import type { ExceptionOptionType as __ExceptionOptionType } from "@smithy/core/client"; import { KMSServiceException as __BaseException } from "./KMSServiceException"; /** *

The request was rejected because it attempted to create a resource that already * exists.

* @public */ export declare class AlreadyExistsException extends __BaseException { readonly name: "AlreadyExistsException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The system timed out while trying to fulfill the request. You can retry the * request.

* @public */ export declare class DependencyTimeoutException extends __BaseException { readonly name: "DependencyTimeoutException"; readonly $fault: "server"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because a specified ARN, or an ARN in a key policy, is not * valid.

* @public */ export declare class InvalidArnException extends __BaseException { readonly name: "InvalidArnException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because an internal exception occurred. The request can be * retried.

* @public */ export declare class KMSInternalException extends __BaseException { readonly name: "KMSInternalException"; readonly $fault: "server"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the state of the specified resource is not valid for this * request.

*

This exceptions means one of the following:

*
    *
  • *

    The key state of the KMS key is not compatible with the operation.

    *

    To find the key state, use the DescribeKey operation. For more * information about which key states are compatible with each KMS operation, see * Key states of KMS keys in the * Key Management Service Developer Guide * .

    *
    • *
  • *

    For cryptographic operations on KMS keys in custom key stores, this exception * represents a general failure with many possible causes. To identify the cause, see the * error message that accompanies the exception.

    *
    • *
* @public */ export declare class KMSInvalidStateException extends __BaseException { readonly name: "KMSInvalidStateException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified entity or resource could not be * found.

* @public */ export declare class NotFoundException extends __BaseException { readonly name: "NotFoundException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified CloudHSM cluster is already associated with an * CloudHSM key store in the account, or it shares a backup history with an CloudHSM key store in the * account. Each CloudHSM key store in the account must be associated with a different CloudHSM * cluster.

*

CloudHSM clusters that share a backup history have the same cluster certificate. To view the * cluster certificate of an CloudHSM cluster, use the DescribeClusters operation.

* @public */ export declare class CloudHsmClusterInUseException extends __BaseException { readonly name: "CloudHsmClusterInUseException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the associated CloudHSM cluster did not meet the * configuration requirements for an CloudHSM key store.

*
    *
  • *

    The CloudHSM cluster must be configured with private subnets in at least two different * Availability Zones in the Region.

    *
    • *
  • *

    The security group for * the cluster (cloudhsm-cluster--sg) must * include inbound rules and outbound rules that allow TCP traffic on ports 2223-2225. The * Source in the inbound rules and the Destination in the outbound rules must match the security group * ID. These rules are set by default when you create the CloudHSM cluster. Do not delete or * change them. To get information about a particular security group, use the DescribeSecurityGroups operation.

    *
    • *
  • *

    The CloudHSM cluster must contain at least as many HSMs as the operation requires. To add * HSMs, use the CloudHSM CreateHsm operation.

    *

    For the CreateCustomKeyStore, UpdateCustomKeyStore, and CreateKey operations, the CloudHSM cluster must have at least two * active HSMs, each in a different Availability Zone. For the ConnectCustomKeyStore operation, the CloudHSM must contain at least one active * HSM.

    *
    • *
*

For information about the requirements for an CloudHSM cluster that is associated with an * CloudHSM key store, see Assemble the Prerequisites * in the Key Management Service Developer Guide. For information about creating a private subnet for an CloudHSM cluster, * see Create a Private * Subnet in the CloudHSM User Guide. For information about cluster security groups, see * Configure a Default Security * Group in the * CloudHSM User Guide * .

* @public */ export declare class CloudHsmClusterInvalidConfigurationException extends __BaseException { readonly name: "CloudHsmClusterInvalidConfigurationException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the CloudHSM cluster associated with the CloudHSM key store is * not active. Initialize and activate the cluster and try the command again. For detailed * instructions, see Getting * Started in the CloudHSM User Guide.

* @public */ export declare class CloudHsmClusterNotActiveException extends __BaseException { readonly name: "CloudHsmClusterNotActiveException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because KMS cannot find the CloudHSM cluster with the specified * cluster ID. Retry the request with a different cluster ID.

