/* * Copyright 2018-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with * the License. A copy of the License is located at * * http://aws.amazon.com/apache2.0 * * or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR * CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions * and limitations under the License. */ package com.amazonaws.services.kms.model; import java.io.Serializable; import javax.annotation.Generated; import com.amazonaws.AmazonWebServiceRequest; /** * * @see AWS API * Documentation */ @Generated("com.amazonaws:aws-java-sdk-code-generator") public class CreateKeyRequest extends com.amazonaws.AmazonWebServiceRequest implements Serializable, Cloneable { /** *

* The key policy to attach to the KMS key. *

*

* If you provide a key policy, it must meet the following criteria: *

* *

* If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more information, see * Default key * policy in the Key Management Service Developer Guide. *

*

* The key policy size quota is 32 kilobytes (32768 bytes). *

*

* For help writing and formatting a JSON policy document, see the IAM JSON Policy Reference in * the Identity and Access Management User Guide . *

*/ private String policy; /** *

* A description of the KMS key. Use a description that helps you decide whether the KMS key is appropriate for a * task. The default value is an empty string (no description). *

* *

* Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in * CloudTrail logs and other output. *

* *

* To set or change the description after the key is created, use UpdateKeyDescription. *

*/ private String description; /** *

* Determines the cryptographic * operations for which you can use the KMS key. The default value is ENCRYPT_DECRYPT. This * parameter is optional when you are creating a symmetric encryption KMS key; otherwise, it is required. You can't * change the KeyUsage value after the KMS key is created. *

*

* Select only one valid value. *

* */ private String keyUsage; /** *

* Instead, use the KeySpec parameter. *

*

* The KeySpec and CustomerMasterKeySpec parameters work the same way. Only the names * differ. We recommend that you use KeySpec parameter in your code. However, to avoid breaking * changes, KMS supports both parameters. *

*/ @Deprecated private String customerMasterKeySpec; /** *

* Specifies the type of KMS key to create. The default value, SYMMETRIC_DEFAULT, creates a KMS key * with a 256-bit AES-GCM key that is used for encryption and decryption, except in China Regions, where it creates * a 128-bit symmetric key that uses SM4 encryption. For help choosing a key spec for your KMS key, see Choosing a KMS key * type in the Key Management Service Developer Guide . *

*

* The KeySpec determines whether the KMS key contains a symmetric key or an asymmetric key pair. It * also determines the algorithms that the KMS key supports. You can't change the KeySpec after the KMS * key is created. To further restrict the algorithms that can be used with the KMS key, use a condition key in its * key policy or IAM policy. For more information, see kms:EncryptionAlgorithm, kms:MacAlgorithm or kms:Signing Algorithm in the Key Management Service Developer Guide . *

* *

* Amazon Web Services services that are * integrated with KMS use symmetric encryption KMS keys to protect your data. These services do not support * asymmetric KMS keys or HMAC KMS keys. *

* *

* KMS supports the following key specs for KMS keys: *

* */ private String keySpec; /** *

* The source of the key material for the KMS key. You cannot change the origin after you create the KMS key. The * default is AWS_KMS, which means that KMS creates the key material. *

*

* To create a KMS * key with no key material (for imported key material), set this value to EXTERNAL. For more * information about importing key material into KMS, see Importing Key Material in * the Key Management Service Developer Guide. The EXTERNAL origin value is valid only for * symmetric KMS keys. *

*

* To create a KMS key in * an CloudHSM key store and create its key material in the associated CloudHSM cluster, set this value to * AWS_CLOUDHSM. You must also use the CustomKeyStoreId parameter to identify the CloudHSM * key store. The KeySpec value must be SYMMETRIC_DEFAULT. *

*

* To create a KMS key in an * external key store, set this value to EXTERNAL_KEY_STORE. You must also use the * CustomKeyStoreId parameter to identify the external key store and the XksKeyId * parameter to identify the associated external key. The KeySpec value must be * SYMMETRIC_DEFAULT. *

*/ private String origin; /** *

* Creates the KMS key in the specified custom key store. * The ConnectionState of the custom key store must be CONNECTED. To find the * CustomKeyStoreID and ConnectionState use the DescribeCustomKeyStores operation. *

*

* This parameter is valid only for symmetric encryption KMS keys in a single Region. You cannot create any other * type of KMS key in a custom key store. *

