kms

type CancelKeyDeletionInput struct {
	// The unique identifier for the customer master key (CMK) for which to cancel
	// deletion. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For
	// example:
	//
	//     * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
}

type CancelKeyDeletionOutput struct {
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the CMK whose deletion is canceled.
	KeyId *string

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type Client struct {
	// contains filtered or unexported fields
}

type ConnectCustomKeyStoreInput struct {
	// Enter the key store ID of the custom key store that you want to connect. To find
	// the ID of a custom key store, use the DescribeCustomKeyStores () operation.
	CustomKeyStoreId *string
}

type ConnectCustomKeyStoreOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type CreateAliasInput struct {
	// Specifies the alias name. This value must begin with alias/ followed by a name,
	// such as alias/ExampleAlias. The alias name cannot begin with alias/aws/. The
	// alias/aws/ prefix is reserved for AWS managed CMKs.
	AliasName *string
	// Identifies the CMK to which the alias refers. Specify the key ID or the Amazon
	// Resource Name (ARN) of the CMK. You cannot specify another alias. For help
	// finding the key ID and ARN, see Finding the Key ID and ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/viewing-keys.html#find-cmk-id-arn)
	// in the AWS Key Management Service Developer Guide.
	TargetKeyId *string
}

type CreateAliasOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type CreateCustomKeyStoreInput struct {
	// Identifies the AWS CloudHSM cluster for the custom key store. Enter the cluster
	// ID of any active AWS CloudHSM cluster that is not already associated with a
	// custom key store. To find the cluster ID, use the DescribeClusters
	// (https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html)
	// operation.
	CloudHsmClusterId *string
	// Specifies a friendly name for the custom key store. The name must be unique in
	// your AWS account.
	CustomKeyStoreName *string
	// Enter the content of the trust anchor certificate for the cluster. This is the
	// content of the customerCA.crt file that you created when you initialized the
	// cluster
	// (https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html).
	TrustAnchorCertificate *string
	// Enter the password of the kmsuser crypto user (CU) account
	// (https://docs.aws.amazon.com/kms/latest/developerguide/key-store-concepts.html#concept-kmsuser)
	// in the specified AWS CloudHSM cluster. AWS KMS logs into the cluster as this
	// user to manage key material on your behalf. The password must be a string of 7
	// to 32 characters. Its value is case sensitive. This parameter tells AWS KMS the
	// kmsuser account password; it does not change the password in the AWS CloudHSM
	// cluster.
	KeyStorePassword *string
}

type CreateCustomKeyStoreOutput struct {
	// A unique identifier for the new custom key store.
	CustomKeyStoreId *string

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type CreateGrantInput struct {
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
	// A list of operations that the grant permits.
	Operations []types.GrantOperation
	// The principal that is given permission to perform the operations that the grant
	// permits. To specify the principal, use the Amazon Resource Name (ARN)
	// (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) of
	// an AWS principal. Valid AWS principals include AWS accounts (root), IAM users,
	// IAM roles, federated users, and assumed role users. For examples of the ARN
	// syntax to use for specifying a principal, see AWS Identity and Access Management
	// (IAM)
	// (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam)
	// in the Example ARNs section of the AWS General Reference.
	GranteePrincipal *string
	// The principal that is given permission to retire the grant by using RetireGrant
	// () operation. To specify the principal, use the Amazon Resource Name (ARN)
	// (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) of
	// an AWS principal. Valid AWS principals include AWS accounts (root), IAM users,
	// federated users, and assumed role users. For examples of the ARN syntax to use
	// for specifying a principal, see AWS Identity and Access Management (IAM)
	// (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam)
	// in the Example ARNs section of the AWS General Reference.
	RetiringPrincipal *string
	// A friendly name for identifying the grant. Use this value to prevent the
	// unintended creation of duplicate grants when retrying this request. When this
	// value is absent, all CreateGrant requests result in a new grant with a unique
	// GrantId even if all the supplied parameters are identical. This can result in
	// unintended duplicates when you retry the CreateGrant request. When this value is
	// present, you can retry a CreateGrant request with identical parameters; if the
	// grant already exists, the original GrantId is returned without creating a new
	// grant. Note that the returned grant token is unique with every CreateGrant
	// request, even when a duplicate GrantId is returned. All grant tokens obtained in
	// this way can be used interchangeably.
	Name *string
	// The unique identifier for the customer master key (CMK) that the grant applies
	// to.  <p>Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To
	// specify a CMK in a  different AWS account, you must use the key ARN. For
	// example:
	//
	//     * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
	// Allows a cryptographic operation
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
	// only when the encryption context matches or includes the encryption context
	// specified in this structure. For more information about encryption context, see
	// Encryption Context
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
	// in the AWS Key Management Service Developer Guide .
	Constraints *types.GrantConstraints
}

type CreateGrantOutput struct {
	// The unique identifier for the grant. You can use the GrantId in a subsequent
	// RetireGrant () or RevokeGrant () operation.
	GrantId *string
	// The grant token. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantToken *string

