feat(client-payment-cryptography): The service adds support for transferring AES-256 and other keys between the service and other service providers and HSMs. This feature uses ECDH to derive a one-time key transport key to enable these secure key exchanges.

awstools · awstools · commit 06a1cb57e502 · 2025-03-28T18:16:14.000Z
diff --git a/clients/client-payment-cryptography/src/commands/CreateKeyCommand.ts b/clients/client-payment-cryptography/src/commands/CreateKeyCommand.ts
@@ -90,6 +90,7 @@ export interface CreateKeyCommandOutput extends CreateKeyOutput, __MetadataBeare
  *       Value: "STRING_VALUE", // required
  *     },
  *   ],
+ *   DeriveKeyUsage: "STRING_VALUE",
  * };
  * const command = new CreateKeyCommand(input);
  * const response = await client.send(command);
@@ -123,6 +124,7 @@ export interface CreateKeyCommandOutput extends CreateKeyOutput, __MetadataBeare
  * //     UsageStopTimestamp: new Date("TIMESTAMP"),
  * //     DeletePendingTimestamp: new Date("TIMESTAMP"),
  * //     DeleteTimestamp: new Date("TIMESTAMP"),
+ * //     DeriveKeyUsage: "STRING_VALUE",
  * //   },
  * // };
  *
diff --git a/clients/client-payment-cryptography/src/commands/DeleteKeyCommand.ts b/clients/client-payment-cryptography/src/commands/DeleteKeyCommand.ts
@@ -99,6 +99,7 @@ export interface DeleteKeyCommandOutput extends DeleteKeyOutput, __MetadataBeare
  * //     UsageStopTimestamp: new Date("TIMESTAMP"),
  * //     DeletePendingTimestamp: new Date("TIMESTAMP"),
  * //     DeleteTimestamp: new Date("TIMESTAMP"),
+ * //     DeriveKeyUsage: "STRING_VALUE",
  * //   },
  * // };
  *
diff --git a/clients/client-payment-cryptography/src/commands/ExportKeyCommand.ts b/clients/client-payment-cryptography/src/commands/ExportKeyCommand.ts
@@ -197,6 +197,35 @@ export interface ExportKeyCommandOutput extends ExportKeyOutput, __MetadataBeare
  *       WrappingKeyCertificate: "STRING_VALUE", // required
  *       WrappingSpec: "STRING_VALUE",
  *     },
+ *     DiffieHellmanTr31KeyBlock: { // ExportDiffieHellmanTr31KeyBlock
+ *       PrivateKeyIdentifier: "STRING_VALUE", // required
+ *       CertificateAuthorityPublicKeyIdentifier: "STRING_VALUE", // required
+ *       PublicKeyCertificate: "STRING_VALUE", // required
+ *       DeriveKeyAlgorithm: "TDES_2KEY" || "TDES_3KEY" || "AES_128" || "AES_192" || "AES_256", // required
+ *       KeyDerivationFunction: "NIST_SP800" || "ANSI_X963", // required
+ *       KeyDerivationHashAlgorithm: "SHA_256" || "SHA_384" || "SHA_512", // required
+ *       DerivationData: { // DiffieHellmanDerivationData Union: only one key present
+ *         SharedInformation: "STRING_VALUE",
+ *       },
+ *       KeyBlockHeaders: {
+ *         KeyModesOfUse: {
+ *           Encrypt: true || false,
+ *           Decrypt: true || false,
+ *           Wrap: true || false,
+ *           Unwrap: true || false,
+ *           Generate: true || false,
+ *           Sign: true || false,
+ *           Verify: true || false,
+ *           DeriveKey: true || false,
+ *           NoRestrictions: true || false,
+ *         },
+ *         KeyExportability: "STRING_VALUE",
+ *         KeyVersion: "STRING_VALUE",
+ *         OptionalBlocks: {
+ *           "<keys>": "STRING_VALUE",
+ *         },
+ *       },
+ *     },
  *   },
  *   ExportKeyIdentifier: "STRING_VALUE", // required
  *   ExportAttributes: { // ExportAttributes
diff --git a/clients/client-payment-cryptography/src/commands/GetKeyCommand.ts b/clients/client-payment-cryptography/src/commands/GetKeyCommand.ts
