/******************************************************************************* * Copyright 2012-2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. * Licensed under the Apache License, Version 2.0 (the "License"). You may not use * this file except in compliance with the License. A copy of the License is located at * * http://aws.amazon.com/apache2.0 * * or in the "license" file accompanying this file. * This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR * CONDITIONS OF ANY KIND, either express or implied. See the License for the * specific language governing permissions and limitations under the License. * ***************************************************************************** * * AWS Tools for Windows (TM) PowerShell (TM) * */ using System; using System.Collections.Generic; using System.Linq; using System.Management.Automation; using System.Text; using Amazon.PowerShell.Common; using Amazon.Runtime; using Amazon.KeyManagementService; using Amazon.KeyManagementService.Model; namespace Amazon.PowerShell.Cmdlets.KMS { /// /// Changes the properties of a custom key store. You can use this operation to change /// the properties of an CloudHSM key store or an external key store. /// /// /// /// Use the required CustomKeyStoreId parameter to identify the custom key /// store. Use the remaining optional parameters to change its properties. This operation /// does not return any property values. To verify the updated property values, use the /// DescribeCustomKeyStores operation. /// /// This operation is part of the custom /// key stores feature in KMS, which combines the convenience and extensive integration /// of KMS with the isolation and control of a key store that you own and manage. /// /// When updating the properties of an external key store, verify that the updated settings /// connect your key store, via the external key store proxy, to the same external key /// manager as the previous settings, or to a backup or snapshot of the external key manager /// with the same cryptographic keys. If the updated connection settings fail, you can /// fix them and retry, although an extended delay might disrupt Amazon Web Services services. /// However, if KMS permanently loses its access to cryptographic keys, ciphertext encrypted /// under those keys is unrecoverable. /// /// For external key stores: /// /// Some external key managers provide a simpler method for updating an external key store. /// For details, see your external key manager documentation. /// /// When updating an external key store in the KMS console, you can upload a JSON-based /// proxy configuration file with the desired values. You cannot upload the proxy configuration /// file to the UpdateCustomKeyStore operation. However, you can use the /// file to help you determine the correct values for the UpdateCustomKeyStore /// parameters. /// /// For an CloudHSM key store, you can use this operation to change the custom key store /// friendly name (NewCustomKeyStoreName), to tell KMS about a change to /// the kmsuser crypto user password (KeyStorePassword), or /// to associate the custom key store with a different, but related, CloudHSM cluster /// (CloudHsmClusterId). To update any property of an CloudHSM key store, /// the ConnectionState of the CloudHSM key store must be DISCONNECTED. /// /// /// For an external key store, you can use this operation to change the custom key store /// friendly name (NewCustomKeyStoreName), or to tell KMS about a change /// to the external key store proxy authentication credentials (XksProxyAuthenticationCredential), /// connection method (XksProxyConnectivity), external proxy endpoint (XksProxyUriEndpoint) /// and path (XksProxyUriPath). For external key stores with an XksProxyConnectivity /// of VPC_ENDPOINT_SERVICE, you can also update the Amazon VPC endpoint /// service name (XksProxyVpcEndpointServiceName). To update most properties /// of an external key store, the ConnectionState of the external key store /// must be DISCONNECTED. However, you can update the CustomKeyStoreName, /// XksProxyAuthenticationCredential, and XksProxyUriPath of /// an external key store when it is in the CONNECTED or DISCONNECTED state. /// /// If your update requires a DISCONNECTED state, before using UpdateCustomKeyStore, /// use