Smaws_Client_PaymentCryptography.Typestype nonrec wrapped_key = {key_check_value_algorithm : key_check_value_algorithm option;The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.
For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result. For HMAC keys, the KCV is computed using the hash selected at key creation on a zero-length message, taking the leftmost 3 bytes.
*)key_check_value : key_check_value option;The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.
*)key_material : key_material;Parameter information for generating a wrapped key using TR-31 or TR-34 skey exchange method.
*)wrapped_key_material_format : wrapped_key_material_format;The key block format of a wrapped key.
*)wrapping_key_arn : key_arn;The KeyARN of the wrapped key.
}Parameter information for generating a WrappedKeyBlock for key exchange.
The request was denied due to an invalid request error.
One or more parameters in your request are invalid. Check the parameter values, formats, and constraints specified in the API documentation.
type nonrec alias = {key_arn : key_arn option;The KeyARN of the key associated with the alias.
alias_name : alias_name;A friendly name that you can use to refer to a key. The value must begin with alias/.
Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.
*)}Contains information about an alias.
type nonrec update_alias_input = {key_arn : key_arn option;The KeyARN for the key that you are updating or removing from the alias.
alias_name : alias_name;The alias whose associated key is changing.
*)}The request was denied due to request throttling.
You have exceeded the rate limits for Amazon Web Services Payment Cryptography API calls. Implement exponential backoff and retry logic in your application to handle throttling gracefully.
The service cannot complete the request.
The Amazon Web Services Payment Cryptography service is temporarily unavailable. This is typically a temporary condition - retry your request after a brief delay.
type nonrec resource_not_found_exception = {resource_id : Smaws_Lib.Smithy_api.Types.string_ option;The identifier of the resource that was not found.
This field contains the specific resource identifier (such as a key ARN or alias name) that could not be located.
*)}The request was denied due to resource not found.
The specified key, alias, or other resource does not exist in your account or region. Verify that the resource identifier is correct and that the resource exists in the expected region.
The request processing has failed because of an unknown error, exception, or failure.
This indicates a server-side error within the Amazon Web Services Payment Cryptography service. If this error persists, contact support for assistance.
This request can cause an inconsistent state for the resource.
The requested operation conflicts with the current state of the resource. For example, attempting to delete a key that is currently being used, or trying to create a resource that already exists.
You do not have sufficient access to perform this action.
This exception is thrown when the caller lacks the necessary IAM permissions to perform the requested operation. Verify that your IAM policy includes the required permissions for the specific Amazon Web Services Payment Cryptography action you're attempting.
type nonrec tag_keys = tag_key listtype nonrec untag_resource_input = {tag_keys : tag_keys;One or more tag keys. Don't include the tag values.
If the Amazon Web Services Payment Cryptography key doesn't have the specified tag key, Amazon Web Services Payment Cryptography doesn't throw an exception or return a response. To confirm that the operation succeeded, use the ListTagsForResource operation.
*)resource_arn : resource_arn;The KeyARN of the key whose tags are being removed.
}type nonrec key_usage = | TR31_B0_BASE_DERIVATION_KEY| TR31_C0_CARD_VERIFICATION_KEY| TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY| TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION| TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS| TR31_E1_EMV_MKEY_CONFIDENTIALITY| TR31_E2_EMV_MKEY_INTEGRITY| TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS| TR31_E5_EMV_MKEY_CARD_PERSONALIZATION| TR31_E6_EMV_MKEY_OTHER| TR31_K0_KEY_ENCRYPTION_KEY| TR31_K1_KEY_BLOCK_PROTECTION_KEY| TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT| TR31_M0_ISO_16609_MAC_KEY| TR31_M3_ISO_9797_3_MAC_KEY| TR31_M1_ISO_9797_1_MAC_KEY| TR31_M6_ISO_9797_5_CMAC_KEY| TR31_M7_HMAC_KEY| TR31_P0_PIN_ENCRYPTION_KEY| TR31_P1_PIN_GENERATION_KEY| TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE| TR31_V1_IBM3624_PIN_VERIFICATION_KEY| TR31_V2_VISA_PIN_VERIFICATION_KEY| TR31_K2_TR34_ASYMMETRIC_KEYtype nonrec key_modes_of_use = {no_restrictions : Smaws_Lib.Smithy_api.Types.primitive_boolean option;Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.
derive_key : Smaws_Lib.Smithy_api.Types.primitive_boolean option;Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.
*)verify : Smaws_Lib.Smithy_api.Types.primitive_boolean option;Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.
*)sign : Smaws_Lib.Smithy_api.Types.primitive_boolean option;Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.
*)generate : Smaws_Lib.Smithy_api.Types.primitive_boolean option;Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.
*)unwrap : Smaws_Lib.Smithy_api.Types.primitive_boolean option;Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.
*)wrap : Smaws_Lib.Smithy_api.Types.primitive_boolean option;Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.
*)decrypt : Smaws_Lib.Smithy_api.Types.primitive_boolean option;Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.
*)encrypt : Smaws_Lib.Smithy_api.Types.primitive_boolean option;Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.