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type CreateKeyInput struct {
	// The source of the key material for the CMK. You cannot change the origin after
	// you create the CMK. The default is AWS_KMS, which means AWS KMS creates the key
	// material. When the parameter value is EXTERNAL, AWS KMS creates a CMK without
	// key material so that you can import key material from your existing key
	// management infrastructure. For more information about importing key material
	// into AWS KMS, see Importing Key Material
	// (https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html) in
	// the AWS Key Management Service Developer Guide. This value is valid only for
	// symmetric CMKs. When the parameter value is AWS_CLOUDHSM, AWS KMS creates the
	// CMK in an AWS KMS custom key store
	// (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html)
	// and creates its key material in the associated AWS CloudHSM cluster. You must
	// also use the CustomKeyStoreId parameter to identify the custom key store. This
	// value is valid only for symmetric CMKs.
	Origin types.OriginType
	// The key policy to attach to the CMK. If you provide a key policy, it must meet
	// the following criteria:
	//
	//     * If you don't set BypassPolicyLockoutSafetyCheck
	// to true, the key policy must allow the principal that is making the CreateKey
	// request to make a subsequent PutKeyPolicy () request on the CMK. This reduces
	// the risk that the CMK becomes unmanageable. For more information, refer to the
	// scenario in the Default Key Policy
	// (https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam)
	// section of the AWS Key Management Service Developer Guide .
	//
	//     * Each
	// statement in the key policy must contain one or more principals. The principals
	// in the key policy must exist and be visible to AWS KMS. When you create a new
	// AWS principal (for example, an IAM user or role), you might need to enforce a
	// delay before including the new principal in a key policy because the new
	// principal might not be immediately visible to AWS KMS. For more information, see
	// Changes that I make are not always immediately visible
	// (https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency)
	// in the AWS Identity and Access Management User Guide.
	//
	// If you do not provide a
	// key policy, AWS KMS attaches a default key policy to the CMK. For more
	// information, see Default Key Policy
	// (https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default)
	// in the AWS Key Management Service Developer Guide. The key policy size quota is
	// 32 kilobytes (32768 bytes).
	Policy *string
	// Specifies the type of CMK to create. The default value, SYMMETRIC_DEFAULT,
	// creates a CMK with a 256-bit symmetric key for encryption and decryption. For
	// help choosing a key spec for your CMK, see How to Choose Your CMK Configuration
	// (https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose.html)
	// in the AWS Key Management Service Developer Guide. The CustomerMasterKeySpec
	// determines whether the CMK contains a symmetric key or an asymmetric key pair.
	// It also determines the encryption algorithms or signing algorithms that the CMK
	// supports. You can't change the CustomerMasterKeySpec after the CMK is created.
	// To further restrict the algorithms that can be used with the CMK, use a
	// condition key in its key policy or IAM policy. For more information, see
	// kms:EncryptionAlgorithm
	// (https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm)
	// or kms:Signing Algorithm
	// (https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm)
	// in the AWS Key Management Service Developer Guide. AWS services that are
	// integrated with AWS KMS
	// (http://aws.amazon.com/kms/features/#AWS_Service_Integration) use symmetric CMKs
	// to protect your data. These services do not support asymmetric CMKs. For help
	// determining whether a CMK is symmetric or asymmetric, see Identifying Symmetric
	// and Asymmetric CMKs
	// (https://docs.aws.amazon.com/kms/latest/developerguide/find-symm-asymm.html) in
	// the AWS Key Management Service Developer Guide. AWS KMS supports the following
	// key specs for CMKs:
	//
	//     * Symmetric key (default)
	//
	//         * SYMMETRIC_DEFAULT
	// (AES-256-GCM)
	//
	//     * Asymmetric RSA key pairs
	//
	//         * RSA_2048
	//
	//         *
	// RSA_3072
	//
	//         * RSA_4096
	//
	//     * Asymmetric NIST-recommended elliptic curve
	// key pairs
	//
	//         * ECC_NIST_P256 (secp256r1)
	//
	//         * ECC_NIST_P384
	// (secp384r1)
	//
	//         * ECC_NIST_P521 (secp521r1)
	//
	//     * Other asymmetric
	// elliptic curve key pairs
	//
	//         * ECC_SECG_P256K1 (secp256k1), commonly used
	// for cryptocurrencies.
	CustomerMasterKeySpec types.CustomerMasterKeySpec
	// A description of the CMK. Use a description that helps you decide whether the
	// CMK is appropriate for a task.
	Description *string
	// A flag to indicate whether to bypass the key policy lockout safety check.
	// Setting this value to true increases the risk that the CMK becomes unmanageable.
	// Do not set this value to true indiscriminately. For more information, refer to
	// the scenario in the Default Key Policy
	// (https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam)
	// section in the AWS Key Management Service Developer Guide . Use this parameter
	// only when you include a policy in the request and you intend to prevent the
	// principal that is making the request from making a subsequent PutKeyPolicy ()
	// request on the CMK. The default value is false.
	BypassPolicyLockoutSafetyCheck *bool
	// Determines the cryptographic operations
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
	// for which you can use the CMK. The default value is ENCRYPT_DECRYPT. This
	// parameter is required only for asymmetric CMKs. You can't change the KeyUsage
	// value after the CMK is created. Select only one valid value.
	//
	//     * For
	// symmetric CMKs, omit the parameter or specify ENCRYPT_DECRYPT.
	//
	//     * For
	// asymmetric CMKs with RSA key material, specify ENCRYPT_DECRYPT or SIGN_VERIFY.
	//
	//
	// * For asymmetric CMKs with ECC key material, specify SIGN_VERIFY.
	KeyUsage types.KeyUsageType
	// Creates the CMK in the specified custom key store
	// (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html)
	// and the key material in its associated AWS CloudHSM cluster. To create a CMK in
	// a custom key store, you must also specify the Origin parameter with a value of
	// AWS_CLOUDHSM. The AWS CloudHSM cluster that is associated with the custom key
	// store must have at least two active HSMs, each in a different Availability Zone
	// in the Region. This parameter is valid only for symmetric CMKs. You cannot
	// create an asymmetric CMK in a custom key store. To find the ID of a custom key
	// store, use the DescribeCustomKeyStores () operation. The response includes the
	// custom key store ID and the ID of the AWS CloudHSM cluster. This operation is
	// part of the Custom Key Store feature
	// (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html)
	// feature in AWS KMS, which combines the convenience and extensive integration of
	// AWS KMS with the isolation and control of a single-tenant key store.
	CustomKeyStoreId *string
	// One or more tags. Each tag consists of a tag key and a tag value. Both the tag
	// key and the tag value are required, but the tag value can be an empty (null)
	// string. When you add tags to an AWS resource, AWS generates a cost allocation
	// report with usage and costs aggregated by tags. For information about adding,
	// changing, deleting and listing tags for CMKs, see Tagging Keys
	// (https://docs.aws.amazon.com/kms/latest/developerguide/tagging-keys.html). Use
	// this parameter to tag the CMK when it is created. To add tags to an existing
	// CMK, use the TagResource () operation.
	Tags []*types.Tag
}

type CreateKeyOutput struct {
	// Metadata associated with the CMK.
	KeyMetadata *types.KeyMetadata

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type DecryptInput struct {
	// Specifies the customer master key (CMK) that AWS KMS will use to decrypt the
	// ciphertext. Enter a key ID of the CMK that was used to encrypt the ciphertext.
	// If you specify a KeyId value, the Decrypt operation succeeds only if the
	// specified CMK was used to encrypt the ciphertext. This parameter is required
	// only when the ciphertext was encrypted under an asymmetric CMK. Otherwise, AWS
	// KMS uses the metadata that it adds to the ciphertext blob to determine which CMK
	// was used to encrypt the ciphertext. However, you can use this parameter to
	// ensure that a particular CMK (of any kind) is used to decrypt the ciphertext. To
	// specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias
	// ARN. When using an alias name, prefix it with "alias/". For example:
	//
	//     * Key
	// ID: 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//
	// * Alias name: alias/ExampleAlias
	//
	//     * Alias ARN:
	// arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
	//
	// To get the key ID and key
	// ARN for a CMK, use ListKeys () or DescribeKey (). To get the alias name and
	// alias ARN, use ListAliases ().
	KeyId *string
	// Specifies the encryption algorithm that will be used to decrypt the ciphertext.
	// Specify the same algorithm that was used to encrypt the data. If you specify a
	// different algorithm, the Decrypt operation fails. This parameter is required
	// only when the ciphertext was encrypted under an asymmetric CMK. The default
	// value, SYMMETRIC_DEFAULT, represents the only supported algorithm that is valid
	// for symmetric CMKs.
	EncryptionAlgorithm types.EncryptionAlgorithmSpec
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
	// Ciphertext to be decrypted. The blob includes metadata.
	CiphertextBlob []byte
	// Specifies the encryption context to use when decrypting the data. An encryption
	// context is valid only for cryptographic operations
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
	// with a symmetric CMK. The standard asymmetric encryption algorithms that AWS KMS
	// uses do not support an encryption context. An encryption context is a collection
	// of non-secret key-value pairs that represents additional authenticated data.
	// When you use an encryption context to encrypt data, you must specify the same
	// (an exact case-sensitive match) encryption context to decrypt the data. An
	// encryption context is optional when encrypting with a symmetric CMK, but it is
	// highly recommended. For more information, see Encryption Context
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
	// in the AWS Key Management Service Developer Guide.
	EncryptionContext map[string]*string
}

type DecryptOutput struct {
	// The encryption algorithm that was used to decrypt the ciphertext.
	EncryptionAlgorithm types.EncryptionAlgorithmSpec
	// Decrypted plaintext data. When you use the HTTP API or the AWS CLI, the value is
	// Base64-encoded. Otherwise, it is not Base64-encoded.
	Plaintext []byte
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the CMK that was used to decrypt the ciphertext.
	KeyId *string