the DisconnectCustomKeyStore operation to disconnect the custom key store. /// After the UpdateCustomKeyStore operation completes, use the ConnectCustomKeyStore /// to reconnect the custom key store. To find the ConnectionState of the /// custom key store, use the DescribeCustomKeyStores operation. /// /// Before updating the custom key store, verify that the new values allow KMS to connect /// the custom key store to its backing key store. For example, before you change the /// XksProxyUriPath value, verify that the external key store proxy is reachable /// at the new path. /// /// If the operation succeeds, it returns a JSON object with no properties. /// Cross-account use: No. You cannot perform this operation on a custom key store /// in a different Amazon Web Services account. /// Required permissions: kms:UpdateCustomKeyStore /// (IAM policy) /// Related operations: /// [Cmdlet("Update", "KMSCustomKeyStore", SupportsShouldProcess = true, ConfirmImpact = ConfirmImpact.Medium)] [OutputType("None")] [AWSCmdlet("Calls the AWS Key Management Service UpdateCustomKeyStore API operation.", Operation = new[] {"UpdateCustomKeyStore"}, SelectReturnType = typeof(Amazon.KeyManagementService.Model.UpdateCustomKeyStoreResponse))] [AWSCmdletOutput("None or Amazon.KeyManagementService.Model.UpdateCustomKeyStoreResponse", "This cmdlet does not generate any output." + "The service response (type Amazon.KeyManagementService.Model.UpdateCustomKeyStoreResponse) can be referenced from properties attached to the cmdlet entry in the $AWSHistory stack." )] public partial class UpdateKMSCustomKeyStoreCmdlet : AmazonKeyManagementServiceClientCmdlet, IExecutor { protected override bool IsSensitiveRequest { get; set; } = true; #region Parameter XksProxyAuthenticationCredential_AccessKeyId /// /// /// A unique identifier for the raw secret access key. /// /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public System.String XksProxyAuthenticationCredential_AccessKeyId { get; set; } #endregion #region Parameter CloudHsmClusterId /// /// /// Associates the custom key store with a related CloudHSM cluster. This parameter is /// valid only for custom key stores with a CustomKeyStoreType of AWS_CLOUDHSM.Enter the cluster ID of the cluster that you used to create the custom key store or /// a cluster that shares a backup history and has the same cluster certificate as the /// original cluster. You cannot use this parameter to associate a custom key store with /// an unrelated cluster. In addition, the replacement cluster must fulfill /// the requirements for a cluster associated with a custom key store. To view the /// cluster certificate of a cluster, use the DescribeClusters /// operation.To change this value, the CloudHSM key store must be disconnected. /// /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public System.String CloudHsmClusterId { get; set; } #endregion #region Parameter CustomKeyStoreId /// /// /// Identifies the custom key store that you want to update. Enter the ID of the custom /// key store. To find the ID of a custom key store, use the DescribeCustomKeyStores /// operation. /// /// #if !MODULAR [System.Management.Automation.Parameter(Position = 0, ValueFromPipelineByPropertyName = true, ValueFromPipeline = true)] #else [System.Management.Automation.Parameter(Position = 0, ValueFromPipelineByPropertyName = true, ValueFromPipeline = true, Mandatory = true)] [System.Management.Automation.AllowEmptyString] [System.Management.Automation.AllowNull] #endif [Amazon.PowerShell.Common.AWSRequiredParameter] public System.String CustomKeyStoreId { get; set; } #endregion #region Parameter KeyStorePassword /// /// /// Enter the current password of the kmsuser crypto user (CU) in the CloudHSM /// cluster that is associated with the custom key store. This parameter is valid only /// for custom key stores with a CustomKeyStoreType of AWS_CLOUDHSM.This parameter tells KMS the current password of the kmsuser crypto user /// (CU). It does not set or change the password of any users in the CloudHSM cluster.To change this value, the CloudHSM key store must be disconnected. /// /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public System.String KeyStorePassword { get; set; } #endregion #region Parameter NewCustomKeyStoreName /// /// /// Changes