Kms class

Key Management Service (KMS) is an encryption and key management web service. This guide describes the KMS operations that you can call programmatically. For general information about KMS, see the Key Management Service Developer Guide .

Constructors

Kms({required String region, AwsClientCredentials? credentials, AwsClientCredentialsProvider? credentialsProvider, Client? client, String? endpointUrl})

Properties

hashCode → int
The hash code for this object.
no setterinherited
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited

Methods

cancelKeyDeletion({required String keyId}) → Future<CancelKeyDeletionResponse>
Cancels the deletion of a KMS key. When this operation succeeds, the key state of the KMS key is Disabled. To enable the KMS key, use EnableKey.
close() → void
Closes the internal HTTP client if none was provided at creation. If a client was passed as a constructor argument, this becomes a noop.
connectCustomKeyStore({required String customKeyStoreId}) → Future<void>
Connects or reconnects a custom key store to its backing key store. For an CloudHSM key store, ConnectCustomKeyStore connects the key store to its associated CloudHSM cluster. For an external key store, ConnectCustomKeyStore connects the key store to the external key store proxy that communicates with your external key manager.
createAlias({required String aliasName, required String targetKeyId}) → Future<void>
Creates a friendly name for a KMS key. You can use an alias to identify a KMS key in the KMS console, in the DescribeKey operation and in cryptographic operations, such as Encrypt and GenerateDataKey. You can also change the KMS key that's associated with the alias (UpdateAlias) or delete the alias (DeleteAlias) at any time. These operations don't affect the underlying KMS key.
createCustomKeyStore({required String customKeyStoreName, String? cloudHsmClusterId, CustomKeyStoreType? customKeyStoreType, String? keyStorePassword, String? trustAnchorCertificate, XksProxyAuthenticationCredentialType? xksProxyAuthenticationCredential, XksProxyConnectivityType? xksProxyConnectivity, String? xksProxyUriEndpoint, String? xksProxyUriPath, String? xksProxyVpcEndpointServiceName, String? xksProxyVpcEndpointServiceOwner}) → Future<CreateCustomKeyStoreResponse>
Creates a custom key store backed by a key store that you own and manage. When you use a KMS key in a custom key store for a cryptographic operation, the cryptographic operation is actually performed in your key store using your keys. KMS supports CloudHSM key stores backed by an CloudHSM cluster and external key stores backed by an external key store proxy and external key manager outside of Amazon Web Services.
createGrant({required String keyId, required List<GrantOperation> operations, GrantConstraints? constraints, bool? dryRun, List<String>? grantTokens, String? granteePrincipal, String? granteeServicePrincipal, String? name, String? retiringPrincipal, String? retiringServicePrincipal}) → Future<CreateGrantResponse>
Adds a grant to a KMS key.
createKey({bool? bypassPolicyLockoutSafetyCheck, String? customKeyStoreId, CustomerMasterKeySpec? customerMasterKeySpec, String? description, KeySpec? keySpec, KeyUsageType? keyUsage, bool? multiRegion, OriginType? origin, String? policy, List<Tag>? tags, String? xksKeyId}) → Future<CreateKeyResponse>
Creates a unique customer managed KMS key in your Amazon Web Services account and Region. You can use a KMS key in cryptographic operations, such as encryption and signing. Some Amazon Web Services services let you use KMS keys that you create and manage to protect your service resources.
decrypt({Uint8List? ciphertextBlob, bool? dryRun, List<DryRunModifierType>? dryRunModifiers, EncryptionAlgorithmSpec? encryptionAlgorithm, Map<String, String>? encryptionContext, List<String>? grantTokens, String? keyId, RecipientInfo? recipient}) → Future<DecryptResponse>
Decrypts ciphertext that was encrypted by a KMS key using any of the following operations:
deleteAlias({required String aliasName}) → Future<void>
Deletes the specified alias. Because an alias is not a property of a KMS key, you can delete and change the aliases of a KMS key without affecting the KMS key. Also, aliases do not appear in the response from the DescribeKey operation. To get the aliases of all KMS keys, use the ListAliases operation.
deleteCustomKeyStore({required String customKeyStoreId}) → Future<void>
