aws-iam-policy-types/dist/esm/actions/kms.d.ts

Autogenerated Typescript types for AWS IAM Policy and enums for all policy actions

/**
 * All IAM policy actions for AWS Key Management Service (KMS)
 *
 * Extracted by `aws-iam-policy` from
 * https://docs.aws.amazon.com/service-authorization/latest/reference/list_awskeymanagementservice.html
 *
 * 2025-02-24T21:48:30.666Z
 */
export declare enum AwsKmsActions {
    /**
     * Controls permission to cancel the scheduled deletion of an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html
     */
    CancelKeyDeletion = "kms:CancelKeyDeletion",
    /**
     * Controls permission to connect or reconnect a custom key store to its associate
     * d AWS CloudHSM cluster or external key manager outside of AWS
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ConnectCustomKeyStore.html
     */
    ConnectCustomKeyStore = "kms:ConnectCustomKeyStore",
    /**
     * Controls permission to create an alias for an AWS KMS key. Aliases are optional
     * friendly names that you can associate with KMS keys
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html
     */
    CreateAlias = "kms:CreateAlias",
    /**
     * Controls permission to create a custom key store that is backed by an AWS Cloud
     * HSM cluster or an external key manager outside of AWS
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateCustomKeyStore.html
     */
    CreateCustomKeyStore = "kms:CreateCustomKeyStore",
    /**
     * Controls permission to add a grant to an AWS KMS key. You can use grants to add
     * permissions without changing the key policy or IAM policy
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html
     */
    CreateGrant = "kms:CreateGrant",
    /**
     * Controls permission to create an AWS KMS key that can be used to protect data k
     * eys and other sensitive information
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html
     */
    CreateKey = "kms:CreateKey",
    /**
     * Controls permission to decrypt ciphertext that was encrypted under an AWS KMS k
     * ey
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html
     */
    Decrypt = "kms:Decrypt",
    /**
     * Controls permission to delete an alias. Aliases are optional friendly names tha
     * t you can associate with AWS KMS keys
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html
     */
    DeleteAlias = "kms:DeleteAlias",
    /**
     * Controls permission to delete a custom key store
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteCustomKeyStore.html
     */
    DeleteCustomKeyStore = "kms:DeleteCustomKeyStore",
    /**
     * Controls permission to delete cryptographic material that you imported into an
     * AWS KMS key. This action makes the key unusable
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html
     */
    DeleteImportedKeyMaterial = "kms:DeleteImportedKeyMaterial",
    /**
     * Controls permission to use the specified AWS KMS key to derive shared secrets
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_DeriveSharedSecret.html
     */
    DeriveSharedSecret = "kms:DeriveSharedSecret",
    /**
     * Controls permission to view detailed information about custom key stores in the
     * account and region
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeCustomKeyStores.html
     */
    DescribeCustomKeyStores = "kms:DescribeCustomKeyStores",
    /**
     * Controls permission to view detailed information about an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html
     */
    DescribeKey = "kms:DescribeKey",
    /**
     * Controls permission to disable an AWS KMS key, which prevents it from being use
     * d in cryptographic operations
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html
     */
    DisableKey = "kms:DisableKey",
    /**
     * Controls permission to disable automatic rotation of a customer managed AWS KMS
     * key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html
     */
    DisableKeyRotation = "kms:DisableKeyRotation",
    /**
     * Controls permission to disconnect the custom key store from its associated AWS
     * CloudHSM cluster or external key manager outside of AWS
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_DisconnectCustomKeyStore.html
     */
    DisconnectCustomKeyStore = "kms:DisconnectCustomKeyStore",
    /**
     * Controls permission to change the state of an AWS KMS key to enabled. This allo
     * ws the KMS key to be used in cryptographic operations
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html
     */
    EnableKey = "kms:EnableKey",
    /**
     * Controls permission to enable automatic rotation of the cryptographic material
     * in an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html
     */
    EnableKeyRotation = "kms:EnableKeyRotation",
    /**
     * Controls permission to use the specified AWS KMS key to encrypt data and data k
     * eys
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html
     */
    Encrypt = "kms:Encrypt",
    /**
     * Controls permission to use the AWS KMS key to generate data keys. You can use t
     * he data keys to encrypt data outside of AWS KMS
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html
     */
    GenerateDataKey = "kms:GenerateDataKey",
    /**
     * Controls permission to use the AWS KMS key to generate data key pairs
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html
     */
    GenerateDataKeyPair = "kms:GenerateDataKeyPair",
    /**
     * Controls permission to use the AWS KMS key to generate data key pairs. Unlike t
     * he GenerateDataKeyPair operation, this operation returns an encrypted private k
     * ey without a plaintext copy
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html
     */
    GenerateDataKeyPairWithoutPlaintext = "kms:GenerateDataKeyPairWithoutPlaintext",
    /**
     * Controls permission to use the AWS KMS key to generate a data key. Unlike the G
     * enerateDataKey operation, this operation returns an encrypted data key without
     * a plaintext version of the data key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html
     */
    GenerateDataKeyWithoutPlaintext = "kms:GenerateDataKeyWithoutPlaintext",
    /**
     * Controls permission to use the AWS KMS key to generate message authentication c
     * odes
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateMac.html
     */
    GenerateMac = "kms:GenerateMac",
    /**
     * Controls permission to get a cryptographically secure random byte string from A
     * WS KMS
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateRandom.html
     */
    GenerateRandom = "kms:GenerateRandom",