the friendly name of the custom key store to the value that you specify. The /// custom key store name must be unique in the Amazon Web Services account.Do not include confidential or sensitive information in this field. This field may /// be displayed in plaintext in CloudTrail logs and other output.To change this value, an CloudHSM key store must be disconnected. An external key /// store can be connected or disconnected. /// /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public System.String NewCustomKeyStoreName { get; set; } #endregion #region Parameter XksProxyAuthenticationCredential_RawSecretAccessKey /// /// /// A secret string of 43-64 characters. Valid characters are a-z, A-Z, 0-9, /, +, and /// =. /// /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public System.String XksProxyAuthenticationCredential_RawSecretAccessKey { get; set; } #endregion #region Parameter XksProxyConnectivity /// /// /// Changes the connectivity setting for the external key store. To indicate that the /// external key store proxy uses a Amazon VPC endpoint service to communicate with KMS, /// specify VPC_ENDPOINT_SERVICE. Otherwise, specify PUBLIC_ENDPOINT.If you change the XksProxyConnectivity to VPC_ENDPOINT_SERVICE, /// you must also change the XksProxyUriEndpoint and add an XksProxyVpcEndpointServiceName /// value. If you change the XksProxyConnectivity to PUBLIC_ENDPOINT, /// you must also change the XksProxyUriEndpoint and specify a null or empty /// string for the XksProxyVpcEndpointServiceName value.To change this value, the external key store must be disconnected. /// /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] [AWSConstantClassSource("Amazon.KeyManagementService.XksProxyConnectivityType")] public Amazon.KeyManagementService.XksProxyConnectivityType XksProxyConnectivity { get; set; } #endregion #region Parameter XksProxyUriEndpoint /// /// /// Changes the URI endpoint that KMS uses to connect to your external key store proxy /// (XKS proxy). This parameter is valid only for custom key stores with a CustomKeyStoreType /// of EXTERNAL_KEY_STORE.For external key stores with an XksProxyConnectivity value of PUBLIC_ENDPOINT, /// the protocol must be HTTPS.For external key stores with an XksProxyConnectivity value of VPC_ENDPOINT_SERVICE, /// specify https:// followed by the private DNS name associated with the /// VPC endpoint service. Each external key store must use a different private DNS name.The combined XksProxyUriEndpoint and XksProxyUriPath values /// must be unique in the Amazon Web Services account and Region.To change this value, the external key store must be disconnected. /// /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public System.String XksProxyUriEndpoint { get; set; } #endregion #region Parameter XksProxyUriPath /// /// /// Changes the base path to the proxy APIs for this external key store. To find this /// value, see the documentation for your external key manager and external key store /// proxy (XKS proxy). This parameter is valid only for custom key stores with a CustomKeyStoreType /// of EXTERNAL_KEY_STORE.The value must start with / and must end with /kms/xks/v1, /// where v1 represents the version of the KMS external key store proxy API. /// You can include an optional prefix between the required elements such as /example/kms/xks/v1.The combined XksProxyUriEndpoint and XksProxyUriPath values /// must be unique in the Amazon Web Services account and Region.You can change this value when the external key store is connected or disconnected. /// /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public System.String XksProxyUriPath { get; set; } #endregion #region Parameter XksProxyVpcEndpointServiceName /// /// /// Changes the name that KMS uses to identify the Amazon VPC endpoint service for your /// external key store proxy (XKS proxy). This parameter is valid when the CustomKeyStoreType /// is EXTERNAL_KEY_STORE and the XksProxyConnectivity is VPC_ENDPOINT_SERVICE.To change this value, the external key store must be disconnected. /// /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public System.String XksProxyVpcEndpointServiceName { get; set; } #endregion #region Parameter Select /// /// Use the -Select parameter to control the cmdlet output. The cmdlet doesn't have a