Amazonka.KMS.Types.KeyMetadata

Documentation

data KeyMetadata

Contains metadata about a KMS key.

This data type is used as a response element for the CreateKey, DescribeKey, and ReplicateKey operations.

See: newKeyMetadata smart constructor.

Constructors

KeyMetadata'

Fields

• aWSAccountId :: Maybe Text

  The twelve-digit account ID of the Amazon Web Services account that owns the KMS key.

• arn :: Maybe Text

  The Amazon Resource Name (ARN) of the KMS key. For examples, see Key Management Service (KMS) in the Example ARNs section of the /Amazon Web Services General Reference/.

• cloudHsmClusterId :: Maybe Text

  The cluster ID of the CloudHSM cluster that contains the key material for the KMS key. When you create a KMS key in an CloudHSM custom key store, KMS creates the key material for the KMS key in the associated CloudHSM cluster. This field is present only when the KMS key is created in an CloudHSM key store.

• creationDate :: Maybe POSIX

  The date and time when the KMS key was created.

• customKeyStoreId :: Maybe Text

  A unique identifier for the custom key store that contains the KMS key. This field is present only when the KMS key is created in a custom key store.

• customerMasterKeySpec :: Maybe CustomerMasterKeySpec

  Instead, use the KeySpec field.

  The KeySpec and CustomerMasterKeySpec fields have the same value. We recommend that you use the KeySpec field in your code. However, to avoid breaking changes, KMS supports both fields.

• deletionDate :: Maybe POSIX

  The date and time after which KMS deletes this KMS key. This value is present only when the KMS key is scheduled for deletion, that is, when its KeyState is PendingDeletion.

  When the primary key in a multi-Region key is scheduled for deletion but still has replica keys, its key state is PendingReplicaDeletion and the length of its waiting period is displayed in the PendingDeletionWindowInDays field.

• description :: Maybe Text

  The description of the KMS key.

• enabled :: Maybe Bool

  Specifies whether the KMS key is enabled. When KeyState is Enabled this value is true, otherwise it is false.

• encryptionAlgorithms :: Maybe [EncryptionAlgorithmSpec]

  The encryption algorithms that the KMS key supports. You cannot use the KMS key with other encryption algorithms within KMS.

  This value is present only when the KeyUsage of the KMS key is ENCRYPT_DECRYPT.

• expirationModel :: Maybe ExpirationModelType

  Specifies whether the KMS key's key material expires. This value is present only when Origin is EXTERNAL, otherwise this value is omitted.

• keyManager :: Maybe KeyManagerType

  The manager of the KMS key. KMS keys in your Amazon Web Services account are either customer managed or Amazon Web Services managed. For more information about the difference, see KMS keys in the Key Management Service Developer Guide.

• keySpec :: Maybe KeySpec

  Describes the type of key material in the KMS key.

• keyState :: Maybe KeyState

  The current status of the KMS key.

  For more information about how key state affects the use of a KMS key, see Key states of KMS keys in the Key Management Service Developer Guide.

• keyUsage :: Maybe KeyUsageType

  The cryptographic operations for which you can use the KMS key.

• macAlgorithms :: Maybe [MacAlgorithmSpec]

  The message authentication code (MAC) algorithm that the HMAC KMS key supports.

  This value is present only when the KeyUsage of the KMS key is GENERATE_VERIFY_MAC.

• multiRegion :: Maybe Bool

  Indicates whether the KMS key is a multi-Region (True) or regional (False) key. This value is True for multi-Region primary and replica keys and False for regional KMS keys.

  For more information about multi-Region keys, see Multi-Region keys in KMS in the Key Management Service Developer Guide.

• multiRegionConfiguration :: Maybe MultiRegionConfiguration

  Lists the primary and replica keys in same multi-Region key. This field is present only when the value of the MultiRegion field is True.

  For more information about any listed KMS key, use the DescribeKey operation.

