@Generated(value="software.amazon.awssdk:codegen") public final class CreateKeyRequest extends KmsRequest implements ToCopyableBuilder<CreateKeyRequest.Builder,CreateKeyRequest>
| Modifier and Type | Class and Description |
|---|---|
static interface |
CreateKeyRequest.Builder |
| Modifier and Type | Method and Description |
|---|---|
static CreateKeyRequest.Builder |
builder() |
Boolean |
bypassPolicyLockoutSafetyCheck()
A flag to indicate whether to bypass the key policy lockout safety check.
|
String |
customKeyStoreId()
Creates the CMK in the specified custom key store and the
key material in its associated AWS CloudHSM cluster.
|
String |
description()
A description of the CMK.
|
boolean |
equals(Object obj) |
<T> Optional<T> |
getValueForField(String fieldName,
Class<T> clazz)
Used to retrieve the value of a field from any class that extends
SdkRequest. |
int |
hashCode() |
KeyUsageType |
keyUsage()
The intended use of the CMK.
|
String |
keyUsageAsString()
The intended use of the CMK.
|
OriginType |
origin()
The source of the CMK's key material.
|
String |
originAsString()
The source of the CMK's key material.
|
String |
policy()
The key policy to attach to the CMK.
|
List<SdkField<?>> |
sdkFields() |
static Class<? extends CreateKeyRequest.Builder> |
serializableBuilderClass() |
List<Tag> |
tags()
One or more tags.
|
CreateKeyRequest.Builder |
toBuilder()
Take this object and create a builder that contains all of the current property values of this object.
|
String |
toString() |
overrideConfigurationcopypublic String policy()
The key policy to attach to the CMK.
If you provide a key policy, it must meet the following criteria:
If you don't set BypassPolicyLockoutSafetyCheck to true, the key policy must allow the principal
that is making the CreateKey request to make a subsequent PutKeyPolicy request on the CMK.
This reduces the risk that the CMK becomes unmanageable. For more information, refer to the scenario in the Default Key Policy section of the AWS Key Management Service Developer Guide.
Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS. For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide.
If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK. For more information, see Default Key Policy in the AWS Key Management Service Developer Guide.
The key policy size limit is 32 kilobytes (32768 bytes).
If you provide a key policy, it must meet the following criteria:
If you don't set BypassPolicyLockoutSafetyCheck to true, the key policy must allow the
principal that is making the CreateKey request to make a subsequent PutKeyPolicy
request on the CMK. This reduces the risk that the CMK becomes unmanageable. For more information, refer
to the scenario in the Default Key Policy section of the AWS Key Management Service Developer Guide.
Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before including the new principal in a key policy because the new principal might not be immediately visible to AWS KMS. For more information, see Changes that I make are not always immediately visible in the AWS Identity and Access Management User Guide.
If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK. For more information, see Default Key Policy in the AWS Key Management Service Developer Guide.
The key policy size limit is 32 kilobytes (32768 bytes).
public String description()
A description of the CMK.
Use a description that helps you decide whether the CMK is appropriate for a task.
Use a description that helps you decide whether the CMK is appropriate for a task.
public KeyUsageType keyUsage()
The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
If the service returns an enum value that is not available in the current SDK version, keyUsage will
return KeyUsageType.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from
keyUsageAsString().
You can use CMKs only for symmetric encryption and decryption.
KeyUsageTypepublic String keyUsageAsString()
The intended use of the CMK.
You can use CMKs only for symmetric encryption and decryption.
If the service returns an enum value that is not available in the current SDK version, keyUsage will
return KeyUsageType.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from
keyUsageAsString().
You can use CMKs only for symmetric encryption and decryption.
KeyUsageTypepublic OriginType origin()
The source of the CMK's key material. You cannot change the origin after you create the CMK.
The default is AWS_KMS, which means AWS KMS creates the key material in its own key store.
When the parameter value is EXTERNAL, AWS KMS creates a CMK without key material so that you can
import key material from your existing key management infrastructure. For more information about importing key
material into AWS KMS, see Importing Key Material in the
AWS Key Management Service Developer Guide.
When the parameter value is AWS_CLOUDHSM, AWS KMS creates the CMK in a AWS KMS custom key store and
creates its key material in the associated AWS CloudHSM cluster. You must also use the
CustomKeyStoreId parameter to identify the custom key store.
If the service returns an enum value that is not available in the current SDK version, origin will
return OriginType.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from
originAsString().
The default is AWS_KMS, which means AWS KMS creates the key material in its own key store.
