type AlgorithmSpec string

const (
	AlgorithmSpecRsaes_pkcs1_v1_5   AlgorithmSpec = "RSAES_PKCS1_V1_5"
	AlgorithmSpecRsaes_oaep_sha_1   AlgorithmSpec = "RSAES_OAEP_SHA_1"
	AlgorithmSpecRsaes_oaep_sha_256 AlgorithmSpec = "RSAES_OAEP_SHA_256"
)

type AliasListEntry struct {

	// String that contains the alias. This value begins with alias/.
	AliasName *string

	// String that contains the key identifier referred to by the alias.
	TargetKeyId *string

	// String that contains the key ARN.
	AliasArn *string
}

type AlreadyExistsException struct {
	Message *string
}

type CloudHsmClusterInUseException struct {
	Message *string
}

type CloudHsmClusterInvalidConfigurationException struct {
	Message *string
}

type CloudHsmClusterNotActiveException struct {
	Message *string
}

type CloudHsmClusterNotFoundException struct {
	Message *string
}

type CloudHsmClusterNotRelatedException struct {
	Message *string
}

type ConnectionErrorCodeType string

const (
	ConnectionErrorCodeTypeInvalid_credentials        ConnectionErrorCodeType = "INVALID_CREDENTIALS"
	ConnectionErrorCodeTypeCluster_not_found          ConnectionErrorCodeType = "CLUSTER_NOT_FOUND"
	ConnectionErrorCodeTypeNetwork_errors             ConnectionErrorCodeType = "NETWORK_ERRORS"
	ConnectionErrorCodeTypeInternal_error             ConnectionErrorCodeType = "INTERNAL_ERROR"
	ConnectionErrorCodeTypeInsufficient_cloudhsm_hsms ConnectionErrorCodeType = "INSUFFICIENT_CLOUDHSM_HSMS"
	ConnectionErrorCodeTypeUser_locked_out            ConnectionErrorCodeType = "USER_LOCKED_OUT"
	ConnectionErrorCodeTypeUser_not_found             ConnectionErrorCodeType = "USER_NOT_FOUND"
	ConnectionErrorCodeTypeUser_logged_in             ConnectionErrorCodeType = "USER_LOGGED_IN"
	ConnectionErrorCodeTypeSubnet_not_found           ConnectionErrorCodeType = "SUBNET_NOT_FOUND"
)

type ConnectionStateType string

const (
	ConnectionStateTypeConnected     ConnectionStateType = "CONNECTED"
	ConnectionStateTypeConnecting    ConnectionStateType = "CONNECTING"
	ConnectionStateTypeFailed        ConnectionStateType = "FAILED"
	ConnectionStateTypeDisconnected  ConnectionStateType = "DISCONNECTED"
	ConnectionStateTypeDisconnecting ConnectionStateType = "DISCONNECTING"
)

type CustomKeyStoreHasCMKsException struct {
	Message *string
}

type CustomKeyStoreInvalidStateException struct {
	Message *string
}

type CustomKeyStoreNameInUseException struct {
	Message *string
}

type CustomKeyStoreNotFoundException struct {
	Message *string
}

type CustomKeyStoresListEntry struct {

	// The date and time when the custom key store was created.
	CreationDate *time.Time

	// The user-specified friendly name for the custom key store.
	CustomKeyStoreName *string