  • MultiRegionKeyType indicates whether the KMS key is a PRIMARY or REPLICA key.
  • PrimaryKey displays the key ARN and Region of the primary key. This field displays the current KMS key if it is the primary key.
  • ReplicaKeys displays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.
• origin :: Maybe OriginType

  The source of the key material for the KMS key. When this value is AWS_KMS, KMS created the key material. When this value is EXTERNAL, the key material was imported or the KMS key doesn't have any key material. When this value is AWS_CLOUDHSM, the key material was created in the CloudHSM cluster associated with a custom key store.

• pendingDeletionWindowInDays :: Maybe Natural

  The waiting period before the primary key in a multi-Region key is deleted. This waiting period begins when the last of its replica keys is deleted. This value is present only when the KeyState of the KMS key is PendingReplicaDeletion. That indicates that the KMS key is the primary key in a multi-Region key, it is scheduled for deletion, and it still has existing replica keys.

  When a single-Region KMS key or a multi-Region replica key is scheduled for deletion, its deletion date is displayed in the DeletionDate field. However, when the primary key in a multi-Region key is scheduled for deletion, its waiting period doesn't begin until all of its replica keys are deleted. This value displays that waiting period. When the last replica key in the multi-Region key is deleted, the KeyState of the scheduled primary key changes from PendingReplicaDeletion to PendingDeletion and the deletion date appears in the DeletionDate field.

• signingAlgorithms :: Maybe [SigningAlgorithmSpec]

  The signing algorithms that the KMS key supports. You cannot use the KMS key with other signing algorithms within KMS.

  This field appears only when the KeyUsage of the KMS key is SIGN_VERIFY.

• validTo :: Maybe POSIX

  The time at which the imported key material expires. When the key material expires, KMS deletes the key material and the KMS key becomes unusable. This value is present only for KMS keys whose Origin is EXTERNAL and whose ExpirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is omitted.

• xksKeyConfiguration :: Maybe XksKeyConfigurationType

  Information about the external key that is associated with a KMS key in an external key store.

  For more information, see External key in the Key Management Service Developer Guide.

• keyId :: Text

  The globally unique identifier for the KMS key.

Instances

FromJSON KeyMetadata

Defined in Amazonka.KMS.Types.KeyMetadata

Methods

parseJSON :: Value -> Parser KeyMetadata

parseJSONList :: Value -> Parser [KeyMetadata]

Generic KeyMetadata

Defined in Amazonka.KMS.Types.KeyMetadata

Associated Types

type Rep KeyMetadata :: Type -> Type

Methods

from :: KeyMetadata -> Rep KeyMetadata x

to :: Rep KeyMetadata x -> KeyMetadata

Read KeyMetadata

Defined in Amazonka.KMS.Types.KeyMetadata

Methods

readsPrec :: Int -> ReadS KeyMetadata

readList :: ReadS [KeyMetadata]

readPrec :: ReadPrec KeyMetadata

readListPrec :: ReadPrec [KeyMetadata]

Show KeyMetadata

Defined in Amazonka.KMS.Types.KeyMetadata

Methods

showsPrec :: Int -> KeyMetadata -> ShowS

show :: KeyMetadata -> String

showList :: [KeyMetadata] -> ShowS

NFData KeyMetadata

Defined in Amazonka.KMS.Types.KeyMetadata

Methods

rnf :: KeyMetadata -> ()