* @public */ export declare class CloudHsmClusterNotFoundException extends __BaseException { readonly name: "CloudHsmClusterNotFoundException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified CloudHSM cluster has a different cluster * certificate than the original cluster. You cannot use the operation to specify an unrelated * cluster for an CloudHSM key store.

*

Specify an CloudHSM cluster that shares a backup history with the original cluster. This * includes clusters that were created from a backup of the current cluster, and clusters that * were created from the same backup that produced the current cluster.

*

CloudHSM clusters that share a backup history have the same cluster certificate. To view the * cluster certificate of an CloudHSM cluster, use the DescribeClusters operation.

* @public */ export declare class CloudHsmClusterNotRelatedException extends __BaseException { readonly name: "CloudHsmClusterNotRelatedException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because an automatic rotation of this key is currently in * progress or scheduled to begin within the next 20 minutes.

* @public */ export declare class ConflictException extends __BaseException { readonly name: "ConflictException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because of the ConnectionState of the custom key * store. To get the ConnectionState of a custom key store, use the DescribeCustomKeyStores operation.

*

This exception is thrown under the following conditions:

*
    *
  • *

    You requested the ConnectCustomKeyStore operation on a custom key * store with a ConnectionState of DISCONNECTING or * FAILED. This operation is valid for all other ConnectionState * values. To reconnect a custom key store in a FAILED state, disconnect it * (DisconnectCustomKeyStore), then connect it * (ConnectCustomKeyStore).

    *
    • *
  • *

    You requested the CreateKey operation in a custom key store that is * not connected. This operations is valid only when the custom key store * ConnectionState is CONNECTED.

    *
    • *
  • *

    You requested the DisconnectCustomKeyStore operation on a custom key * store with a ConnectionState of DISCONNECTING or * DISCONNECTED. This operation is valid for all other * ConnectionState values.

    *
    • *
  • *

    You requested the UpdateCustomKeyStore or DeleteCustomKeyStore operation on a custom key store that is not * disconnected. UpdateCustomKeyStore can be called on a custom key store in the * CONNECTED state only to update NewCustomKeyStoreName. * For all other properties, the custom key store * ConnectionState must be DISCONNECTED.

    *
    • *
  • *

    You requested the GenerateRandom operation in an CloudHSM key store * that is not connected. This operation is valid only when the CloudHSM key store * ConnectionState is CONNECTED.

    *
    • *
* @public */ export declare class CustomKeyStoreInvalidStateException extends __BaseException { readonly name: "CustomKeyStoreInvalidStateException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because KMS cannot find a custom key store with the specified * key store name or ID.

* @public */ export declare class CustomKeyStoreNotFoundException extends __BaseException { readonly name: "CustomKeyStoreNotFoundException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified alias name is not valid.

* @public */ export declare class InvalidAliasNameException extends __BaseException { readonly name: "InvalidAliasNameException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because a length constraint or quota was exceeded. For more * information, see Quotas in * the Key Management Service Developer Guide.

* @public */ export declare class LimitExceededException extends __BaseException { readonly name: "LimitExceededException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified custom key store name is already assigned * to another custom key store in the account. Try again with a custom key store name that is * unique in the account.

* @public */ export declare class CustomKeyStoreNameInUseException extends __BaseException { readonly name: "CustomKeyStoreNameInUseException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the trust anchor certificate in the request to create an * CloudHSM key store is not the trust anchor certificate for the specified CloudHSM cluster.

*

When you initialize the CloudHSM cluster, you create the trust anchor certificate and save it * in the customerCA.crt file.

* @public */ export declare class IncorrectTrustAnchorException extends __BaseException { readonly name: "IncorrectTrustAnchorException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the proxy credentials failed to authenticate to the * specified external key store proxy. The specified external key store proxy rejected a status * request from KMS due to invalid credentials. This can indicate an error in the credentials * or in the identification of the external key store proxy.

* @public */ export declare class XksProxyIncorrectAuthenticationCredentialException extends __BaseException { readonly name: "XksProxyIncorrectAuthenticationCredentialException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the external key store proxy is not configured correctly. * To identify the cause, see the error message that accompanies the exception.

