class AWS::KMS
AWS Key Management Service: keys that never leave it, used to encrypt, decrypt, make data keys, sign and verify. Shareable: one per program, used from any task.
creds = AWS::Credentials.static(access_key_id: "AKIDEXAMPLE", secret_access_key: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY")
kms = AWS::KMS.new(AWS::Config.new(region: "ap-northeast-1", credentials: creds))
kms.endpoint.to_s # => "https://kms.ap-northeast-1.amazonaws.com"
Each operation sends KMS's JSON 1.1 protocol (POST / with
X-Amz-Target: TrentService.<Operation>), signed with SigV4, and
returns a data value with KMS's fields in snake_case (Bytes for the
base64 ones). KMS's errors raise AWS::ServiceError (match on code:
NotFoundException, AccessDeniedException, ...); a connection that
fails, AWS::TransportError. Throttling, 5xx answers and transport
errors are tried again (Config#retries, with full-jitter backoff);
an answer saying the clock is off is tried once more with the server's
time. Enumerations are symbols: key_spec: :aes_256,
signing_algorithm: :rsassa_pss_sha_256, message_type: :digest.
/home/runner/work/aws/aws/src/kms.qz:26
Classes and modules
AWS::KMS::DataKeygenerate_data_key's answer: the key in plaintext and as encrypted under the KMS key. inspect leaves the plaintext out.AWS::KMS::DecryptOutputdecrypt's answer. inspect leaves the plaintext out.AWS::KMS::EncryptOutputencrypt's answer.AWS::KMS::EncryptedDataKeygenerate_data_key_without_plaintext's answer.AWS::KMS::EnvelopeEnvelope encryption: each secret encrypted locally with AES-256-GCM under a fresh data key from KMS (generate_data_key), the data key kept, encrypted under the KMS key, with the ciphertext. For secrets over KMS's 4 KB, and for many secrets without a KMS call each to encrypt (opening one decrypts its data key through KMS). Nothing is cached but the key an alias or a bare key id names (RESOLVED_FOR).AWS::KMS::KeyMetadatadescribe_key's answer.AWS::KMS::PublicKeyget_public_key's answer: the public key as DER (SubjectPublicKeyInfo; Crypto::RSA::PublicKey.from_der reads an RSA one).AWS::KMS::RandomOutputgenerate_random's answer.AWS::KMS::SignOutputsign's answer.
Constants
TARGET: String
The X-Amz-Target prefix of KMS's operations.
CONTENT_TYPE: String
The content type of the JSON 1.1 protocol.
RETRIED_CODES: Array[String]
The codes tried again, besides the 5xx statuses and 429.
SKEW_CODES: Array[String]
The codes that may mean the request's time is too far from the server's (corrected only when the server's Date says so).
Class methods
def self.new(config: AWS::Config) -> AWS::KMS
A client for config's region and credentials, at
config.endpoint_for("kms").
Methods
def endpoint -> URI
Where the requests go.
def config -> AWS::Config
The configuration.
def inspect -> String
#<AWS::KMS https://kms.ap-northeast-1.amazonaws.com>.
def to_s -> String
As inspect.
def encrypt(*, key_id: String, plaintext: Bytes | String, encryption_context: Hash[String, String] = …, grant_tokens: Array[String] = …, encryption_algorithm: Symbol? = …) -> AWS::KMS::EncryptOutput
plaintext (up to 4096 bytes) encrypted under key_id (an id, an
ARN, or alias/name), bound to encryption_context.
def decrypt(*, ciphertext_blob: Bytes, encryption_context: Hash[String, String] = …, grant_tokens: Array[String] = …, key_id: String? = …, encryption_algorithm: Symbol? = …) -> AWS::KMS::DecryptOutput
The plaintext of ciphertext_blob, with the encryption_context it
was encrypted with.
def generate_data_key(*, key_id: String, key_spec: Symbol? = …, number_of_bytes: Int? = …, encryption_context: Hash[String, String] = …, grant_tokens: Array[String] = …) -> AWS::KMS::DataKey
A data key (key_spec :aes_256 or :aes_128, or number_of_bytes)
in plaintext and encrypted under key_id.
def generate_data_key_without_plaintext(*, key_id: String, key_spec: Symbol? = …, number_of_bytes: Int? = …, encryption_context: Hash[String, String] = …, grant_tokens: Array[String] = …) -> AWS::KMS::EncryptedDataKey
A data key encrypted under key_id only (decrypt it when it is to
be used).
def sign(*, key_id: String, message: Bytes | String, signing_algorithm: Symbol, message_type: Symbol = …, grant_tokens: Array[String] = …) -> AWS::KMS::SignOutput
The signature of message (message_type :raw, up to 4096 bytes,
or :digest, its hash) with the asymmetric key key_id.
def verify(*, key_id: String, message: Bytes | String, signature: Bytes, signing_algorithm: Symbol, message_type: Symbol = …, grant_tokens: Array[String] = …) -> Bool
Whether signature is key_id's signature of message: false
when KMS says it is not (KMSInvalidSignatureException).
def get_public_key(*, key_id: String, grant_tokens: Array[String] = …) -> AWS::KMS::PublicKey
The public key of the asymmetric key key_id.
def describe_key(*, key_id: String, grant_tokens: Array[String] = …) -> AWS::KMS::KeyMetadata
What key_id is.
def generate_random(*, number_of_bytes: Int) -> AWS::KMS::RandomOutput
number_of_bytes random bytes (1 to 1024) from KMS.