Deletes a custom key store. This operation does not affect any backing elements of the custom key store. It does not delete the CloudHSM cluster that is associated with an CloudHSM key store, or affect any users or keys in the cluster. For an external key store, it does not affect the external key store proxy, external key manager, or any external keys.
deleteImportedKeyMaterial({required String keyId, String? keyMaterialId}) → Future<DeleteImportedKeyMaterialResponse>
Deletes key material that was previously imported. This operation makes the specified KMS key temporarily unusable. To restore the usability of the KMS key, reimport the same key material. For more information about importing key material into KMS, see Importing Key Material in the Key Management Service Developer Guide.
deriveSharedSecret({required KeyAgreementAlgorithmSpec keyAgreementAlgorithm, required String keyId, required Uint8List publicKey, bool? dryRun, List<String>? grantTokens, RecipientInfo? recipient}) → Future<DeriveSharedSecretResponse>
Derives a shared secret using a key agreement algorithm. DeriveSharedSecret uses the Elliptic Curve Cryptography Cofactor Diffie-Hellman Primitive (ECDH) to establish a key agreement between two peers by deriving a shared secret from their elliptic curve public-private key pairs. You can use the raw shared secret that DeriveSharedSecret returns to derive a symmetric key that can encrypt and decrypt data that is sent between the two peers, or that can generate and verify HMACs. KMS recommends that you follow NIST recommendations for key derivation when using the raw shared secret to derive a symmetric key.
describeCustomKeyStores({String? customKeyStoreId, String? customKeyStoreName, int? limit, String? marker}) → Future<DescribeCustomKeyStoresResponse>
Gets information about custom key stores in the account and Region.
describeKey({required String keyId, List<String>? grantTokens}) → Future<DescribeKeyResponse>
Provides detailed information about a KMS key. You can run DescribeKey on a customer managed key or an Amazon Web Services managed key.
disableKey({required String keyId}) → Future<void>
Sets the state of a KMS key to disabled. This change temporarily prevents use of the KMS key for cryptographic operations.
disableKeyRotation({required String keyId}) → Future<void>
Disables automatic rotation of the key material of the specified symmetric encryption KMS key.
disconnectCustomKeyStore({required String customKeyStoreId}) → Future<void>
Disconnects the custom key store from its backing key store. This operation disconnects an CloudHSM key store from its associated CloudHSM cluster or disconnects an external key store from the external key store proxy that communicates with your external key manager.
enableKey({required String keyId}) → Future<void>
Sets the key state of a KMS key to enabled. This allows you to use the KMS key for cryptographic operations.
enableKeyRotation({required String keyId, int? rotationPeriodInDays}) → Future<void>
Enables automatic rotation of the key material of the specified symmetric encryption KMS key.
encrypt({required String keyId, required Uint8List plaintext, bool? dryRun, EncryptionAlgorithmSpec? encryptionAlgorithm, Map<String, String>? encryptionContext, List<String>? grantTokens}) → Future<EncryptResponse>
Encrypts plaintext of up to 4,096 bytes using a KMS key. You can use a symmetric or asymmetric KMS key with a KeyUsage of ENCRYPT_DECRYPT.
generateDataKey({required String keyId, bool? dryRun, Map<String, String>? encryptionContext, List<String>? grantTokens, DataKeySpec? keySpec, int? numberOfBytes, RecipientInfo? recipient}) → Future<GenerateDataKeyResponse>
Returns a unique symmetric data key for use outside of KMS. This operation returns a plaintext copy of the data key and a copy that is encrypted under a symmetric encryption KMS key that you specify. The bytes in the plaintext key are random; they are not related to the caller or the KMS key. You can use the plaintext key to encrypt your data outside of KMS and store the encrypted data key with the encrypted data.
generateDataKeyPair({required String keyId, required DataKeyPairSpec keyPairSpec, bool? dryRun, Map<String, String>? encryptionContext, List<String>? grantTokens, RecipientInfo? recipient}) → Future<GenerateDataKeyPairResponse>
Returns a unique asymmetric data key pair for use outside of KMS. This operation returns a plaintext public key, a plaintext private key, and a copy of the private key that is encrypted under the symmetric encryption KMS key you specify. You can use the data key pair to perform asymmetric cryptography and implement digital signatures outside of KMS. The bytes in the keys are random; they are not related to the caller or to the KMS key that is used to encrypt the private key.