Eq KeyMetadata

Defined in Amazonka.KMS.Types.KeyMetadata

Methods

(==) :: KeyMetadata -> KeyMetadata -> Bool

(/=) :: KeyMetadata -> KeyMetadata -> Bool

Hashable KeyMetadata

Defined in Amazonka.KMS.Types.KeyMetadata

Methods

hashWithSalt :: Int -> KeyMetadata -> Int

hash :: KeyMetadata -> Int

type Rep KeyMetadata

Defined in Amazonka.KMS.Types.KeyMetadata

type Rep KeyMetadata = D1 ('MetaData "KeyMetadata" "Amazonka.KMS.Types.KeyMetadata" "amazonka-kms-2.0-6YhT3Ymbf9Z5PoaGoz7tbG" 'False) (C1 ('MetaCons "KeyMetadata'" 'PrefixI 'True) ((((S1 ('MetaSel ('Just "aWSAccountId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: (S1 ('MetaSel ('Just "arn") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "cloudHsmClusterId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)))) :*: (S1 ('MetaSel ('Just "creationDate") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe POSIX)) :*: (S1 ('MetaSel ('Just "customKeyStoreId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "customerMasterKeySpec") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe CustomerMasterKeySpec))))) :*: ((S1 ('MetaSel ('Just "deletionDate") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe POSIX)) :*: (S1 ('MetaSel ('Just "description") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "enabled") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Bool)))) :*: (S1 ('MetaSel ('Just "encryptionAlgorithms") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe [EncryptionAlgorithmSpec])) :*: (S1 ('MetaSel ('Just "expirationModel") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe ExpirationModelType)) :*: S1 ('MetaSel ('Just "keyManager") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe KeyManagerType)))))) :*: (((S1 ('MetaSel ('Just "keySpec") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe KeySpec)) :*: (S1 ('MetaSel ('Just "keyState") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe KeyState)) :*: S1 ('MetaSel ('Just "keyUsage") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe KeyUsageType)))) :*: (S1 ('MetaSel ('Just "macAlgorithms") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe [MacAlgorithmSpec])) :*: (S1 ('MetaSel ('Just "multiRegion") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Bool)) :*: S1 ('MetaSel ('Just "multiRegionConfiguration") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe MultiRegionConfiguration))))) :*: ((S1 ('MetaSel ('Just "origin") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe OriginType)) :*: (S1 ('MetaSel ('Just "pendingDeletionWindowInDays") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Natural)) :*: S1 ('MetaSel ('Just "signingAlgorithms") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe [SigningAlgorithmSpec])))) :*: (S1 ('MetaSel ('Just "validTo") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe POSIX)) :*: (S1 ('MetaSel ('Just "xksKeyConfiguration") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe XksKeyConfigurationType)) :*: S1 ('MetaSel ('Just "keyId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text)))))))

newKeyMetadata

Arguments

:: Text

$sel:keyId:KeyMetadata'

-> KeyMetadata

Create a value of KeyMetadata with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:aWSAccountId:KeyMetadata', keyMetadata_aWSAccountId - The twelve-digit account ID of the Amazon Web Services account that owns the KMS key.

$sel:arn:KeyMetadata', keyMetadata_arn - The Amazon Resource Name (ARN) of the KMS key. For examples, see Key Management Service (KMS) in the Example ARNs section of the /Amazon Web Services General Reference/.

$sel:cloudHsmClusterId:KeyMetadata', keyMetadata_cloudHsmClusterId - The cluster ID of the CloudHSM cluster that contains the key material for the KMS key. When you create a KMS key in an CloudHSM custom key store, KMS creates the key material for the KMS key in the associated CloudHSM cluster. This field is present only when the KMS key is created in an CloudHSM key store.

$sel:creationDate:KeyMetadata', keyMetadata_creationDate - The date and time when the KMS key was created.

$sel:customKeyStoreId:KeyMetadata', keyMetadata_customKeyStoreId - A unique identifier for the custom key store that contains the KMS key. This field is present only when the KMS key is created in a custom key store.

$sel:customerMasterKeySpec:KeyMetadata', keyMetadata_customerMasterKeySpec - Instead, use the KeySpec field.

The KeySpec and CustomerMasterKeySpec fields have the same value. We recommend that you use the KeySpec field in your code. However, to avoid breaking changes, KMS supports both fields.

$sel:deletionDate:KeyMetadata', keyMetadata_deletionDate - The date and time after which KMS deletes this KMS key. This value is present only when the KMS key is scheduled for deletion, that is, when its KeyState is PendingDeletion.