*)}The list of cryptographic operations that you can perform using the key. The modes of use are defined in section A.5.3 of the TR-31 spec.
type nonrec key_attributes = {key_modes_of_use : key_modes_of_use;The list of cryptographic operations that you can perform using the key.
*)key_algorithm : key_algorithm;The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.
For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.
key_class : key_class;The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.
*)key_usage : key_usage;The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.
*)}The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.
type nonrec trusted_certificate_public_key = {public_key_certificate : certificate_type;Parameter information for trusted public key certificate import.
*)key_attributes : key_attributes;The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after a trusted public key is imported.
*)}Parameter information for trusted public key certificate import.
type nonrec tags = tag listtype nonrec tag_resource_input = {resource_arn : resource_arn;The KeyARN of the key whose tags are being updated.
}type nonrec service_quota_exceeded_exception = {message : Smaws_Lib.Smithy_api.Types.string_ option;}This request would cause a service quota to be exceeded.
You have reached the maximum number of keys, aliases, or other resources allowed in your account. Review your current usage and consider deleting unused resources or requesting a quota increase.
type nonrec derive_key_usage = | TR31_B0_BASE_DERIVATION_KEY| TR31_C0_CARD_VERIFICATION_KEY| TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY| TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS| TR31_E1_EMV_MKEY_CONFIDENTIALITY| TR31_E2_EMV_MKEY_INTEGRITY| TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS| TR31_E5_EMV_MKEY_CARD_PERSONALIZATION| TR31_E6_EMV_MKEY_OTHER| TR31_K0_KEY_ENCRYPTION_KEY| TR31_K1_KEY_BLOCK_PROTECTION_KEY| TR31_M3_ISO_9797_3_MAC_KEY| TR31_M1_ISO_9797_1_MAC_KEY| TR31_M6_ISO_9797_5_CMAC_KEY| TR31_M7_HMAC_KEY| TR31_P0_PIN_ENCRYPTION_KEY| TR31_P1_PIN_GENERATION_KEY| TR31_V1_IBM3624_PIN_VERIFICATION_KEY| TR31_V2_VISA_PIN_VERIFICATION_KEYtype nonrec replication_status_type = {status_message : Smaws_Lib.Smithy_api.Types.string_ option;A message that provides additional information about the current replication status of the key.
This field contains details about any issues or progress updates related to key replication operations. It may include information about replication failures, synchronization status, or other operational details.
*)status : key_replication_state;The current status of key replication in this Amazon Web Services Region.
This field indicates whether the key replication is in progress, completed successfully, or has encountered an error. Possible values include states such as SYNCRHONIZED, IN_PROGRESS, DELETE_IN_PROGRESS, or FAILED. This provides visibility into the replication process for monitoring and troubleshooting purposes.
}Represents the replication status information for a key in a replication region for Multi-Region key replication.
This structure contains details about the current state of key replication, including any status messages and operational information about the replication process.
type nonrec replication_status = (region * replication_status_type) listtype nonrec mpa_status = {status_message : mpa_status_message option;The message providing additional information about the MPA session status.
*)initiation_date : timestamp;The date and time when the MPA session was initiated.
*)status : session_status;The current status of the MPA session.
*)mpa_session_arn : mpa_session_arn;The ARN of the MPA session.
*)}The status of an MPA session.
type nonrec key = {mpa_status : mpa_status option;The Multi-Party Approval (MPA) status for the key, if applicable.
*)using_default_replication_regions : Smaws_Lib.Smithy_api.Types.boolean_ option;Indicates whether this key is using the account's default replication regions configuration for Multi-Region key replication.
When set to true, the key automatically replicates to the regions specified in the account's default replication settings. When set to false, the key has a custom replication configuration that overrides the account defaults.
replication_status : replication_status option;Information about the replication status of the key across different Amazon Web Services Regions.
This field provides details about the current state of key replication, including any status messages or operational information. It helps track the progress and health of key replication operations.
*)primary_region : region option;multi_region_key_type : multi_region_key_type option;Indicates whether this key is a Multi-Region key and its role in the Multi-Region key hierarchy.
Multi-Region replication keys allow the same key material to be used across multiple Amazon Web Services Regions. This field specifies whether the key is a Primary Region key (PRK) (which can be replicated to other Amazon Web Services Regions) or a Replica Region key (RRK) (which is a copy of a PRK in another Region). For more information, see Multi-Region key replication.
*)derive_key_usage : derive_key_usage option;The cryptographic usage of an ECDH derived key as defined in section A.5.2 of the TR-31 spec.
*)delete_timestamp : timestamp option;The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when when the KeyState is DELETE_COMPLETE and the Amazon Web Services Payment Cryptography key is deleted.
delete_pending_timestamp : timestamp option;The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when KeyState is DELETE_PENDING and the key is scheduled for deletion.
usage_stop_timestamp : timestamp option;The date and time after which Amazon Web Services Payment Cryptography will stop using the key material for cryptographic operations.
*)usage_start_timestamp : timestamp option;The date and time after which Amazon Web Services Payment Cryptography will start using the key material for cryptographic operations.