When the parameter value is EXTERNAL, AWS KMS creates a CMK without key material so that you
can import key material from your existing key management infrastructure. For more information about
importing key material into AWS KMS, see Importing Key
Material in the AWS Key Management Service Developer Guide.
When the parameter value is AWS_CLOUDHSM, AWS KMS creates the CMK in a AWS KMS custom key store
and creates its key material in the associated AWS CloudHSM cluster. You must also use the
CustomKeyStoreId parameter to identify the custom key store.
OriginTypepublic String originAsString()
The source of the CMK's key material. You cannot change the origin after you create the CMK.
The default is AWS_KMS, which means AWS KMS creates the key material in its own key store.
When the parameter value is EXTERNAL, AWS KMS creates a CMK without key material so that you can
import key material from your existing key management infrastructure. For more information about importing key
material into AWS KMS, see Importing Key Material in the
AWS Key Management Service Developer Guide.
When the parameter value is AWS_CLOUDHSM, AWS KMS creates the CMK in a AWS KMS custom key store and
creates its key material in the associated AWS CloudHSM cluster. You must also use the
CustomKeyStoreId parameter to identify the custom key store.
If the service returns an enum value that is not available in the current SDK version, origin will
return OriginType.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from
originAsString().
The default is AWS_KMS, which means AWS KMS creates the key material in its own key store.
When the parameter value is EXTERNAL, AWS KMS creates a CMK without key material so that you
can import key material from your existing key management infrastructure. For more information about
importing key material into AWS KMS, see Importing Key
Material in the AWS Key Management Service Developer Guide.
When the parameter value is AWS_CLOUDHSM, AWS KMS creates the CMK in a AWS KMS custom key store
and creates its key material in the associated AWS CloudHSM cluster. You must also use the
CustomKeyStoreId parameter to identify the custom key store.
OriginTypepublic String customKeyStoreId()
Creates the CMK in the specified custom key store and the
key material in its associated AWS CloudHSM cluster. To create a CMK in a custom key store, you must also specify
the Origin parameter with a value of AWS_CLOUDHSM. The AWS CloudHSM cluster that is
associated with the custom key store must have at least two active HSMs, each in a different Availability Zone in
the Region.
To find the ID of a custom key store, use the DescribeCustomKeyStores operation.
The response includes the custom key store ID and the ID of the AWS CloudHSM cluster.
This operation is part of the Custom Key Store feature feature in AWS KMS, which combines the convenience and extensive integration of AWS KMS with the isolation and control of a single-tenant key store.
Origin parameter with a value of AWS_CLOUDHSM. The AWS
CloudHSM cluster that is associated with the custom key store must have at least two active HSMs, each in
a different Availability Zone in the Region.
To find the ID of a custom key store, use the DescribeCustomKeyStores operation.
The response includes the custom key store ID and the ID of the AWS CloudHSM cluster.
This operation is part of the Custom Key Store feature feature in AWS KMS, which combines the convenience and extensive integration of AWS KMS with the isolation and control of a single-tenant key store.
public Boolean bypassPolicyLockoutSafetyCheck()
A flag to indicate whether to bypass the key policy lockout safety check.
Setting this value to true increases the risk that the CMK becomes unmanageable. Do not set this value to true indiscriminately.
For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.
Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.
The default value is false.
Setting this value to true increases the risk that the CMK becomes unmanageable. Do not set this value to true indiscriminately.
For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.
Use this parameter only when you include a policy in the request and you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.
The default value is false.
public List<Tag> tags()
One or more tags. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty (null) strings.
Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using TagResource.
Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.
Use this parameter to tag the CMK when it is created. Alternately, you can omit this parameter and instead tag the CMK after it is created using TagResource.
public CreateKeyRequest.Builder toBuilder()
ToCopyableBuildertoBuilder in interface ToCopyableBuilder<CreateKeyRequest.Builder,CreateKeyRequest>toBuilder in class KmsRequestpublic static CreateKeyRequest.Builder builder()
public static Class<? extends CreateKeyRequest.Builder> serializableBuilderClass()
public <T> Optional<T> getValueForField(String fieldName, Class<T> clazz)
SdkRequestSdkRequest. The field name
specified should match the member name from the corresponding service-2.json model specified in the
codegen-resources folder for a given service. The class specifies what class to cast the returned value to.
If the returned value is also a modeled class, the SdkRequest.getValueForField(String, Class) method will
again be available.getValueForField in class SdkRequestfieldName - The name of the member to be retrieved.clazz - The class to cast the returned object to.Copyright © 2017 Amazon Web Services, Inc. All Rights Reserved.