When the primary key in a multi-Region key is scheduled for deletion but still has replica keys, its key state is PendingReplicaDeletion and the length of its waiting period is displayed in the PendingDeletionWindowInDays field.

$sel:description:KeyMetadata', keyMetadata_description - The description of the KMS key.

$sel:enabled:KeyMetadata', keyMetadata_enabled - Specifies whether the KMS key is enabled. When KeyState is Enabled this value is true, otherwise it is false.

$sel:encryptionAlgorithms:KeyMetadata', keyMetadata_encryptionAlgorithms - The encryption algorithms that the KMS key supports. You cannot use the KMS key with other encryption algorithms within KMS.

This value is present only when the KeyUsage of the KMS key is ENCRYPT_DECRYPT.

$sel:expirationModel:KeyMetadata', keyMetadata_expirationModel - Specifies whether the KMS key's key material expires. This value is present only when Origin is EXTERNAL, otherwise this value is omitted.

$sel:keyManager:KeyMetadata', keyMetadata_keyManager - The manager of the KMS key. KMS keys in your Amazon Web Services account are either customer managed or Amazon Web Services managed. For more information about the difference, see KMS keys in the Key Management Service Developer Guide.

$sel:keySpec:KeyMetadata', keyMetadata_keySpec - Describes the type of key material in the KMS key.

$sel:keyState:KeyMetadata', keyMetadata_keyState - The current status of the KMS key.

For more information about how key state affects the use of a KMS key, see Key states of KMS keys in the Key Management Service Developer Guide.

$sel:keyUsage:KeyMetadata', keyMetadata_keyUsage - The cryptographic operations for which you can use the KMS key.

$sel:macAlgorithms:KeyMetadata', keyMetadata_macAlgorithms - The message authentication code (MAC) algorithm that the HMAC KMS key supports.

This value is present only when the KeyUsage of the KMS key is GENERATE_VERIFY_MAC.

$sel:multiRegion:KeyMetadata', keyMetadata_multiRegion - Indicates whether the KMS key is a multi-Region (True) or regional (False) key. This value is True for multi-Region primary and replica keys and False for regional KMS keys.

For more information about multi-Region keys, see Multi-Region keys in KMS in the Key Management Service Developer Guide.

$sel:multiRegionConfiguration:KeyMetadata', keyMetadata_multiRegionConfiguration - Lists the primary and replica keys in same multi-Region key. This field is present only when the value of the MultiRegion field is True.

For more information about any listed KMS key, use the DescribeKey operation.

• MultiRegionKeyType indicates whether the KMS key is a PRIMARY or REPLICA key.
• PrimaryKey displays the key ARN and Region of the primary key. This field displays the current KMS key if it is the primary key.
• ReplicaKeys displays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.

$sel:origin:KeyMetadata', keyMetadata_origin - The source of the key material for the KMS key. When this value is AWS_KMS, KMS created the key material. When this value is EXTERNAL, the key material was imported or the KMS key doesn't have any key material. When this value is AWS_CLOUDHSM, the key material was created in the CloudHSM cluster associated with a custom key store.

$sel:pendingDeletionWindowInDays:KeyMetadata', keyMetadata_pendingDeletionWindowInDays - The waiting period before the primary key in a multi-Region key is deleted. This waiting period begins when the last of its replica keys is deleted. This value is present only when the KeyState of the KMS key is PendingReplicaDeletion. That indicates that the KMS key is the primary key in a multi-Region key, it is scheduled for deletion, and it still has existing replica keys.

When a single-Region KMS key or a multi-Region replica key is scheduled for deletion, its deletion date is displayed in the DeletionDate field. However, when the primary key in a multi-Region key is scheduled for deletion, its waiting period doesn't begin until all of its replica keys are deleted. This value displays that waiting period. When the last replica key in the multi-Region key is deleted, the KeyState of the scheduled primary key changes from PendingReplicaDeletion to PendingDeletion and the deletion date appears in the DeletionDate field.

