aws_sdk_kms/operation/decapsulate/builders.rs
1// Code generated by software.amazon.smithy.rust.codegen.smithy-rs. DO NOT EDIT.
2pub use crate::operation::decapsulate::_decapsulate_input::DecapsulateInputBuilder;
3
4pub use crate::operation::decapsulate::_decapsulate_output::DecapsulateOutputBuilder;
5
6impl crate::operation::decapsulate::builders::DecapsulateInputBuilder {
7 /// Sends a request with this input using the given client.
8 pub async fn send_with(
9 self,
10 client: &crate::Client,
11 ) -> ::std::result::Result<
12 crate::operation::decapsulate::DecapsulateOutput,
13 ::aws_smithy_runtime_api::client::result::SdkError<
14 crate::operation::decapsulate::DecapsulateError,
15 ::aws_smithy_runtime_api::client::orchestrator::HttpResponse,
16 >,
17 > {
18 let mut fluent_builder = client.decapsulate();
19 fluent_builder.inner = self;
20 fluent_builder.send().await
21 }
22}
23/// Fluent builder constructing a request to `Decapsulate`.
24///
25/// <p>Recovers the shared secret that was encapsulated with the public key of an ML-KEM KMS key. Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), specified in <a href="https://csrc.nist.gov/pubs/fips/203/final">FIPS 203</a> on the NIST website, is a post-quantum algorithm for establishing a shared secret between two parties. For an example of how two parties establish a shared secret over an insecure channel using ML-KEM, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/pqkeys.html#mlkem">ML-KEM keys in KMS</a> in the <i>Key Management Service Developer Guide</i>.</p>
26/// <p>The Decapsulate operation is not available in China Regions.</p>
27/// <p><code>Decapsulate</code> returns the shared secret as a 32-byte value. You can use it directly as key material, or run it through a key derivation function to derive multiple keys and nonces.</p><important>
28/// <p><code>Decapsulate</code> returns an <code>InvalidCiphertextException</code> when the length of the <code>SharedSecretCiphertextBlob</code> is inconsistent with the ML-KEM key spec. In all other cases, <code>Decapsulate</code> returns a 32-byte pseudo-random value. This is true even when the <code>SharedSecretCiphertextBlob</code> was created using a different ML-KEM key or altered from its original value. This behavior is a security feature called <i>implicit rejection</i> that helps protect against chosen-ciphertext attacks.</p>
29/// <p>Because a response does not indicate that the ciphertext and key are valid, confirm the two parties derived the same shared secret before using it.</p>
30/// </important>
31/// <p>The KMS key that you use for this operation must be in a compatible key state. For details, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i>Key Management Service Developer Guide</i>.</p>
32/// <p><b>Cross-account use</b>: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the <code>KeyId</code> parameter.</p>
33/// <p><b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:Decapsulate</a> (key policy)</p>
34/// <p><b>Related operations:</b></p>
35/// <ul>
36/// <li>
37/// <p><code>Encapsulate</code></p></li>
38/// <li>
39/// <p><code>CreateKey</code></p></li>
40/// <li>
41/// <p><code>GetPublicKey</code></p></li>
42/// <li>
43/// <p><code>DescribeKey</code></p></li>
44/// </ul>
45/// <p><b>Eventual consistency</b>: The KMS API follows an eventual consistency model. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency">KMS eventual consistency</a>.</p>
46#[derive(::std::clone::Clone, ::std::fmt::Debug)]
47pub struct DecapsulateFluentBuilder {
48 handle: ::std::sync::Arc<crate::client::Handle>,
49 inner: crate::operation::decapsulate::builders::DecapsulateInputBuilder,
50 config_override: ::std::option::Option<crate::config::Builder>,
51}
52impl
53 crate::client::customize::internal::CustomizableSend<
54 crate::operation::decapsulate::DecapsulateOutput,
55 crate::operation::decapsulate::DecapsulateError,
56 > for DecapsulateFluentBuilder
57{
58 fn send(
59 self,
60 config_override: crate::config::Builder,
61 ) -> crate::client::customize::internal::BoxFuture<
62 crate::client::customize::internal::SendResult<
63 crate::operation::decapsulate::DecapsulateOutput,
64 crate::operation::decapsulate::DecapsulateError,
65 >,
66 > {
67 ::std::boxed::Box::pin(async move { self.config_override(config_override).send().await })
68 }
69}
70impl DecapsulateFluentBuilder {
71 /// Creates a new `DecapsulateFluentBuilder`.
72 pub(crate) fn new(handle: ::std::sync::Arc<crate::client::Handle>) -> Self {
73 Self {
74 handle,
75 inner: ::std::default::Default::default(),
76 config_override: ::std::option::Option::None,
77 }
78 }
79 /// Access the Decapsulate as a reference.
