class Aws::KMS::Types::GenerateDataKeyPairWithoutPlaintextRequest

@note When making an API call, you may pass GenerateDataKeyPairWithoutPlaintextRequest

data as a hash:

    {
      encryption_context: {
        "EncryptionContextKey" => "EncryptionContextValue",
      },
      key_id: "KeyIdType", # required
      key_pair_spec: "RSA_2048", # required, accepts RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1
      grant_tokens: ["GrantTokenType"],
    }

@!attribute [rw] encryption_context

Specifies the encryption context that will be used when encrypting
the private key in the data key pair.

An *encryption context* is a collection of non-secret key-value
pairs that represents additional authenticated data. When you use an
encryption context to encrypt data, you must specify the same (an
exact case-sensitive match) encryption context to decrypt the data.
An encryption context is optional when encrypting with a symmetric
KMS key, but it is highly recommended.

For more information, see [Encryption Context][1] in the *Key
Management Service Developer Guide*.

[1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context
@return [Hash<String,String>]

@!attribute [rw] key_id

Specifies the KMS key that encrypts the private key in the data key
pair. You must specify a symmetric KMS key. You cannot use an
asymmetric KMS key or a KMS key in a custom key store. To get the
type and origin of your KMS key, use the DescribeKey operation.

To specify a KMS key, use its key ID, key ARN, alias name, or alias
ARN. When using an alias name, prefix it with `"alias/"`. To specify
a KMS key in a different Amazon Web Services account, you must use
the key ARN or alias ARN.

For example:

* Key ID: `1234abcd-12ab-34cd-56ef-1234567890ab`

* Key ARN:
  `arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`

* Alias name: `alias/ExampleAlias`

* Alias ARN: `arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias`

To get the key ID and key ARN for a KMS key, use ListKeys or
DescribeKey. To get the alias name and alias ARN, use ListAliases.
@return [String]

@!attribute [rw] key_pair_spec

Determines the type of data key pair that is generated.

The KMS rule that restricts the use of asymmetric RSA KMS keys to
encrypt and decrypt or to sign and verify (but not both), and the
rule that permits you to use ECC KMS keys only to sign and verify,
are not effective on data key pairs, which are used outside of KMS.
@return [String]

@!attribute [rw] grant_tokens

A list of grant tokens.

Use a grant token when your permission to call this operation comes
from a new grant that has not yet achieved *eventual consistency*.
For more information, see [Grant token][1] and [Using a grant
token][2] in the *Key Management Service Developer Guide*.

[1]: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token
[2]: https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token
@return [Array<String>]

@see docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01/GenerateDataKeyPairWithoutPlaintextRequest AWS API Documentation

Constants

SENSITIVE