Network.AWS.KMS.ReEncrypt

Encrypts data on the server side with a new customer master key (CMK) without exposing the plaintext of the data on the client side. The data is first decrypted and then reencrypted. You can also use this operation to change the encryption context of a ciphertext.

You can reencrypt data using CMKs in different AWS accounts.

Unlike other operations, ReEncrypt is authorized twice, once as ReEncryptFrom on the source CMK and once as ReEncryptTo on the destination CMK. We recommend that you include the "kms:ReEncrypt*" permission in your key policies to permit reencryption from or to the CMK. This permission is automatically included in the key policy when you create a CMK through the console, but you must include it manually when you create a CMK programmatically or when you set a key policy with the PutKeyPolicy operation.

Creating a Request

reEncrypt

Arguments

:: ByteString

reCiphertextBlob

-> Text

reDestinationKeyId

-> ReEncrypt

Creates a value of ReEncrypt with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• reDestinationEncryptionContext - Encryption context to use when the data is reencrypted.
• reSourceEncryptionContext - Encryption context used to encrypt and decrypt the data specified in the CiphertextBlob parameter.
• reGrantTokens - A list of grant tokens. For more information, see Grant Tokens in the AWS Key Management Service Developer Guide .
• reCiphertextBlob - Ciphertext of the data to reencrypt.-- Note: This Lens automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This Lens accepts and returns only raw unencoded data.
• reDestinationKeyId - A unique identifier for the CMK that is used to reencrypt the data. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example: * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab * Key ARN: @arn:aws:kms:us-east-2:111122223333:key1234abcd-12ab-34cd-56ef-1234567890ab * Alias name: aliasExampleAlias * Alias ARN: arn:aws:kms:us-east-2:111122223333:aliasExampleAlias@ To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey . To get the alias name and alias ARN, use ListAliases .

data ReEncrypt

See: reEncrypt smart constructor.

Instances

Eq ReEncrypt

Methods

(==) :: ReEncrypt -> ReEncrypt -> Bool

(/=) :: ReEncrypt -> ReEncrypt -> Bool

Data ReEncrypt

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> ReEncrypt -> c ReEncrypt

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c ReEncrypt

toConstr :: ReEncrypt -> Constr

dataTypeOf :: ReEncrypt -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c ReEncrypt)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c ReEncrypt)

gmapT :: (forall b. Data b => b -> b) -> ReEncrypt -> ReEncrypt

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> ReEncrypt -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> ReEncrypt -> r

gmapQ :: (forall d. Data d => d -> u) -> ReEncrypt -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> ReEncrypt -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> ReEncrypt -> m ReEncrypt

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> ReEncrypt -> m ReEncrypt

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> ReEncrypt -> m ReEncrypt

Read ReEncrypt

Methods

readsPrec :: Int -> ReadS ReEncrypt

readList :: ReadS [ReEncrypt]

readPrec :: ReadPrec ReEncrypt

readListPrec :: ReadPrec [ReEncrypt]

Show ReEncrypt

Methods

showsPrec :: Int -> ReEncrypt -> ShowS

show :: ReEncrypt -> String

showList :: [ReEncrypt] -> ShowS

Generic ReEncrypt

Associated Types

type Rep ReEncrypt :: * -> *

Methods

from :: ReEncrypt -> Rep ReEncrypt x

to :: Rep ReEncrypt x -> ReEncrypt

Hashable ReEncrypt

Methods

hashWithSalt :: Int -> ReEncrypt -> Int

hash :: ReEncrypt -> Int

ToJSON ReEncrypt

Methods

toJSON :: ReEncrypt -> Value

toEncoding :: ReEncrypt -> Encoding

toJSONList :: [ReEncrypt] -> Value

toEncodingList :: [ReEncrypt] -> Encoding

NFData ReEncrypt

Methods

rnf :: ReEncrypt -> ()

AWSRequest ReEncrypt

Associated Types

type Rs ReEncrypt :: *

Methods

request :: ReEncrypt -> Request ReEncrypt

response :: MonadResource m => Logger -> Service -> Proxy * ReEncrypt -> ClientResponse -> m (Response ReEncrypt)

ToQuery ReEncrypt

Methods

toQuery :: ReEncrypt -> QueryString

ToPath ReEncrypt

Methods

toPath :: ReEncrypt -> ByteString

ToHeaders ReEncrypt

Methods

toHeaders :: ReEncrypt -> [Header]

type Rep ReEncrypt

type Rep ReEncrypt = D1 (MetaData "ReEncrypt" "Network.AWS.KMS.ReEncrypt" "amazonka-kms-1.5.0-1ul8bs34gET2EfYsh0ppOn" False) (C1 (MetaCons "ReEncrypt'" PrefixI True) ((:*:) ((:*:) (S1 (MetaSel (Just Symbol "_reDestinationEncryptionContext") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe (Map Text Text)))) (S1 (MetaSel (Just Symbol "_reSourceEncryptionContext") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe (Map Text Text))))) ((:*:) (S1 (MetaSel (Just Symbol "_reGrantTokens") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe [Text]))) ((:*:) (S1 (MetaSel (Just Symbol "_reCiphertextBlob") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Base64)) (S1 (MetaSel (Just Symbol "_reDestinationKeyId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text))))))

type Rs ReEncrypt

type Rs ReEncrypt = ReEncryptResponse

Request Lenses

reDestinationEncryptionContext :: Lens' ReEncrypt (HashMap Text Text)