generateDataKeyPairWithoutPlaintext({required String keyId, required DataKeyPairSpec keyPairSpec, bool? dryRun, Map<String, String>? encryptionContext, List<String>? grantTokens}) → Future<GenerateDataKeyPairWithoutPlaintextResponse>
Returns a unique asymmetric data key pair for use outside of KMS. This operation returns a plaintext public key and a copy of the private key that is encrypted under the symmetric encryption KMS key you specify. Unlike GenerateDataKeyPair, this operation does not return a plaintext private key. The bytes in the keys are random; they are not related to the caller or to the KMS key that is used to encrypt the private key.
generateDataKeyWithoutPlaintext({required String keyId, bool? dryRun, Map<String, String>? encryptionContext, List<String>? grantTokens, DataKeySpec? keySpec, int? numberOfBytes}) → Future<GenerateDataKeyWithoutPlaintextResponse>
Returns a unique symmetric data key for use outside of KMS. This operation returns a data key that is encrypted under a symmetric encryption KMS key that you specify. The bytes in the key are random; they are not related to the caller or to the KMS key.
generateMac({required String keyId, required MacAlgorithmSpec macAlgorithm, required Uint8List message, bool? dryRun, List<String>? grantTokens}) → Future<GenerateMacResponse>
Generates a hash-based message authentication code (HMAC) for a message using an HMAC KMS key and a MAC algorithm that the key supports. HMAC KMS keys and the HMAC algorithms that KMS uses conform to industry standards defined in RFC 2104.
generateRandom({String? customKeyStoreId, int? numberOfBytes, RecipientInfo? recipient}) → Future<GenerateRandomResponse>
Returns a random byte string that is cryptographically secure.
getKeyLastUsage({required String keyId}) → Future<GetKeyLastUsageResponse>
Returns usage information about the last successful cryptographic operation performed with a specified KMS key, including the operation type, timestamp, and associated CloudTrail event ID.
getKeyPolicy({required String keyId, String? policyName}) → Future<GetKeyPolicyResponse>
Gets a key policy attached to the specified KMS key.
getKeyRotationStatus({required String keyId}) → Future<GetKeyRotationStatusResponse>
Provides detailed information about the rotation status for a KMS key, including whether automatic rotation of the key material is enabled for the specified KMS key, the rotation period, and the next scheduled rotation date.
getParametersForImport({required String keyId, required AlgorithmSpec wrappingAlgorithm, required WrappingKeySpec wrappingKeySpec}) → Future<GetParametersForImportResponse>
Returns the public key and an import token you need to import or reimport key material for a KMS key.
getPublicKey({required String keyId, List<String>? grantTokens}) → Future<GetPublicKeyResponse>
Returns the public key of an asymmetric KMS key. Unlike the private key of a asymmetric KMS key, which never leaves KMS unencrypted, callers with kms:GetPublicKey permission can download the public key of an asymmetric KMS key. You can share the public key to allow others to encrypt messages and verify signatures outside of KMS. For information about asymmetric KMS keys, see Asymmetric KMS keys in the Key Management Service Developer Guide.
importKeyMaterial({required Uint8List encryptedKeyMaterial, required Uint8List importToken, required String keyId, ExpirationModelType? expirationModel, ImportType? importType, String? keyMaterialDescription, String? keyMaterialId, DateTime? validTo}) → Future<ImportKeyMaterialResponse>
Imports or reimports key material into an existing KMS key that was created without key material. You can also use this operation to set or update the expiration model and expiration date of the imported key material.
listAliases({String? keyId, int? limit, String? marker}) → Future<ListAliasesResponse>
Gets a list of aliases in the caller's Amazon Web Services account and region. For more information about aliases, see CreateAlias.
listGrants({required String keyId, String? grantId, String? granteePrincipal, String? granteeServicePrincipal, int? limit, String? marker}) → Future<ListGrantsResponse>
Gets a list of all grants for the specified KMS key.
listKeyPolicies({required String keyId, int? limit, String? marker}) → Future<ListKeyPoliciesResponse>
