import { Command as $Command } from "@smithy/core/client"; import type { MetadataBearer as __MetadataBearer } from "@smithy/types"; import type { KMSClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../KMSClient"; import type { ReEncryptRequest, ReEncryptResponse } from "../models/models_0"; /** * @public */ export type { __MetadataBearer }; export { $Command }; /** * @public * * The input for {@link ReEncryptCommand}. */ export interface ReEncryptCommandInput extends ReEncryptRequest { } /** * @public * * The output of {@link ReEncryptCommand}. */ export interface ReEncryptCommandOutput extends ReEncryptResponse, __MetadataBearer { } declare const ReEncryptCommand_base: { new (input: ReEncryptCommandInput): import("@smithy/core/client").CommandImpl; new (input: ReEncryptCommandInput): import("@smithy/core/client").CommandImpl; getEndpointParameterInstructions(): { [x: string]: unknown; }; }; /** *

Decrypts ciphertext and then reencrypts it entirely within KMS. You can use this * operation to change the KMS key under which data is encrypted, such as when you manually rotate a * KMS key or change the KMS key that protects a ciphertext. You can also use it to reencrypt * ciphertext under the same KMS key, such as to change the encryption context of a ciphertext.

*

The ReEncrypt operation can decrypt ciphertext that was encrypted by using a * KMS key in an KMS operation, such as Encrypt or GenerateDataKey. It can also decrypt ciphertext that was encrypted by using the * public key of an asymmetric KMS key outside of KMS. However, it cannot decrypt ciphertext produced * by other libraries, such as the Amazon Web Services * Encryption SDK or Amazon S3 client-side encryption. * These libraries return a ciphertext format that is incompatible with KMS.

*

When you use the ReEncrypt operation, you need to provide information for the * decrypt operation and the subsequent encrypt operation.

* *

The KMS key that you use for this operation must be in a compatible key state. For * details, see Key states of KMS keys in the Key Management Service Developer Guide.

* *

When using grants with SourceArn constraints for * ReEncrypt operations, the grants on both the source KMS key (for * ReEncryptFrom) and the destination KMS key (for ReEncryptTo) * must specify the same SourceArn value.

* *

* Cross-account use: Yes. The source KMS key and * destination KMS key can be in different Amazon Web Services accounts. Either or both KMS keys can be in a * different account than the caller. To specify a KMS key in a different account, use the key ARN * or alias ARN. A short key ID * is also acceptable for the source key when decrypting symmetric ciphertexts, though * using a full key ARN is recommended to be more explicit about the intended KMS key.

*

* Required permissions:

* *

To permit reencryption from or to a KMS key, include the "kms:ReEncrypt*" * permission in your key policy. This permission is * automatically included in the key policy when you use the console to create a KMS key. But you * must include it manually when you create a KMS key programmatically or when you use the PutKeyPolicy operation to set a key policy.

*

* Related operations: *

* *

* Eventual consistency: The KMS API follows an eventual consistency model. * For more information, see KMS eventual consistency.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript * import { KMSClient, ReEncryptCommand } from "@aws-sdk/client-kms"; // ES Modules import * // const { KMSClient, ReEncryptCommand } = require("@aws-sdk/client-kms"); // CommonJS import * // import type { KMSClientConfig } from "@aws-sdk/client-kms"; * const config = {}; // type is KMSClientConfig * const client = new KMSClient(config); * const input = { // ReEncryptRequest * CiphertextBlob: new Uint8Array(), // e.g. Buffer.from("") or new TextEncoder().encode("") * SourceEncryptionContext: { // EncryptionContextType * "": "STRING_VALUE", * }, * SourceKeyId: "STRING_VALUE", * DestinationKeyId: "STRING_VALUE", // required * DestinationEncryptionContext: { * "": "STRING_VALUE", * }, * SourceEncryptionAlgorithm: "SYMMETRIC_DEFAULT" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "SM2PKE", * DestinationEncryptionAlgorithm: "SYMMETRIC_DEFAULT" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "SM2PKE", * GrantTokens: [ // GrantTokenList * "STRING_VALUE", * ], * DryRun: true || false, * DryRunModifiers: [ // DryRunModifierList * "IGNORE_CIPHERTEXT", * ], * }; * const command = new ReEncryptCommand(input); * const response = await client.send(command); * // { // ReEncryptResponse * // CiphertextBlob: new Uint8Array(), * // SourceKeyId: "STRING_VALUE", * // KeyId: "STRING_VALUE", * // SourceEncryptionAlgorithm: "SYMMETRIC_DEFAULT" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "SM2PKE", * // DestinationEncryptionAlgorithm: "SYMMETRIC_DEFAULT" || "RSAES_OAEP_SHA_1" || "RSAES_OAEP_SHA_256" || "SM2PKE", * // SourceKeyMaterialId: "STRING_VALUE", * // DestinationKeyMaterialId: "STRING_VALUE", * // }; * * ``` * * @param ReEncryptCommandInput - {@link ReEncryptCommandInput} * @returns {@link ReEncryptCommandOutput} * @see {@link ReEncryptCommandInput} for command's `input` shape. * @see {@link ReEncryptCommandOutput} for command's `response` shape. * @see {@link KMSClientResolvedConfig | config} for KMSClient's `config` shape. * * @throws {@link DependencyTimeoutException} (server fault) *

The system timed out while trying to fulfill the request. You can retry the * request.