Encryption context to use when the data is reencrypted.

reSourceEncryptionContext :: Lens' ReEncrypt (HashMap Text Text)

Encryption context used to encrypt and decrypt the data specified in the CiphertextBlob parameter.

reGrantTokens :: Lens' ReEncrypt [Text]

A list of grant tokens. For more information, see Grant Tokens in the AWS Key Management Service Developer Guide .

reCiphertextBlob :: Lens' ReEncrypt ByteString

Ciphertext of the data to reencrypt.-- Note: This Lens automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This Lens accepts and returns only raw unencoded data.

reDestinationKeyId :: Lens' ReEncrypt Text

A unique identifier for the CMK that is used to reencrypt the data. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example: * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab * Key ARN: @arn:aws:kms:us-east-2:111122223333:key1234abcd-12ab-34cd-56ef-1234567890ab * Alias name: aliasExampleAlias * Alias ARN: arn:aws:kms:us-east-2:111122223333:aliasExampleAlias@ To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey . To get the alias name and alias ARN, use ListAliases .

Destructuring the Response

reEncryptResponse

Arguments

:: Int

rersResponseStatus

-> ReEncryptResponse

Creates a value of ReEncryptResponse with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• rersSourceKeyId - Unique identifier of the CMK used to originally encrypt the data.
• rersKeyId - Unique identifier of the CMK used to reencrypt the data.
• rersCiphertextBlob - The reencrypted data. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- Note: This Lens automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This Lens accepts and returns only raw unencoded data.
• rersResponseStatus - -- | The response status code.

data ReEncryptResponse

See: reEncryptResponse smart constructor.

Instances

Eq ReEncryptResponse

Methods

(==) :: ReEncryptResponse -> ReEncryptResponse -> Bool

(/=) :: ReEncryptResponse -> ReEncryptResponse -> Bool

Data ReEncryptResponse

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> ReEncryptResponse -> c ReEncryptResponse

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c ReEncryptResponse

toConstr :: ReEncryptResponse -> Constr

dataTypeOf :: ReEncryptResponse -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c ReEncryptResponse)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c ReEncryptResponse)

gmapT :: (forall b. Data b => b -> b) -> ReEncryptResponse -> ReEncryptResponse

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> ReEncryptResponse -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> ReEncryptResponse -> r

gmapQ :: (forall d. Data d => d -> u) -> ReEncryptResponse -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> ReEncryptResponse -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> ReEncryptResponse -> m ReEncryptResponse

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> ReEncryptResponse -> m ReEncryptResponse

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> ReEncryptResponse -> m ReEncryptResponse

Read ReEncryptResponse

Methods

readsPrec :: Int -> ReadS ReEncryptResponse

readList :: ReadS [ReEncryptResponse]

readPrec :: ReadPrec ReEncryptResponse

readListPrec :: ReadPrec [ReEncryptResponse]

Show ReEncryptResponse

Methods

showsPrec :: Int -> ReEncryptResponse -> ShowS

show :: ReEncryptResponse -> String

showList :: [ReEncryptResponse] -> ShowS

Generic ReEncryptResponse

Associated Types

type Rep ReEncryptResponse :: * -> *

Methods

from :: ReEncryptResponse -> Rep ReEncryptResponse x

to :: Rep ReEncryptResponse x -> ReEncryptResponse

NFData ReEncryptResponse

Methods

rnf :: ReEncryptResponse -> ()

type Rep ReEncryptResponse

type Rep ReEncryptResponse = D1 (MetaData "ReEncryptResponse" "Network.AWS.KMS.ReEncrypt" "amazonka-kms-1.5.0-1ul8bs34gET2EfYsh0ppOn" False) (C1 (MetaCons "ReEncryptResponse'" PrefixI True) ((:*:) ((:*:) (S1 (MetaSel (Just Symbol "_rersSourceKeyId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text))) (S1 (MetaSel (Just Symbol "_rersKeyId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text)))) ((:*:) (S1 (MetaSel (Just Symbol "_rersCiphertextBlob") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Base64))) (S1 (MetaSel (Just Symbol "_rersResponseStatus") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Int)))))

Response Lenses

rersSourceKeyId :: Lens' ReEncryptResponse (Maybe Text)

Unique identifier of the CMK used to originally encrypt the data.

rersKeyId :: Lens' ReEncryptResponse (Maybe Text)

Unique identifier of the CMK used to reencrypt the data.

rersCiphertextBlob :: Lens' ReEncryptResponse (Maybe ByteString)

The reencrypted data. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- Note: This Lens automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This Lens accepts and returns only raw unencoded data.

rersResponseStatus :: Lens' ReEncryptResponse Int

• - | The response status code.