	// Describes the connection error. This field appears in the response only when the
	// ConnectionState is FAILED. For help resolving these errors, see How to Fix a
	// Connection Failure
	// (https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-failed)
	// in AWS Key Management Service Developer Guide. Valid values are:
	//
	//     *
	// CLUSTER_NOT_FOUND - AWS KMS cannot find the AWS CloudHSM cluster with the
	// specified cluster ID.
	//
	//     * INSUFFICIENT_CLOUDHSM_HSMS - The associated AWS
	// CloudHSM cluster does not contain any active HSMs. To connect a custom key store
	// to its AWS CloudHSM cluster, the cluster must contain at least one active HSM.
	//
	//
	// * INTERNAL_ERROR - AWS KMS could not complete the request due to an internal
	// error. Retry the request. For ConnectCustomKeyStore requests, disconnect the
	// custom key store before trying to connect again.
	//
	//     * INVALID_CREDENTIALS -
	// AWS KMS does not have the correct password for the kmsuser crypto user in the
	// AWS CloudHSM cluster. Before you can connect your custom key store to its AWS
	// CloudHSM cluster, you must change the kmsuser account password and update the
	// key store password value for the custom key store.
	//
	//     * NETWORK_ERRORS -
	// Network errors are preventing AWS KMS from connecting to the custom key store.
	//
	//
	// * SUBNET_NOT_FOUND - A subnet in the AWS CloudHSM cluster configuration was
	// deleted. If AWS KMS cannot find all of the subnets in the cluster configuration,
	// attempts to connect the custom key store to the AWS CloudHSM cluster fail. To
	// fix this error, create a cluster from a recent backup and associate it with your
	// custom key store. (This process creates a new cluster configuration with a VPC
	// and private subnets.) For details, see How to Fix a Connection Failure
	// (https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#fix-keystore-failed)
	// in the AWS Key Management Service Developer Guide.
	//
	//     * USER_LOCKED_OUT - The
	// kmsuser CU account is locked out of the associated AWS CloudHSM cluster due to
	// too many failed password attempts. Before you can connect your custom key store
	// to its AWS CloudHSM cluster, you must change the kmsuser account password and
	// update the key store password value for the custom key store.
	//
	//     *
	// USER_LOGGED_IN - The kmsuser CU account is logged into the the associated AWS
	// CloudHSM cluster. This prevents AWS KMS from rotating the kmsuser account
	// password and logging into the cluster. Before you can connect your custom key
	// store to its AWS CloudHSM cluster, you must log the kmsuser CU out of the
	// cluster. If you changed the kmsuser password to log into the cluster, you must
	// also and update the key store password value for the custom key store. For help,
	// see How to Log Out and Reconnect
	// (https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html#login-kmsuser-2)
	// in the AWS Key Management Service Developer Guide.
	//
	//     * USER_NOT_FOUND - AWS
	// KMS cannot find a kmsuser CU account in the associated AWS CloudHSM cluster.
	// Before you can connect your custom key store to its AWS CloudHSM cluster, you
	// must create a kmsuser CU account in the cluster, and then update the key store
	// password value for the custom key store.
	ConnectionErrorCode ConnectionErrorCodeType

	// A unique identifier for the custom key store.
	CustomKeyStoreId *string

	// The trust anchor certificate of the associated AWS CloudHSM cluster. When you
	// initialize the cluster
	// (https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html#sign-csr),
	// you create this certificate and save it in the customerCA.crt file.
	TrustAnchorCertificate *string

	// Indicates whether the custom key store is connected to its AWS CloudHSM cluster.
	// You can create and use CMKs in your custom key stores only when its connection
	// state is CONNECTED. The value is DISCONNECTED if the key store has never been
	// connected or you use the DisconnectCustomKeyStore () operation to disconnect it.
	// If the value is CONNECTED but you are having trouble using the custom key store,
	// make sure that its associated AWS CloudHSM cluster is active and contains at
	// least one active HSM. A value of FAILED indicates that an attempt to connect was
	// unsuccessful. The ConnectionErrorCode field in the response indicates the cause
	// of the failure. For help resolving a connection failure, see Troubleshooting a
	// Custom Key Store
	// (https://docs.aws.amazon.com/kms/latest/developerguide/fix-keystore.html) in the
	// AWS Key Management Service Developer Guide.
	ConnectionState ConnectionStateType

	// A unique identifier for the AWS CloudHSM cluster that is associated with the
	// custom key store.
	CloudHsmClusterId *string
}

type CustomerMasterKeySpec string

const (
	CustomerMasterKeySpecRsa_2048          CustomerMasterKeySpec = "RSA_2048"
	CustomerMasterKeySpecRsa_3072          CustomerMasterKeySpec = "RSA_3072"
	CustomerMasterKeySpecRsa_4096          CustomerMasterKeySpec = "RSA_4096"
	CustomerMasterKeySpecEcc_nist_p256     CustomerMasterKeySpec = "ECC_NIST_P256"
	CustomerMasterKeySpecEcc_nist_p384     CustomerMasterKeySpec = "ECC_NIST_P384"
	CustomerMasterKeySpecEcc_nist_p521     CustomerMasterKeySpec = "ECC_NIST_P521"
	CustomerMasterKeySpecEcc_secg_p256k1   CustomerMasterKeySpec = "ECC_SECG_P256K1"
	CustomerMasterKeySpecSymmetric_default CustomerMasterKeySpec = "SYMMETRIC_DEFAULT"
)