*)create_timestamp : timestamp;The date and time when the key was created.
*)key_origin : key_origin;The source of the key material. For keys created within Amazon Web Services Payment Cryptography, the value is AWS_PAYMENT_CRYPTOGRAPHY. For keys imported into Amazon Web Services Payment Cryptography, the value is EXTERNAL.
key_state : key_state;The state of key that is being created or deleted.
*)exportable : Smaws_Lib.Smithy_api.Types.boolean_;Specifies whether the key is exportable. This data is immutable after the key is created.
*)enabled : Smaws_Lib.Smithy_api.Types.boolean_;Specifies whether the key is enabled.
*)key_check_value_algorithm : key_check_value_algorithm;The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.
For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result. For HMAC keys, the KCV is computed using the hash selected at key creation on a zero-length message, taking the leftmost 3 bytes.
*)key_check_value : key_check_value;The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.
*)key_attributes : key_attributes;The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.
*)key_arn : key_arn;The Amazon Resource Name (ARN) of the key.
*)}Metadata about an Amazon Web Services Payment Cryptography key.
type nonrec stop_key_usage_input = {key_identifier : key_arn_or_key_alias_type;The KeyArn of the key.
}type nonrec start_key_usage_output = {key : key;The KeyARN of the Amazon Web Services Payment Cryptography key activated for use.
}type nonrec start_key_usage_input = {key_identifier : key_arn_or_key_alias_type;The KeyArn of the key.
}type nonrec root_certificate_public_key = {public_key_certificate : certificate_type;Parameter information for root public key certificate import.
*)key_attributes : key_attributes;The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the root public key is imported.
*)}Parameter information for root public key certificate import.
type nonrec restore_key_output = {key : key;The key material of the restored key. The KeyState will change to CREATE_COMPLETE and value for DeletePendingTimestamp gets removed.
}type nonrec restore_key_input = {key_identifier : key_arn_or_key_alias_type;The KeyARN of the key to be restored within Amazon Web Services Payment Cryptography.
}type nonrec remove_key_replication_regions_output = {key : key;The updated key metadata after removing the replication regions.
This reflects the current state of the key and its updated replication configuration.
*)}Output from removing replication regions from a key.
type nonrec regions = region listtype nonrec remove_key_replication_regions_input = {replication_regions : regions;The list of Amazon Web Services Regions to remove from the key's replication configuration.
The key will no longer be available for cryptographic operations in these regions after removal. Ensure no active operations depend on the key in these regions before removal.
*)key_identifier : key_arn_or_key_alias_type;The key identifier (ARN or alias) of the key from which to remove replication regions.
This key must exist and have replication enabled in the specified regions.
*)}Input parameters for removing replication regions from a specific key.
type nonrec put_resource_policy_output = {policy : resource_policy;The resource-based policy that was attached to the key.
*)resource_arn : resource_arn;The KeyARN of the key that the resource-based policy was attached to.
}type nonrec put_resource_policy_input = {policy : resource_policy;The resource-based policy to attach to the key, in JSON format.
*)resource_arn : resource_arn;The KeyARN of the key to attach the resource-based policy to.
}The resource-based policy would grant public access to the key.
Modify the policy to restrict access to specific principals and resubmit the request.
type nonrec import_key_output = {key : key;The KeyARN of the key material imported within Amazon Web Services Payment Cryptography.
}type nonrec import_tr31_key_block = {wrapped_key_block : tr31_wrapped_key_block;The TR-31 wrapped key block to import.
*)wrapping_key_identifier : key_arn_or_key_alias_type;The KeyARN of the key that will decrypt or unwrap a TR-31 key block during import.
}Parameter information for key material import using symmetric TR-31 key exchange method.
type nonrec import_tr34_key_block = {random_nonce : even_hex_length_between16_and32 option;A random number value that is unique to the TR-34 key block generated using 2 pass. The operation will fail, if a random nonce value is not provided for a TR-34 key block generated using 2 pass.
*)key_block_format : tr34_key_block_format;The key block format to use during key import. The only value allowed is X9_TR34_2012.
wrapped_key_block : tr34_wrapped_key_block;The TR-34 wrapped key block to import.
*)wrapping_key_certificate : certificate_type option;The certificate used to wrap the TR-34 key block.
*)wrapping_key_identifier : key_arn_or_key_alias_type option;Key Identifier used for unwrapping the import key
*)import_token : import_token_id option;The import token that initiates key import using the asymmetric TR-34 key exchange method into Amazon Web Services Payment Cryptography. It expires after 30 days. You can use the same import token to import multiple keys to the same service account.
*)signing_key_certificate : certificate_type;The public key component in PEM certificate format of the private key that signs the KDH TR-34 WrappedKeyBlock.
*)}Parameter information for key material import using the asymmetric TR-34 key exchange method.
type nonrec import_key_cryptogram = {wrapping_spec : wrapping_key_spec option;The wrapping spec for the wrapped key cryptogram.
*)import_token : import_token_id;The import token that initiates key import using the asymmetric RSA wrap and unwrap key exchange method into AWS Payment Cryptography. It expires after 30 days. You can use the same import token to import multiple keys to the same service account.
