Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Returns a data encryption key encrypted under a customer master key (CMK). This operation is identical to GenerateDataKey but returns only the encrypted copy of the data key.

To perform this operation on a CMK in a different AWS account, specify the key ARN or alias ARN in the value of the KeyId parameter.

This operation is useful in a system that has multiple components with different degrees of trust. For example, consider a system that stores encrypted data in containers. Each container stores the encrypted data and an encrypted copy of the data key. One component of the system, called the control plane , creates new containers. When it creates a new container, it uses this operation (GenerateDataKeyWithoutPlaintext ) to get an encrypted data key and then stores it in the container. Later, a different component of the system, called the data plane , puts encrypted data into the containers. To do this, it passes the encrypted data key to the Decrypt operation, then uses the returned plaintext data key to encrypt data, and finally stores the encrypted data in the container. In this system, the control plane never sees the plaintext data key.

Creating a Request

generateDataKeyWithoutPlaintext

Arguments

:: Text

gdkwpKeyId

-> GenerateDataKeyWithoutPlaintext

Creates a value of GenerateDataKeyWithoutPlaintext with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• gdkwpKeySpec - The length of the data encryption key. Use AES_128 to generate a 128-bit symmetric key, or AES_256 to generate a 256-bit symmetric key.
• gdkwpEncryptionContext - A set of key-value pairs that represents additional authenticated data. For more information, see Encryption Context in the AWS Key Management Service Developer Guide .
• gdkwpNumberOfBytes - The length of the data encryption key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For common key lengths (128-bit and 256-bit symmetric keys), we recommend that you use the KeySpec field instead of this one.
• gdkwpGrantTokens - A list of grant tokens. For more information, see Grant Tokens in the AWS Key Management Service Developer Guide .
• gdkwpKeyId - The identifier of the customer master key (CMK) under which to generate and encrypt the data encryption key. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example: * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab * Key ARN: @arn:aws:kms:us-east-2:111122223333:key1234abcd-12ab-34cd-56ef-1234567890ab * Alias name: aliasExampleAlias * Alias ARN: arn:aws:kms:us-east-2:111122223333:aliasExampleAlias@ To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey . To get the alias name and alias ARN, use ListAliases .

data GenerateDataKeyWithoutPlaintext

See: generateDataKeyWithoutPlaintext smart constructor.

Instances

Eq GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

(==) :: GenerateDataKeyWithoutPlaintext -> GenerateDataKeyWithoutPlaintext -> Bool

(/=) :: GenerateDataKeyWithoutPlaintext -> GenerateDataKeyWithoutPlaintext -> Bool

Data GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> GenerateDataKeyWithoutPlaintext -> c GenerateDataKeyWithoutPlaintext

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c GenerateDataKeyWithoutPlaintext

toConstr :: GenerateDataKeyWithoutPlaintext -> Constr

dataTypeOf :: GenerateDataKeyWithoutPlaintext -> DataType

dataCast1 :: Typeable t => (forall d. Data d => c (t d)) -> Maybe (c GenerateDataKeyWithoutPlaintext)

dataCast2 :: Typeable t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c GenerateDataKeyWithoutPlaintext)

gmapT :: (forall b. Data b => b -> b) -> GenerateDataKeyWithoutPlaintext -> GenerateDataKeyWithoutPlaintext

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> GenerateDataKeyWithoutPlaintext -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> GenerateDataKeyWithoutPlaintext -> r

gmapQ :: (forall d. Data d => d -> u) -> GenerateDataKeyWithoutPlaintext -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> GenerateDataKeyWithoutPlaintext -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> GenerateDataKeyWithoutPlaintext -> m GenerateDataKeyWithoutPlaintext

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> GenerateDataKeyWithoutPlaintext -> m GenerateDataKeyWithoutPlaintext

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> GenerateDataKeyWithoutPlaintext -> m GenerateDataKeyWithoutPlaintext

Read GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

readsPrec :: Int -> ReadS GenerateDataKeyWithoutPlaintext

readList :: ReadS [GenerateDataKeyWithoutPlaintext]

readPrec :: ReadPrec GenerateDataKeyWithoutPlaintext

readListPrec :: ReadPrec [GenerateDataKeyWithoutPlaintext]