return value by default. /// Specifying -Select '*' will result in the cmdlet returning the whole service response (Amazon.KeyManagementService.Model.UpdateCustomKeyStoreResponse). /// Specifying -Select '^ParameterName' will result in the cmdlet returning the selected cmdlet parameter value. /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public string Select { get; set; } = "*"; #endregion #region Parameter PassThru /// /// Changes the cmdlet behavior to return the value passed to the CustomKeyStoreId parameter. /// The -PassThru parameter is deprecated, use -Select '^CustomKeyStoreId' instead. This parameter will be removed in a future version. /// [System.Obsolete("The -PassThru parameter is deprecated, use -Select '^CustomKeyStoreId' instead. This parameter will be removed in a future version.")] [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public SwitchParameter PassThru { get; set; } #endregion #region Parameter Force /// /// This parameter overrides confirmation prompts to force /// the cmdlet to continue its operation. This parameter should always /// be used with caution. /// [System.Management.Automation.Parameter(ValueFromPipelineByPropertyName = true)] public SwitchParameter Force { get; set; } #endregion protected override void ProcessRecord() { this._AWSSignerType = "v4"; base.ProcessRecord(); var resourceIdentifiersText = FormatParameterValuesForConfirmationMsg(nameof(this.CustomKeyStoreId), MyInvocation.BoundParameters); if (!ConfirmShouldProceed(this.Force.IsPresent, resourceIdentifiersText, "Update-KMSCustomKeyStore (UpdateCustomKeyStore)")) { return; } var context = new CmdletContext(); // allow for manipulation of parameters prior to loading into context PreExecutionContextLoad(context); #pragma warning disable CS0618, CS0612 //A class member was marked with the Obsolete attribute if (ParameterWasBound(nameof(this.Select))) { context.Select = CreateSelectDelegate(Select) ?? throw new System.ArgumentException("Invalid value for -Select parameter.", nameof(this.Select)); if (this.PassThru.IsPresent) { throw new System.ArgumentException("-PassThru cannot be used when -Select is specified.", nameof(this.Select)); } } else if (this.PassThru.IsPresent) { context.Select = (response, cmdlet) => this.CustomKeyStoreId; } #pragma warning restore CS0618, CS0612 //A class member was marked with the Obsolete attribute context.CloudHsmClusterId = this.CloudHsmClusterId; context.CustomKeyStoreId = this.CustomKeyStoreId; #if MODULAR if (this.CustomKeyStoreId == null && ParameterWasBound(nameof(this.CustomKeyStoreId))) { WriteWarning("You are passing $null as a value for parameter CustomKeyStoreId which is marked as required. In case you believe this parameter was incorrectly marked as required, report this by opening an issue at https://github.com/aws/aws-tools-for-powershell/issues."); } #endif context.KeyStorePassword = this.KeyStorePassword; context.NewCustomKeyStoreName = this.NewCustomKeyStoreName; context.XksProxyAuthenticationCredential_AccessKeyId = this.XksProxyAuthenticationCredential_AccessKeyId; context.XksProxyAuthenticationCredential_RawSecretAccessKey = this.XksProxyAuthenticationCredential_RawSecretAccessKey; context.XksProxyConnectivity = this.XksProxyConnectivity; context.XksProxyUriEndpoint = this.XksProxyUriEndpoint; context.XksProxyUriPath = this.XksProxyUriPath; context.XksProxyVpcEndpointServiceName = this.XksProxyVpcEndpointServiceName; // allow further manipulation of loaded context prior to processing PostExecutionContextLoad(context); var output = Execute(context) as CmdletOutput; ProcessOutput(output); } #region IExecutor Members public object Execute(ExecutorContext context) { var cmdletContext = context as CmdletContext; // create request var request = new Amazon.KeyManagementService.Model.UpdateCustomKeyStoreRequest(); if (cmdletContext.CloudHsmClusterId != null) { request.CloudHsmClusterId = cmdletContext.CloudHsmClusterId; } if (cmdletContext.CustomKeyStoreId != null) { request.CustomKeyStoreId = cmdletContext.CustomKeyStoreId; } if (cmdletContext.KeyStorePassword != null) { request.KeyStorePassword = cmdletContext.KeyStorePassword; } if (cmdletContext.NewCustomKeyStoreName != null) { request.NewCustomKeyStoreName = cmdletContext.NewCustomKeyStoreName; } // populate