*)wrapped_key_cryptogram : wrapped_key_cryptogram;The RSA wrapped key cryptogram under import.
*)exportable : Smaws_Lib.Smithy_api.Types.boolean_;Specifies whether the key is exportable from the service.
*)key_attributes : key_attributes;}Parameter information for key material import using asymmetric RSA wrap and unwrap key exchange method.
The shared information used when deriving a key using ECDH.
type nonrec import_diffie_hellman_tr31_key_block = {wrapped_key_block : tr31_wrapped_key_block;The ECDH wrapped key block to import.
*)derivation_data : diffie_hellman_derivation_data;The shared information used when deriving a key using ECDH.
*)key_derivation_hash_algorithm : key_derivation_hash_algorithm;The hash type to use when deriving a key using ECDH.
*)key_derivation_function : key_derivation_function;The key derivation function to use when deriving a key using ECDH.
*)derive_key_algorithm : symmetric_key_algorithm;The key algorithm of the shared derived ECDH key.
*)public_key_certificate : certificate_type;The public key certificate of the client's receiving ECC key pair, in PEM format (base64 encoded), to use for ECDH key derivation.
*)private_key_identifier : key_arn_or_key_alias_type;The keyARN of the asymmetric ECC key created within Amazon Web Services Payment Cryptography.
}Key derivation parameter information for key material import using asymmetric ECDH key exchange method.
type nonrec import_as2805_key_cryptogram = {wrapped_key_cryptogram : wrapped_key_cryptogram;The wrapped key cryptogram under import.
*)wrapping_key_identifier : key_arn_or_key_alias_type;exportable : Smaws_Lib.Smithy_api.Types.boolean_;Specified whether the key is exportable. This data is immutable after the key is imported.
*)key_algorithm : key_algorithm;The key algorithm of the key under import.
*)key_modes_of_use : key_modes_of_use;as2805_key_variant : as2805_key_variant;The cryptographic usage of the key under import.
*)}Parameter information for key material import using AS2805 key cryptogram format.
type nonrec import_key_material = | As2805KeyCryptogram of import_as2805_key_cryptogramParameter information for key material import using AS2805 key cryptogram format.
*)| DiffieHellmanTr31KeyBlock of import_diffie_hellman_tr31_key_blockKey derivation parameter information for key material import using asymmetric ECDH key exchange method.
*)| KeyCryptogram of import_key_cryptogramParameter information for key material import using asymmetric RSA wrap and unwrap key exchange method.
*)| Tr34KeyBlock of import_tr34_key_blockParameter information for key material import using the asymmetric TR-34 key exchange method.
*)| Tr31KeyBlock of import_tr31_key_blockParameter information for key material import using symmetric TR-31 key exchange method.
*)| TrustedCertificatePublicKey of trusted_certificate_public_keyParameter information for trusted public key certificate import.
*)| RootCertificatePublicKey of root_certificate_public_keyParameter information for root public key certificate import.
*)Parameter information for key material import into Amazon Web Services Payment Cryptography using TR-31 or TR-34 or RSA wrap and unwrap key exchange method.
type nonrec import_key_input = {requester_comment : mpa_requester_comment option;The comment from the requester explaining the reason for the import.
Don't include personal, confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.
*)replication_regions : regions option;enabled : Smaws_Lib.Smithy_api.Types.boolean_ option;Specifies whether import key is enabled.
*)key_check_value_algorithm : key_check_value_algorithm option;The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.
For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result. For HMAC keys, the KCV is computed using the hash selected at key creation on a zero-length message, taking the leftmost 3 bytes.
*)key_material : import_key_material;The key or public key certificate type to use during key material import, for example TR-34 or RootCertificatePublicKey.
*)}type nonrec get_resource_policy_output = {policy : resource_policy;The resource-based policy attached to the key, in JSON format.
*)resource_arn : resource_arn;The KeyARN of the key.
}type nonrec get_resource_policy_input = {resource_arn : resource_arn;The KeyARN of the key whose resource-based policy you want to retrieve.
}type nonrec get_public_key_certificate_output = {key_certificate_chain : certificate_type;The root certificate authority (CA) that signed the public key certificate in PEM format (base64 encoded) of the asymmetric key pair.
*)key_certificate : certificate_type;The public key component of the asymmetric key pair in a certificate PEM format (base64 encoded). It is signed by the root certificate authority (CA). The certificate is valid for 90 days from the time it is issued. The service returns a cached certificate if one exists with at least 30 days of remaining validity. Otherwise, a new 90-day certificate is issued.
*)}type nonrec get_public_key_certificate_input = {key_identifier : key_arn_or_key_alias_type;The KeyARN of the asymmetric key pair.
}type nonrec get_parameters_for_import_output = {parameters_valid_until_timestamp : timestamp;The validity period of the import token.
*)import_token : import_token_id;The import token to initiate key import into Amazon Web Services Payment Cryptography. The import token expires after 30 days. You can use the same import token to import multiple keys to the same service account.