80 pub fn as_input(&self) -> &crate::operation::decapsulate::builders::DecapsulateInputBuilder {
81 &self.inner
82 }
83 /// Sends the request and returns the response.
84 ///
85 /// If an error occurs, an `SdkError` will be returned with additional details that
86 /// can be matched against.
87 ///
88 /// By default, any retryable failures will be retried twice. Retry behavior
89 /// is configurable with the [RetryConfig](aws_smithy_types::retry::RetryConfig), which can be
90 /// set when configuring the client.
91 pub async fn send(
92 self,
93 ) -> ::std::result::Result<
94 crate::operation::decapsulate::DecapsulateOutput,
95 ::aws_smithy_runtime_api::client::result::SdkError<
96 crate::operation::decapsulate::DecapsulateError,
97 ::aws_smithy_runtime_api::client::orchestrator::HttpResponse,
98 >,
99 > {
100 let input = self
101 .inner
102 .build()
103 .map_err(::aws_smithy_runtime_api::client::result::SdkError::construction_failure)?;
104 let runtime_plugins = crate::operation::decapsulate::Decapsulate::operation_runtime_plugins(
105 self.handle.runtime_plugins.clone(),
106 &self.handle.conf,
107 self.config_override,
108 );
109 crate::operation::decapsulate::Decapsulate::orchestrate(&runtime_plugins, input).await
110 }
111
112 /// Consumes this builder, creating a customizable operation that can be modified before being sent.
113 pub fn customize(
114 self,
115 ) -> crate::client::customize::CustomizableOperation<
116 crate::operation::decapsulate::DecapsulateOutput,
117 crate::operation::decapsulate::DecapsulateError,
118 Self,
119 > {
120 crate::client::customize::CustomizableOperation::new(self)
121 }
122 pub(crate) fn config_override(mut self, config_override: impl ::std::convert::Into<crate::config::Builder>) -> Self {
123 self.set_config_override(::std::option::Option::Some(config_override.into()));
124 self
125 }
126
127 pub(crate) fn set_config_override(&mut self, config_override: ::std::option::Option<crate::config::Builder>) -> &mut Self {
128 self.config_override = config_override;
129 self
130 }
131 /// <p>Identifies the asymmetric ML-KEM KMS key whose public key was used to produce the encapsulated shared secret. KMS uses the private key in the specified key pair to decapsulate the shared secret.</p>
132 /// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
133 /// <p>For example:</p>
134 /// <ul>
135 /// <li>
136 /// <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code></p></li>
137 /// <li>
138 /// <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code></p></li>
139 /// <li>
140 /// <p>Alias name: <code>alias/ExampleAlias</code></p></li>
141 /// <li>
142 /// <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code></p></li>
143 /// </ul>
144 /// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
145 pub fn key_id(mut self, input: impl ::std::convert::Into<::std::string::String>) -> Self {
146 self.inner = self.inner.key_id(input.into());
147 self
148 }
149 /// <p>Identifies the asymmetric ML-KEM KMS key whose public key was used to produce the encapsulated shared secret. KMS uses the private key in the specified key pair to decapsulate the shared secret.</p>
150 /// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
151 /// <p>For example:</p>
152 /// <ul>
153 /// <li>
154 /// <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code></p></li>
155 /// <li>
156 /// <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code></p></li>
157 /// <li>
158 /// <p>Alias name: <code>alias/ExampleAlias</code></p></li>
159 /// <li>
160 /// <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code></p></li>
161 /// </ul>
162 /// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
163 pub fn set_key_id(mut self, input: ::std::option::Option<::std::string::String>) -> Self {
164 self.inner = self.inner.set_key_id(input);
165 self
166 }
167 /// <p>Identifies the asymmetric ML-KEM KMS key whose public key was used to produce the encapsulated shared secret. KMS uses the private key in the specified key pair to decapsulate the shared secret.</p>
168 /// <p>To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with <code>"alias/"</code>. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.</p>
169 /// <p>For example:</p>
170 /// <ul>
171 /// <li>
172 /// <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code></p></li>
173 /// <li>
174 /// <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code></p></li>
175 /// <li>
176 /// <p>Alias name: <code>alias/ExampleAlias</code></p></li>
177 /// <li>
178 /// <p>Alias ARN: <code>arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias</code></p></li>
179 /// </ul>
180 /// <p>To get the key ID and key ARN for a KMS key, use <code>ListKeys</code> or <code>DescribeKey</code>. To get the alias name and alias ARN, use <code>ListAliases</code>.</p>
181 pub fn get_key_id(&self) -> &::std::option::Option<::std::string::String> {
182 self.inner.get_key_id()