Gets the names of the key policies that are attached to a KMS key. This operation is designed to get policy names that you can use in a GetKeyPolicy operation. However, the only valid policy name is default.
listKeyRotations({required String keyId, IncludeKeyMaterial? includeKeyMaterial, int? limit, String? marker}) → Future<ListKeyRotationsResponse>
Returns information about the key materials associated with the specified KMS key. You can use the optional IncludeKeyMaterial parameter to control which key materials are included in the response.
listKeys({int? limit, String? marker}) → Future<ListKeysResponse>
Gets a list of all KMS keys in the caller's Amazon Web Services account and Region.
listResourceTags({required String keyId, int? limit, String? marker}) → Future<ListResourceTagsResponse>
Returns all tags on the specified KMS key.
listRetirableGrants({int? limit, String? marker, String? retiringPrincipal, String? retiringServicePrincipal}) → Future<ListGrantsResponse>
Returns information about all grants in the Amazon Web Services account and Region that have the specified retiring principal or retiring service principal.
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
putKeyPolicy({required String keyId, required String policy, bool? bypassPolicyLockoutSafetyCheck, String? policyName}) → Future<void>
Attaches a key policy to the specified KMS key.
reEncrypt({required String destinationKeyId, Uint8List? ciphertextBlob, EncryptionAlgorithmSpec? destinationEncryptionAlgorithm, Map<String, String>? destinationEncryptionContext, bool? dryRun, List<DryRunModifierType>? dryRunModifiers, List<String>? grantTokens, EncryptionAlgorithmSpec? sourceEncryptionAlgorithm, Map<String, String>? sourceEncryptionContext, String? sourceKeyId}) → Future<ReEncryptResponse>
Decrypts ciphertext and then reencrypts it entirely within KMS. You can use this operation to change the KMS key under which data is encrypted, such as when you manually rotate a KMS key or change the KMS key that protects a ciphertext. You can also use it to reencrypt ciphertext under the same KMS key, such as to change the encryption context of a ciphertext.
replicateKey({required String keyId, required String replicaRegion, bool? bypassPolicyLockoutSafetyCheck, String? description, String? policy, List<Tag>? tags}) → Future<ReplicateKeyResponse>
Replicates a multi-Region key into the specified Region. This operation creates a multi-Region replica key based on a multi-Region primary key in a different Region of the same Amazon Web Services partition. You can create multiple replicas of a primary key, but each must be in a different Region. To create a multi-Region primary key, use the CreateKey operation.
retireGrant({bool? dryRun, String? grantId, String? grantToken, String? keyId}) → Future<void>
Deletes a grant. Typically, you retire a grant when you no longer need its permissions. To identify the grant to retire, use a grant token, or both the grant ID and a key identifier (key ID or key ARN) of the KMS key. The CreateGrant operation returns both values.
revokeGrant({required String grantId, required String keyId, bool? dryRun}) → Future<void>
Deletes the specified grant. You revoke a grant to terminate the permissions that the grant allows. For more information, see Retiring and revoking grants in the Key Management Service Developer Guide .
rotateKeyOnDemand({required String keyId}) → Future<RotateKeyOnDemandResponse>
Immediately initiates rotation of the key material of the specified symmetric encryption KMS key.
scheduleKeyDeletion({required String keyId, int? pendingWindowInDays}) → Future<ScheduleKeyDeletionResponse>
Schedules the deletion of a KMS key. By default, KMS applies a waiting period of 30 days, but you can specify a waiting period of 7-30 days. When this operation is successful, the key state of the KMS key changes to PendingDeletion and the key can't be used in any cryptographic operations. It remains in this state for the duration of the waiting period. Before the waiting period ends, you can use CancelKeyDeletion to cancel the deletion of the KMS key. After the waiting period ends, KMS deletes the KMS key, its key material, and all KMS data associated with it, including all aliases that refer to it. You can schedule the deletion of a multi-Region primary key and its replica keys at any time. However, KMS will not delete a multi-Region primary key with existing replica keys. If you schedule the deletion of a primary key with replicas, its key state changes to PendingReplicaDeletion and it cannot be replicated or used in cryptographic operations. This status can continue indefinitely. When the last of its replicas keys is deleted (not just scheduled), the key state of the primary key changes to PendingDeletion and its waiting period (PendingWindowInDays) begins. For details, see Deleting multi-Region keys in the Key Management Service Developer Guide.