*)wrapping_key_algorithm : key_algorithm;The algorithm of the wrapping key for use within TR-34 WrappedKeyBlock or RSA WrappedKeyCryptogram.
*)wrapping_key_certificate_chain : certificate_type;The Amazon Web Services Payment Cryptography root certificate authority (CA) that signed the wrapping key certificate in PEM format (base64 encoded).
*)wrapping_key_certificate : certificate_type;The wrapping key certificate in PEM format (base64 encoded) of the wrapping key for use within the TR-34 key block. The certificate expires in 30 days.
*)}type nonrec get_parameters_for_import_input = {reuse_last_generated_token : Smaws_Lib.Smithy_api.Types.boolean_ option;Specifies whether to reuse the existing import token and wrapping key certificate. If set to true and a valid import token exists for the same key material type and wrapping key algorithm with at least 7 days of remaining validity, the existing token and wrapping key certificate are returned. Otherwise, a new import token and wrapping key certificate are generated. The default value is false, which generates a new import token and wrapping key certificate on every call.
wrapping_key_algorithm : key_algorithm;The wrapping key algorithm to generate a wrapping key certificate. This certificate wraps the key under import.
At this time, RSA_2048 is the allowed algorithm for TR-34 WrappedKeyBlock import. Additionally, RSA_2048, RSA_3072, RSA_4096 are the allowed algorithms for RSA WrappedKeyCryptogram import.
key_material_type : key_material_type;The method to use for key material import. Import token is only required for TR-34 WrappedKeyBlock (TR34_KEY_BLOCK) and RSA WrappedKeyCryptogram (KEY_CRYPTOGRAM).
Import token is not required for TR-31, root public key cerificate or trusted public key certificate.
*)}type nonrec get_parameters_for_export_output = {parameters_valid_until_timestamp : timestamp;The validity period of the export token.
*)export_token : export_token_id;The export token to initiate key export from Amazon Web Services Payment Cryptography. The export token expires after 30 days. You can use the same export token to export multiple keys from the same service account.
*)signing_key_algorithm : key_algorithm;The algorithm of the signing key certificate for use in TR-34 key block generation. RSA_2048 is the only signing key algorithm allowed.
signing_key_certificate_chain : certificate_type;The root certificate authority (CA) that signed the signing key certificate in PEM format (base64 encoded).
*)signing_key_certificate : certificate_type;The signing key certificate in PEM format (base64 encoded) of the public key for signature within the TR-34 key block. The certificate expires after 30 days.
*)}type nonrec get_parameters_for_export_input = {reuse_last_generated_token : Smaws_Lib.Smithy_api.Types.boolean_ option;Specifies whether to reuse the existing export token and signing key certificate. If set to true and a valid export token exists for the same key material type and signing key algorithm with at least 7 days of remaining validity, the existing token and signing key certificate are returned. Otherwise, a new export token and signing key certificate are generated. The default value is false, which generates a new export token and signing key certificate on every call.
signing_key_algorithm : key_algorithm;The signing key algorithm to generate a signing key certificate. This certificate signs the wrapped key under export within the TR-34 key block. RSA_2048 is the only signing key algorithm allowed.
key_material_type : key_material_type;The key block format type (for example, TR-34 or TR-31) to use during key material export. Export token is only required for a TR-34 key export, TR34_KEY_BLOCK. Export token is not required for TR-31 key export.
}type nonrec mpa_team_association = {mpa_status : mpa_status option;The MPA session status for the association, if applicable.
*)association_state : association_state;The state of the MPA team association.
*)mpa_team_arn : mpa_team_arn;The ARN of the MPA team.
*)action : mpa_operation;The protected operation associated with the MPA team.
*)}The details of an MPA team association with a protected operation.
type nonrec get_mpa_team_association_output = {mpa_team_association : mpa_team_association;The details of the MPA team association.
*)}type nonrec get_mpa_team_association_input = {action : mpa_operation;The protected operation whose MPA team association you want to retrieve. Currently, the only supported value is IMPORT_ROOT_PUBLIC_KEY_CERTIFICATE.
}type nonrec get_default_key_replication_regions_output = {enabled_replication_regions : regions;The list of regions where default key replication is currently enabled for the account.
New keys created in this account will automatically be replicated to these regions unless explicitly configured otherwise during key creation.
*)}Output containing the account's current default key replication configuration.
type nonrec get_certificate_signing_request_output = {certificate_signing_request : certificate_signing_request_type;The certificate signing request generated using the key pair associated with the key identifier.
*)}type nonrec certificate_subject_type = {email_address : Smaws_Lib.Smithy_api.Types.string_ option;The email address you provide to create the certificate signing request.
*)state_or_province : Smaws_Lib.Smithy_api.Types.string_ option;The state or province you provide to create the certificate signing request.
*)country : Smaws_Lib.Smithy_api.Types.string_ option;The country you provide to create the certificate signing request.
*)city : Smaws_Lib.Smithy_api.Types.string_ option;The city you provide to create the certificate signing request.
*)organization : Smaws_Lib.Smithy_api.Types.string_ option;The organization you provide to create the certificate signing request.