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type DeleteAliasInput struct {
	// The alias to be deleted. The alias name must begin with alias/ followed by the
	// alias name, such as alias/ExampleAlias.
	AliasName *string
}

type DeleteAliasOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type DeleteCustomKeyStoreInput struct {
	// Enter the ID of the custom key store you want to delete. To find the ID of a
	// custom key store, use the DescribeCustomKeyStores () operation.
	CustomKeyStoreId *string
}

type DeleteCustomKeyStoreOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type DeleteImportedKeyMaterialInput struct {
	// Identifies the CMK from which you are deleting imported key material. The Origin
	// of the CMK must be EXTERNAL. Specify the key ID or the Amazon Resource Name
	// (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
}

type DeleteImportedKeyMaterialOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type DescribeCustomKeyStoresInput struct {
	// Gets only information about the specified custom key store. Enter the friendly
	// name of the custom key store. By default, this operation gets information about
	// all custom key stores in the account and region. To limit the output to a
	// particular custom key store, you can use either the CustomKeyStoreId or
	// CustomKeyStoreName parameter, but not both.
	CustomKeyStoreName *string
	// Use this parameter in a subsequent request after you receive a response with
	// truncated results. Set it to the value of NextMarker from the truncated response
	// you just received.
	Marker *string
	// Use this parameter to specify the maximum number of items to return. When this
	// value is present, AWS KMS does not return more than the specified number of
	// items, but it might return fewer.
	Limit *int32
	// Gets only information about the specified custom key store. Enter the key store
	// ID. By default, this operation gets information about all custom key stores in
	// the account and region. To limit the output to a particular custom key store,
	// you can use either the CustomKeyStoreId or CustomKeyStoreName parameter, but not
	// both.
	CustomKeyStoreId *string
}

type DescribeCustomKeyStoresOutput struct {
	// A flag that indicates whether there are more items in the list. When this value
	// is true, the list in this response is truncated. To get more items, pass the
	// value of the NextMarker element in thisresponse to the Marker parameter in a
	// subsequent request.
	Truncated *bool
	// When Truncated is true, this element is present and contains the value to use
	// for the Marker parameter in a subsequent request.
	NextMarker *string
	// Contains metadata about each custom key store.
	CustomKeyStores []*types.CustomKeyStoresListEntry

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type DescribeKeyInput struct {
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
	// Describes the specified customer master key (CMK). If you specify a predefined
	// AWS alias (an AWS alias with no key ID), KMS associates the alias with an AWS
	// managed CMK
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys)
	// and returns its KeyId and Arn in the response. To specify a CMK, use its key ID,
	// Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name,
	// prefix it with "alias/". To specify a CMK in a different AWS account, you must
	// use the key ARN or alias ARN. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//
	// * Alias name: alias/ExampleAlias
	//
	//     * Alias ARN:
	// arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
	//
	// To get the key ID and key
	// ARN for a CMK, use ListKeys () or DescribeKey (). To get the alias name and
	// alias ARN, use ListAliases ().
	KeyId *string
}

type DescribeKeyOutput struct {
	// Metadata associated with the key.
	KeyMetadata *types.KeyMetadata

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type DisableKeyInput struct {
	// A unique identifier for the customer master key (CMK). Specify the key ID or the
	// Amazon Resource Name (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
}

type DisableKeyOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type DisableKeyRotationInput struct {
	// Identifies a symmetric customer master key (CMK). You cannot enable automatic
	// rotation of asymmetric CMKs
	// (https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html#asymmetric-cmks),
	// CMKs with imported key material
	// (https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html), or
	// CMKs in a custom key store
	// (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html).
	// Specify the key ID or the Amazon Resource Name (ARN) of the CMK. For example:
	//
	//
	// * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
}

type DisableKeyRotationOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type DisconnectCustomKeyStoreInput struct {
	// Enter the ID of the custom key store you want to disconnect. To find the ID of a
	// custom key store, use the DescribeCustomKeyStores () operation.
	CustomKeyStoreId *string
}

type DisconnectCustomKeyStoreOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type EnableKeyInput struct {
	// A unique identifier for the customer master key (CMK). Specify the key ID or the
	// Amazon Resource Name (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
}

type EnableKeyOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type EnableKeyRotationInput struct {
	// Identifies a symmetric customer master key (CMK). You cannot enable automatic
	// rotation of asymmetric CMKs, CMKs with imported key material, or CMKs in a
	// custom key store
	// (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html).
	// <p>Specify the key ID or the Amazon Resource Name (ARN) of the CMK.</p> <p>For
	// example:</p> <ul> <li> <p>Key ID:
	// <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> <li> <p>Key ARN:
	// <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code>
	// </p> </li> </ul> <p>To get the key ID and key ARN for a CMK, use <a>ListKeys</a>
	// or <a>DescribeKey</a>.</p>
	KeyId *string
}

type EnableKeyRotationOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type EncryptInput struct {
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
	// A unique identifier for the customer master key (CMK). To specify a CMK, use its
	// key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an
	// alias name, prefix it with "alias/". To specify a CMK in a different AWS
	// account, you must use the key ARN or alias ARN. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//
	// * Alias name: alias/ExampleAlias
	//
	//     * Alias ARN:
	// arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
	//
	// To get the key ID and key
	// ARN for a CMK, use ListKeys () or DescribeKey (). To get the alias name and
	// alias ARN, use ListAliases ().
	KeyId *string
	// Specifies the encryption algorithm that AWS KMS will use to encrypt the
	// plaintext message. The algorithm must be compatible with the CMK that you
	// specify. This parameter is required only for asymmetric CMKs. The default value,
	// SYMMETRIC_DEFAULT, is the algorithm used for symmetric CMKs. If you are using an
	// asymmetric CMK, we recommend RSAES_OAEP_SHA_256.
	EncryptionAlgorithm types.EncryptionAlgorithmSpec
	// Specifies the encryption context that will be used to encrypt the data. An
	// encryption context is valid only for cryptographic operations
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
	// with a symmetric CMK. The standard asymmetric encryption algorithms that AWS KMS
	// uses do not support an encryption context. An encryption context is a collection
	// of non-secret key-value pairs that represents additional authenticated data.
	// When you use an encryption context to encrypt data, you must specify the same
	// (an exact case-sensitive match) encryption context to decrypt the data. An
	// encryption context is optional when encrypting with a symmetric CMK, but it is
	// highly recommended. For more information, see Encryption Context
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
	// in the AWS Key Management Service Developer Guide.
	EncryptionContext map[string]*string
	// Data to be encrypted.
	Plaintext []byte
}

type EncryptOutput struct {
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the CMK that was used to encrypt the plaintext.
	KeyId *string
	// The encrypted plaintext. When you use the HTTP API or the AWS CLI, the value is
	// Base64-encoded. Otherwise, it is not Base64-encoded.
	CiphertextBlob []byte
	// The encryption algorithm that was used to encrypt the plaintext.
	EncryptionAlgorithm types.EncryptionAlgorithmSpec

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type EndpointResolver interface {
	ResolveEndpoint(region string, options ResolverOptions) (aws.Endpoint, error)
}

type EndpointResolverFunc func(region string, options ResolverOptions) (aws.Endpoint, error)

type GenerateDataKeyInput struct {
	// Specifies the length of the data key in bytes. For example, use the value 64 to
	// generate a 512-bit data key (64 bytes is 512 bits). For 128-bit (16-byte) and
	// 256-bit (32-byte) data keys, use the KeySpec parameter. You must specify either
	// the KeySpec or the NumberOfBytes parameter (but not both) in every
	// GenerateDataKey request.
	NumberOfBytes *int32
	// Specifies the encryption context that will be used when encrypting the data key.
	// An encryption context is a collection of non-secret key-value pairs that
	// represents additional authenticated data. When you use an encryption context to
	// encrypt data, you must specify the same (an exact case-sensitive match)
	// encryption context to decrypt the data. An encryption context is optional when
	// encrypting with a symmetric CMK, but it is highly recommended. For more
	// information, see Encryption Context
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
	// in the AWS Key Management Service Developer Guide.
	EncryptionContext map[string]*string
	// Identifies the symmetric CMK that encrypts the data key.  <p>To specify a CMK,
	// use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using
	// an alias name, prefix it with <code>"alias/"</code>. To specify a CMK in a
	// different AWS account, you must use the key ARN or alias ARN.</p> <p>For
	// example:</p> <ul> <li> <p>Key ID:
	// <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> <li> <p>Key ARN:
	// <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code>
	// </p> </li> <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li> <li>
	// <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code>
	// </p> </li> </ul> <p>To get the key ID and key ARN for a CMK, use <a>ListKeys</a>
	// or <a>DescribeKey</a>. To get the alias name and alias ARN, use
	// <a>ListAliases</a>.</p>
	KeyId *string
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
	// Specifies the length of the data key. Use AES_128 to generate a 128-bit
	// symmetric key, or AES_256 to generate a 256-bit symmetric key. You must specify
	// either the KeySpec or the NumberOfBytes parameter (but not both) in every
	// GenerateDataKey request.
	KeySpec types.DataKeySpec
}

type GenerateDataKeyOutput struct {
	// The plaintext data key. When you use the HTTP API or the AWS CLI, the value is
	// Base64-encoded. Otherwise, it is not Base64-encoded. Use this data key to
	// encrypt your data outside of KMS. Then, remove it from memory as soon as
	// possible.
	Plaintext []byte
	// The encrypted copy of the data key. When you use the HTTP API or the AWS CLI,
	// the value is Base64-encoded. Otherwise, it is not Base64-encoded.
	CiphertextBlob []byte
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the CMK that encrypted the data key.
	KeyId *string