sign({required String keyId, required Uint8List message, required SigningAlgorithmSpec signingAlgorithm, bool? dryRun, List<String>? grantTokens, MessageType? messageType}) → Future<SignResponse>
Creates a digital signature for a message or message digest by using the private key in an asymmetric signing KMS key. To verify the signature, use the Verify operation, or use the public key in the same asymmetric KMS key outside of KMS. For information about asymmetric KMS keys, see Asymmetric KMS keys in the Key Management Service Developer Guide.
tagResource({required String keyId, required List<Tag> tags}) → Future<void>
Adds or edits tags on a customer managed key. Each tag consists of a tag key and a tag value, both of which are case-sensitive strings. The tag value can be an empty (null) string. To add a tag, specify a new tag key and a tag value. To edit a tag, specify an existing tag key and a new tag value.
toString() → String
A string representation of this object.
inherited
untagResource({required String keyId, required List<String> tagKeys}) → Future<void>
Deletes tags from a customer managed key. To delete a tag, specify the tag key and the KMS key. When it succeeds, the UntagResource operation doesn't return any output. Also, if the specified tag key isn't found on the KMS key, it doesn't throw an exception or return a response. To confirm that the operation worked, use the ListResourceTags operation.
updateAlias({required String aliasName, required String targetKeyId}) → Future<void>
Associates an existing KMS alias with a different KMS key. Each alias is associated with only one KMS key at a time, although a KMS key can have multiple aliases. The alias and the KMS key must be in the same Amazon Web Services account and Region. The current and new KMS key must be the same type (both symmetric or both asymmetric or both HMAC), and they must have the same key usage. This restriction prevents errors in code that uses aliases. If you must assign an alias to a different type of KMS key, use DeleteAlias to delete the old alias and CreateAlias to create a new alias.
updateCustomKeyStore({required String customKeyStoreId, String? cloudHsmClusterId, String? keyStorePassword, String? newCustomKeyStoreName, XksProxyAuthenticationCredentialType? xksProxyAuthenticationCredential, XksProxyConnectivityType? xksProxyConnectivity, String? xksProxyUriEndpoint, String? xksProxyUriPath, String? xksProxyVpcEndpointServiceName, String? xksProxyVpcEndpointServiceOwner}) → Future<void>
Changes the properties of a custom key store. You can use this operation to change the properties of an CloudHSM key store or an external key store.
updateKeyDescription({required String description, required String keyId}) → Future<void>
Updates the description of a KMS key. To see the description of a KMS key, use DescribeKey.
updatePrimaryRegion({required String keyId, required String primaryRegion}) → Future<void>
Changes the primary key of a multi-Region key.
verify({required String keyId, required Uint8List message, required Uint8List signature, required SigningAlgorithmSpec signingAlgorithm, bool? dryRun, List<String>? grantTokens, MessageType? messageType}) → Future<VerifyResponse>
Verifies a digital signature that was generated by the Sign operation.
verifyMac({required String keyId, required Uint8List mac, required MacAlgorithmSpec macAlgorithm, required Uint8List message, bool? dryRun, List<String>? grantTokens}) → Future<VerifyMacResponse>
Verifies the hash-based message authentication code (HMAC) for a specified message, HMAC KMS key, and MAC algorithm. To verify the HMAC, VerifyMac computes an HMAC using the message, HMAC KMS key, and MAC algorithm that you specify, and compares the computed HMAC to the HMAC that you specify. If the HMACs are identical, the verification succeeds; otherwise, it fails. Verification indicates that the message hasn't changed since the HMAC was calculated, and the specified key was used to generate and verify the HMAC.

Operators

operator ==(Object other) → bool
The equality operator.
inherited