* @public */ export declare class XksProxyInvalidConfigurationException extends __BaseException { readonly name: "XksProxyInvalidConfigurationException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

*

KMS cannot interpret the response it received from the external key store proxy. The * problem might be a poorly constructed response, but it could also be a transient network * issue. If you see this error repeatedly, report it to the proxy vendor.

* @public */ export declare class XksProxyInvalidResponseException extends __BaseException { readonly name: "XksProxyInvalidResponseException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the XksProxyUriEndpoint is already * associated with another external key store in this Amazon Web Services Region. To identify the cause, see * the error message that accompanies the exception.

* @public */ export declare class XksProxyUriEndpointInUseException extends __BaseException { readonly name: "XksProxyUriEndpointInUseException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the concatenation of the XksProxyUriEndpoint * and XksProxyUriPath is already associated with another external key store in this * Amazon Web Services Region. Each external key store in a Region must use a unique external key store proxy * API address.

* @public */ export declare class XksProxyUriInUseException extends __BaseException { readonly name: "XksProxyUriInUseException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

KMS was unable to reach the specified XksProxyUriPath. The path must be * reachable before you create the external key store or update its settings.

*

This exception is also thrown when the external key store proxy response to a * GetHealthStatus request indicates that all external key manager instances are * unavailable.

* @public */ export declare class XksProxyUriUnreachableException extends __BaseException { readonly name: "XksProxyUriUnreachableException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified Amazon VPC endpoint service is already * associated with another external key store in this Amazon Web Services Region. Each external key store in a * Region must use a different Amazon VPC endpoint service.

* @public */ export declare class XksProxyVpcEndpointServiceInUseException extends __BaseException { readonly name: "XksProxyVpcEndpointServiceInUseException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the Amazon VPC endpoint service configuration does not fulfill * the requirements for an external key store. To identify the cause, see the error message that * accompanies the exception and review the * requirements for Amazon VPC endpoint service connectivity for an external key * store.

* @public */ export declare class XksProxyVpcEndpointServiceInvalidConfigurationException extends __BaseException { readonly name: "XksProxyVpcEndpointServiceInvalidConfigurationException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because KMS could not find the specified VPC endpoint service. * Use DescribeCustomKeyStores to verify the VPC endpoint service name for the * external key store. Also, confirm that the Allow principals list for the VPC * endpoint service includes the KMS service principal for the Region, such as * cks.kms.us-east-1.amazonaws.com.

* @public */ export declare class XksProxyVpcEndpointServiceNotFoundException extends __BaseException { readonly name: "XksProxyVpcEndpointServiceNotFoundException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified KMS key is not enabled.

* @public */ export declare class DisabledException extends __BaseException { readonly name: "DisabledException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the DryRun parameter was specified.

* @public */ export declare class DryRunOperationException extends __BaseException { readonly name: "DryRunOperationException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified grant token is not valid.

* @public */ export declare class InvalidGrantTokenException extends __BaseException { readonly name: "InvalidGrantTokenException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified policy is not syntactically or semantically * correct.

* @public */ export declare class MalformedPolicyDocumentException extends __BaseException { readonly name: "MalformedPolicyDocumentException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because one or more tags are not valid.

* @public */ export declare class TagException extends __BaseException { readonly name: "TagException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because a specified parameter is not supported or a specified * resource is not valid for this operation.

* @public */ export declare class UnsupportedOperationException extends __BaseException { readonly name: "UnsupportedOperationException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the (XksKeyId) is already associated with * another KMS key in this external key store. Each KMS key in an external key store must be * associated with a different external key.

* @public */ export declare class XksKeyAlreadyInUseException extends __BaseException { readonly name: "XksKeyAlreadyInUseException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the external key specified by the XksKeyId * parameter did not meet the configuration requirements for an external key store.

*

The external key must be an AES-256 symmetric key that is enabled and performs encryption * and decryption.

* @public */ export declare class XksKeyInvalidConfigurationException extends __BaseException { readonly name: "XksKeyInvalidConfigurationException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the external key store proxy could not find the external * key. This exception is thrown when the value of the XksKeyId parameter doesn't * identify a key in the external key manager associated with the external key proxy.

