aws_sdk_kms/client/
decapsulate.rs

1// Code generated by software.amazon.smithy.rust.codegen.smithy-rs. DO NOT EDIT.
2impl super::Client {
3    /// Constructs a fluent builder for the [`Decapsulate`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder) operation.
4    ///
5    /// - The fluent builder is configurable:
6    ///   - [`key_id(impl Into<String>)`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder::key_id) / [`set_key_id(Option<String>)`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder::set_key_id):<br>required: **true**<br><p>Identifies the asymmetric ML-KEM KMS key whose public key was used to produce the encapsulated shared secret. KMS uses the private key in the specified key pair to decapsulate the shared secret.</p> <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p> <p>For example:</p> <ul>  <li>   <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code></p></li>  <li>   <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code></p></li>  <li>   <p>Alias name: <code>alias/ExampleAlias</code></p></li>  <li>   <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code></p></li> </ul> <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p><br>
7    ///   - [`shared_secret_ciphertext_blob(Blob)`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder::shared_secret_ciphertext_blob) / [`set_shared_secret_ciphertext_blob(Option<Blob>)`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder::set_shared_secret_ciphertext_blob):<br>required: **true**<br><p>The encapsulated (ciphertext) form of the shared secret to recover. This is the <code>SharedSecretCiphertextBlob</code> value that the <code>Encapsulate</code> operation returns. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.</p><br>
8    ///   - [`encapsulation_algorithm(EncapsulationAlgorithmSpec)`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder::encapsulation_algorithm) / [`set_encapsulation_algorithm(Option<EncapsulationAlgorithmSpec>)`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder::set_encapsulation_algorithm):<br>required: **true**<br><p>Specifies the key encapsulation algorithm used to recover the shared secret. The only valid value is <code>ML_KEM</code>.</p><br>
9    ///   - [`grant_tokens(impl Into<String>)`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder::grant_tokens) / [`set_grant_tokens(Option<Vec::<String>>)`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder::set_grant_tokens):<br>required: **false**<br><p>A list of grant tokens.</p> <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p><br>
10    ///   - [`dry_run(bool)`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder::dry_run) / [`set_dry_run(Option<bool>)`](crate::operation::decapsulate::builders::DecapsulateFluentBuilder::set_dry_run):<br>required: **false**<br><p>Checks if your request will succeed. <code>DryRun</code> is an optional parameter.</p> <p>To learn more about how to use this parameter, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html">Testing your permissions</a> in the <i>Key Management Service Developer Guide</i>.</p><br>
11    /// - On success, responds with [`DecapsulateOutput`](crate::operation::decapsulate::DecapsulateOutput) with field(s):
12    ///   - [`key_id(Option<String>)`](crate::operation::decapsulate::DecapsulateOutput::key_id): <p>The identifier of the ML-KEM KMS key used to decapsulate the shared secret.</p>
13    ///   - [`shared_secret(Option<Blob>)`](crate::operation::decapsulate::DecapsulateOutput::shared_secret): <p>The plaintext shared secret recovered from the encapsulated form. It is a 32-byte value that matches the shared secret held by the encapsulating party. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.</p>
14    ///   - [`encapsulation_algorithm(Option<EncapsulationAlgorithmSpec>)`](crate::operation::decapsulate::DecapsulateOutput::encapsulation_algorithm): <p>The key encapsulation algorithm used to recover the shared secret.</p>
15    /// - On failure, responds with [`SdkError<DecapsulateError>`](crate::operation::decapsulate::DecapsulateError)
16    pub fn decapsulate(&self) -> crate::operation::decapsulate::builders::DecapsulateFluentBuilder {
17        crate::operation::decapsulate::builders::DecapsulateFluentBuilder::new(self.handle.clone())
18    }
19}
aws_sdk_kms/client/decapsulate.rs

aws_sdk_kms/client/
decapsulate.rs