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type GenerateDataKeyPairInput struct {
	// Specifies the encryption context that will be used when encrypting the private
	// key in the data key pair. An encryption context is a collection of non-secret
	// key-value pairs that represents additional authenticated data. When you use an
	// encryption context to encrypt data, you must specify the same (an exact
	// case-sensitive match) encryption context to decrypt the data. An encryption
	// context is optional when encrypting with a symmetric CMK, but it is highly
	// recommended. For more information, see Encryption Context
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
	// in the AWS Key Management Service Developer Guide.
	EncryptionContext map[string]*string
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
	// Specifies the symmetric CMK that encrypts the private key in the data key pair.
	// You cannot specify an asymmetric CMK or a CMK in a custom key store. To get the
	// type and origin of your CMK, use the DescribeKey () operation. To specify a CMK,
	// use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using
	// an alias name, prefix it with "alias/". To specify a CMK in a different AWS
	// account, you must use the key ARN or alias ARN. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//
	// * Alias name: alias/ExampleAlias
	//
	//     * Alias ARN:
	// arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
	//
	// To get the key ID and key
	// ARN for a CMK, use ListKeys () or DescribeKey (). To get the alias name and
	// alias ARN, use ListAliases ().
	KeyId *string
	// Determines the type of data key pair that is generated. The AWS KMS rule that
	// restricts the use of asymmetric RSA CMKs to encrypt and decrypt or to sign and
	// verify (but not both), and the rule that permits you to use ECC CMKs only to
	// sign and verify, are not effective outside of AWS KMS.
	KeyPairSpec types.DataKeyPairSpec
}

type GenerateDataKeyPairOutput struct {
	// The encrypted copy of the private key. When you use the HTTP API or the AWS CLI,
	// the value is Base64-encoded. Otherwise, it is not Base64-encoded.
	PrivateKeyCiphertextBlob []byte
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the CMK that encrypted the private key.
	KeyId *string
	// The type of data key pair that was generated.
	KeyPairSpec types.DataKeyPairSpec
	// The plaintext copy of the private key. When you use the HTTP API or the AWS CLI,
	// the value is Base64-encoded. Otherwise, it is not Base64-encoded.
	PrivateKeyPlaintext []byte
	// The public key (in plaintext).
	PublicKey []byte

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type GenerateDataKeyPairWithoutPlaintextInput struct {
	// Specifies the CMK that encrypts the private key in the data key pair. You must
	// specify a symmetric CMK. You cannot use an asymmetric CMK or a CMK in a custom
	// key store. To get the type and origin of your CMK, use the DescribeKey ()
	// operation. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias
	// name, or alias ARN. When using an alias name, prefix it with "alias/". For
	// example:
	//
	//     * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//
	// * Alias name: alias/ExampleAlias
	//
	//     * Alias ARN:
	// arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
	//
	// To get the key ID and key
	// ARN for a CMK, use ListKeys () or DescribeKey (). To get the alias name and
	// alias ARN, use ListAliases ().
	KeyId *string
	// Determines the type of data key pair that is generated. The AWS KMS rule that
	// restricts the use of asymmetric RSA CMKs to encrypt and decrypt or to sign and
	// verify (but not both), and the rule that permits you to use ECC CMKs only to
	// sign and verify, are not effective outside of AWS KMS.
	KeyPairSpec types.DataKeyPairSpec
	// Specifies the encryption context that will be used when encrypting the private
	// key in the data key pair. An encryption context is a collection of non-secret
	// key-value pairs that represents additional authenticated data. When you use an
	// encryption context to encrypt data, you must specify the same (an exact
	// case-sensitive match) encryption context to decrypt the data. An encryption
	// context is optional when encrypting with a symmetric CMK, but it is highly
	// recommended. For more information, see Encryption Context
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
	// in the AWS Key Management Service Developer Guide.
	EncryptionContext map[string]*string
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
}

type GenerateDataKeyPairWithoutPlaintextOutput struct {
	// The type of data key pair that was generated.
	KeyPairSpec types.DataKeyPairSpec
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the CMK that encrypted the private key.
	KeyId *string
	// The encrypted copy of the private key. When you use the HTTP API or the AWS CLI,
	// the value is Base64-encoded. Otherwise, it is not Base64-encoded.
	PrivateKeyCiphertextBlob []byte
	// The public key (in plaintext).
	PublicKey []byte

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type GenerateDataKeyWithoutPlaintextInput struct {
	// Specifies the encryption context that will be used when encrypting the data key.
	// An encryption context is a collection of non-secret key-value pairs that
	// represents additional authenticated data. When you use an encryption context to
	// encrypt data, you must specify the same (an exact case-sensitive match)
	// encryption context to decrypt the data. An encryption context is optional when
	// encrypting with a symmetric CMK, but it is highly recommended. For more
	// information, see Encryption Context
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
	// in the AWS Key Management Service Developer Guide.
	EncryptionContext map[string]*string
	// The identifier of the symmetric customer master key (CMK) that encrypts the data
	// key. To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name,
	// or alias ARN. When using an alias name, prefix it with "alias/". To specify a
	// CMK in a different AWS account, you must use the key ARN or alias ARN. For
	// example:
	//
	//     * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//
	// * Alias name: alias/ExampleAlias
	//
	//     * Alias ARN:
	// arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
	//
	// To get the key ID and key
	// ARN for a CMK, use ListKeys () or DescribeKey (). To get the alias name and
	// alias ARN, use ListAliases ().
	KeyId *string
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
	// The length of the data key. Use AES_128 to generate a 128-bit symmetric key, or
	// AES_256 to generate a 256-bit symmetric key.
	KeySpec types.DataKeySpec
	// The length of the data key in bytes. For example, use the value 64 to generate a
	// 512-bit data key (64 bytes is 512 bits). For common key lengths (128-bit and
	// 256-bit symmetric keys), we recommend that you use the KeySpec field instead of
	// this one.
	NumberOfBytes *int32
}

type GenerateDataKeyWithoutPlaintextOutput struct {
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the CMK that encrypted the data key.
	KeyId *string
	// The encrypted data key. When you use the HTTP API or the AWS CLI, the value is
	// Base64-encoded. Otherwise, it is not Base64-encoded.
	CiphertextBlob []byte

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type GenerateRandomInput struct {
	// The length of the byte string.
	NumberOfBytes *int32
	// Generates the random byte string in the AWS CloudHSM cluster that is associated
	// with the specified custom key store
	// (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html).
	// To find the ID of a custom key store, use the DescribeCustomKeyStores ()
	// operation.
	CustomKeyStoreId *string
}

type GenerateRandomOutput struct {
	// The random byte string. When you use the HTTP API or the AWS CLI, the value is
	// Base64-encoded. Otherwise, it is not Base64-encoded.
	Plaintext []byte