XksProxyAuthenticationCredential var requestXksProxyAuthenticationCredentialIsNull = true; request.XksProxyAuthenticationCredential = new Amazon.KeyManagementService.Model.XksProxyAuthenticationCredentialType(); System.String requestXksProxyAuthenticationCredential_xksProxyAuthenticationCredential_AccessKeyId = null; if (cmdletContext.XksProxyAuthenticationCredential_AccessKeyId != null) { requestXksProxyAuthenticationCredential_xksProxyAuthenticationCredential_AccessKeyId = cmdletContext.XksProxyAuthenticationCredential_AccessKeyId; } if (requestXksProxyAuthenticationCredential_xksProxyAuthenticationCredential_AccessKeyId != null) { request.XksProxyAuthenticationCredential.AccessKeyId = requestXksProxyAuthenticationCredential_xksProxyAuthenticationCredential_AccessKeyId; requestXksProxyAuthenticationCredentialIsNull = false; } System.String requestXksProxyAuthenticationCredential_xksProxyAuthenticationCredential_RawSecretAccessKey = null; if (cmdletContext.XksProxyAuthenticationCredential_RawSecretAccessKey != null) { requestXksProxyAuthenticationCredential_xksProxyAuthenticationCredential_RawSecretAccessKey = cmdletContext.XksProxyAuthenticationCredential_RawSecretAccessKey; } if (requestXksProxyAuthenticationCredential_xksProxyAuthenticationCredential_RawSecretAccessKey != null) { request.XksProxyAuthenticationCredential.RawSecretAccessKey = requestXksProxyAuthenticationCredential_xksProxyAuthenticationCredential_RawSecretAccessKey; requestXksProxyAuthenticationCredentialIsNull = false; } // determine if request.XksProxyAuthenticationCredential should be set to null if (requestXksProxyAuthenticationCredentialIsNull) { request.XksProxyAuthenticationCredential = null; } if (cmdletContext.XksProxyConnectivity != null) { request.XksProxyConnectivity = cmdletContext.XksProxyConnectivity; } if (cmdletContext.XksProxyUriEndpoint != null) { request.XksProxyUriEndpoint = cmdletContext.XksProxyUriEndpoint; } if (cmdletContext.XksProxyUriPath != null) { request.XksProxyUriPath = cmdletContext.XksProxyUriPath; } if (cmdletContext.XksProxyVpcEndpointServiceName != null) { request.XksProxyVpcEndpointServiceName = cmdletContext.XksProxyVpcEndpointServiceName; } CmdletOutput output; // issue call var client = Client ?? CreateClient(_CurrentCredentials, _RegionEndpoint); try { var response = CallAWSServiceOperation(client, request); object pipelineOutput = null; pipelineOutput = cmdletContext.Select(response, this); output = new CmdletOutput { PipelineOutput = pipelineOutput, ServiceResponse = response }; } catch (Exception e) { output = new CmdletOutput { ErrorResponse = e }; } return output; } public ExecutorContext CreateContext() { return new CmdletContext(); } #endregion #region AWS Service Operation Call private Amazon.KeyManagementService.Model.UpdateCustomKeyStoreResponse CallAWSServiceOperation(IAmazonKeyManagementService client, Amazon.KeyManagementService.Model.UpdateCustomKeyStoreRequest request) { Utils.Common.WriteVerboseEndpointMessage(this, client.Config, "AWS Key Management Service", "UpdateCustomKeyStore"); try { #if DESKTOP return client.UpdateCustomKeyStore(request); #elif CORECLR return client.UpdateCustomKeyStoreAsync(request).GetAwaiter().GetResult(); #else #error "Unknown build edition" #endif } catch (AmazonServiceException exc) { var webException = exc.InnerException as System.Net.WebException; if (webException != null) { throw new Exception(Utils.Common.FormatNameResolutionFailureMessage(client.Config, webException.Message), webException); } throw; } } #endregion internal partial class CmdletContext : ExecutorContext { public System.String CloudHsmClusterId { get; set; } public System.String CustomKeyStoreId { get; set; } public System.String KeyStorePassword { get; set; } public System.String NewCustomKeyStoreName { get; set; } public System.String XksProxyAuthenticationCredential_AccessKeyId { get; set; } public System.String XksProxyAuthenticationCredential_RawSecretAccessKey { get; set; } public Amazon.KeyManagementService.XksProxyConnectivityType XksProxyConnectivity { get; set; } public System.String XksProxyUriEndpoint { get; set; } public System.String XksProxyUriPath { get; set; } public System.String XksProxyVpcEndpointServiceName { get; set; } public System.Func Select { get; set; } = (response, cmdlet) => null; } } }