*

Verify that the XksKeyId represents an existing key in the external key * manager. Use the key identifier that the external key store proxy uses to identify the key. * For details, see the documentation provided with your external key store proxy or key * manager.

* @public */ export declare class XksKeyNotFoundException extends __BaseException { readonly name: "XksKeyNotFoundException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the custom key store contains KMS keys. After verifying * that you do not need to use the KMS keys, use the ScheduleKeyDeletion * operation to delete the KMS keys. After they are deleted, you can delete the custom key * store.

* @public */ export declare class CustomKeyStoreHasCMKsException extends __BaseException { readonly name: "CustomKeyStoreHasCMKsException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified KMS key cannot decrypt the data. The * KeyId in a Decrypt request and the SourceKeyId * in a ReEncrypt request must identify the same KMS key that was used to * encrypt the ciphertext.

* @public */ export declare class IncorrectKeyException extends __BaseException { readonly name: "IncorrectKeyException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

From the Decrypt or ReEncrypt operation, the request * was rejected because the specified ciphertext, or additional authenticated data incorporated * into the ciphertext, such as the encryption context, is corrupted, missing, or otherwise * invalid.

*

From the ImportKeyMaterial operation, the request was rejected because * KMS could not decrypt the encrypted (wrapped) key material.

* @public */ export declare class InvalidCiphertextException extends __BaseException { readonly name: "InvalidCiphertextException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected for one of the following reasons:

*
    *
  • *

    The KeyUsage value of the KMS key is incompatible with the API * operation.

    *
    • *
  • *

    The encryption algorithm or signing algorithm specified for the operation is * incompatible with the type of key material in the KMS key (KeySpec).

    *
    • *
*

For encrypting, decrypting, re-encrypting, and generating data keys, the * KeyUsage must be ENCRYPT_DECRYPT. For signing and verifying * messages, the KeyUsage must be SIGN_VERIFY. For generating and * verifying message authentication codes (MACs), the KeyUsage must be * GENERATE_VERIFY_MAC. For deriving key agreement secrets, the * KeyUsage must be KEY_AGREEMENT. To find the KeyUsage * of a KMS key, use the DescribeKey operation.

*

To find the encryption or signing algorithms supported for a particular KMS key, use the * DescribeKey operation.

* @public */ export declare class InvalidKeyUsageException extends __BaseException { readonly name: "InvalidKeyUsageException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified KMS key was not available. You can retry * the request.

* @public */ export declare class KeyUnavailableException extends __BaseException { readonly name: "KeyUnavailableException"; readonly $fault: "server"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the marker that specifies where pagination should next * begin is not valid.

* @public */ export declare class InvalidMarkerException extends __BaseException { readonly name: "InvalidMarkerException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified import token is expired. Use GetParametersForImport to get a new import token and public key, use the new * public key to encrypt the key material, and then try the request again.

* @public */ export declare class ExpiredImportTokenException extends __BaseException { readonly name: "ExpiredImportTokenException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the key material in the request is, expired, invalid, or * does not meet expectations. For example, it is not the same key material that was previously * imported or KMS expected new key material but the key material being imported is already * associated with the KMS key.

* @public */ export declare class IncorrectKeyMaterialException extends __BaseException { readonly name: "IncorrectKeyMaterialException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the provided import token is invalid or is associated * with a different KMS key.

* @public */ export declare class InvalidImportTokenException extends __BaseException { readonly name: "InvalidImportTokenException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the specified GrantId is not valid.

* @public */ export declare class InvalidGrantIdException extends __BaseException { readonly name: "InvalidGrantIdException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the HMAC verification failed. HMAC verification fails * when the HMAC computed by using the specified message, HMAC KMS key, and MAC algorithm does * not match the HMAC specified in the request.

* @public */ export declare class KMSInvalidMacException extends __BaseException { readonly name: "KMSInvalidMacException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); } /** *

The request was rejected because the signature verification failed. Signature verification * fails when it cannot confirm that signature was produced by signing the specified message with * the specified KMS key and signing algorithm.

* @public */ export declare class KMSInvalidSignatureException extends __BaseException { readonly name: "KMSInvalidSignatureException"; readonly $fault: "client"; /** * @internal */ constructor(opts: __ExceptionOptionType); }