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type GetKeyPolicyInput struct {
	// Specifies the name of the key policy. The only valid name is default. To get the
	// names of key policies, use ListKeyPolicies ().
	PolicyName *string
	// A unique identifier for the customer master key (CMK). Specify the key ID or the
	// Amazon Resource Name (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
}

type GetKeyPolicyOutput struct {
	// A key policy document in JSON format.
	Policy *string

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type GetKeyRotationStatusInput struct {
	// A unique identifier for the customer master key (CMK). Specify the key ID or the
	// Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS
	// account, you must use the key ARN. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
}

type GetKeyRotationStatusOutput struct {
	// A Boolean value that specifies whether key rotation is enabled.
	KeyRotationEnabled *bool

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type GetParametersForImportInput struct {
	// The type of wrapping key (public key) to return in the response. Only 2048-bit
	// RSA public keys are supported.
	WrappingKeySpec types.WrappingKeySpec
	// The identifier of the symmetric CMK into which you will import key material. The
	// Origin of the CMK must be EXTERNAL. Specify the key ID or the Amazon Resource
	// Name (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
	// The algorithm you will use to encrypt the key material before importing it with
	// ImportKeyMaterial (). For more information, see Encrypt the Key Material
	// (https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-encrypt-key-material.html)
	// in the AWS Key Management Service Developer Guide.
	WrappingAlgorithm types.AlgorithmSpec
}

type GetParametersForImportOutput struct {
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the CMK to use in a subsequent ImportKeyMaterial () request. This is the same
	// CMK specified in the GetParametersForImport request.
	KeyId *string
	// The import token to send in a subsequent ImportKeyMaterial () request.
	ImportToken []byte
	// The public key to use to encrypt the key material before importing it with
	// ImportKeyMaterial ().
	PublicKey []byte
	// The time at which the import token and public key are no longer valid. After
	// this time, you cannot use them to make an ImportKeyMaterial () request and you
	// must send another GetParametersForImport request to get new ones.
	ParametersValidTo *time.Time

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type GetPublicKeyInput struct {
	// Identifies the asymmetric CMK that includes the public key.  <p>To specify a
	// CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When
	// using an alias name, prefix it with <code>"alias/"</code>. To specify a CMK in a
	// different AWS account, you must use the key ARN or alias ARN.</p> <p>For
	// example:</p> <ul> <li> <p>Key ID:
	// <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> <li> <p>Key ARN:
	// <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code>
	// </p> </li> <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li> <li>
	// <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code>
	// </p> </li> </ul> <p>To get the key ID and key ARN for a CMK, use <a>ListKeys</a>
	// or <a>DescribeKey</a>. To get the alias name and alias ARN, use
	// <a>ListAliases</a>.</p>
	KeyId *string
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
}

type GetPublicKeyOutput struct {
	// The permitted use of the public key. Valid values are ENCRYPT_DECRYPT or
	// SIGN_VERIFY. This information is critical. If a public key with SIGN_VERIFY key
	// usage encrypts data outside of AWS KMS, the ciphertext cannot be decrypted.
	KeyUsage types.KeyUsageType
	// The exported public key. The value is a DER-encoded X.509 public key, also known
	// as SubjectPublicKeyInfo (SPKI), as defined in RFC 5280
	// (https://tools.ietf.org/html/rfc5280). When you use the HTTP API or the AWS CLI,
	// the value is Base64-encoded. Otherwise, it is not Base64-encoded.
	PublicKey []byte
	// The type of the of the public key that was downloaded.
	CustomerMasterKeySpec types.CustomerMasterKeySpec
	// The signing algorithms that AWS KMS supports for this key. This field appears in
	// the response only when the KeyUsage of the public key is SIGN_VERIFY.
	SigningAlgorithms []types.SigningAlgorithmSpec
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the asymmetric CMK from which the public key was downloaded.
	KeyId *string
	// The encryption algorithms that AWS KMS supports for this key. This information
	// is critical. If a public key encrypts data outside of AWS KMS by using an
	// unsupported encryption algorithm, the ciphertext cannot be decrypted. This field
	// appears in the response only when the KeyUsage of the public key is
	// ENCRYPT_DECRYPT.
	EncryptionAlgorithms []types.EncryptionAlgorithmSpec

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type HTTPClient interface {
	Do(*http.Request) (*http.Response, error)
}

type HTTPSignerV4 interface {
	SignHTTP(ctx context.Context, credentials aws.Credentials, r *http.Request, payloadHash string, service string, region string, signingTime time.Time) error
}

type ImportKeyMaterialInput struct {
	// The import token that you received in the response to a previous
	// GetParametersForImport () request. It must be from the same response that
	// contained the public key that you used to encrypt the key material.
	ImportToken []byte
	// The identifier of the symmetric CMK that receives the imported key material. The
	// CMK's Origin must be EXTERNAL. This must be the same CMK specified in the KeyID
	// parameter of the corresponding GetParametersForImport () request. Specify the
	// key ID or the Amazon Resource Name (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
	// The encrypted key material to import. The key material must be encrypted with
	// the public wrapping key that GetParametersForImport () returned, using the
	// wrapping algorithm that you specified in the same GetParametersForImport
	// request.
	EncryptedKeyMaterial []byte
	// Specifies whether the key material expires. The default is KEY_MATERIAL_EXPIRES,
	// in which case you must include the ValidTo parameter. When this parameter is set
	// to KEY_MATERIAL_DOES_NOT_EXPIRE, you must omit the ValidTo parameter.
	ExpirationModel types.ExpirationModelType
	// The time at which the imported key material expires. When the key material
	// expires, AWS KMS deletes the key material and the CMK becomes unusable. You must
	// omit this parameter when the ExpirationModel parameter is set to
	// KEY_MATERIAL_DOES_NOT_EXPIRE. Otherwise it is required.
	ValidTo *time.Time
}

type ImportKeyMaterialOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type ListAliasesInput struct {
	// Lists only aliases that refer to the specified CMK. The value of this parameter
	// can be the ID or Amazon Resource Name (ARN) of a CMK in the caller's account and
	// region. You cannot use an alias name or alias ARN in this value. This parameter
	// is optional. If you omit it, ListAliases returns all aliases in the account and
	// region.
	KeyId *string
	// Use this parameter in a subsequent request after you receive a response with
	// truncated results. Set it to the value of NextMarker from the truncated response
	// you just received.
	Marker *string
	// Use this parameter to specify the maximum number of items to return. When this
	// value is present, AWS KMS does not return more than the specified number of
	// items, but it might return fewer. This value is optional. If you include a
	// value, it must be between 1 and 100, inclusive. If you do not include a value,
	// it defaults to 50.
	Limit *int32
}

type ListAliasesOutput struct {
	// When Truncated is true, this element is present and contains the value to use
	// for the Marker parameter in a subsequent request.
	NextMarker *string
	// A list of aliases.
	Aliases []*types.AliasListEntry
	// A flag that indicates whether there are more items in the list. When this value
	// is true, the list in this response is truncated. To get more items, pass the
	// value of the NextMarker element in thisresponse to the Marker parameter in a
	// subsequent request.
	Truncated *bool

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type ListGrantsInput struct {
	// Use this parameter in a subsequent request after you receive a response with
	// truncated results. Set it to the value of NextMarker from the truncated response
	// you just received.
	Marker *string
	// A unique identifier for the customer master key (CMK). Specify the key ID or the
	// Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS
	// account, you must use the key ARN. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
	// Use this parameter to specify the maximum number of items to return. When this
	// value is present, AWS KMS does not return more than the specified number of
	// items, but it might return fewer. This value is optional. If you include a
	// value, it must be between 1 and 100, inclusive. If you do not include a value,
	// it defaults to 50.
	Limit *int32
}

type ListGrantsOutput struct {
	// A list of grants.
	Grants []*types.GrantListEntry
	// When Truncated is true, this element is present and contains the value to use
	// for the Marker parameter in a subsequent request.
	NextMarker *string
	// A flag that indicates whether there are more items in the list. When this value
	// is true, the list in this response is truncated. To get more items, pass the
	// value of the NextMarker element in thisresponse to the Marker parameter in a
	// subsequent request.
	Truncated *bool