183 }
184 /// <p>The encapsulated (ciphertext) form of the shared secret to recover. This is the <code>SharedSecretCiphertextBlob</code> value that the <code>Encapsulate</code> operation returns. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.</p>
185 pub fn shared_secret_ciphertext_blob(mut self, input: ::aws_smithy_types::Blob) -> Self {
186 self.inner = self.inner.shared_secret_ciphertext_blob(input);
187 self
188 }
189 /// <p>The encapsulated (ciphertext) form of the shared secret to recover. This is the <code>SharedSecretCiphertextBlob</code> value that the <code>Encapsulate</code> operation returns. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.</p>
190 pub fn set_shared_secret_ciphertext_blob(mut self, input: ::std::option::Option<::aws_smithy_types::Blob>) -> Self {
191 self.inner = self.inner.set_shared_secret_ciphertext_blob(input);
192 self
193 }
194 /// <p>The encapsulated (ciphertext) form of the shared secret to recover. This is the <code>SharedSecretCiphertextBlob</code> value that the <code>Encapsulate</code> operation returns. When you use the HTTP API or the Amazon Web Services CLI, the value is Base64-encoded. Otherwise, it is not Base64-encoded.</p>
195 pub fn get_shared_secret_ciphertext_blob(&self) -> &::std::option::Option<::aws_smithy_types::Blob> {
196 self.inner.get_shared_secret_ciphertext_blob()
197 }
198 /// <p>Specifies the key encapsulation algorithm used to recover the shared secret. The only valid value is <code>ML_KEM</code>.</p>
199 pub fn encapsulation_algorithm(mut self, input: crate::types::EncapsulationAlgorithmSpec) -> Self {
200 self.inner = self.inner.encapsulation_algorithm(input);
201 self
202 }
203 /// <p>Specifies the key encapsulation algorithm used to recover the shared secret. The only valid value is <code>ML_KEM</code>.</p>
204 pub fn set_encapsulation_algorithm(mut self, input: ::std::option::Option<crate::types::EncapsulationAlgorithmSpec>) -> Self {
205 self.inner = self.inner.set_encapsulation_algorithm(input);
206 self
207 }
208 /// <p>Specifies the key encapsulation algorithm used to recover the shared secret. The only valid value is <code>ML_KEM</code>.</p>
209 pub fn get_encapsulation_algorithm(&self) -> &::std::option::Option<crate::types::EncapsulationAlgorithmSpec> {
210 self.inner.get_encapsulation_algorithm()
211 }
212 ///
213 /// Appends an item to `GrantTokens`.
214 ///
215 /// To override the contents of this collection use [`set_grant_tokens`](Self::set_grant_tokens).
216 ///
217 /// <p>A list of grant tokens.</p>
218 /// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
219 pub fn grant_tokens(mut self, input: impl ::std::convert::Into<::std::string::String>) -> Self {
220 self.inner = self.inner.grant_tokens(input.into());
221 self
222 }
223 /// <p>A list of grant tokens.</p>
224 /// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
225 pub fn set_grant_tokens(mut self, input: ::std::option::Option<::std::vec::Vec<::std::string::String>>) -> Self {
226 self.inner = self.inner.set_grant_tokens(input);
227 self
228 }
229 /// <p>A list of grant tokens.</p>
230 /// <p>Use a grant token when your permission to call this operation comes from a new grant that has not yet achieved <i>eventual consistency</i>. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#grant_token">Grant token</a> and <a href="https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html">Using a grant token</a> in the <i>Key Management Service Developer Guide</i>.</p>
231 pub fn get_grant_tokens(&self) -> &::std::option::Option<::std::vec::Vec<::std::string::String>> {
232 self.inner.get_grant_tokens()
233 }
234 /// <p>Checks if your request will succeed. <code>DryRun</code> is an optional parameter.</p>
235 /// <p>To learn more about how to use this parameter, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html">Testing your permissions</a> in the <i>Key Management Service Developer Guide</i>.</p>
236 pub fn dry_run(mut self, input: bool) -> Self {
237 self.inner = self.inner.dry_run(input);
238 self
239 }
240 /// <p>Checks if your request will succeed. <code>DryRun</code> is an optional parameter.</p>
241 /// <p>To learn more about how to use this parameter, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html">Testing your permissions</a> in the <i>Key Management Service Developer Guide</i>.</p>
242 pub fn set_dry_run(mut self, input: ::std::option::Option<bool>) -> Self {
243 self.inner = self.inner.set_dry_run(input);
244 self
245 }
246 /// <p>Checks if your request will succeed. <code>DryRun</code> is an optional parameter.</p>
247 /// <p>To learn more about how to use this parameter, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/testing-permissions.html">Testing your permissions</a> in the <i>Key Management Service Developer Guide</i>.</p>
248 pub fn get_dry_run(&self) -> &::std::option::Option<bool> {
249 self.inner.get_dry_run()
250 }
251}