type DataKeyPairSpec string

const (
	DataKeyPairSpecRsa_2048        DataKeyPairSpec = "RSA_2048"
	DataKeyPairSpecRsa_3072        DataKeyPairSpec = "RSA_3072"
	DataKeyPairSpecRsa_4096        DataKeyPairSpec = "RSA_4096"
	DataKeyPairSpecEcc_nist_p256   DataKeyPairSpec = "ECC_NIST_P256"
	DataKeyPairSpecEcc_nist_p384   DataKeyPairSpec = "ECC_NIST_P384"
	DataKeyPairSpecEcc_nist_p521   DataKeyPairSpec = "ECC_NIST_P521"
	DataKeyPairSpecEcc_secg_p256k1 DataKeyPairSpec = "ECC_SECG_P256K1"
)

type DataKeySpec string

const (
	DataKeySpecAes_256 DataKeySpec = "AES_256"
	DataKeySpecAes_128 DataKeySpec = "AES_128"
)

type DependencyTimeoutException struct {
	Message *string
}

type DisabledException struct {
	Message *string
}

type EncryptionAlgorithmSpec string

const (
	EncryptionAlgorithmSpecSymmetric_default  EncryptionAlgorithmSpec = "SYMMETRIC_DEFAULT"
	EncryptionAlgorithmSpecRsaes_oaep_sha_1   EncryptionAlgorithmSpec = "RSAES_OAEP_SHA_1"
	EncryptionAlgorithmSpecRsaes_oaep_sha_256 EncryptionAlgorithmSpec = "RSAES_OAEP_SHA_256"
)

type ExpirationModelType string

const (
	ExpirationModelTypeKey_material_expires         ExpirationModelType = "KEY_MATERIAL_EXPIRES"
	ExpirationModelTypeKey_material_does_not_expire ExpirationModelType = "KEY_MATERIAL_DOES_NOT_EXPIRE"
)

type ExpiredImportTokenException struct {
	Message *string
}

type GrantConstraints struct {

	// A list of key-value pairs that must match the encryption context in the
	// cryptographic operation
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
	// request. The grant allows the operation only when the encryption context in the
	// request is the same as the encryption context specified in this constraint.
	EncryptionContextEquals map[string]*string

	// A list of key-value pairs that must be included in the encryption context of the
	// cryptographic operation
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
	// request. The grant allows the cryptographic operation only when the encryption
	// context in the request includes the key-value pairs specified in this
	// constraint, although it can include additional key-value pairs.
	EncryptionContextSubset map[string]*string
}

type GrantListEntry struct {

	// The AWS account under which the grant was issued.
	IssuingAccount *string

	// The identity that gets the permissions in the grant. The GranteePrincipal field
	// in the ListGrants response usually contains the user or role designated as the
	// grantee principal in the grant. However, when the grantee principal in the grant
	// is an AWS service, the GranteePrincipal field contains the service principal
	// (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services),
	// which might represent several different grantee principals.
	GranteePrincipal *string

	// The list of operations permitted by the grant.
	Operations []GrantOperation

	// The friendly name that identifies the grant. If a name was provided in the
	// CreateGrant () request, that name is returned. Otherwise this value is null.
	Name *string

	// The principal that can retire the grant.
	RetiringPrincipal *string

	// The unique identifier for the customer master key (CMK) to which the grant
	// applies.
	KeyId *string

	// The unique identifier for the grant.
	GrantId *string

	// A list of key-value pairs that must be present in the encryption context of
	// certain subsequent operations that the grant allows.
	Constraints *GrantConstraints