$sel:signingAlgorithms:KeyMetadata', keyMetadata_signingAlgorithms - The signing algorithms that the KMS key supports. You cannot use the KMS key with other signing algorithms within KMS.

This field appears only when the KeyUsage of the KMS key is SIGN_VERIFY.

$sel:validTo:KeyMetadata', keyMetadata_validTo - The time at which the imported key material expires. When the key material expires, KMS deletes the key material and the KMS key becomes unusable. This value is present only for KMS keys whose Origin is EXTERNAL and whose ExpirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is omitted.

$sel:xksKeyConfiguration:KeyMetadata', keyMetadata_xksKeyConfiguration - Information about the external key that is associated with a KMS key in an external key store.

For more information, see External key in the Key Management Service Developer Guide.

$sel:keyId:KeyMetadata', keyMetadata_keyId - The globally unique identifier for the KMS key.

keyMetadata_aWSAccountId :: Lens' KeyMetadata (Maybe Text)

The twelve-digit account ID of the Amazon Web Services account that owns the KMS key.

keyMetadata_arn :: Lens' KeyMetadata (Maybe Text)

The Amazon Resource Name (ARN) of the KMS key. For examples, see Key Management Service (KMS) in the Example ARNs section of the /Amazon Web Services General Reference/.

keyMetadata_cloudHsmClusterId :: Lens' KeyMetadata (Maybe Text)

The cluster ID of the CloudHSM cluster that contains the key material for the KMS key. When you create a KMS key in an CloudHSM custom key store, KMS creates the key material for the KMS key in the associated CloudHSM cluster. This field is present only when the KMS key is created in an CloudHSM key store.

keyMetadata_creationDate :: Lens' KeyMetadata (Maybe UTCTime)

The date and time when the KMS key was created.

keyMetadata_customKeyStoreId :: Lens' KeyMetadata (Maybe Text)

A unique identifier for the custom key store that contains the KMS key. This field is present only when the KMS key is created in a custom key store.

keyMetadata_customerMasterKeySpec :: Lens' KeyMetadata (Maybe CustomerMasterKeySpec)

Instead, use the KeySpec field.

The KeySpec and CustomerMasterKeySpec fields have the same value. We recommend that you use the KeySpec field in your code. However, to avoid breaking changes, KMS supports both fields.

keyMetadata_deletionDate :: Lens' KeyMetadata (Maybe UTCTime)

The date and time after which KMS deletes this KMS key. This value is present only when the KMS key is scheduled for deletion, that is, when its KeyState is PendingDeletion.

When the primary key in a multi-Region key is scheduled for deletion but still has replica keys, its key state is PendingReplicaDeletion and the length of its waiting period is displayed in the PendingDeletionWindowInDays field.

keyMetadata_description :: Lens' KeyMetadata (Maybe Text)

The description of the KMS key.

keyMetadata_enabled :: Lens' KeyMetadata (Maybe Bool)

Specifies whether the KMS key is enabled. When KeyState is Enabled this value is true, otherwise it is false.

keyMetadata_encryptionAlgorithms :: Lens' KeyMetadata (Maybe [EncryptionAlgorithmSpec])

The encryption algorithms that the KMS key supports. You cannot use the KMS key with other encryption algorithms within KMS.

This value is present only when the KeyUsage of the KMS key is ENCRYPT_DECRYPT.

keyMetadata_expirationModel :: Lens' KeyMetadata (Maybe ExpirationModelType)

Specifies whether the KMS key's key material expires. This value is present only when Origin is EXTERNAL, otherwise this value is omitted.

keyMetadata_keyManager :: Lens' KeyMetadata (Maybe KeyManagerType)

The manager of the KMS key. KMS keys in your Amazon Web Services account are either customer managed or Amazon Web Services managed. For more information about the difference, see KMS keys in the Key Management Service Developer Guide.

keyMetadata_keySpec :: Lens' KeyMetadata (Maybe KeySpec)

Describes the type of key material in the KMS key.

keyMetadata_keyState :: Lens' KeyMetadata (Maybe KeyState)

The current status of the KMS key.