* * @throws {@link DisabledException} (client fault) *

The request was rejected because the specified KMS key is not enabled.

* * @throws {@link DryRunOperationException} (client fault) *

The request was rejected because the DryRun parameter was specified.

* * @throws {@link IncorrectKeyException} (client fault) *

The request was rejected because the specified KMS key cannot decrypt the data. The * KeyId in a Decrypt request and the SourceKeyId * in a ReEncrypt request must identify the same KMS key that was used to * encrypt the ciphertext.

* * @throws {@link InvalidCiphertextException} (client fault) *

From the Decrypt or ReEncrypt operation, the request * was rejected because the specified ciphertext, or additional authenticated data incorporated * into the ciphertext, such as the encryption context, is corrupted, missing, or otherwise * invalid.

*

From the ImportKeyMaterial operation, the request was rejected because * KMS could not decrypt the encrypted (wrapped) key material.

* * @throws {@link InvalidGrantTokenException} (client fault) *

The request was rejected because the specified grant token is not valid.

* * @throws {@link InvalidKeyUsageException} (client fault) *

The request was rejected for one of the following reasons:

*
    *
  • *

    The KeyUsage value of the KMS key is incompatible with the API * operation.

    *
    • *
  • *

    The encryption algorithm or signing algorithm specified for the operation is * incompatible with the type of key material in the KMS key (KeySpec).

    *
    • *
*

For encrypting, decrypting, re-encrypting, and generating data keys, the * KeyUsage must be ENCRYPT_DECRYPT. For signing and verifying * messages, the KeyUsage must be SIGN_VERIFY. For generating and * verifying message authentication codes (MACs), the KeyUsage must be * GENERATE_VERIFY_MAC. For deriving key agreement secrets, the * KeyUsage must be KEY_AGREEMENT. To find the KeyUsage * of a KMS key, use the DescribeKey operation.

*

To find the encryption or signing algorithms supported for a particular KMS key, use the * DescribeKey operation.

* * @throws {@link KeyUnavailableException} (server fault) *

The request was rejected because the specified KMS key was not available. You can retry * the request.

* * @throws {@link KMSInternalException} (server fault) *

The request was rejected because an internal exception occurred. The request can be * retried.

* * @throws {@link KMSInvalidStateException} (client fault) *

The request was rejected because the state of the specified resource is not valid for this * request.

*

This exceptions means one of the following:

*
    *
  • *

    The key state of the KMS key is not compatible with the operation.

    *

    To find the key state, use the DescribeKey operation. For more * information about which key states are compatible with each KMS operation, see * Key states of KMS keys in the * Key Management Service Developer Guide * .

    *
    • *
  • *

    For cryptographic operations on KMS keys in custom key stores, this exception * represents a general failure with many possible causes. To identify the cause, see the * error message that accompanies the exception.

    *
    • *
* * @throws {@link NotFoundException} (client fault) *

The request was rejected because the specified entity or resource could not be * found.

* * @throws {@link KMSServiceException} *

Base exception class for all service exceptions from KMS service.

* * * @example To reencrypt data * ```javascript * // The following example reencrypts data with the specified KMS key. * const input = { * CiphertextBlob: "", * DestinationKeyId: "0987dcba-09fe-87dc-65ba-ab0987654321" * }; * const command = new ReEncryptCommand(input); * const response = await client.send(command); * /* response is * { * CiphertextBlob: "", * DestinationEncryptionAlgorithm: "SYMMETRIC_DEFAULT", * DestinationKeyMaterialId: "0b7fd7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6", * KeyId: "arn:aws:kms:us-east-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321", * SourceEncryptionAlgorithm: "SYMMETRIC_DEFAULT", * SourceKeyId: "arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", * SourceKeyMaterialId: "1c6be7ddbac6eef27907413567cad8c810e2883dc8a7534067a82ee1142fc1e6" * } * *\/ * ``` * * @public */ export declare class ReEncryptCommand extends ReEncryptCommand_base { /** @internal type navigation helper, not in runtime. */ protected static __types: { api: { input: ReEncryptRequest; output: ReEncryptResponse; }; sdk: { input: ReEncryptCommandInput; output: ReEncryptCommandOutput; }; }; }