	// The date and time when the grant was created.
	CreationDate *time.Time
}

type GrantOperation string

const (
	GrantOperationDecrypt                             GrantOperation = "Decrypt"
	GrantOperationEncrypt                             GrantOperation = "Encrypt"
	GrantOperationGeneratedatakey                     GrantOperation = "GenerateDataKey"
	GrantOperationGeneratedatakeywithoutplaintext     GrantOperation = "GenerateDataKeyWithoutPlaintext"
	GrantOperationReencryptfrom                       GrantOperation = "ReEncryptFrom"
	GrantOperationReencryptto                         GrantOperation = "ReEncryptTo"
	GrantOperationSign                                GrantOperation = "Sign"
	GrantOperationVerify                              GrantOperation = "Verify"
	GrantOperationGetpublickey                        GrantOperation = "GetPublicKey"
	GrantOperationCreategrant                         GrantOperation = "CreateGrant"
	GrantOperationRetiregrant                         GrantOperation = "RetireGrant"
	GrantOperationDescribekey                         GrantOperation = "DescribeKey"
	GrantOperationGeneratedatakeypair                 GrantOperation = "GenerateDataKeyPair"
	GrantOperationGeneratedatakeypairwithoutplaintext GrantOperation = "GenerateDataKeyPairWithoutPlaintext"
)

type IncorrectKeyException struct {
	Message *string
}

type IncorrectKeyMaterialException struct {
	Message *string
}

type IncorrectTrustAnchorException struct {
	Message *string
}

type InvalidAliasNameException struct {
	Message *string
}

type InvalidArnException struct {
	Message *string
}

type InvalidCiphertextException struct {
	Message *string
}

type InvalidGrantIdException struct {
	Message *string
}

type InvalidGrantTokenException struct {
	Message *string
}

type InvalidImportTokenException struct {
	Message *string
}

type InvalidKeyUsageException struct {
	Message *string
}

type InvalidMarkerException struct {
	Message *string
}

type KMSInternalException struct {
	Message *string
}

type KMSInvalidSignatureException struct {
	Message *string
}

type KMSInvalidStateException struct {
	Message *string
}

type KeyListEntry struct {

	// ARN of the key.
	KeyArn *string

	// Unique identifier of the key.
	KeyId *string
}

type KeyManagerType string

const (
	KeyManagerTypeAws      KeyManagerType = "AWS"
	KeyManagerTypeCustomer KeyManagerType = "CUSTOMER"
)

type KeyMetadata struct {

	// Specifies whether the CMK's key material expires. This value is present only
	// when Origin is EXTERNAL, otherwise this value is omitted.
	ExpirationModel ExpirationModelType

	// The globally unique identifier for the CMK.
	//
	// This member is required.
	KeyId *string

	// The date and time when the CMK was created.
	CreationDate *time.Time

	// The cluster ID of the AWS CloudHSM cluster that contains the key material for
	// the CMK. When you create a CMK in a custom key store
	// (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html),
	// AWS KMS creates the key material for the CMK in the associated AWS CloudHSM
	// cluster. This value is present only when the CMK is created in a custom key
	// store.
	CloudHsmClusterId *string

	// The Amazon Resource Name (ARN) of the CMK. For examples, see AWS Key Management
	// Service (AWS KMS)
	// (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-kms)
	// in the Example ARNs section of the AWS General Reference.
	Arn *string

	// The manager of the CMK. CMKs in your AWS account are either customer managed or
	// AWS managed. For more information about the difference, see Customer Master Keys
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys)
	// in the AWS Key Management Service Developer Guide.
	KeyManager KeyManagerType

	// The current status of the CMK. For more information about how key state affects
	// the use of a CMK, see Key state: Effect on your CMK
	// (https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html) in the
	// AWS Key Management Service Developer Guide.
	KeyState KeyState

	// The cryptographic operations
	// (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations)
	// for which you can use the CMK.
	KeyUsage KeyUsageType

	// A unique identifier for the custom key store
	// (https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html)
	// that contains the CMK. This value is present only when the CMK is created in a
	// custom key store.
	CustomKeyStoreId *string

	// The twelve-digit account ID of the AWS account that owns the CMK.
	AWSAccountId *string

	// The description of the CMK.
	Description *string

	// The encryption algorithms that the CMK supports. You cannot use the CMK with
	// other encryption algorithms within AWS KMS. This field appears only when the
	// KeyUsage of the CMK is ENCRYPT_DECRYPT.
	EncryptionAlgorithms []EncryptionAlgorithmSpec