For more information about how key state affects the use of a KMS key, see Key states of KMS keys in the Key Management Service Developer Guide.

keyMetadata_keyUsage :: Lens' KeyMetadata (Maybe KeyUsageType)

The cryptographic operations for which you can use the KMS key.

keyMetadata_macAlgorithms :: Lens' KeyMetadata (Maybe [MacAlgorithmSpec])

The message authentication code (MAC) algorithm that the HMAC KMS key supports.

This value is present only when the KeyUsage of the KMS key is GENERATE_VERIFY_MAC.

keyMetadata_multiRegion :: Lens' KeyMetadata (Maybe Bool)

Indicates whether the KMS key is a multi-Region (True) or regional (False) key. This value is True for multi-Region primary and replica keys and False for regional KMS keys.

For more information about multi-Region keys, see Multi-Region keys in KMS in the Key Management Service Developer Guide.

keyMetadata_multiRegionConfiguration :: Lens' KeyMetadata (Maybe MultiRegionConfiguration)

Lists the primary and replica keys in same multi-Region key. This field is present only when the value of the MultiRegion field is True.

For more information about any listed KMS key, use the DescribeKey operation.

• MultiRegionKeyType indicates whether the KMS key is a PRIMARY or REPLICA key.
• PrimaryKey displays the key ARN and Region of the primary key. This field displays the current KMS key if it is the primary key.
• ReplicaKeys displays the key ARNs and Regions of all replica keys. This field includes the current KMS key if it is a replica key.

keyMetadata_origin :: Lens' KeyMetadata (Maybe OriginType)

The source of the key material for the KMS key. When this value is AWS_KMS, KMS created the key material. When this value is EXTERNAL, the key material was imported or the KMS key doesn't have any key material. When this value is AWS_CLOUDHSM, the key material was created in the CloudHSM cluster associated with a custom key store.

keyMetadata_pendingDeletionWindowInDays :: Lens' KeyMetadata (Maybe Natural)

The waiting period before the primary key in a multi-Region key is deleted. This waiting period begins when the last of its replica keys is deleted. This value is present only when the KeyState of the KMS key is PendingReplicaDeletion. That indicates that the KMS key is the primary key in a multi-Region key, it is scheduled for deletion, and it still has existing replica keys.

When a single-Region KMS key or a multi-Region replica key is scheduled for deletion, its deletion date is displayed in the DeletionDate field. However, when the primary key in a multi-Region key is scheduled for deletion, its waiting period doesn't begin until all of its replica keys are deleted. This value displays that waiting period. When the last replica key in the multi-Region key is deleted, the KeyState of the scheduled primary key changes from PendingReplicaDeletion to PendingDeletion and the deletion date appears in the DeletionDate field.

keyMetadata_signingAlgorithms :: Lens' KeyMetadata (Maybe [SigningAlgorithmSpec])

The signing algorithms that the KMS key supports. You cannot use the KMS key with other signing algorithms within KMS.

This field appears only when the KeyUsage of the KMS key is SIGN_VERIFY.

keyMetadata_validTo :: Lens' KeyMetadata (Maybe UTCTime)

The time at which the imported key material expires. When the key material expires, KMS deletes the key material and the KMS key becomes unusable. This value is present only for KMS keys whose Origin is EXTERNAL and whose ExpirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is omitted.

keyMetadata_xksKeyConfiguration :: Lens' KeyMetadata (Maybe XksKeyConfigurationType)

Information about the external key that is associated with a KMS key in an external key store.

For more information, see External key in the Key Management Service Developer Guide.

keyMetadata_keyId :: Lens' KeyMetadata Text

The globally unique identifier for the KMS key.