Show GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

showsPrec :: Int -> GenerateDataKeyWithoutPlaintext -> ShowS

show :: GenerateDataKeyWithoutPlaintext -> String

showList :: [GenerateDataKeyWithoutPlaintext] -> ShowS

Generic GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Associated Types

type Rep GenerateDataKeyWithoutPlaintext :: Type -> Type

Methods

from :: GenerateDataKeyWithoutPlaintext -> Rep GenerateDataKeyWithoutPlaintext x

to :: Rep GenerateDataKeyWithoutPlaintext x -> GenerateDataKeyWithoutPlaintext

Hashable GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

hashWithSalt :: Int -> GenerateDataKeyWithoutPlaintext -> Int

hash :: GenerateDataKeyWithoutPlaintext -> Int

ToJSON GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

toJSON :: GenerateDataKeyWithoutPlaintext -> Value

toEncoding :: GenerateDataKeyWithoutPlaintext -> Encoding

toJSONList :: [GenerateDataKeyWithoutPlaintext] -> Value

toEncodingList :: [GenerateDataKeyWithoutPlaintext] -> Encoding

AWSRequest GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Associated Types

type Rs GenerateDataKeyWithoutPlaintext :: Type

Methods

request :: GenerateDataKeyWithoutPlaintext -> Request GenerateDataKeyWithoutPlaintext

response :: (MonadResource m, MonadThrow m) => Logger -> Service -> Proxy GenerateDataKeyWithoutPlaintext -> ClientResponse -> m (Response GenerateDataKeyWithoutPlaintext)

ToHeaders GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

toHeaders :: GenerateDataKeyWithoutPlaintext -> [Header]

ToPath GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

toPath :: GenerateDataKeyWithoutPlaintext -> ByteString

ToQuery GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

toQuery :: GenerateDataKeyWithoutPlaintext -> QueryString

NFData GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

rnf :: GenerateDataKeyWithoutPlaintext -> ()

type Rep GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

type Rep GenerateDataKeyWithoutPlaintext = D1 (MetaData "GenerateDataKeyWithoutPlaintext" "Network.AWS.KMS.GenerateDataKeyWithoutPlaintext" "amazonka-kms-1.6.1-1UDljZYfeha1jjHbbMax4v" False) (C1 (MetaCons "GenerateDataKeyWithoutPlaintext'" PrefixI True) ((S1 (MetaSel (Just "_gdkwpKeySpec") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe DataKeySpec)) :*: S1 (MetaSel (Just "_gdkwpEncryptionContext") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe (Map Text Text)))) :*: (S1 (MetaSel (Just "_gdkwpNumberOfBytes") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Nat)) :*: (S1 (MetaSel (Just "_gdkwpGrantTokens") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe [Text])) :*: S1 (MetaSel (Just "_gdkwpKeyId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)))))

type Rs GenerateDataKeyWithoutPlaintext

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

type Rs GenerateDataKeyWithoutPlaintext = GenerateDataKeyWithoutPlaintextResponse

Request Lenses

gdkwpKeySpec :: Lens' GenerateDataKeyWithoutPlaintext (Maybe DataKeySpec)

The length of the data encryption key. Use AES_128 to generate a 128-bit symmetric key, or AES_256 to generate a 256-bit symmetric key.

gdkwpEncryptionContext :: Lens' GenerateDataKeyWithoutPlaintext (HashMap Text Text)

A set of key-value pairs that represents additional authenticated data. For more information, see Encryption Context in the AWS Key Management Service Developer Guide .

gdkwpNumberOfBytes :: Lens' GenerateDataKeyWithoutPlaintext (Maybe Natural)

The length of the data encryption key in bytes. For example, use the value 64 to generate a 512-bit data key (64 bytes is 512 bits). For common key lengths (128-bit and 256-bit symmetric keys), we recommend that you use the KeySpec field instead of this one.

gdkwpGrantTokens :: Lens' GenerateDataKeyWithoutPlaintext [Text]

A list of grant tokens. For more information, see Grant Tokens in the AWS Key Management Service Developer Guide .

gdkwpKeyId :: Lens' GenerateDataKeyWithoutPlaintext Text

The identifier of the customer master key (CMK) under which to generate and encrypt the data encryption key. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias". To specify a CMK in a different AWS account, you must use the key ARN or alias ARN. For example: * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab * Key ARN: @arn:aws:kms:us-east-2:111122223333:key1234abcd-12ab-34cd-56ef-1234567890ab * Alias name: aliasExampleAlias * Alias ARN: arn:aws:kms:us-east-2:111122223333:aliasExampleAlias@ To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey . To get the alias name and alias ARN, use ListAliases .

Destructuring the Response

generateDataKeyWithoutPlaintextResponse

Arguments

:: Int

gdkwprsResponseStatus

-> GenerateDataKeyWithoutPlaintextResponse

Creates a value of GenerateDataKeyWithoutPlaintextResponse with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• gdkwprsKeyId - The identifier of the CMK under which the data encryption key was generated and encrypted.
• gdkwprsCiphertextBlob - The encrypted data encryption key. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- Note: This Lens automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This Lens accepts and returns only raw unencoded data.
• gdkwprsResponseStatus - -- | The response status code.

data GenerateDataKeyWithoutPlaintextResponse

See: generateDataKeyWithoutPlaintextResponse smart constructor.

