEncryptionContext") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe (Map Text Text)))) (S1 (MetaSel (Just Symbol "_reSourceEncryptionContext") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe (Map Text Text))))) ((:*:) (S1 (MetaSel (Just Symbol "_reGrantTokens") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe [Text]))) ((:*:) (S1 (MetaSel (Just Symbol "_reCiphertextBlob") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Base64)) (S1 (MetaSel (Just Symbol "_reDestinationKeyId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text))))))

type Rs ReEncrypt

type Rs ReEncrypt = ReEncryptResponse

Request Lenses

reDestinationEncryptionContext :: Lens' ReEncrypt (HashMap Text Text)

Encryption context to be used when the data is re-encrypted.

reSourceEncryptionContext :: Lens' ReEncrypt (HashMap Text Text)

Encryption context used to encrypt and decrypt the data specified in the CiphertextBlob parameter.

reGrantTokens :: Lens' ReEncrypt [Text]

A list of grant tokens.

For more information, go to Grant Tokens in the AWS Key Management Service Developer Guide.

reCiphertextBlob :: Lens' ReEncrypt ByteString

Ciphertext of the data to re-encrypt.

Note: This Lens automatically encodes and decodes Base64 data, despite what the AWS documentation might say. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This Lens accepts and returns only raw unencoded data.

reDestinationKeyId :: Lens' ReEncrypt Text

A unique identifier for the customer master key used to re-encrypt the data. This value can be a globally unique identifier, a fully specified ARN to either an alias or a key, or an alias name prefixed by "alias/".

• Key ARN Example - arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012
• Alias ARN Example - arn:aws:kms:us-east-1:123456789012:alias/MyAliasName
• Globally Unique Key ID Example - 12345678-1234-1234-1234-123456789012
• Alias Name Example - alias/MyAliasName

Destructuring the Response

reEncryptResponse

Arguments

:: Int

rersResponseStatus

-> ReEncryptResponse

Creates a value of ReEncryptResponse with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• rersSourceKeyId
• rersKeyId
• rersCiphertextBlob
• rersResponseStatus

data ReEncryptResponse

See: reEncryptResponse smart constructor.

Instances

Eq ReEncryptResponse

Methods

(==) :: ReEncryptResponse -> ReEncryptResponse -> Bool

(/=) :: ReEncryptResponse -> ReEncryptResponse -> Bool

Data ReEncryptResponse

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> ReEncryptResponse -> c ReEncryptResponse

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c ReEncryptResponse

toConstr :: ReEncryptResponse -> Constr

dataTypeOf :: ReEncryptResponse -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c ReEncryptResponse)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c ReEncryptResponse)

gmapT :: (forall b. Data b => b -> b) -> ReEncryptResponse -> ReEncryptResponse

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> ReEncryptResponse -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> ReEncryptResponse -> r

gmapQ :: (forall d. Data d => d -> u) -> ReEncryptResponse -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> ReEncryptResponse -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> ReEncryptResponse -> m ReEncryptResponse

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> ReEncryptResponse -> m ReEncryptResponse

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> ReEncryptResponse -> m ReEncryptResponse

Read ReEncryptResponse

Methods

readsPrec :: Int -> ReadS ReEncryptResponse

readList :: ReadS [ReEncryptResponse]

readPrec :: ReadPrec ReEncryptResponse

readListPrec :: ReadPrec [ReEncryptResponse]

Show ReEncryptResponse

Methods

showsPrec :: Int -> ReEncryptResponse -> ShowS

show :: ReEncryptResponse -> String

showList :: [ReEncryptResponse] -> ShowS

Generic ReEncryptResponse

Associated Types

type Rep ReEncryptResponse :: * -> *

Methods

from :: ReEncryptResponse -> Rep ReEncryptResponse x

to :: Rep ReEncryptResponse x -> ReEncryptResponse

NFData ReEncryptResponse

Methods

rnf :: ReEncryptResponse -> ()

type Rep ReEncryptResponse

type Rep ReEncryptResponse = D1 (MetaData "ReEncryptResponse" "Network.AWS.KMS.ReEncrypt" "amazonka-kms-1.4.3-71oGAJhe0mRBKSBLtKegjw" False) (C1 (MetaCons "ReEncryptResponse'" PrefixI True) ((:*:) ((:*:) (S1 (MetaSel (Just Symbol "_rersSourceKeyId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text))) (S1 (MetaSel (Just Symbol "_rersKeyId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text)))) ((:*:) (S1 (MetaSel (Just Symbol "_rersCiphertextBlob") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Base64))) (S1 (MetaSel (Just Symbol "_rersResponseStatus") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Int)))))

Response Lenses

rersSourceKeyId :: Lens' ReEncryptResponse (Maybe Text)

Unique identifier of the key used to originally encrypt the data.

rersKeyId :: Lens' ReEncryptResponse (Maybe Text)

Unique identifier of the key used to re-encrypt the data.

rersCiphertextBlob :: Lens' ReEncryptResponse (Maybe ByteString)

The re-encrypted data. If you are using the CLI, the value is Base64 encoded. Otherwise, it is not encoded.

Note: This Lens automatically encodes and decodes Base64 data, despite what the AWS documentation might say. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This Lens accepts and returns only raw unencoded data.

rersResponseStatus :: Lens' ReEncryptResponse Int

The response status code.