*)organization_unit : Smaws_Lib.Smithy_api.Types.string_ option;The organization unit you provide to create the certificate signing request.
*)common_name : Smaws_Lib.Smithy_api.Types.string_;The name you provide to create the certificate signing request.
*)}The metadata used to create the certificate signing request.
type nonrec get_certificate_signing_request_input = {certificate_subject : certificate_subject_type;The metadata used to create the CSR.
*)signing_algorithm : signing_algorithm_type;The cryptographic algorithm used to sign your CSR.
*)key_identifier : key_arn_or_key_alias_type;Asymmetric key used for generating the certificate signing request
*)}type nonrec export_key_output = {wrapped_key : wrapped_key option;The key material under export as a TR-34 WrappedKeyBlock or a TR-31 WrappedKeyBlock. or a RSA WrappedKeyCryptogram.
*)}type nonrec optional_blocks = (optional_block_id * optional_block_value) listtype nonrec key_block_headers = {optional_blocks : optional_blocks option;Parameter used to indicate the type of optional data in key block headers. Refer to ANSI X9.143-2022 for information on allowed data type for optional blocks.
Optional block character limit is 112 characters. For each optional block, 2 characters are reserved for optional block ID and 2 characters reserved for optional block length. More than one optional blocks can be included as long as the combined length does not increase 112 characters.
*)key_version : key_version option;Parameter used to indicate the version of the key carried in the key block or indicate the value carried in the key block is a component of a key.
*)key_exportability : key_exportability option;Specifies subsequent exportability of the key within the key block after it is received by the receiving party. It can be used to further restrict exportability of the key after export from Amazon Web Services Payment Cryptography.
When set to EXPORTABLE, the key can be subsequently exported by the receiver under a KEK using TR-31 or TR-34 key block export only. When set to NON_EXPORTABLE, the key cannot be subsequently exported by the receiver. When set to SENSITIVE, the key can be exported by the receiver under a KEK using TR-31, TR-34, RSA wrap and unwrap cryptogram or using a symmetric cryptogram key export method. For further information refer to ANSI X9.143-2022.
key_modes_of_use : key_modes_of_use option;}Optional metadata for export associated with the key material. This data is signed but transmitted in clear text.
type nonrec export_tr31_key_block = {key_block_headers : key_block_headers option;Optional metadata for export associated with the key material. This data is signed but transmitted in clear text.
*)wrapping_key_identifier : key_arn_or_key_alias_type;The KeyARN of the the wrapping key. This key encrypts or wraps the key under export for TR-31 key block generation.
}Parameter information for key material export using symmetric TR-31 key exchange method.
type nonrec export_tr34_key_block = {key_block_headers : key_block_headers option;Optional metadata for export associated with the key material. This data is signed but transmitted in clear text.
*)random_nonce : even_hex_length_between16_and32 option;A random number value that is unique to the TR-34 key block generated using 2 pass. The operation will fail, if a random nonce value is not provided for a TR-34 key block generated using 2 pass.
*)key_block_format : tr34_key_block_format;The format of key block that Amazon Web Services Payment Cryptography will use during key export.
*)signing_key_certificate : certificate_type option;The certificate used to sign the TR-34 key block.
*)signing_key_identifier : key_arn_or_key_alias_type option;Key Identifier used for signing the export key
*)export_token : export_token_id option;The export token to initiate key export from Amazon Web Services Payment Cryptography. It also contains the signing key certificate that will sign the wrapped key during TR-34 key block generation. Call GetParametersForExport to receive an export token. It expires after 30 days. You can use the same export token to export multiple keys from the same service account.
*)wrapping_key_certificate : certificate_type;The KeyARN of the wrapping key certificate. Amazon Web Services Payment Cryptography uses this certificate to wrap the key under export.
}Parameter information for key material export using the asymmetric TR-34 key exchange method.
type nonrec export_key_cryptogram = {wrapping_spec : wrapping_key_spec option;The wrapping spec for the key under export.
*)wrapping_key_certificate : certificate_type;The wrapping key certificate in PEM format (base64 encoded). Amazon Web Services Payment Cryptography uses this certificate to wrap the key under export.
*)}Parameter information for key material export using asymmetric RSA wrap and unwrap key exchange method.
type nonrec export_diffie_hellman_tr31_key_block = {key_block_headers : key_block_headers option;derivation_data : diffie_hellman_derivation_data;The shared information used when deriving a key using ECDH.
*)key_derivation_hash_algorithm : key_derivation_hash_algorithm;The hash type to use when deriving a key using ECDH.
*)key_derivation_function : key_derivation_function;The key derivation function to use when deriving a key using ECDH.
*)derive_key_algorithm : symmetric_key_algorithm;The key algorithm of the shared derived ECDH key.
*)public_key_certificate : certificate_type;The public key certificate of the client's receiving ECC key pair, in PEM format (base64 encoded), to use for ECDH key derivation.
*)private_key_identifier : key_arn_or_key_alias_type;The keyARN of the asymmetric ECC key created within Amazon Web Services Payment Cryptography.
