Module Values.GetPublicKeyResponseSource

Returns the public key of an asymmetric KMS key. Unlike the private key of a asymmetric KMS key, which never leaves KMS unencrypted, callers with kms:GetPublicKey permission can download the public key of an asymmetric KMS key. You can share the public key to allow others to encrypt messages and verify signatures outside of KMS. For information about asymmetric KMS keys, see Asymmetric KMS keys in the Key Management Service Developer Guide. You do not need to download the public key. Instead, you can use the public key within KMS by calling the Encrypt, ReEncrypt, or Verify operations with the identifier of an asymmetric KMS key. When you use the public key within KMS, you benefit from the authentication, authorization, and logging that are part of every KMS operation. You also reduce of risk of encrypting data that cannot be decrypted. These features are not effective outside of KMS. To help you use the public key safely outside of KMS, GetPublicKey returns important information about the public key in the response, including: KeySpec: The type of key material in the public key, such as RSA_4096 or ECC_NIST_P521. KeyUsage: Whether the key is used for encryption, signing, or deriving a shared secret. EncryptionAlgorithms, KeyAgreementAlgorithms, or SigningAlgorithms: A list of the encryption algorithms, key agreement algorithms, or signing algorithms for the key. Although KMS cannot enforce these restrictions on external operations, it is crucial that you use this information to prevent the public key from being used improperly. For example, you can prevent a public signing key from being used encrypt data, or prevent a public key from being used with an encryption algorithm that is not supported by KMS. You can also avoid errors, such as using the wrong signing algorithm in a verification operation. To verify a signature outside of KMS with an SM2 public key (China Regions only), you must specify the distinguishing ID. By default, KMS uses 1234567812345678 as the distinguishing ID. For more information, see Offline verification with SM2 key pairs. The KMS key that you use for this operation must be in a compatible key state. For details, see Key states of KMS keys in the Key Management Service Developer Guide. Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter. Required permissions: kms:GetPublicKey (key policy) Related operations: CreateKey Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.

Sourcetype nonrec t = {
  1. keyId : KeyIdType.t option;
    (*

    The Amazon Resource Name (key ARN) of the asymmetric KMS key from which the public key was downloaded.

    *)
  2. publicKey : PublicKeyType.t option;
    (*

    The exported public key. The value is a DER-encoded X.509 public key, also known as SubjectPublicKeyInfo (SPKI), as defined in RFC 5280. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.

    *)
  3. customerMasterKeySpec : CustomerMasterKeySpec.t option;
    (*

    Instead, use the KeySpec field in the GetPublicKey response. The KeySpec and CustomerMasterKeySpec fields have the same value. We recommend that you use the KeySpec field in your code. However, to avoid breaking changes, KMS supports both fields.

    *)
  4. keySpec : KeySpec.t option;
    (*

    The type of the of the public key that was downloaded.

    *)
  5. keyUsage : KeyUsageType.t option;
    (*

    The permitted use of the public key. Valid values for asymmetric key pairs are ENCRYPT_DECRYPT, SIGN_VERIFY, and KEY_AGREEMENT. This information is critical. For example, if a public key with SIGN_VERIFY key usage encrypts data outside of KMS, the ciphertext cannot be decrypted.

    *)
  6. encryptionAlgorithms : EncryptionAlgorithmSpecList.t option;
    (*

    The encryption algorithms that KMS supports for this key. This information is critical. If a public key encrypts data outside of KMS by using an unsupported encryption algorithm, the ciphertext cannot be decrypted. This field appears in the response only when the KeyUsage of the public key is ENCRYPT_DECRYPT.

    *)
  7. signingAlgorithms : SigningAlgorithmSpecList.t option;
    (*

    The signing algorithms that KMS supports for this key. This field appears in the response only when the KeyUsage of the public key is SIGN_VERIFY.

    *)
  8. keyAgreementAlgorithms : KeyAgreementAlgorithmSpecList.t option;
    (*

    The key agreement algorithm used to derive a shared secret. This field is present only when the KMS key has a KeyUsage value of KEY_AGREEMENT.

    *)
}
Sourcetype nonrec error = [
  1. | `DependencyTimeoutException of DependencyTimeoutException.t
  2. | `DisabledException of DisabledException.t
  3. | `InvalidArnException of InvalidArnException.t
  4. | `InvalidGrantTokenException of InvalidGrantTokenException.t
  5. | `InvalidKeyUsageException of InvalidKeyUsageException.t
  6. | `KMSInternalException of KMSInternalException.t
  7. | `KMSInvalidStateException of KMSInvalidStateException.t
  8. | `KeyUnavailableException of KeyUnavailableException.t
  9. | `NotFoundException of NotFoundException.t
  10. | `UnsupportedOperationException of UnsupportedOperationException.t
  11. | `Unknown_operation_error of string * string option
]
Sourceval make : ?keyId:??? -> ?publicKey:??? -> ?customerMasterKeySpec:??? -> ?keySpec:??? -> ?keyUsage:??? -> ?encryptionAlgorithms:??? -> ?signingAlgorithms:??? -> ?keyAgreementAlgorithms:??? -> unit -> t
Sourceval error_of_json : string -> Yojson.Safe.t -> [> `DependencyTimeoutException of DependencyTimeoutException.t | `DisabledException of DisabledException.t | `InvalidArnException of InvalidArnException.t | `InvalidGrantTokenException of InvalidGrantTokenException.t | `InvalidKeyUsageException of InvalidKeyUsageException.t | `KMSInternalException of KMSInternalException.t | `KMSInvalidStateException of KMSInvalidStateException.t | `KeyUnavailableException of KeyUnavailableException.t | `NotFoundException of NotFoundException.t | `Unknown_operation_error of string * string option | `UnsupportedOperationException of UnsupportedOperationException.t ]
Sourceval error_of_xml : string -> Awso.Xml.t -> [> `DependencyTimeoutException of DependencyTimeoutException.t | `DisabledException of DisabledException.t | `InvalidArnException of InvalidArnException.t | `InvalidGrantTokenException of InvalidGrantTokenException.t | `InvalidKeyUsageException of InvalidKeyUsageException.t | `KMSInternalException of KMSInternalException.t | `KMSInvalidStateException of KMSInvalidStateException.t | `KeyUnavailableException of KeyUnavailableException.t | `NotFoundException of NotFoundException.t | `Unknown_operation_error of string * string option | `UnsupportedOperationException of UnsupportedOperationException.t ]
Sourceval error_to_json : error -> Yojson.Safe.t
Sourceval to_value : t -> [> `Structure of (string * [> `Blob of PublicKeyType.t | `Enum of string | `List of [> `Enum of string ] list | `String of KeyIdType.t ]) list ]
Sourceval to_query : t -> Awso.Client.Query.t
Sourceval of_xml : Awso.Xml.t -> t
Sourceval of_string : string -> t
Sourceval of_json : Yojson.Safe.t -> t
Sourceval to_json : t -> Yojson.Safe.t