    /**
     * Controls permission to view the key policy for the specified AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html
     */
    GetKeyPolicy = "kms:GetKeyPolicy",
    /**
     * Controls permission to view the key rotation status for an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html
     */
    GetKeyRotationStatus = "kms:GetKeyRotationStatus",
    /**
     * Controls permission to get data that is required to import cryptographic materi
     * al into a customer managed key, including a public key and import token
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html
     */
    GetParametersForImport = "kms:GetParametersForImport",
    /**
     * Controls permission to download the public key of an asymmetric AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html
     */
    GetPublicKey = "kms:GetPublicKey",
    /**
     * Controls permission to import cryptographic material into an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html
     */
    ImportKeyMaterial = "kms:ImportKeyMaterial",
    /**
     * Controls permission to view the aliases that are defined in the account. Aliase
     * s are optional friendly names that you can associate with AWS KMS keys
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html
     */
    ListAliases = "kms:ListAliases",
    /**
     * Controls permission to view all grants for an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.html
     */
    ListGrants = "kms:ListGrants",
    /**
     * Controls permission to view the names of key policies for an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.html
     */
    ListKeyPolicies = "kms:ListKeyPolicies",
    /**
     * Controls permission to view the list of completed key rotations for an AWS KMS
     * key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyRotations.html
     */
    ListKeyRotations = "kms:ListKeyRotations",
    /**
     * Controls permission to view the key ID and Amazon Resource Name (ARN) of all AW
     * S KMS keys in the account
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeys.html
     */
    ListKeys = "kms:ListKeys",
    /**
     * Controls permission to view all tags that are attached to an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html
     */
    ListResourceTags = "kms:ListResourceTags",
    /**
     * Controls permission to view grants in which the specified principal is the reti
     * ring principal. Other principals might be able to retire the grant and this pri
     * ncipal might be able to retire other grants
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.html
     */
    ListRetirableGrants = "kms:ListRetirableGrants",
    /**
     * Controls permission to replace the key policy for the specified AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
     */
    PutKeyPolicy = "kms:PutKeyPolicy",
    /**
     * Controls permission to decrypt data as part of the process that decrypts and re
     * encrypts the data within AWS KMS
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html
     */
    ReEncryptFrom = "kms:ReEncryptFrom",
    /**
     * Controls permission to encrypt data as part of the process that decrypts and re
     * encrypts the data within AWS KMS
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html
     */
    ReEncryptTo = "kms:ReEncryptTo",
    /**
     * Controls permission to replicate a multi-Region primary key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html
     */
    ReplicateKey = "kms:ReplicateKey",
    /**
     * Controls permission to retire a grant. The RetireGrant operation is typically c
     * alled by the grant user after they complete the tasks that the grant allowed th
     * em to perform
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html
     */
    RetireGrant = "kms:RetireGrant",
    /**
     * Controls permission to revoke a grant, which denies permission for all operatio
     * ns that depend on the grant
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html
     */
    RevokeGrant = "kms:RevokeGrant",
    /**
     * Controls permission to invoke on-demand rotation of the cryptographic material
     * in an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_RotateKeyOnDemand.html
     */
    RotateKeyOnDemand = "kms:RotateKeyOnDemand",
    /**
     * Controls permission to schedule deletion of an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html
     */
    ScheduleKeyDeletion = "kms:ScheduleKeyDeletion",
    /**
     * Controls permission to produce a digital signature for a message
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html
     */
    Sign = "kms:Sign",
    /**
     * Controls access to internal APIs that synchronize multi-Region keys
     *
     * See https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-auth.html#multi-region-auth-slr
     */
    SynchronizeMultiRegionKey = "kms:SynchronizeMultiRegionKey",
    /**
     * Controls permission to create or update tags that are attached to an AWS KMS ke
     * y
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html
     */
    TagResource = "kms:TagResource",
    /**
     * Controls permission to delete tags that are attached to an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html
     */
    UntagResource = "kms:UntagResource",
    /**
     * Controls permission to associate an alias with a different AWS KMS key. An alia
     * s is an optional friendly name that you can associate with a KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html
     */
    UpdateAlias = "kms:UpdateAlias",
    /**
     * Controls permission to change the properties of a custom key store
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateCustomKeyStore.html
     */
    UpdateCustomKeyStore = "kms:UpdateCustomKeyStore",
    /**
     * Controls permission to delete or change the description of an AWS KMS key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html
     */
    UpdateKeyDescription = "kms:UpdateKeyDescription",
    /**
     * Controls permission to update the primary Region of a multi-Region primary key
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdatePrimaryRegion.html
     */
    UpdatePrimaryRegion = "kms:UpdatePrimaryRegion",
    /**
     * Controls permission to use the specified AWS KMS key to verify digital signatur
     * es
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html
     */
    Verify = "kms:Verify",
    /**
     * Controls permission to use the AWS KMS key to verify message authentication cod
     * es
     *
     * See https://docs.aws.amazon.com/kms/latest/APIReference/API_VerifyMac.html
     */
    VerifyMac = "kms:VerifyMac"
}