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type ListKeyPoliciesInput struct {
	// Use this parameter to specify the maximum number of items to return. When this
	// value is present, AWS KMS does not return more than the specified number of
	// items, but it might return fewer. This value is optional. If you include a
	// value, it must be between 1 and 1000, inclusive. If you do not include a value,
	// it defaults to 100. Only one policy can be attached to a key.
	Limit *int32
	// A unique identifier for the customer master key (CMK). Specify the key ID or the
	// Amazon Resource Name (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
	// Use this parameter in a subsequent request after you receive a response with
	// truncated results. Set it to the value of NextMarker from the truncated response
	// you just received.
	Marker *string
}

type ListKeyPoliciesOutput struct {
	// A list of key policy names. The only valid value is default.
	PolicyNames []*string
	// A flag that indicates whether there are more items in the list. When this value
	// is true, the list in this response is truncated. To get more items, pass the
	// value of the NextMarker element in thisresponse to the Marker parameter in a
	// subsequent request.
	Truncated *bool
	// When Truncated is true, this element is present and contains the value to use
	// for the Marker parameter in a subsequent request.
	NextMarker *string

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type ListKeysInput struct {
	// Use this parameter in a subsequent request after you receive a response with
	// truncated results. Set it to the value of NextMarker from the truncated response
	// you just received.
	Marker *string
	// Use this parameter to specify the maximum number of items to return. When this
	// value is present, AWS KMS does not return more than the specified number of
	// items, but it might return fewer. This value is optional. If you include a
	// value, it must be between 1 and 1000, inclusive. If you do not include a value,
	// it defaults to 100.
	Limit *int32
}

type ListKeysOutput struct {
	// When Truncated is true, this element is present and contains the value to use
	// for the Marker parameter in a subsequent request.
	NextMarker *string
	// A flag that indicates whether there are more items in the list. When this value
	// is true, the list in this response is truncated. To get more items, pass the
	// value of the NextMarker element in thisresponse to the Marker parameter in a
	// subsequent request.
	Truncated *bool
	// A list of customer master keys (CMKs).
	Keys []*types.KeyListEntry

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type ListResourceTagsInput struct {
	// Use this parameter to specify the maximum number of items to return. When this
	// value is present, AWS KMS does not return more than the specified number of
	// items, but it might return fewer. This value is optional. If you include a
	// value, it must be between 1 and 50, inclusive. If you do not include a value, it
	// defaults to 50.
	Limit *int32
	// A unique identifier for the customer master key (CMK). Specify the key ID or the
	// Amazon Resource Name (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
	// Use this parameter in a subsequent request after you receive a response with
	// truncated results. Set it to the value of NextMarker from the truncated response
	// you just received. Do not attempt to construct this value. Use only the value of
	// NextMarker from the truncated response you just received.
	Marker *string
}

type ListResourceTagsOutput struct {
	// When Truncated is true, this element is present and contains the value to use
	// for the Marker parameter in a subsequent request. Do not assume or infer any
	// information from this value.
	NextMarker *string
	// A flag that indicates whether there are more items in the list. When this value
	// is true, the list in this response is truncated. To get more items, pass the
	// value of the NextMarker element in thisresponse to the Marker parameter in a
	// subsequent request.
	Truncated *bool
	// A list of tags. Each tag consists of a tag key and a tag value.
	Tags []*types.Tag

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type ListRetirableGrantsInput struct {
	// Use this parameter to specify the maximum number of items to return. When this
	// value is present, AWS KMS does not return more than the specified number of
	// items, but it might return fewer. This value is optional. If you include a
	// value, it must be between 1 and 100, inclusive. If you do not include a value,
	// it defaults to 50.
	Limit *int32
	// Use this parameter in a subsequent request after you receive a response with
	// truncated results. Set it to the value of NextMarker from the truncated response
	// you just received.
	Marker *string
	// The retiring principal for which to list grants. To specify the retiring
	// principal, use the Amazon Resource Name (ARN)
	// (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) of
	// an AWS principal. Valid AWS principals include AWS accounts (root), IAM users,
	// federated users, and assumed role users. For examples of the ARN syntax for
	// specifying a principal, see AWS Identity and Access Management (IAM)
	// (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-iam)
	// in the Example ARNs section of the Amazon Web Services General Reference.
	RetiringPrincipal *string
}

type ListRetirableGrantsOutput struct {
	// A list of grants.
	Grants []*types.GrantListEntry
	// When Truncated is true, this element is present and contains the value to use
	// for the Marker parameter in a subsequent request.
	NextMarker *string
	// A flag that indicates whether there are more items in the list. When this value
	// is true, the list in this response is truncated. To get more items, pass the
	// value of the NextMarker element in thisresponse to the Marker parameter in a
	// subsequent request.
	Truncated *bool

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type Options struct {
	// Set of options to modify how an operation is invoked. These apply to all
	// operations invoked for this client. Use functional options on operation call to
	// modify this list for per operation behavior.
	APIOptions []func(*middleware.Stack) error

	// The credentials object to use when signing requests.
	Credentials aws.CredentialsProvider

	// The endpoint options to be used when attempting to resolve an endpoint.
	EndpointOptions ResolverOptions

	// The service endpoint resolver.
	EndpointResolver EndpointResolver

	// Signature Version 4 (SigV4) Signer
	HTTPSignerV4 HTTPSignerV4

	// The region to send requests to. (Required)
	Region string

	// Retryer guides how HTTP requests should be retried in case of recoverable
	// failures. When nil the API client will use a default retryer.
	Retryer retry.Retryer

	// The HTTP client to invoke API calls with. Defaults to client's default HTTP
	// implementation if nil.
	HTTPClient HTTPClient
}

type PutKeyPolicyInput struct {
	// A unique identifier for the customer master key (CMK). Specify the key ID or the
	// Amazon Resource Name (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
	// A flag to indicate whether to bypass the key policy lockout safety check.
	// Setting this value to true increases the risk that the CMK becomes unmanageable.
	// Do not set this value to true indiscriminately. For more information, refer to
	// the scenario in the Default Key Policy
	// (https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam)
	// section in the AWS Key Management Service Developer Guide. Use this parameter
	// only when you intend to prevent the principal that is making the request from
	// making a subsequent PutKeyPolicy request on the CMK. The default value is false.
	BypassPolicyLockoutSafetyCheck *bool
	// The key policy to attach to the CMK. The key policy must meet the following
	// criteria:
	//
	//     * If you don't set BypassPolicyLockoutSafetyCheck to true, the
	// key policy must allow the principal that is making the PutKeyPolicy request to
	// make a subsequent PutKeyPolicy request on the CMK. This reduces the risk that
	// the CMK becomes unmanageable. For more information, refer to the scenario in the
	// Default Key Policy
	// (https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam)
	// section of the AWS Key Management Service Developer Guide.
	//
	//     * Each statement
	// in the key policy must contain one or more principals. The principals in the key
	// policy must exist and be visible to AWS KMS. When you create a new AWS principal
	// (for example, an IAM user or role), you might need to enforce a delay before
	// including the new principal in a key policy because the new principal might not
	// be immediately visible to AWS KMS. For more information, see Changes that I make
	// are not always immediately visible
	// (https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency)
	// in the AWS Identity and Access Management User Guide.
	//
	// The key policy cannot
	// exceed 32 kilobytes (32768 bytes). For more information, see Resource Quotas
	// (https://docs.aws.amazon.com/kms/latest/developerguide/resource-limits.html) in
	// the AWS Key Management Service Developer Guide.
	Policy *string
	// The name of the key policy. The only valid value is default.
	PolicyName *string
}

type PutKeyPolicyOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type ReEncryptInput struct {
	// Ciphertext of the data to reencrypt.
	CiphertextBlob []byte
	// Specifies that encryption context to use when the reencrypting the data. A
	// destination encryption context is valid only when the destination CMK is a
	// symmetric CMK. The standard ciphertext format for asymmetric CMKs does not
	// include fields for metadata. An encryption context is a collection of non-secret
	// key-value pairs that represents additional authenticated data. When you use an
	// encryption context to encrypt data, you must specify the same (an exact
	// case-sensitive match) encryption context to decrypt the data. An encryption
	// context is optional when encrypting with a symmetric CMK, but it is highly
	// recommended. For more information, see Encryption Context
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
	// in the AWS Key Management Service Developer Guide.
	DestinationEncryptionContext map[string]*string
	// A unique identifier for the CMK that is used to decrypt the ciphertext before it
	// reencrypts it using the destination CMK. This parameter is required only when
	// the ciphertext was encrypted under an asymmetric CMK. Otherwise, AWS KMS uses
	// the metadata that it adds to the ciphertext blob to determine which CMK was used
	// to encrypt the ciphertext. However, you can use this parameter to ensure that a
	// particular CMK (of any kind) is used to decrypt the ciphertext before it is
	// reencrypted. If you specify a KeyId value, the decrypt part of the ReEncrypt
	// operation succeeds only if the specified CMK was used to encrypt the ciphertext.
	// <p>To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or
	// alias ARN. When using an alias name, prefix it with <code>"alias/"</code>.</p>
	// <p>For example:</p> <ul> <li> <p>Key ID:
	// <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> <li> <p>Key ARN:
	// <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code>
	// </p> </li> <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li> <li>
	// <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code>
	// </p> </li> </ul> <p>To get the key ID and key ARN for a CMK, use <a>ListKeys</a>
	// or <a>DescribeKey</a>. To get the alias name and alias ARN, use
	// <a>ListAliases</a>.</p>
	SourceKeyId *string
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
	// Specifies the encryption algorithm that AWS KMS will use to reecrypt the data
	// after it has decrypted it. The default value, SYMMETRIC_DEFAULT, represents the
	// encryption algorithm used for symmetric CMKs. This parameter is required only
	// when the destination CMK is an asymmetric CMK.
	DestinationEncryptionAlgorithm types.EncryptionAlgorithmSpec
	// Specifies the encryption context to use to decrypt the ciphertext. Enter the
	// same encryption context that was used to encrypt the ciphertext. An encryption
	// context is a collection of non-secret key-value pairs that represents additional
	// authenticated data. When you use an encryption context to encrypt data, you must
	// specify the same (an exact case-sensitive match) encryption context to decrypt
	// the data. An encryption context is optional when encrypting with a symmetric
	// CMK, but it is highly recommended. For more information, see Encryption Context
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context)
	// in the AWS Key Management Service Developer Guide.
	SourceEncryptionContext map[string]*string
	// Specifies the encryption algorithm that AWS KMS will use to decrypt the
	// ciphertext before it is reencrypted. The default value, SYMMETRIC_DEFAULT,
	// represents the algorithm used for symmetric CMKs. Specify the same algorithm
	// that was used to encrypt the ciphertext. If you specify a different algorithm,
	// the decrypt attempt fails. This parameter is required only when the ciphertext
	// was encrypted under an asymmetric CMK.
	SourceEncryptionAlgorithm types.EncryptionAlgorithmSpec
	// A unique identifier for the CMK that is used to reencrypt the data. Specify a
	// symmetric or asymmetric CMK with a KeyUsage value of ENCRYPT_DECRYPT. To find
	// the KeyUsage value of a CMK, use the DescribeKey () operation. To specify a CMK,
	// use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using
	// an alias name, prefix it with "alias/". To specify a CMK in a different AWS
	// account, you must use the key ARN or alias ARN. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//
	// * Alias name: alias/ExampleAlias
	//
	//     * Alias ARN:
	// arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
	//
	// To get the key ID and key
	// ARN for a CMK, use ListKeys () or DescribeKey (). To get the alias name and
	// alias ARN, use ListAliases ().
	DestinationKeyId *string
}

type ReEncryptOutput struct {
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the CMK that was used to reencrypt the data.
	KeyId *string
	// Unique identifier of the CMK used to originally encrypt the data.
	SourceKeyId *string
	// The reencrypted data. When you use the HTTP API or the AWS CLI, the value is
	// Base64-encoded. Otherwise, it is not Base64-encoded.
	CiphertextBlob []byte
	// The encryption algorithm that was used to reencrypt the data.
	DestinationEncryptionAlgorithm types.EncryptionAlgorithmSpec
	// The encryption algorithm that was used to decrypt the ciphertext before it was
	// reencrypted.
	SourceEncryptionAlgorithm types.EncryptionAlgorithmSpec

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type ResolveEndpoint struct {
	Resolver EndpointResolver
	Options  ResolverOptions
}

type ResolveEndpointMiddlewareOptions interface {
	GetEndpointResolver() EndpointResolver
	GetEndpointOptions() ResolverOptions
}

type ResolverOptions = internalendpoints.Options

type RetireGrantInput struct {
	// Token that identifies the grant to be retired.
	GrantToken *string
	// The Amazon Resource Name (ARN) of the CMK associated with the grant. For
	// example:
	// arn:aws:kms:us-east-2:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab
	KeyId *string
	// Unique identifier of the grant to retire. The grant ID is returned in the
	// response to a CreateGrant operation.
	//
	//     * Grant ID Example -
	// 0123456789012345678901234567890123456789012345678901234567890123
	GrantId *string
}

type RetireGrantOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type RevokeGrantInput struct {
	// Identifier of the grant to be revoked.
	GrantId *string
	// A unique identifier for the customer master key associated with the grant.
	// <p>Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a
	// CMK in a  different AWS account, you must use the key ARN. For example:
	//
	//     *
	// Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
}

type RevokeGrantOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type ScheduleKeyDeletionInput struct {
	// The unique identifier of the customer master key (CMK) to delete.  <p>Specify
	// the key ID or the Amazon Resource Name (ARN) of the CMK.</p> <p>For example:</p>
	// <ul> <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p>
	// </li> <li> <p>Key ARN:
	// <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code>
	// </p> </li> </ul> <p>To get the key ID and key ARN for a CMK, use <a>ListKeys</a>
	// or <a>DescribeKey</a>.</p>
	KeyId *string
	// The waiting period, specified in number of days. After the waiting period ends,
	// AWS KMS deletes the customer master key (CMK). This value is optional. If you
	// include a value, it must be between 7 and 30, inclusive. If you do not include a
	// value, it defaults to 30.
	PendingWindowInDays *int32
}

type ScheduleKeyDeletionOutput struct {
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the CMK whose deletion is scheduled.
	KeyId *string
	// The date and time after which AWS KMS deletes the customer master key (CMK).
	DeletionDate *time.Time