	// The time at which the imported key material expires. When the key material
	// expires, AWS KMS deletes the key material and the CMK becomes unusable. This
	// value is present only for CMKs whose Origin is EXTERNAL and whose
	// ExpirationModel is KEY_MATERIAL_EXPIRES, otherwise this value is omitted.
	ValidTo *time.Time

	// Specifies whether the CMK is enabled. When KeyState is Enabled this value is
	// true, otherwise it is false.
	Enabled *bool

	// The signing algorithms that the CMK supports. You cannot use the CMK with other
	// signing algorithms within AWS KMS. This field appears only when the KeyUsage of
	// the CMK is SIGN_VERIFY.
	SigningAlgorithms []SigningAlgorithmSpec

	// Describes the type of key material in the CMK.
	CustomerMasterKeySpec CustomerMasterKeySpec

	// The source of the CMK's key material. When this value is AWS_KMS, AWS KMS
	// created the key material. When this value is EXTERNAL, the key material was
	// imported from your existing key management infrastructure or the CMK lacks key
	// material. When this value is AWS_CLOUDHSM, the key material was created in the
	// AWS CloudHSM cluster associated with a custom key store.
	Origin OriginType

	// The date and time after which AWS KMS deletes the CMK. This value is present
	// only when KeyState is PendingDeletion.
	DeletionDate *time.Time
}

type KeyState string

const (
	KeyStateEnabled         KeyState = "Enabled"
	KeyStateDisabled        KeyState = "Disabled"
	KeyStatePendingdeletion KeyState = "PendingDeletion"
	KeyStatePendingimport   KeyState = "PendingImport"
	KeyStateUnavailable     KeyState = "Unavailable"
)

type KeyUnavailableException struct {
	Message *string
}

type KeyUsageType string

const (
	KeyUsageTypeSign_verify     KeyUsageType = "SIGN_VERIFY"
	KeyUsageTypeEncrypt_decrypt KeyUsageType = "ENCRYPT_DECRYPT"
)

type LimitExceededException struct {
	Message *string
}

type MalformedPolicyDocumentException struct {
	Message *string
}

type MessageType string

const (
	MessageTypeRaw    MessageType = "RAW"
	MessageTypeDigest MessageType = "DIGEST"
)

type NotFoundException struct {
	Message *string
}

type OriginType string

const (
	OriginTypeAws_kms      OriginType = "AWS_KMS"
	OriginTypeExternal     OriginType = "EXTERNAL"
	OriginTypeAws_cloudhsm OriginType = "AWS_CLOUDHSM"
)

type SigningAlgorithmSpec string

const (
	SigningAlgorithmSpecRsassa_pss_sha_256        SigningAlgorithmSpec = "RSASSA_PSS_SHA_256"
	SigningAlgorithmSpecRsassa_pss_sha_384        SigningAlgorithmSpec = "RSASSA_PSS_SHA_384"
	SigningAlgorithmSpecRsassa_pss_sha_512        SigningAlgorithmSpec = "RSASSA_PSS_SHA_512"
	SigningAlgorithmSpecRsassa_pkcs1_v1_5_sha_256 SigningAlgorithmSpec = "RSASSA_PKCS1_V1_5_SHA_256"
	SigningAlgorithmSpecRsassa_pkcs1_v1_5_sha_384 SigningAlgorithmSpec = "RSASSA_PKCS1_V1_5_SHA_384"
	SigningAlgorithmSpecRsassa_pkcs1_v1_5_sha_512 SigningAlgorithmSpec = "RSASSA_PKCS1_V1_5_SHA_512"
	SigningAlgorithmSpecEcdsa_sha_256             SigningAlgorithmSpec = "ECDSA_SHA_256"
	SigningAlgorithmSpecEcdsa_sha_384             SigningAlgorithmSpec = "ECDSA_SHA_384"
	SigningAlgorithmSpecEcdsa_sha_512             SigningAlgorithmSpec = "ECDSA_SHA_512"
)

type Tag struct {

	// The key of the tag.
	//
	// This member is required.
	TagKey *string

	// The value of the tag.
	//
	// This member is required.
	TagValue *string
}

type TagException struct {
	Message *string
}

type UnsupportedOperationException struct {
	Message *string
}

type WrappingKeySpec string

const (
	WrappingKeySpecRsa_2048 WrappingKeySpec = "RSA_2048"
)