*

* When you create a KMS key in an CloudHSM key store, KMS generates a non-exportable 256-bit symmetric key in its * associated CloudHSM cluster and associates it with the KMS key. When you create a KMS key in an external key * store, you must use the XksKeyId parameter to specify an external key that serves as key material * for the KMS key. *

*/ private String customKeyStoreId; /** *

* Skips ("bypasses") the key policy lockout safety check. The default value is false. *

* *

* Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to * true indiscriminately. *

*

* For more information, see Default key policy in the Key Management Service Developer Guide. *

* *

* Use this parameter only when you intend to prevent the principal that is making the request from making a * subsequent PutKeyPolicy request on the KMS key. *

*/ private Boolean bypassPolicyLockoutSafetyCheck; /** *

* Assigns one or more tags to the KMS key. Use this parameter to tag the KMS key when it is created. To tag an * existing KMS key, use the TagResource operation. *

* *

* Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in * CloudTrail logs and other output. *

* *

* Tagging or untagging a KMS key can allow or deny permission to the KMS key. For details, see ABAC for KMS in the Key Management * Service Developer Guide. *

* *

* To use this parameter, you must have kms:TagResource permission in an IAM policy. *

*

* Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag * value can be an empty (null) string. You cannot have more than one tag on a KMS key with the same tag key. If you * specify an existing tag key with a different tag value, KMS replaces the current tag value with the specified * one. *

*

* When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with * usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see Tagging Keys. *

*/ private com.amazonaws.internal.SdkInternalList tags; /** *

* Creates a multi-Region primary key that you can replicate into other Amazon Web Services Regions. You cannot * change this value after you create the KMS key. *

*

* For a multi-Region key, set this parameter to True. For a single-Region KMS key, omit this parameter * or set it to False. The default value is False. *

*

* This operation supports multi-Region keys, an KMS feature that lets you create multiple interoperable KMS * keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key material, and * other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt it * in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more * information about multi-Region keys, see Multi-Region keys in * KMS in the Key Management Service Developer Guide. *

*

* This value creates a primary key, not a replica. To create a replica key, use the * ReplicateKey operation. *

*

* You can create a symmetric or asymmetric multi-Region key, and you can create a multi-Region key with imported * key material. However, you cannot create a multi-Region key in a custom key store. *

*/ private Boolean multiRegion; /** *

* Identifies the external * key that serves as key material for the KMS key in an external key store. * Specify the ID that the external * key store proxy uses to refer to the external key. For help, see the documentation for your external key * store proxy. *

*

* This parameter is required for a KMS key with an Origin value of EXTERNAL_KEY_STORE. It * is not valid for KMS keys with any other Origin value. *

*

* The external key must be an existing 256-bit AES symmetric encryption key hosted outside of Amazon Web Services * in an external key manager associated with the external key store specified by the CustomKeyStoreId * parameter. This key must be enabled and configured to perform encryption and decryption. Each KMS key in an * external key store must use a different external key. For details, see Requirements for a KMS key in an * external key store in the Key Management Service Developer Guide. *

*

* Each KMS key in an external key store is associated two backing keys. One is key material that KMS generates. The * other is the external key specified by this parameter. When you use the KMS key in an external key store to * encrypt data, the encryption operation is performed first by KMS using the KMS key material, and then by the * external key manager using the specified external key, a process known as double encryption. For details, * see Double encryption in the Key Management Service Developer Guide. *

*/ private String xksKeyId; /** *

* The key policy to attach to the KMS key. *

*

* If you provide a key policy, it must meet the following criteria: *

* *

* If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more information, see * Default key * policy in the Key Management Service Developer Guide. *

*

* The key policy size quota is 32 kilobytes (32768 bytes). *

*

* For help writing and formatting a JSON policy document, see the IAM JSON Policy Reference in * the Identity and Access Management User Guide . *

* * @param policy * The key policy to attach to the KMS key.

*

* If you provide a key policy, it must meet the following criteria: *

* *

* If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more * information, see Default * key policy in the Key Management Service Developer Guide. *

*

* The key policy size quota is 32 kilobytes (32768 bytes). *

*

* For help writing and formatting a JSON policy document, see the IAM JSON Policy * Reference in the Identity and Access Management User Guide . */ public void setPolicy(String policy) { this.policy = policy; } /** *

* The key policy to attach to the KMS key. *

*

* If you provide a key policy, it must meet the following criteria: *

* *

* If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more information, see * Default key * policy in the Key Management Service Developer Guide. *

*

* The key policy size quota is 32 kilobytes (32768 bytes). *

*

* For help writing and formatting a JSON policy document, see the IAM JSON Policy Reference in * the Identity and Access Management User Guide . *

* * @return The key policy to attach to the KMS key.