}Key derivation parameter information for key material export using asymmetric ECDH key exchange method.
type nonrec export_as2805_key_cryptogram = {as2805_key_variant : as2805_key_variant;The cryptographic usage of the key under export.
*)wrapping_key_identifier : key_arn_or_key_alias_type;}Parameter information for key material export using AS2805 key cryptogram format.
type nonrec export_key_material = | As2805KeyCryptogram of export_as2805_key_cryptogramParameter information for key material export using AS2805 key cryptogram format.
*)| DiffieHellmanTr31KeyBlock of export_diffie_hellman_tr31_key_blockKey derivation parameter information for key material export using asymmetric ECDH key exchange method.
*)| KeyCryptogram of export_key_cryptogramParameter information for key material export using asymmetric RSA wrap and unwrap key exchange method
*)| Tr34KeyBlock of export_tr34_key_blockParameter information for key material export using the asymmetric TR-34 key exchange method.
*)| Tr31KeyBlock of export_tr31_key_blockParameter information for key material export using symmetric TR-31 key exchange method.
*)Parameter information for key material export from Amazon Web Services Payment Cryptography using TR-31 or TR-34 or RSA wrap and unwrap key exchange method.
type nonrec export_dukpt_initial_key = {key_serial_number : hex_length20_or24;The KSN for IPEK generation using DUKPT.
KSN must be padded before sending to Amazon Web Services Payment Cryptography. KSN hex length should be 20 for a TDES_2KEY key or 24 for an AES key.
*)}Parameter information for IPEK generation during export.
type nonrec export_attributes = {key_check_value_algorithm : key_check_value_algorithm option;The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity. Specify KCV for IPEK export only.
For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result. For HMAC keys, the KCV is computed using the hash selected at key creation on a zero-length message, taking the leftmost 3 bytes.
*)export_dukpt_initial_key : export_dukpt_initial_key option;Parameter information for IPEK export.
*)}The attributes for IPEK generation during export.
type nonrec export_key_input = {export_attributes : export_attributes option;The attributes for IPEK generation during export.
*)export_key_identifier : key_arn_or_key_alias_type;The KeyARN of the key under export from Amazon Web Services Payment Cryptography.
key_material : export_key_material;The key block format type, for example, TR-34 or TR-31, to use during key material export.
*)}type nonrec enable_default_key_replication_regions_output = {enabled_replication_regions : regions;The complete list of regions where default key replication is now enabled for the account.
This includes both previously enabled regions and the newly added regions from this operation.
*)}Output from enabling default key replication regions for the account.
type nonrec enable_default_key_replication_regions_input = {replication_regions : regions;The list of Amazon Web Services Regions to enable as default replication regions for the Amazon Web Services account for Multi-Region key replication.
New keys created in this account will automatically be replicated to these regions unless explicitly overridden during key creation.
*)}Input parameters for enabling default key replication regions for the account.
type nonrec disassociate_mpa_team_output = {mpa_team_association : mpa_team_association;The details of the MPA team association.
*)}type nonrec disassociate_mpa_team_input = {requester_comment : mpa_requester_comment option;The comment from the requester explaining the reason for the disassociation.
Don't include personal, confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.
*)action : mpa_operation;The protected operation to disassociate from the MPA team. Currently, the only supported value is IMPORT_ROOT_PUBLIC_KEY_CERTIFICATE.
}type nonrec disable_default_key_replication_regions_output = {enabled_replication_regions : regions;The remaining list of regions where default key replication is still enabled for the account.
This reflects the account's default replication configuration after removing the specified regions.
*)}Output from disabling default key replication regions for the account.
type nonrec disable_default_key_replication_regions_input = {replication_regions : regions;The list of Amazon Web Services Regions to remove from the account's default replication regions.
New keys created after this operation will not automatically be replicated to these regions, though existing keys with replication to these regions will be unaffected.
*)}Input parameters for disabling default key replication regions for the account.
type nonrec delete_resource_policy_input = {resource_arn : resource_arn;The KeyARN of the key whose resource-based policy you want to delete.
}type nonrec associate_mpa_team_output = {mpa_team_association : mpa_team_association;The details of the MPA team association.
*)}type nonrec associate_mpa_team_input = {requester_comment : mpa_requester_comment option;The comment from the requester explaining the reason for the association.
Don't include personal, confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.
*)mpa_team_arn : mpa_team_arn;The ARN of the MPA team to associate with the protected operation.
*)action : mpa_operation;The protected operation to associate with the MPA team. Currently, the only supported value is IMPORT_ROOT_PUBLIC_KEY_CERTIFICATE.
}type nonrec key_summary = {primary_region : region option;multi_region_key_type : multi_region_key_type option;Indicates whether this key is a Multi-Region key and its role in the Multi-Region key hierarchy.
Multi-Region replication keys allow the same key material to be used across multiple Amazon Web Services Regions. This field specifies whether the key is a Primary Region key (PRK) (which can be replicated to other Amazon Web Services Regions) or a Replica Region key (RRK) (which is a copy of a PRK in another Region). For more information, see Multi-Region key replication.