Instances

Eq GenerateDataKeyWithoutPlaintextResponse

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

(==) :: GenerateDataKeyWithoutPlaintextResponse -> GenerateDataKeyWithoutPlaintextResponse -> Bool

(/=) :: GenerateDataKeyWithoutPlaintextResponse -> GenerateDataKeyWithoutPlaintextResponse -> Bool

Data GenerateDataKeyWithoutPlaintextResponse

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> GenerateDataKeyWithoutPlaintextResponse -> c GenerateDataKeyWithoutPlaintextResponse

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c GenerateDataKeyWithoutPlaintextResponse

toConstr :: GenerateDataKeyWithoutPlaintextResponse -> Constr

dataTypeOf :: GenerateDataKeyWithoutPlaintextResponse -> DataType

dataCast1 :: Typeable t => (forall d. Data d => c (t d)) -> Maybe (c GenerateDataKeyWithoutPlaintextResponse)

dataCast2 :: Typeable t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c GenerateDataKeyWithoutPlaintextResponse)

gmapT :: (forall b. Data b => b -> b) -> GenerateDataKeyWithoutPlaintextResponse -> GenerateDataKeyWithoutPlaintextResponse

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> GenerateDataKeyWithoutPlaintextResponse -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> GenerateDataKeyWithoutPlaintextResponse -> r

gmapQ :: (forall d. Data d => d -> u) -> GenerateDataKeyWithoutPlaintextResponse -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> GenerateDataKeyWithoutPlaintextResponse -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> GenerateDataKeyWithoutPlaintextResponse -> m GenerateDataKeyWithoutPlaintextResponse

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> GenerateDataKeyWithoutPlaintextResponse -> m GenerateDataKeyWithoutPlaintextResponse

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> GenerateDataKeyWithoutPlaintextResponse -> m GenerateDataKeyWithoutPlaintextResponse

Read GenerateDataKeyWithoutPlaintextResponse

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

readsPrec :: Int -> ReadS GenerateDataKeyWithoutPlaintextResponse

readList :: ReadS [GenerateDataKeyWithoutPlaintextResponse]

readPrec :: ReadPrec GenerateDataKeyWithoutPlaintextResponse

readListPrec :: ReadPrec [GenerateDataKeyWithoutPlaintextResponse]

Show GenerateDataKeyWithoutPlaintextResponse

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

showsPrec :: Int -> GenerateDataKeyWithoutPlaintextResponse -> ShowS

show :: GenerateDataKeyWithoutPlaintextResponse -> String

showList :: [GenerateDataKeyWithoutPlaintextResponse] -> ShowS

Generic GenerateDataKeyWithoutPlaintextResponse

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Associated Types

type Rep GenerateDataKeyWithoutPlaintextResponse :: Type -> Type

Methods

from :: GenerateDataKeyWithoutPlaintextResponse -> Rep GenerateDataKeyWithoutPlaintextResponse x

to :: Rep GenerateDataKeyWithoutPlaintextResponse x -> GenerateDataKeyWithoutPlaintextResponse

NFData GenerateDataKeyWithoutPlaintextResponse

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

Methods

rnf :: GenerateDataKeyWithoutPlaintextResponse -> ()

type Rep GenerateDataKeyWithoutPlaintextResponse

Defined in Network.AWS.KMS.GenerateDataKeyWithoutPlaintext

type Rep GenerateDataKeyWithoutPlaintextResponse = D1 (MetaData "GenerateDataKeyWithoutPlaintextResponse" "Network.AWS.KMS.GenerateDataKeyWithoutPlaintext" "amazonka-kms-1.6.1-1UDljZYfeha1jjHbbMax4v" False) (C1 (MetaCons "GenerateDataKeyWithoutPlaintextResponse'" PrefixI True) (S1 (MetaSel (Just "_gdkwprsKeyId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text)) :*: (S1 (MetaSel (Just "_gdkwprsCiphertextBlob") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Base64)) :*: S1 (MetaSel (Just "_gdkwprsResponseStatus") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Int))))

Response Lenses

gdkwprsKeyId :: Lens' GenerateDataKeyWithoutPlaintextResponse (Maybe Text)

The identifier of the CMK under which the data encryption key was generated and encrypted.

gdkwprsCiphertextBlob :: Lens' GenerateDataKeyWithoutPlaintextResponse (Maybe ByteString)

The encrypted data encryption key. When you use the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not encoded.-- Note: This Lens automatically encodes and decodes Base64 data. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This Lens accepts and returns only raw unencoded data.

gdkwprsResponseStatus :: Lens' GenerateDataKeyWithoutPlaintextResponse Int

• - | The response status code.