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type SignInput struct {
	// Identifies an asymmetric CMK. AWS KMS uses the private key in the asymmetric CMK
	// to sign the message. The KeyUsage type of the CMK must be SIGN_VERIFY. To find
	// the KeyUsage of a CMK, use the DescribeKey () operation.  <p>To specify a CMK,
	// use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using
	// an alias name, prefix it with <code>"alias/"</code>. To specify a CMK in a
	// different AWS account, you must use the key ARN or alias ARN.</p> <p>For
	// example:</p> <ul> <li> <p>Key ID:
	// <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> <li> <p>Key ARN:
	// <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code>
	// </p> </li> <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li> <li>
	// <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code>
	// </p> </li> </ul> <p>To get the key ID and key ARN for a CMK, use <a>ListKeys</a>
	// or <a>DescribeKey</a>. To get the alias name and alias ARN, use
	// <a>ListAliases</a>.</p>
	KeyId *string
	// Specifies the signing algorithm to use when signing the message. Choose an
	// algorithm that is compatible with the type and size of the specified asymmetric
	// CMK.
	SigningAlgorithm types.SigningAlgorithmSpec
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
	// Tells AWS KMS whether the value of the Message parameter is a message or message
	// digest. The default value, RAW, indicates a message. To indicate a message
	// digest, enter DIGEST.
	MessageType types.MessageType
	// Specifies the message or message digest to sign. Messages can be 0-4096 bytes.
	// To sign a larger message, provide the message digest. If you provide a message,
	// AWS KMS generates a hash digest of the message and then signs it.
	Message []byte
}

type SignOutput struct {
	// The signing algorithm that was used to sign the message.
	SigningAlgorithm types.SigningAlgorithmSpec
	// The cryptographic signature that was generated for the message.
	//
	//     * When used
	// with the supported RSA signing algorithms, the encoding of this value is defined
	// by PKCS #1 in RFC 8017 (https://tools.ietf.org/html/rfc8017).
	//
	//     * When used
	// with the ECDSA_SHA_256, ECDSA_SHA_384, or ECDSA_SHA_512 signing algorithms, this
	// value is a DER-encoded object as defined by ANS X9.62–2005 and RFC 3279 Section
	// 2.2.3 (https://tools.ietf.org/html/rfc3279#section-2.2.3). This is the most
	// commonly used signature format and is appropriate for most uses.
	//
	// When you use
	// the HTTP API or the AWS CLI, the value is Base64-encoded. Otherwise, it is not
	// Base64-encoded.
	Signature []byte
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the asymmetric CMK that was used to sign the message.
	KeyId *string

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type TagResourceInput struct {
	// A unique identifier for the CMK you are tagging. Specify the key ID or the
	// Amazon Resource Name (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
	// One or more tags. Each tag consists of a tag key and a tag value.
	Tags []*types.Tag
}

type TagResourceOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type UntagResourceInput struct {
	// A unique identifier for the CMK from which you are removing tags.  <p>Specify
	// the key ID or the Amazon Resource Name (ARN) of the CMK.</p> <p>For example:</p>
	// <ul> <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p>
	// </li> <li> <p>Key ARN:
	// <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code>
	// </p> </li> </ul> <p>To get the key ID and key ARN for a CMK, use <a>ListKeys</a>
	// or <a>DescribeKey</a>.</p>
	KeyId *string
	// One or more tag keys. Specify only the tag keys, not the tag values.
	TagKeys []*string
}

type UntagResourceOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type UpdateAliasInput struct {
	// Identifies the CMK to associate with the alias. When the update operation
	// completes, the alias will point to this CMK. The CMK must be in the same AWS
	// account and Region as the alias. Also, the new target CMK must be the same type
	// as the current target CMK (both symmetric or both asymmetric) and they must have
	// the same key usage. Specify the key ID or the Amazon Resource Name (ARN) of the
	// CMK. For example:
	//
	//     * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key
	// ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey (). To
	// verify that the alias is mapped to the correct CMK, use ListAliases ().
	TargetKeyId *string
	// Identifies the alias that is changing its CMK. This value must begin with alias/
	// followed by the alias name, such as alias/ExampleAlias. You cannot use
	// UpdateAlias to change the alias name.
	AliasName *string
}

type UpdateAliasOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type UpdateCustomKeyStoreInput struct {
	// Associates the custom key store with a related AWS CloudHSM cluster. Enter the
	// cluster ID of the cluster that you used to create the custom key store or a
	// cluster that shares a backup history and has the same cluster certificate as the
	// original cluster. You cannot use this parameter to associate a custom key store
	// with an unrelated cluster. In addition, the replacement cluster must fulfill the
	// requirements
	// (https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore)
	// for a cluster associated with a custom key store. To view the cluster
	// certificate of a cluster, use the DescribeClusters
	// (https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html)
	// operation.
	CloudHsmClusterId *string
	// Identifies the custom key store that you want to update. Enter the ID of the
	// custom key store. To find the ID of a custom key store, use the
	// DescribeCustomKeyStores () operation.
	CustomKeyStoreId *string
	// Changes the friendly name of the custom key store to the value that you specify.
	// The custom key store name must be unique in the AWS account.
	NewCustomKeyStoreName *string
	// Enter the current password of the kmsuser crypto user (CU) in the AWS CloudHSM
	// cluster that is associated with the custom key store. This parameter tells AWS
	// KMS the current password of the kmsuser crypto user (CU). It does not set or
	// change the password of any users in the AWS CloudHSM cluster.
	KeyStorePassword *string
}

type UpdateCustomKeyStoreOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type UpdateKeyDescriptionInput struct {
	// New description for the CMK.
	Description *string
	// A unique identifier for the customer master key (CMK). Specify the key ID or the
	// Amazon Resource Name (ARN) of the CMK. For example:
	//
	//     * Key ID:
	// 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//     * Key ARN:
	// arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	// To
	// get the key ID and key ARN for a CMK, use ListKeys () or DescribeKey ().
	KeyId *string
}

type UpdateKeyDescriptionOutput struct {
	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}

type VerifyInput struct {
	// Tells AWS KMS whether the value of the Message parameter is a message or message
	// digest. The default value, RAW, indicates a message. To indicate a message
	// digest, enter DIGEST. Use the DIGEST value only when the value of the Message
	// parameter is a message digest. If you use the DIGEST value with a raw message,
	// the security of the verification operation can be compromised.
	MessageType types.MessageType
	// Specifies the message that was signed. You can submit a raw message of up to
	// 4096 bytes, or a hash digest of the message. If you submit a digest, use the
	// MessageType parameter with a value of DIGEST. If the message specified here is
	// different from the message that was signed, the signature verification fails. A
	// message and its hash digest are considered to be the same message.
	Message []byte
	// The signing algorithm that was used to sign the message. If you submit a
	// different algorithm, the signature verification fails.
	SigningAlgorithm types.SigningAlgorithmSpec
	// A list of grant tokens. For more information, see Grant Tokens
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token)
	// in the AWS Key Management Service Developer Guide.
	GrantTokens []*string
	// Identifies the asymmetric CMK that will be used to verify the signature. This
	// must be the same CMK that was used to generate the signature. If you specify a
	// different CMK, the signature verification fails.  <p>To specify a CMK, use its
	// key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an
	// alias name, prefix it with <code>"alias/"</code>. To specify a CMK in a
	// different AWS account, you must use the key ARN or alias ARN.</p> <p>For
	// example:</p> <ul> <li> <p>Key ID:
	// <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> <li> <p>Key ARN:
	// <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code>
	// </p> </li> <li> <p>Alias name: <code>alias/ExampleAlias</code> </p> </li> <li>
	// <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code>
	// </p> </li> </ul> <p>To get the key ID and key ARN for a CMK, use <a>ListKeys</a>
	// or <a>DescribeKey</a>. To get the alias name and alias ARN, use
	// <a>ListAliases</a>.</p>
	KeyId *string
	// The signature that the Sign operation generated.
	Signature []byte
}

type VerifyOutput struct {
	// The Amazon Resource Name (key ARN
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN))
	// of the asymmetric CMK that was used to verify the signature.
	KeyId *string
	// The signing algorithm that was used to verify the signature.
	SigningAlgorithm types.SigningAlgorithmSpec
	// A Boolean value that indicates whether the signature was verified. A value of
	// True indicates that the Signature was produced by signing the Message with the
	// specified KeyID and SigningAlgorithm. If the signature is not verified, the
	// Verify operation fails with a KMSInvalidSignatureException exception.
	SignatureValid *bool

	// Metadata pertaining to the operation's result.
	ResultMetadata middleware.Metadata
}