@@ -96,6 +96,7 @@ export interface GetKeyCommandOutput extends GetKeyOutput, __MetadataBearer {}
  * //     UsageStopTimestamp: new Date("TIMESTAMP"),
  * //     DeletePendingTimestamp: new Date("TIMESTAMP"),
  * //     DeleteTimestamp: new Date("TIMESTAMP"),
+ * //     DeriveKeyUsage: "STRING_VALUE",
  * //   },
  * // };
  *
diff --git a/clients/client-payment-cryptography/src/commands/ImportKeyCommand.ts b/clients/client-payment-cryptography/src/commands/ImportKeyCommand.ts
@@ -40,10 +40,6 @@ export interface ImportKeyCommandOutput extends ImportKeyOutput, __MetadataBeare
  *          <p>
  *             <b>To import a public root key certificate</b>
  *          </p>
- *          <p>You can also import a <i>root public key certificate</i>, used to sign other public key certificates, or a <i>trusted public key certificate</i> under an already established root public key certificate.</p>
- *          <p>
- *             <b>To import a public root key certificate</b>
- *          </p>
  *          <p>Using this operation, you can import the public component (in PEM cerificate format) of your private root key. You can use the imported public root key certificate for digital signatures, for example signing wrapping key or signing key in TR-34, within your Amazon Web Services Payment Cryptography account.</p>
  *          <p>Set the following parameters:</p>
  *          <ul>
@@ -245,6 +241,18 @@ export interface ImportKeyCommandOutput extends ImportKeyOutput, __MetadataBeare
  *       ImportToken: "STRING_VALUE", // required
  *       WrappingSpec: "STRING_VALUE",
  *     },
+ *     DiffieHellmanTr31KeyBlock: { // ImportDiffieHellmanTr31KeyBlock
+ *       PrivateKeyIdentifier: "STRING_VALUE", // required
+ *       CertificateAuthorityPublicKeyIdentifier: "STRING_VALUE", // required
+ *       PublicKeyCertificate: "STRING_VALUE", // required
+ *       DeriveKeyAlgorithm: "TDES_2KEY" || "TDES_3KEY" || "AES_128" || "AES_192" || "AES_256", // required
+ *       KeyDerivationFunction: "NIST_SP800" || "ANSI_X963", // required
+ *       KeyDerivationHashAlgorithm: "SHA_256" || "SHA_384" || "SHA_512", // required
+ *       DerivationData: { // DiffieHellmanDerivationData Union: only one key present
+ *         SharedInformation: "STRING_VALUE",
+ *       },
+ *       WrappedKeyBlock: "STRING_VALUE", // required
+ *     },
  *   },
  *   KeyCheckValueAlgorithm: "STRING_VALUE",
  *   Enabled: true || false,
@@ -287,6 +295,7 @@ export interface ImportKeyCommandOutput extends ImportKeyOutput, __MetadataBeare
  * //     UsageStopTimestamp: new Date("TIMESTAMP"),
  * //     DeletePendingTimestamp: new Date("TIMESTAMP"),
  * //     DeleteTimestamp: new Date("TIMESTAMP"),
+ * //     DeriveKeyUsage: "STRING_VALUE",
  * //   },
  * // };
  *
diff --git a/clients/client-payment-cryptography/src/commands/RestoreKeyCommand.ts b/clients/client-payment-cryptography/src/commands/RestoreKeyCommand.ts
@@ -98,6 +98,7 @@ export interface RestoreKeyCommandOutput extends RestoreKeyOutput, __MetadataBea
  * //     UsageStopTimestamp: new Date("TIMESTAMP"),
  * //     DeletePendingTimestamp: new Date("TIMESTAMP"),
  * //     DeleteTimestamp: new Date("TIMESTAMP"),
+ * //     DeriveKeyUsage: "STRING_VALUE",
  * //   },
  * // };
  *
diff --git a/clients/client-payment-cryptography/src/commands/StartKeyUsageCommand.ts b/clients/client-payment-cryptography/src/commands/StartKeyUsageCommand.ts