*)enabled : Smaws_Lib.Smithy_api.Types.boolean_;Specifies whether the key is enabled.
*)exportable : Smaws_Lib.Smithy_api.Types.boolean_;Specifies whether the key is exportable. This data is immutable after the key is created.
*)key_check_value : key_check_value;The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.
*)key_attributes : key_attributes;The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.
*)key_state : key_state;The state of an Amazon Web Services Payment Cryptography that is being created or deleted.
*)key_arn : key_arn;The Amazon Resource Name (ARN) of the key.
*)}Metadata about an Amazon Web Services Payment Cryptography key.
type nonrec key_summary_list = key_summary listtype nonrec list_keys_output = {next_token : next_token option;The token for the next set of results, or an empty or null value if there are no more results.
*)keys : key_summary_list;The list of keys created within the caller's Amazon Web Services account and Amazon Web Services Region.
*)}type nonrec list_keys_input = {max_results : max_results option;Use this parameter to specify the maximum number of items to return. When this value is present, Amazon Web Services Payment Cryptography does not return more than the specified number of items, but it might return fewer.
This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.
*)next_token : next_token option;Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of NextToken from the truncated response you just received.
key_state : key_state option;The key state of the keys you want to list.
*)}type nonrec aliases = alias listtype nonrec list_aliases_output = {next_token : next_token option;The token for the next set of results, or an empty or null value if there are no more results.
*)aliases : aliases;The list of aliases. Each alias describes the KeyArn contained within.
}type nonrec list_aliases_input = {max_results : max_results option;Use this parameter to specify the maximum number of items to return. When this value is present, Amazon Web Services Payment Cryptography does not return more than the specified number of items, but it might return fewer.
This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.
*)next_token : next_token option;Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of NextToken from the truncated response you just received.
key_arn : key_arn option;The keyARN for which you want to list all aliases.
}type nonrec key_resource = Smaws_Lib.CoreTypes.Resource.ttype nonrec get_key_output = {key : key;Contains the key metadata, including both immutable and mutable attributes for the key, but does not include actual cryptographic key material.
*)}type nonrec get_key_input = {key_identifier : key_arn_or_key_alias_type;The KeyARN of the Amazon Web Services Payment Cryptography key.
}type nonrec get_alias_output = {alias : alias;The alias of the Amazon Web Services Payment Cryptography key.
*)}type nonrec get_alias_input = {alias_name : alias_name;The alias of the Amazon Web Services Payment Cryptography key.
*)}type nonrec delete_key_output = {key : key;The KeyARN of the key that is scheduled for deletion.
}type nonrec delete_key_input = {delete_key_in_days : Smaws_Lib.Smithy_api.Types.integer option;The waiting period for key deletion. The default value is seven days.
*)key_identifier : key_arn_or_key_alias_type;The KeyARN of the key that is scheduled for deletion.
}type nonrec delete_alias_input = {alias_name : alias_name;A friendly name that you can use to refer Amazon Web Services Payment Cryptography key. This value must begin with alias/ followed by a name, such as alias/ExampleAlias.
}type nonrec create_key_output = {key : key;The key material that contains all the key attributes.
*)}type nonrec create_key_input = {replication_regions : regions option;derive_key_usage : derive_key_usage option;The intended cryptographic usage of keys derived from the ECC key pair to be created.
After creating an ECC key pair, you cannot change the intended cryptographic usage of keys derived from it using ECDH.
*)enabled : Smaws_Lib.Smithy_api.Types.boolean_ option;Specifies whether to enable the key. If the key is enabled, it is activated for use within the service. If the key is not enabled, then it is created but not activated. The default value is enabled.
*)exportable : Smaws_Lib.Smithy_api.Types.boolean_;Specifies whether the key is exportable from the service.
*)key_check_value_algorithm : key_check_value_algorithm option;The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.
For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result. For HMAC keys, the KCV is computed using the hash selected at key creation on a zero-length message, taking the leftmost 3 bytes.
*)key_attributes : key_attributes;The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.
*)}type nonrec create_alias_input = {key_arn : key_arn option;The KeyARN of the key to associate with the alias.
alias_name : alias_name;A friendly name that you can use to refer to a key. An alias must begin with alias/ followed by a name, for example alias/ExampleAlias. It can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-).
Don't include personal, confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.
*)}type nonrec alias_resource = Smaws_Lib.CoreTypes.Resource.ttype nonrec add_key_replication_regions_output = {key : key;The updated key metadata after adding the replication regions.
This includes the current state of the key and its replication configuration.
*)}Output from adding replication regions to a key.
type nonrec add_key_replication_regions_input = {replication_regions : regions;The list of Amazon Web Services Regions to add to the key's replication configuration.
Each region must be a valid Amazon Web Services Region where Amazon Web Services Payment Cryptography is available. The key will be replicated to these regions, allowing cryptographic operations to be performed closer to your applications.
*)key_identifier : key_arn_or_key_alias_type;The key identifier (ARN or alias) of the key for which to add replication regions.
This key must exist and be in a valid state for replication operations.
*)}Input parameters for adding replication regions to a specific key.