*

* If you provide a key policy, it must meet the following criteria: *

* *

* If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more * information, see Default * key policy in the Key Management Service Developer Guide. *

*

* The key policy size quota is 32 kilobytes (32768 bytes). *

*

* For help writing and formatting a JSON policy document, see the IAM JSON Policy * Reference in the Identity and Access Management User Guide . */ public String getPolicy() { return this.policy; } /** *

* The key policy to attach to the KMS key. *

*

* If you provide a key policy, it must meet the following criteria: *

* *

* If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more information, see * Default key * policy in the Key Management Service Developer Guide. *

*

* The key policy size quota is 32 kilobytes (32768 bytes). *

*

* For help writing and formatting a JSON policy document, see the IAM JSON Policy Reference in * the Identity and Access Management User Guide . *

* * @param policy * The key policy to attach to the KMS key.

*

* If you provide a key policy, it must meet the following criteria: *

* *

* If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more * information, see Default * key policy in the Key Management Service Developer Guide. *

*

* The key policy size quota is 32 kilobytes (32768 bytes). *

*

* For help writing and formatting a JSON policy document, see the IAM JSON Policy * Reference in the Identity and Access Management User Guide . * @return Returns a reference to this object so that method calls can be chained together. */ public CreateKeyRequest withPolicy(String policy) { setPolicy(policy); return this; } /** *

* A description of the KMS key. Use a description that helps you decide whether the KMS key is appropriate for a * task. The default value is an empty string (no description). *

* *

* Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in * CloudTrail logs and other output. *

* *

* To set or change the description after the key is created, use UpdateKeyDescription. *

* * @param description * A description of the KMS key. Use a description that helps you decide whether the KMS key is appropriate * for a task. The default value is an empty string (no description).

*

* Do not include confidential or sensitive information in this field. This field may be displayed in * plaintext in CloudTrail logs and other output. *

* *

* To set or change the description after the key is created, use UpdateKeyDescription. */ public void setDescription(String description) { this.description = description; } /** *

* A description of the KMS key. Use a description that helps you decide whether the KMS key is appropriate for a * task. The default value is an empty string (no description). *

* *

* Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in * CloudTrail logs and other output. *

* *

* To set or change the description after the key is created, use UpdateKeyDescription. *

* * @return A description of the KMS key. Use a description that helps you decide whether the KMS key is appropriate * for a task. The default value is an empty string (no description).

*

* Do not include confidential or sensitive information in this field. This field may be displayed in * plaintext in CloudTrail logs and other output. *

* *

* To set or change the description after the key is created, use UpdateKeyDescription. */ public String getDescription() { return this.description; } /** *

* A description of the KMS key. Use a description that helps you decide whether the KMS key is appropriate for a * task. The default value is an empty string (no description). *

* *

* Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in * CloudTrail logs and other output. *

* *

* To set or change the description after the key is created, use UpdateKeyDescription. *

* * @param description * A description of the KMS key. Use a description that helps you decide whether the KMS key is appropriate * for a task. The default value is an empty string (no description).

*

* Do not include confidential or sensitive information in this field. This field may be displayed in * plaintext in CloudTrail logs and other output. *

* *

* To set or change the description after the key is created, use UpdateKeyDescription. * @return Returns a reference to this object so that method calls can be chained together. */ public CreateKeyRequest withDescription(String description) { setDescription(description); return this; } /** *

* Determines the cryptographic * operations for which you can use the KMS key. The default value is ENCRYPT_DECRYPT. This * parameter is optional when you are creating a symmetric encryption KMS key; otherwise, it is required. You can't * change the KeyUsage value after the KMS key is created. *

*

* Select only one valid value. *

* * * @param keyUsage * Determines the cryptographic operations for which you can use the KMS key. The default value is * ENCRYPT_DECRYPT. This parameter is optional when you are creating a symmetric encryption KMS * key; otherwise, it is required. You can't change the KeyUsage value after the KMS key is * created.

*

* Select only one valid value. *

*