@@ -86,6 +86,7 @@ export interface StartKeyUsageCommandOutput extends StartKeyUsageOutput, __Metad
  * //     UsageStopTimestamp: new Date("TIMESTAMP"),
  * //     DeletePendingTimestamp: new Date("TIMESTAMP"),
  * //     DeleteTimestamp: new Date("TIMESTAMP"),
+ * //     DeriveKeyUsage: "STRING_VALUE",
  * //   },
  * // };
  *
diff --git a/clients/client-payment-cryptography/src/commands/StopKeyUsageCommand.ts b/clients/client-payment-cryptography/src/commands/StopKeyUsageCommand.ts
@@ -92,6 +92,7 @@ export interface StopKeyUsageCommandOutput extends StopKeyUsageOutput, __Metadat
  * //     UsageStopTimestamp: new Date("TIMESTAMP"),
  * //     DeletePendingTimestamp: new Date("TIMESTAMP"),
  * //     DeleteTimestamp: new Date("TIMESTAMP"),
+ * //     DeriveKeyUsage: "STRING_VALUE",
  * //   },
  * // };
  *
diff --git a/clients/client-payment-cryptography/src/models/models_0.ts b/clients/client-payment-cryptography/src/models/models_0.ts
diff --git a/clients/client-payment-cryptography/src/protocols/Aws_json1_0.ts b/clients/client-payment-cryptography/src/protocols/Aws_json1_0.ts
diff --git a/codegen/sdk-codegen/aws-models/payment-cryptography.json b/codegen/sdk-codegen/aws-models/payment-cryptography.json

Original file line number	Diff line number	Diff line change
`@@ -99,6 +99,7 @@ export interface DeleteKeyCommandOutput extends DeleteKeyOutput, __MetadataBeare`
`99`	`99`	`* // UsageStopTimestamp: new Date("TIMESTAMP"),`
`100`	`100`	`* // DeletePendingTimestamp: new Date("TIMESTAMP"),`
`101`	`101`	`* // DeleteTimestamp: new Date("TIMESTAMP"),`
	`102`	`+ * // DeriveKeyUsage: "STRING_VALUE",`
`102`	`103`	`* // },`
`103`	`104`	`* // };`
`104`	`105`	`*`
Original file line number	Diff line number	Diff line change
`@@ -96,6 +96,7 @@ export interface GetKeyCommandOutput extends GetKeyOutput, __MetadataBearer {}`
`96`	`96`	`* // UsageStopTimestamp: new Date("TIMESTAMP"),`
`97`	`97`	`* // DeletePendingTimestamp: new Date("TIMESTAMP"),`
`98`	`98`	`* // DeleteTimestamp: new Date("TIMESTAMP"),`
	`99`	`+ * // DeriveKeyUsage: "STRING_VALUE",`
`99`	`100`	`* // },`
`100`	`101`	`* // };`
`101`	`102`	`*`
Original file line number	Diff line number	Diff line change
`@@ -98,6 +98,7 @@ export interface RestoreKeyCommandOutput extends RestoreKeyOutput, __MetadataBea`
`98`	`98`	`* // UsageStopTimestamp: new Date("TIMESTAMP"),`
`99`	`99`	`* // DeletePendingTimestamp: new Date("TIMESTAMP"),`
`100`	`100`	`* // DeleteTimestamp: new Date("TIMESTAMP"),`
	`101`	`+ * // DeriveKeyUsage: "STRING_VALUE",`
`101`	`102`	`* // },`
`102`	`103`	`* // };`
`103`	`104`	`*`
Original file line number	Diff line number	Diff line change
`@@ -86,6 +86,7 @@ export interface StartKeyUsageCommandOutput extends StartKeyUsageOutput, __Metad`
`86`	`86`	`* // UsageStopTimestamp: new Date("TIMESTAMP"),`
`87`	`87`	`* // DeletePendingTimestamp: new Date("TIMESTAMP"),`
`88`	`88`	`* // DeleteTimestamp: new Date("TIMESTAMP"),`
	`89`	`+ * // DeriveKeyUsage: "STRING_VALUE",`
`89`	`90`	`* // },`
`90`	`91`	`* // };`
`91`	`92`	`*`
Original file line number	Diff line number	Diff line change
`@@ -92,6 +92,7 @@ export interface StopKeyUsageCommandOutput extends StopKeyUsageOutput, __Metadat`
`92`	`92`	`* // UsageStopTimestamp: new Date("TIMESTAMP"),`
`93`	`93`	`* // DeletePendingTimestamp: new Date("TIMESTAMP"),`
`94`	`94`	`* // DeleteTimestamp: new Date("TIMESTAMP"),`
	`95`	`+ * // DeriveKeyUsage: "STRING_VALUE",`
`95`	`96`	`* // },`
`96`	`97`	`* // };`
`97`	`98`	`*`